- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] arm64/mpam: Expand the monitor number of the resctrl root
by Zeng Heng 11 Mar '24

11 Mar '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9758Q ----------------------------- Expand the monitor number of the resctrl root to 1023, instead of 255. Fixes: 750084197059 ("arm64/mpam: Remap reqpartid,pmg to rmid and intpartid to closid") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/resctrlfs.c | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-) diff --git a/fs/resctrlfs.c b/fs/resctrlfs.c index 0e6753012140..4e9a1cdb9b13 100644 --- a/fs/resctrlfs.c +++ b/fs/resctrlfs.c @@ -550,26 +550,22 @@ static int find_rdtgrp_allocable_rmid(struct resctrl_group *rdtgrp) struct list_head *head; prgrp = rdtgrp->mon.parent; - if (prgrp == &resctrl_group_default) { - rmid = rmid_alloc(-1); - if (rmid < 0) - return rmid; - } else { - do { - rmid = rmid_alloc(prgrp->closid.reqpartid); + + do { + rmid = rmid_alloc(prgrp->closid.reqpartid); + if (rmid >= 0) + break; + + head = &prgrp->mon.crdtgrp_list; + list_for_each_entry(entry, head, mon.crdtgrp_list) { + if (entry == rdtgrp) + continue; + + rmid = rmid_alloc(entry->closid.reqpartid); if (rmid >= 0) break; - - head = &prgrp->mon.crdtgrp_list; - list_for_each_entry(entry, head, mon.crdtgrp_list) { - if (entry == rdtgrp) - continue; - rmid = rmid_alloc(entry->closid.reqpartid); - if (rmid >= 0) - break; - } - } while (0); - } + } + } while (0); if (rmid < 0) rmid = rmid_alloc(-1); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
by ZhaoLong Wang 11 Mar '24

11 Mar '24

From: Randy Dunlap <rdunlap(a)infradead.org> stable inclusion from stable-v5.10.36 commit 96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/I949C5 CVE: CVE-2021-46952 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c09f11ef35955785f92369e25819bf0629df2e59 upstream. Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused by a garbage timeout (retrans) mount option being passed to nfs mount, in this case from syzkaller. If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift value for a 64-bit long integer, so 'retrans' cannot be >= 64. If it is >= 64, fail the mount and return an error. Fixes: 9954bf92c0cd ("NFS: Move mount parameterisation bits into their own file") Reported-by: syzbot+ba2e91df8f74809417fa(a)syzkaller.appspotmail.com Reported-by: syzbot+f3a0fa110fd630ab56c8(a)syzkaller.appspotmail.com Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Anna Schumaker <anna.schumaker(a)netapp.com> Cc: linux-nfs(a)vger.kernel.org Cc: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/nfs/fs_context.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nfs/super.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/nfs/super.c b/fs/nfs/super.c index a05e1eb2c3fd..15f4e6d34fdd 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -2068,6 +2068,15 @@ static int nfs23_validate_mount_data(void *options, memset(mntfh->data + mntfh->size, 0, sizeof(mntfh->data) - mntfh->size); + /* + * for proto == XPRT_TRANSPORT_UDP, which is what uses + * to_exponential, implying shift: limit the shift value + * to BITS_PER_LONG (majortimeo is unsigned long) + */ + if (!(data->flags & NFS_MOUNT_TCP)) /* this will be UDP */ + if (data->retrans >= 64) /* shift value is too large */ + goto out_invalid_data; + /* * Translate to nfs_parsed_mount_data, which nfs_fill_super * can deal with. @@ -2168,6 +2177,10 @@ static int nfs23_validate_mount_data(void *options, out_invalid_fh: dfprintk(MOUNT, "NFS: invalid root filehandle\n"); return -EINVAL; + +out_invalid_data: + dfprintk(MOUNT, "NFS: invalid binary mount data\n"); + return -EINVAL; } #if IS_ENABLED(CONFIG_NFS_V4) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
by ZhaoLong Wang 11 Mar '24

