- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 v3 0/2] optimize inlining
by Yuntao Liu 25 Dec '23

25 Dec '23

*** BLURB HERE *** Guo Xuenan (2): Revert "compiler: remove CONFIG_OPTIMIZE_INLINING entirely" make OPTIMIZE_INLINING config editable arch/arm64/kvm/sys_regs.h | 5 ++++ arch/x86/configs/i386_defconfig | 1 + arch/x86/configs/x86_64_defconfig | 1 + .../net/ethernet/mellanox/mlx5/core/health.c | 24 +++++++++++++++++++ .../ethernet/mellanox/mlx5/core/mlx5_core.h | 24 ------------------- .../pci/hive_isp_css_include/print_support.h | 4 ++++ include/linux/compiler_types.h | 8 +++++++ include/trace/trace_events.h | 2 +- kernel/configs/tiny.config | 1 + lib/Kconfig.debug | 13 ++++++++++ 10 files changed, 58 insertions(+), 25 deletions(-) -- 2.34.1

2 3

[PATCH V3 OLK-6.6 0/5] ubi: Enhance fault injection capability for the UBI driver
by ZhaoLong Wang 25 Dec '23

25 Dec '23

CONFIG Dependency CONFIG_MTD=y CONFIG_MTD_NAND_NANDSIM=m CONFIG_MTD_UBI=m CONFIG_FAULT_INJECTION_DEBUG_FS=y CONFIG_MTD_PARTITIONED_MASTER The existing fault injection capability of UBI is too simple. It uses hard-coded fault probability values and lacks other configurable options. As a result, these interfaces are difficult to use when digging defects in the abnormal path of code and reproducing some problems. The kernel provides a powerful fault injection framework, which provides rich configurable fault injection attributes during runtime. So it can be used to improve the fault injection capability of the UBI driver. This series of patches refactor the existing fault injection interface and add some fault injection types to help testers and developers find potential problems in the code. This series of patches enhance the existing fault injection interface and retain the old debugfs interface, and add some fault injection types to help testers and developers Look for potential problems in the code. v1 -> v2: Delete the redundant semicolon of the first patch. v2 -> v3: Completely checked and fixed the English syntax errors in the patch. ZhaoLong Wang (5): ubi: Use the fault injection framework to enhance the fault injection capability ubi: Split io_failures into write_failure and erase_failure ubi: Add six fault injection type for testing ubi: Reserve sufficient buffer length for the input mask mtd: Add several functions to the fail_function list drivers/mtd/mtdcore.c | 5 + drivers/mtd/ubi/Kconfig | 9 ++ drivers/mtd/ubi/debug.c | 107 ++++++++++++-- drivers/mtd/ubi/debug.h | 304 +++++++++++++++++++++++++++++++++++++--- drivers/mtd/ubi/io.c | 86 +++++++++++- drivers/mtd/ubi/ubi.h | 45 +++--- 6 files changed, 497 insertions(+), 59 deletions(-) -- 2.39.2

2 6

[PATCH OLK-6.6 v2 0/9] Support dynamic affinity scheduler
by Hui Tang 25 Dec '23

25 Dec '23

patch 1->7: Introduce dynamic affinity for cfs scheduler. patch 8->9: Tiny bugfix. v1->v2: * move sysctl interface to fair.c Hui Tang (7): sched: Introduce dynamic affinity for cfs scheduler cpuset: Introduce new interface for scheduler dynamic affinity sched: Adjust wakeup cpu range according CPU util dynamicly sched: Adjust cpu allowed in load balance dynamicly sched: Add statistics for scheduler dynamic affinity sched: Add cmdline for dynamic affinity config: enable CONFIG_QOS_SCHED_DYNAMIC_AFFINITY by default zhangwei123171 (2): sched/fair: Remove invalid cpu selection logic in dynamic affinity sched/fair: Modify idle cpu judgment in dynamic affinity arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/proc/base.c | 73 ++++++++++ include/linux/sched.h | 22 +++ init/Kconfig | 10 ++ init/init_task.c | 3 + kernel/cgroup/cpuset.c | 153 ++++++++++++++++++++- kernel/fork.c | 16 +++ kernel/sched/core.c | 98 +++++++++++++ kernel/sched/debug.c | 6 + kernel/sched/fair.c | 183 +++++++++++++++++++++++++ kernel/sched/features.h | 7 + 12 files changed, 572 insertions(+), 1 deletion(-) -- 2.34.1