11 Mar '24

From: Randy Dunlap <rdunlap(a)infradead.org> stable inclusion from stable-5.10.36 commit 96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/I949C5 CVE: CVE-2021-46952 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c09f11ef35955785f92369e25819bf0629df2e59 upstream. Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused by a garbage timeout (retrans) mount option being passed to nfs mount, in this case from syzkaller. If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift value for a 64-bit long integer, so 'retrans' cannot be >= 64. If it is >= 64, fail the mount and return an error. Fixes: 9954bf92c0cd ("NFS: Move mount parameterisation bits into their own file") Reported-by: syzbot+ba2e91df8f74809417fa(a)syzkaller.appspotmail.com Reported-by: syzbot+f3a0fa110fd630ab56c8(a)syzkaller.appspotmail.com Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Anna Schumaker <anna.schumaker(a)netapp.com> Cc: linux-nfs(a)vger.kernel.org Cc: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/nfs/fs_context.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nfs/super.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/nfs/super.c b/fs/nfs/super.c index a05e1eb2c3fd..15f4e6d34fdd 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -2068,6 +2068,15 @@ static int nfs23_validate_mount_data(void *options, memset(mntfh->data + mntfh->size, 0, sizeof(mntfh->data) - mntfh->size); + /* + * for proto == XPRT_TRANSPORT_UDP, which is what uses + * to_exponential, implying shift: limit the shift value + * to BITS_PER_LONG (majortimeo is unsigned long) + */ + if (!(data->flags & NFS_MOUNT_TCP)) /* this will be UDP */ + if (data->retrans >= 64) /* shift value is too large */ + goto out_invalid_data; + /* * Translate to nfs_parsed_mount_data, which nfs_fill_super * can deal with. @@ -2168,6 +2177,10 @@ static int nfs23_validate_mount_data(void *options, out_invalid_fh: dfprintk(MOUNT, "NFS: invalid root filehandle\n"); return -EINVAL; + +out_invalid_data: + dfprintk(MOUNT, "NFS: invalid binary mount data\n"); + return -EINVAL; } #if IS_ENABLED(CONFIG_NFS_V4) -- 2.39.2

2 1

[PATCH] NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
by ZhaoLong Wang 11 Mar '24

11 Mar '24

From: Randy Dunlap <rdunlap(a)infradead.org> stable inclusion from stable-5.10.36 commit 96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2 bugzilla: 189657 CVE: CVE-2021-46952 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c09f11ef35955785f92369e25819bf0629df2e59 upstream. Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused by a garbage timeout (retrans) mount option being passed to nfs mount, in this case from syzkaller. If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift value for a 64-bit long integer, so 'retrans' cannot be >= 64. If it is >= 64, fail the mount and return an error. Fixes: 9954bf92c0cd ("NFS: Move mount parameterisation bits into their own file") Reported-by: syzbot+ba2e91df8f74809417fa(a)syzkaller.appspotmail.com Reported-by: syzbot+f3a0fa110fd630ab56c8(a)syzkaller.appspotmail.com Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Anna Schumaker <anna.schumaker(a)netapp.com> Cc: linux-nfs(a)vger.kernel.org Cc: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- fs/nfs/fs_context.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/fs/nfs/fs_context.c b/fs/nfs/fs_context.c index 29ec8b09a52d..05b39e8f97b9 100644 --- a/fs/nfs/fs_context.c +++ b/fs/nfs/fs_context.c @@ -937,6 +937,15 @@ static int nfs23_parse_monolithic(struct fs_context *fc, memset(mntfh->data + mntfh->size, 0, sizeof(mntfh->data) - mntfh->size); + /* + * for proto == XPRT_TRANSPORT_UDP, which is what uses + * to_exponential, implying shift: limit the shift value + * to BITS_PER_LONG (majortimeo is unsigned long) + */ + if (!(data->flags & NFS_MOUNT_TCP)) /* this will be UDP */ + if (data->retrans >= 64) /* shift value is too large */ + goto out_invalid_data; + /* * Translate to nfs_fs_context, which nfs_fill_super * can deal with. @@ -1037,6 +1046,9 @@ static int nfs23_parse_monolithic(struct fs_context *fc, out_invalid_fh: return nfs_invalf(fc, "NFS: invalid root filehandle"); + +out_invalid_data: + return nfs_invalf(fc, "NFS: invalid binary mount data"); } #if IS_ENABLED(CONFIG_NFS_V4) -- 2.39.2