1 0

[PATCH OLK-6.6 v4] blk-throttle: enable hierarchical throttle in cgroup v1
by Yu Kuai 25 Dec '23

25 Dec '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8QYR1 CVE: NA ----------------------------------------------- blkio subsytem is not under default hierarchy in cgroup v1 by default, which means configurations will only be effective on current cgroup for io throttle. This patch introduces a new feature that enable default hierarchy for io throttle, which means configurations will be effective on child cgroups. Such feature is disabled by default, and can be enabled by: 1) set CONFIG_BLK_DEV_SUPPORT_LEGACY_GLOBAL_LIMIT, then 2) adding "blkcg_global_limit=1" or "blkcg_global_limit=Y" or "blkcg_global_limit=y" in boot cmd; Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/Kconfig | 11 ++++++++++ block/blk-throttle.c | 28 +++++++++++++++++++++++++- 4 files changed, 40 insertions(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 33ba39711884..2422922f27e7 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -857,6 +857,7 @@ CONFIG_BLK_DEV_INTEGRITY_T10=m CONFIG_BLK_DEV_ZONED=y CONFIG_BLK_DEV_THROTTLING=y # CONFIG_BLK_DEV_THROTTLING_LOW is not set +CONFIG_BLK_DEV_SUPPORT_LEGACY_GLOBAL_LIMIT=y CONFIG_BLK_WBT=y CONFIG_BLK_WBT_MQ=y # CONFIG_BLK_CGROUP_IOLATENCY is not set diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 44040b835333..e5f605531186 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -927,6 +927,7 @@ CONFIG_BLK_DEV_INTEGRITY_T10=m CONFIG_BLK_DEV_ZONED=y CONFIG_BLK_DEV_THROTTLING=y # CONFIG_BLK_DEV_THROTTLING_LOW is not set +CONFIG_BLK_DEV_SUPPORT_LEGACY_GLOBAL_LIMIT=y CONFIG_BLK_WBT=y CONFIG_BLK_WBT_MQ=y # CONFIG_BLK_CGROUP_IOLATENCY is not set diff --git a/block/Kconfig b/block/Kconfig index ca04b657e058..03b53a50939f 100644 --- a/block/Kconfig +++ b/block/Kconfig @@ -131,6 +131,17 @@ config BLK_DEV_THROTTLING_LOW Note, this is an experimental interface and could be changed someday. +config BLK_DEV_SUPPORT_LEGACY_GLOBAL_LIMIT + bool "Block layer global limit in cgroup v1" + depends on BLK_DEV_THROTTLING + default n + help + Blkio subsytem is not under default hierarchy in cgroup v1 by default, + enabling this will support globlal limit in cgroup v1. + + Note, a cmdline "blkcg_global_limit=1" is still required to enabled this + feature. + config BLK_WBT bool "Enable support for block device writeback throttling" help diff --git a/block/blk-throttle.c b/block/blk-throttle.c index 13e4377a8b28..76a54f43135c 100644 --- a/block/blk-throttle.c +++ b/block/blk-throttle.c @@ -41,6 +41,31 @@ /* A workqueue to queue throttle related work */ static struct workqueue_struct *kthrotld_workqueue; +#ifdef CONFIG_BLK_DEV_SUPPORT_LEGACY_GLOBAL_LIMIT +/* True if global limit is enabled in cgroup v1 */ +static bool global_limit; + +static inline bool blkcg_global_limit_enabled(void) +{ + return global_limit; +} + +static int __init setup_global_limit(char *str) +{ + if (!strcmp(str, "1") || !strcmp(str, "Y") || !strcmp(str, "y")) + global_limit = true; + + return 1; +} + +__setup("blkcg_global_limit=", setup_global_limit); + +#else +static inline bool blkcg_global_limit_enabled(void) +{ + return false; +} +#endif #define rb_entry_tg(node) rb_entry((node), struct throtl_grp, rb_node) /* We measure latency for request size from <= 4k to >= 1M */ @@ -405,7 +430,8 @@ static void throtl_pd_init(struct blkg_policy_data *pd) * regardless of the position of the group in the hierarchy. */ sq->parent_sq = &td->service_queue; - if (cgroup_subsys_on_dfl(io_cgrp_subsys) && blkg->parent) + if ((cgroup_subsys_on_dfl(io_cgrp_subsys) || + blkcg_global_limit_enabled()) && blkg->parent) sq->parent_sq = &blkg_to_tg(blkg->parent)->service_queue; tg->td = td; } -- 2.39.2