1 0

[PATCH OLK-6.6] modpost: Optimize symbol search from linear to binary search
by Hongchen Zhang 11 Mar '24

11 Mar '24

From: Jack Brennen <jbrennen(a)google.com> mainline inclusion from mainline-v6.7-rc1 commit 4074532758c5c367d3fcb8d124150824a254659d category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I97HOU CVE: NA -------------------------------- Modify modpost to use binary search for converting addresses back into symbol references. Previously it used linear search. This change saves a few seconds of wall time for defconfig builds, but can save several minutes on allyesconfigs. Before: $ make LLVM=1 -j128 allyesconfig vmlinux -s KCFLAGS="-Wno-error" $ time scripts/mod/modpost -M -m -a -N -o vmlinux.symvers vmlinux.o 198.38user 1.27system 3:19.71elapsed After: $ make LLVM=1 -j128 allyesconfig vmlinux -s KCFLAGS="-Wno-error" $ time scripts/mod/modpost -M -m -a -N -o vmlinux.symvers vmlinux.o 11.91user 0.85system 0:12.78elapsed Signed-off-by: Jack Brennen <jbrennen(a)google.com> Tested-by: Nick Desaulniers <ndesaulniers(a)google.com> Signed-off-by: Masahiro Yamada <masahiroy(a)kernel.org> --- scripts/mod/Makefile | 4 +- scripts/mod/modpost.c | 70 ++------------ scripts/mod/modpost.h | 25 +++++ scripts/mod/symsearch.c | 199 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 232 insertions(+), 66 deletions(-) create mode 100644 scripts/mod/symsearch.c diff --git a/scripts/mod/Makefile b/scripts/mod/Makefile index c9e38ad937fd..3c54125eb373 100644 --- a/scripts/mod/Makefile +++ b/scripts/mod/Makefile @@ -5,7 +5,7 @@ CFLAGS_REMOVE_empty.o += $(CC_FLAGS_LTO) hostprogs-always-y += modpost mk_elfconfig always-y += empty.o -modpost-objs := modpost.o file2alias.o sumversion.o +modpost-objs := modpost.o file2alias.o sumversion.o symsearch.o devicetable-offsets-file := devicetable-offsets.h @@ -16,7 +16,7 @@ targets += $(devicetable-offsets-file) devicetable-offsets.s # dependencies on generated files need to be listed explicitly -$(obj)/modpost.o $(obj)/file2alias.o $(obj)/sumversion.o: $(obj)/elfconfig.h +$(obj)/modpost.o $(obj)/file2alias.o $(obj)/sumversion.o $(obj)/symsearch.o: $(obj)/elfconfig.h $(obj)/file2alias.o: $(obj)/$(devicetable-offsets-file) quiet_cmd_elfconfig = MKELF $@ diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c index ac4ef3e206bb..e6c8b096362e 100644 --- a/scripts/mod/modpost.c +++ b/scripts/mod/modpost.c @@ -22,7 +22,6 @@ #include <errno.h> #include "modpost.h" #include "../../include/linux/license.h" -#include "../../include/linux/module_symbol.h" static bool module_enabled; /* Are we using CONFIG_MODVERSIONS? */ @@ -577,11 +576,14 @@ static int parse_elf(struct elf_info *info, const char *filename) *p = TO_NATIVE(*p); } + symsearch_init(info); + return 1; } static void parse_elf_finish(struct elf_info *info) { + symsearch_finish(info); release_file(info->hdr, info->size); } @@ -1050,71 +1052,10 @@ static int secref_whitelist(const char *fromsec, const char *fromsym, return 1; } -/* - * If there's no name there, ignore it; likewise, ignore it if it's - * one of the magic symbols emitted used by current tools. - * - * Otherwise if find_symbols_between() returns those symbols, they'll - * fail the whitelist tests and cause lots of false alarms ... fixable - * only by merging __exit and __init sections into __text, bloating - * the kernel (which is especially evil on embedded platforms). - */ -static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym) -{ - const char *name = elf->strtab + sym->st_name; - - if (!name || !strlen(name)) - return 0; - return !is_mapping_symbol(name); -} - -/* Look up the nearest symbol based on the section and the address */ -static Elf_Sym *find_nearest_sym(struct elf_info *elf, Elf_Addr addr, - unsigned int secndx, bool allow_negative, - Elf_Addr min_distance) -{ - Elf_Sym *sym; - Elf_Sym *near = NULL; - Elf_Addr sym_addr, distance; - bool is_arm = (elf->hdr->e_machine == EM_ARM); - - for (sym = elf->symtab_start; sym < elf->symtab_stop; sym++) { - if (get_secindex(elf, sym) != secndx) - continue; - if (!is_valid_name(elf, sym)) - continue; - - sym_addr = sym->st_value; - - /* - * For ARM Thumb instruction, the bit 0 of st_value is set - * if the symbol is STT_FUNC type. Mask it to get the address. - */ - if (is_arm && ELF_ST_TYPE(sym->st_info) == STT_FUNC) - sym_addr &= ~1; - - if (addr >= sym_addr) - distance = addr - sym_addr; - else if (allow_negative) - distance = sym_addr - addr; - else - continue; - - if (distance <= min_distance) { - min_distance = distance; - near = sym; - } - - if (min_distance == 0) - break; - } - return near; -} - static Elf_Sym *find_fromsym(struct elf_info *elf, Elf_Addr addr, unsigned int secndx) { - return find_nearest_sym(elf, addr, secndx, false, ~0); + return symsearch_find_nearest(elf, addr, secndx, false, ~0); } static Elf_Sym *find_tosym(struct elf_info *elf, Elf_Addr addr, Elf_Sym *sym) @@ -1127,7 +1068,8 @@ static Elf_Sym *find_tosym(struct elf_info *elf, Elf_Addr addr, Elf_Sym *sym) * Strive to find a better symbol name, but the resulting name may not * match the symbol referenced in the original code. */ - return find_nearest_sym(elf, addr, get_secindex(elf, sym), true, 20); + return symsearch_find_nearest(elf, addr, get_secindex(elf, sym), + true, 20); } static bool is_executable_section(struct elf_info *elf, unsigned int secndx) diff --git a/scripts/mod/modpost.h b/scripts/mod/modpost.h index 5f94c2c9f2d9..6413f26fcb6b 100644 --- a/scripts/mod/modpost.h +++ b/scripts/mod/modpost.h @@ -10,6 +10,7 @@ #include <fcntl.h> #include <unistd.h> #include <elf.h> +#include "../../include/linux/module_symbol.h" #include "list.h" #include "elfconfig.h" @@ -128,6 +129,8 @@ struct elf_info { * take shndx from symtab_shndx_start[N] instead */ Elf32_Word *symtab_shndx_start; Elf32_Word *symtab_shndx_stop; + + struct symsearch *symsearch; }; /* Accessor for sym->st_shndx, hides ugliness of "64k sections" */ @@ -154,6 +157,28 @@ static inline unsigned int get_secindex(const struct elf_info *info, return index; } +/* + * If there's no name there, ignore it; likewise, ignore it if it's + * one of the magic symbols emitted used by current tools. + * + * Internal symbols created by tools should be ignored by modpost. + */ +static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym) +{ + const char *name = elf->strtab + sym->st_name; + + if (!name || !strlen(name)) + return 0; + return !is_mapping_symbol(name); +} + +/* symsearch.c */ +void symsearch_init(struct elf_info *elf); +void symsearch_finish(struct