2 1

[PATCH V3 OLK-6.6 0/5] ubi: Enhance fault injection capability for the UBI driver
by ZhaoLong Wang 25 Dec '23

25 Dec '23

CONFIG Dependency CONFIG_MTD=y CONFIG_MTD_NAND_NANDSIM=m CONFIG_MTD_UBI=m CONFIG_FAULT_INJECTION_DEBUG_FS=y CONFIG_MTD_PARTITIONED_MASTER The existing fault injection capability of UBI is too simple. It uses hard-coded fault probability values and lacks other configurable options. As a result, these interfaces are difficult to use when digging defects in the abnormal path of code and reproducing some problems. The kernel provides a powerful fault injection framework, which provides rich configurable fault injection attributes during runtime. So it can be used to improve the fault injection capability of the UBI driver. This series of patches refactor the existing fault injection interface and add some fault injection types to help testers and developers find potential problems in the code. This series of patches enhance the existing fault injection interface and retain the old debugfs interface, and add some fault injection types to help testers and developers Look for potential problems in the code. ZhaoLong Wang (5): ubi: Use the fault injection framework to enhance the fault injection capability ubi: Split io_failures into write_failure and erase_failure ubi: Add six fault injection type for testing ubi: Reserve sufficient buffer length for the input mask mtd: Add several functions to the fail_function list ZhaoLong Wang (5): ubi: Use the fault injection framework to enhance the fault injection capability ubi: Split io_failures into write_failure and erase_failure ubi: Add six fault injection type for testing ubi: Reserve sufficient buffer length for the input mask mtd: Add several functions to the fail_function list drivers/mtd/mtdcore.c | 5 + drivers/mtd/ubi/Kconfig | 9 ++ drivers/mtd/ubi/debug.c | 107 ++++++++++++-- drivers/mtd/ubi/debug.h | 304 +++++++++++++++++++++++++++++++++++++--- drivers/mtd/ubi/io.c | 86 +++++++++++- drivers/mtd/ubi/ubi.h | 45 +++--- 6 files changed, 497 insertions(+), 59 deletions(-) -- 2.39.2

2 6

[PATCH OLK-6.6] memcg: support ksm merge any mode per cgroup
by Nanyong Sun 25 Dec '23