elf_info *elf); +Elf_Sym *symsearch_find_nearest(struct elf_info *elf, Elf_Addr addr, + unsigned int secndx, bool allow_negative, + Elf_Addr min_distance); + /* file2alias.c */ void handle_moddevtable(struct module *mod, struct elf_info *info, Elf_Sym *sym, const char *symname); diff --git a/scripts/mod/symsearch.c b/scripts/mod/symsearch.c new file mode 100644 index 000000000000..aa4ed51f9960 --- /dev/null +++ b/scripts/mod/symsearch.c @@ -0,0 +1,199 @@ +// SPDX-License-Identifier: GPL-2.0 + +/* + * Helper functions for finding the symbol in an ELF which is "nearest" + * to a given address. + */ + +#include "modpost.h" + +struct syminfo { + unsigned int symbol_index; + unsigned int section_index; + Elf_Addr addr; +}; + +/* + * Container used to hold an entire binary search table. + * Entries in table are ascending, sorted first by section_index, + * then by addr, and last by symbol_index. The sorting by + * symbol_index is used to ensure predictable behavior when + * multiple symbols are present with the same address; all + * symbols past the first are effectively ignored, by eliding + * them in symsearch_fixup(). + */ +struct symsearch { + unsigned int table_size; + struct syminfo table[]; +}; + +static int syminfo_compare(const void *s1, const void *s2) +{ + const struct syminfo *sym1 = s1; + const struct syminfo *sym2 = s2; + + if (sym1->section_index > sym2->section_index) + return 1; + if (sym1->section_index < sym2->section_index) + return -1; + if (sym1->addr > sym2->addr) + return 1; + if (sym1->addr < sym2->addr) + return -1; + if (sym1->symbol_index > sym2->symbol_index) + return 1; + if (sym1->symbol_index < sym2->symbol_index) + return -1; + return 0; +} + +static unsigned int symbol_count(struct elf_info *elf) +{ + unsigned int result = 0; + + for (Elf_Sym *sym = elf->symtab_start; sym < elf->symtab_stop; sym++) { + if (is_valid_name(elf, sym)) + result++; + } + return result; +} + +/* + * Populate the search array that we just allocated. + * Be slightly paranoid here. The ELF file is mmap'd and could + * conceivably change between symbol_count() and symsearch_populate(). + * If we notice any difference, bail out rather than potentially + * propagating errors or crashing. + */ +static void symsearch_populate(struct elf_info *elf, + struct syminfo *table, + unsigned int table_size) +{ + bool is_arm = (elf->hdr->e_machine == EM_ARM); + + for (Elf_Sym *sym = elf->symtab_start; sym < elf->symtab_stop; sym++) { + if (is_valid_name(elf, sym)) { + if (table_size-- == 0) + fatal("%s: size mismatch\n", __func__); + table->symbol_index = sym - elf->symtab_start; + table->section_index = get_secindex(elf, sym); + table->addr = sym->st_value; + + /* + * For ARM Thumb instruction, the bit 0 of st_value is + * set if the symbol is STT_FUNC type. Mask it to get + * the address. + */ + if (is_arm && ELF_ST_TYPE(sym->st_info) == STT_FUNC) + table->addr &= ~1; + + table++; + } + } + + if (table_size != 0) + fatal("%s: size mismatch\n", __func__); +} + +/* + * Do any fixups on the table after sorting. + * For now, this just finds adjacent entries which have + * the same section_index and addr, and it propagates + * the first symbol_index over the subsequent entries, + * so that only one symbol_index