25 Dec '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8OIQR ---------------------------------------------------------------------- Add control file "memory.ksm" to enable ksm per cgroup. Echo to 1 will set all tasks currently in the cgroup to ksm merge any mode, which means ksm gets enabled for all vma's of a process. Meanwhile echo to 0 will disable ksm for them and unmerge the merged pages. Cat the file will show the above state and ksm related profits of this cgroup. Signed-off-by: Nanyong Sun <sunnanyong(a)huawei.com> --- .../admin-guide/cgroup-v1/memory.rst | 1 + mm/memcontrol.c | 110 +++++++++++++++++- 2 files changed, 109 insertions(+), 2 deletions(-) diff --git a/Documentation/admin-guide/cgroup-v1/memory.rst b/Documentation/admin-guide/cgroup-v1/memory.rst index edd795855d68..66ae60dead2e 100644 --- a/Documentation/admin-guide/cgroup-v1/memory.rst +++ b/Documentation/admin-guide/cgroup-v1/memory.rst @@ -109,6 +109,7 @@ Brief summary of control files. memory.kmem.tcp.failcnt show the number of tcp buf memory usage hits limits memory.kmem.tcp.max_usage_in_bytes show max tcp buf memory usage recorded + memory.ksm set/show ksm merge any mode ==================================== ========================================== 1. History diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 1f3b893bb576..e5782248749d 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -73,6 +73,7 @@ #include <linux/uaccess.h> #include <trace/events/vmscan.h> +#include <linux/ksm.h> struct cgroup_subsys memory_cgrp_subsys __read_mostly; EXPORT_SYMBOL(memory_cgrp_subsys); @@ -242,10 +243,15 @@ enum res_type { iter != NULL; \ iter = mem_cgroup_iter(NULL, iter, NULL)) +static inline bool __task_is_dying(struct task_struct *task) +{ + return tsk_is_oom_victim(task) || fatal_signal_pending(task) || + (task->flags & PF_EXITING); +} + static inline bool task_is_dying(void) { - return tsk_is_oom_victim(current) || fatal_signal_pending(current) || - (current->flags & PF_EXITING); + return __task_is_dying(current); } /* Some nice accessors for the vmpressure. */ @@ -5101,6 +5107,98 @@ static int mem_cgroup_slab_show(struct seq_file *m, void *p) } #endif +#ifdef CONFIG_KSM +static int memcg_set_ksm_for_tasks(struct mem_cgroup *memcg, bool enable) +{ + struct task_struct *task; + struct mm_struct *mm; + struct css_task_iter it; + int ret = 0; + + css_task_iter_start(&memcg->css, CSS_TASK_ITER_PROCS, &it); + while (!ret && (task = css_task_iter_next(&it))) { + if (__task_is_dying(task)) + continue; + + mm = get_task_mm(task); + if (!mm) + continue; + + if (mmap_write_lock_killable(mm)) { + mmput(mm); + continue; + } + + if (enable) + ret = ksm_enable_merge_any(mm); + else + ret = ksm_disable_merge_any(mm); + + mmap_write_unlock(mm); + mmput(mm); + } + css_task_iter_end(&it); + + return ret; +} + +static int memory_ksm_show(struct seq_file *m, void *v) +{ + unsigned long ksm_merging_pages = 0; + unsigned long ksm_rmap_items = 0; + long ksm_process_profits = 0; + unsigned int tasks = 0; + struct task_struct *task; + struct mm_struct *mm; + struct css_task_iter it; + struct mem_cgroup *memcg = mem_cgroup_from_seq(m); + + css_task_iter_start(&memcg->css, CSS_TASK_ITER_PROCS, &it); + while ((task = css_task_iter_next(&it))) { + mm = get_task_mm(task); + if (!mm) + continue; + + if (test_bit(MMF_VM_MERGE_ANY, &mm->flags)) + tasks++; + + ksm_rmap_items += mm->ksm_rmap_items; + ksm_merging_pages += mm->ksm_merging_pages; + ksm_process_profits += ksm_process_profit(mm); + mmput(mm); + } + css_task_iter_end(&it); + + seq_printf(m, "merge any tasks: %u\n", tasks); + seq_printf(m, "ksm_rmap_items %lu\n", ksm_rmap_items); + seq_printf(m, "ksm_merging_pages %lu\n", ksm_merging_pages); + seq_printf(m, "ksm_process_profits %ld\n", ksm_process_profits); + return 0; +} + +static ssize_t memory_ksm_write(struct kernfs_open_file *of, char *buf, + size_t nbytes, loff_t off) +{ + bool enable; + int err; + struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of)); + + buf = strstrip(buf); + if (!buf) + return -EINVAL; + + err = kstrtobool(buf, &enable); + if (err) + return err; + + err = memcg_set_ksm_for_tasks(memcg, enable); + if (err) + return err; + + return nbytes; +} +#endif /* CONFIG_KSM */ + static int memory_stat_show(struct seq_file *m, void *v); #ifdef CONFIG_MEMCG_V1_RECLAIM @@ -5417,6 +5515,14 @@ static struct cftype mem_cgroup_legacy_files[] = { .seq_show = wb_blkio_show, .write = wb_blkio_write, }, +#endif +#ifdef CONFIG_KSM + { + .name = "ksm", + .flags = CFTYPE_NOT_ON_ROOT, + .write = memory_ksm_write, + .seq_show = memory_ksm_show, + }, #endif { }, /* terminate */ }; -- 2.25.1