is seen for any given + * section_index and addr. This ensures that whether + * we're looking at an address from "above" or "below" + * that we see the same symbol_index. + * This does leave some duplicate entries in the table; + * in practice, these are a small fraction of the + * total number of entries, and they are harmless to + * the binary search algorithm other than a few occasional + * unnecessary comparisons. + */ +static void symsearch_fixup(struct syminfo *table, unsigned int table_size) +{ + /* Don't look at index 0, it will never change. */ + for (unsigned int i = 1; i < table_size; i++) { + if (table[i].addr == table[i - 1].addr && + table[i].section_index == table[i - 1].section_index) { + table[i].symbol_index = table[i - 1].symbol_index; + } + } +} + +void symsearch_init(struct elf_info *elf) +{ + unsigned int table_size = symbol_count(elf); + + elf->symsearch = NOFAIL(malloc(sizeof(struct symsearch) + + sizeof(struct syminfo) * table_size)); + elf->symsearch->table_size = table_size; + + symsearch_populate(elf, elf->symsearch->table, table_size); + qsort(elf->symsearch->table, table_size, + sizeof(struct syminfo), syminfo_compare); + + symsearch_fixup(elf->symsearch->table, table_size); +} + +void symsearch_finish(struct elf_info *elf) +{ + free(elf->symsearch); + elf->symsearch = NULL; +} + +/* + * Find the syminfo which is in secndx and "nearest" to addr. + * allow_negative: allow returning a symbol whose address is > addr. + * min_distance: ignore symbols which are further away than this. + * + * Returns a pointer into the symbol table for success. + * Returns NULL if no legal symbol is found within the requested range. + */ +Elf_Sym *symsearch_find_nearest(struct elf_info *elf, Elf_Addr addr, + unsigned int secndx, bool allow_negative, + Elf_Addr min_distance) +{ + unsigned int hi = elf->symsearch->table_size; + unsigned int lo = 0; + struct syminfo *table = elf->symsearch->table; + struct syminfo target; + + target.addr = addr; + target.section_index = secndx; + target.symbol_index = ~0; /* compares greater than any actual index */ + while (hi > lo) { + unsigned int mid = lo + (hi - lo) / 2; /* Avoids overflow */ + + if (syminfo_compare(&table[mid], &target) > 0) + hi = mid; + else + lo = mid + 1; + } + + /* + * table[hi], if it exists, is the first entry in the array which + * lies beyond target. table[hi - 1], if it exists, is the last + * entry in the array which comes before target, including the + * case where it perfectly matches the section and the address. + * + * Note -- if the address we're looking up falls perfectly + * in the middle of two symbols, this is written to always + * prefer the symbol with the lower address. + */ + Elf_Sym *result = NULL; + + if (allow_negative && + hi < elf->symsearch->table_size && + table[hi].section_index == secndx && + table[hi].addr - addr <= min_distance) { + min_distance = table[hi].addr - addr; + result = &elf->symtab_start[table[hi].symbol_index]; + } + if (hi > 0 && + table[hi - 1].section_index == secndx && + addr - table[hi - 1].addr <= min_distance) { + result = &elf->symtab_start[table[hi - 1].symbol_index]; + } + return result; +} -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-46926
by Liu Mingrui 11 Mar '24