2 1

[PATCH OLK-5.10] tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
by Yi Yang 25 Dec '23

25 Dec '23

mainline inclusion from mainline-v6.5-rc7 commit 3c4f8333b582487a2d1e02171f1465531cde53e3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8QFUO CVE: CVE-2023-6546 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In commit 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux"), the UAF problem is not completely fixed. There is a race condition in gsm_cleanup_mux(), which caused this UAF. The UAF problem is triggered by the following race: task[5046] task[5054] ----------------------- ----------------------- gsm_cleanup_mux(); dlci = gsm->dlci[0]; mutex_lock(&gsm->mutex); gsm_cleanup_mux(); dlci = gsm->dlci[0]; //Didn't take the lock gsm_dlci_release(gsm->dlci[i]); gsm->dlci[i] = NULL; mutex_unlock(&gsm->mutex); mutex_lock(&gsm->mutex); dlci->dead = true; //UAF Fix it by assigning values after mutex_lock(). Link: https://syzkaller.appspot.com/text?tag=CrashReport&x=176188b5a80000 Cc: stable <stable(a)kernel.org> Fixes: 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux") Fixes: aa371e96f05d ("tty: n_gsm: fix restart handling via CLD command") Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Co-developed-by: Qiumiao Zhang <zhangqiumiao1(a)huawei.com> Signed-off-by: Qiumiao Zhang <zhangqiumiao1(a)huawei.com> Link: https://lore.kernel.org/r/20230811031121.153237-1-yiyang13@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/n_gsm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 23b014b8c919..3693ad9f4521 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2159,12 +2159,13 @@ static void gsm_error(struct gsm_mux *gsm, static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) { int i; - struct gsm_dlci *dlci = gsm->dlci[0]; + struct gsm_dlci *dlci; struct gsm_msg *txq, *ntxq; gsm->dead = true; mutex_lock(&gsm->mutex); + dlci = gsm->dlci[0]; if (dlci) { if (disc && dlci->state != DLCI_CLOSED) { gsm_dlci_begin_close(dlci); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
by Yi Yang 25 Dec '23

25 Dec '23

mainline inclusion from mainline-v6.5-rc7 commit 3c4f8333b582487a2d1e02171f1465531cde53e3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8QFUO CVE: CVE-2023-6546 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In commit 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux"), the UAF problem is not completely fixed. There is a race condition in gsm_cleanup_mux(), which caused this UAF. The UAF problem is triggered by the following race: task[5046] task[5054] ----------------------- ----------------------- gsm_cleanup_mux(); dlci = gsm->dlci[0]; mutex_lock(&gsm->mutex); gsm_cleanup_mux(); dlci = gsm->dlci[0]; //Didn't take the lock gsm_dlci_release(gsm->dlci[i]); gsm->dlci[i] = NULL; mutex_unlock(&gsm->mutex); mutex_lock(&gsm->mutex); dlci->dead = true; //UAF Fix it by assigning values after mutex_lock(). Link: https://syzkaller.appspot.com/text?tag=CrashReport&x=176188b5a80000 Cc: stable <stable(a)kernel.org> Fixes: 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux") Fixes: aa371e96f05d ("tty: n_gsm: fix restart handling via CLD command") Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Co-developed-by: Qiumiao Zhang <zhangqiumiao1(a)huawei.com> Signed-off-by: Qiumiao Zhang <zhangqiumiao1(a)huawei.com> Link: https://lore.kernel.org/r/20230811031121.153237-1-yiyang13@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> conflicts: drivers/tty/n_gsm.c Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/n_gsm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 3f08ad7e629a..c1851fd9149c 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2063,7 +2063,7 @@ static int gsm_disconnect(struct gsm_mux *gsm) static void gsm_cleanup_mux(struct gsm_mux *gsm) { int i; - struct gsm_dlci *dlci = gsm->dlci[0]; + struct gsm_dlci *dlci; struct gsm_msg *txq, *ntxq; gsm->dead = 1; @@ -2082,11 +2082,12 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm) del_timer_sync(&gsm->t2_timer); /* Now we are sure T2 has stopped */ + mutex_lock(&gsm->mutex); + dlci = gsm->dlci[0]; if (dlci) dlci->dead = 1; /* Free up any link layer users */ - mutex_lock(&gsm->mutex); for (i = 0; i < NUM_DLCI; i++) if (gsm->dlci[i]) gsm_dlci_release(gsm->dlci[i]); -- 2.25.1

2 1

[PATCH V3 OLK-6.6 0/4] Fix smmu pgtable prfetch and add support
by Zhang Zekun 25 Dec '23

25 Dec '23

Fix the pgtable prefetch problem, besides add some ras features which is used in ascend scenarios. v3: - Fix code check warnings v2: - issue new ISSUES for olk6.6 Zhang Jian (1): mm: export collect_procs() Zhang Zekun (3): iommu/arm-smmu-v3: Add a SYNC command to avoid broken page table prefetch mm: memory-failure: Directly return the task for specific use ACPI: APEI: Don't call notifier again in ts scenario arch/arm64/Kconfig | 13 +++++++++++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/kernel/cpu_errata.c | 14 ++++++++++++++ arch/arm64/tools/cpucaps | 1 + drivers/acpi/apei/ghes.c | 3 +++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 20 ++++++++++++++++++++ include/linux/mm.h | 8 ++++++++ mm/Kconfig | 11 +++++++++++ mm/memory-failure.c | 13 +++++++++++++ 9 files changed, 84 insertions(+) -- 2.17.1

2 5

[PATCH] tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
by Yi Yang 25 Dec '23

25 Dec '23

mainline inclusion from mainline-v6.5-rc7 commit 3c4f8333b582487a2d1e02171f1465531cde53e3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8QFUO CVE: CVE-2023-6546 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In commit 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux"), the UAF problem is not completely fixed. There is a race condition in gsm_cleanup_mux(), which caused this UAF. The UAF problem is triggered by the following race: task[5046] task[5054] ----------------------- ----------------------- gsm_cleanup_mux(); dlci = gsm->dlci[0]; mutex_lock(&gsm->mutex); gsm_cleanup_mux(); dlci = gsm->dlci[0]; //Didn't take the lock gsm_dlci_release(gsm->dlci[i]); gsm->dlci[i] = NULL; mutex_unlock(&gsm->mutex); mutex_lock(&gsm->mutex); dlci->dead = true; //UAF Fix it by assigning values after mutex_lock(). Link: https://syzkaller.appspot.com/text?tag=CrashReport&x=176188b5a80000 Cc: stable <stable(a)kernel.org> Fixes: 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux") Fixes: aa371e96f05d ("tty: n_gsm: fix restart handling via CLD command") Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Co-developed-by: Qiumiao Zhang <zhangqiumiao1(a)huawei.com> Signed-off-by: Qiumiao Zhang <zhangqiumiao1(a)huawei.com> Link: https://lore.kernel.org/r/20230811031121.153237-1-yiyang13@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> conflicts: drivers/tty/n_gsm.c Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/n_gsm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 3f08ad7e629a..c1851fd9149c 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2063,7 +2063,7 @@ static int gsm_disconnect(struct gsm_mux *gsm) static void gsm_cleanup_mux(struct gsm_mux *gsm) { int i; - struct gsm_dlci *dlci = gsm->dlci[0]; + struct gsm_dlci *dlci; struct gsm_msg *txq, *ntxq; gsm->dead = 1; @@ -2082,11 +2082,12 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm) del_timer_sync(&gsm->t2_timer); /* Now we are sure T2 has stopped */ + mutex_lock(&gsm->mutex); + dlci = gsm->dlci[0]; if (dlci) dlci->dead = 1; /* Free up any link layer users */ - mutex_lock(&gsm->mutex); for (i = 0; i < NUM_DLCI; i++) if (gsm->dlci[i]) gsm_dlci_release(gsm->dlci[i]); -- 2.25.1

1 0