11 Mar '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller Pierre-Louis Bossart (1): soundwire: intel: filter SoundWire controller device search drivers/soundwire/intel_init.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
by ZhaoLong Wang 11 Mar '24

11 Mar '24

From: Randy Dunlap <rdunlap(a)infradead.org> stable inclusion from stable-5.10.36 commit 96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/I949C5 CVE: CVE-2021-46952 -------------------------------- commit c09f11ef35955785f92369e25819bf0629df2e59 upstream. Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused by a garbage timeout (retrans) mount option being passed to nfs mount, in this case from syzkaller. If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift value for a 64-bit long integer, so 'retrans' cannot be >= 64. If it is >= 64, fail the mount and return an error. Fixes: 9954bf92c0cd ("NFS: Move mount parameterisation bits into their own file") Reported-by: syzbot+ba2e91df8f74809417fa(a)syzkaller.appspotmail.com Reported-by: syzbot+f3a0fa110fd630ab56c8(a)syzkaller.appspotmail.com Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Anna Schumaker <anna.schumaker(a)netapp.com> Cc: linux-nfs(a)vger.kernel.org Cc: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/nfs/fs_context.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nfs/super.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/nfs/super.c b/fs/nfs/super.c index a05e1eb2c3fd..15f4e6d34fdd 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -2068,6 +2068,15 @@ static int nfs23_validate_mount_data(void *options, memset(mntfh->data + mntfh->size, 0, sizeof(mntfh->data) - mntfh->size); + /* + * for proto == XPRT_TRANSPORT_UDP, which is what uses + * to_exponential, implying shift: limit the shift value + * to BITS_PER_LONG (majortimeo is unsigned long) + */ + if (!(data->flags & NFS_MOUNT_TCP)) /* this will be UDP */ + if (data->retrans >= 64) /* shift value is too large */ + goto out_invalid_data; + /* * Translate to nfs_parsed_mount_data, which nfs_fill_super * can deal with. @@ -2168,6 +2177,10 @@ static int nfs23_validate_mount_data(void *options, out_invalid_fh: dfprintk(MOUNT, "NFS: invalid root filehandle\n"); return -EINVAL; + +out_invalid_data: + dfprintk(MOUNT, "NFS: invalid binary mount data\n"); + return -EINVAL; } #if IS_ENABLED(CONFIG_NFS_V4) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-46926
by Liu Mingrui 11 Mar '24

11 Mar '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller Pierre-Louis Bossart (1): soundwire: intel: filter SoundWire controller device search drivers/soundwire/intel_init.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6 00/19] net: hns3: provides some customized interfaces for storage devices
by Jijie Shao 11 Mar '24

11 Mar '24

From: Jiantao Xiao <xiaojiantao1(a)h-partners.com> Hao Chen (2): net: hns3: add support to get/set 1d torus param net: hns3: add support modified tx timeout Jian Shen (2): net: hns3: add extend interface support for read and write phy register net: hns3: add input parameters checking Jie Wang (1): net: hns3: add support PF provides customized interfaces to detect port faults. shaojijie (13): net: hns3: add support customized exception handling interfaces. net: hns3: add supports pfc storm detection and suppression net: hns3: add supports fast reporting of faulty nodes net: hns3: add support clear mac statistics net: hns3: add support configuring function-level interrupt affinity net: hns3: add support query port ext information net: hns3: add support query the presence of optical module net: hns3: add supports configure optical module enable net: hns3: add support config and query serdes lane status net: hns3: add support disable nic clock net: hns3: support set pfc pause trans time net: hns3: add support detect port wire type net: hns3: add support set led wangpeiyang (1): net: hns3: add support set mac state drivers/net/ethernet/hisilicon/hns3/Makefile | 3 +- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 7 + .../net/ethernet/hisilicon/hns3/hnae3_ext.h | 121 ++ .../hns3/hns3_common/hclge_comm_cmd.c | 1 + .../hns3/hns3_common/hclge_comm_cmd.h | 1 + .../net/ethernet/hisilicon/hns3/hns3_enet.c | 7 +- .../net/ethernet/hisilicon/hns3/hns3_ext.c | 543 ++++++ .../net/ethernet/hisilicon/hns3/hns3_ext.h | 67 + .../hisilicon/hns3/hns3pf/hclge_cmd.h | 14 +- .../hisilicon/hns3/hns3pf/hclge_ext.c | 1490 +++++++++++++++++ .../hisilicon/hns3/hns3pf/hclge_ext.h | 180 ++ .../hisilicon/hns3/hns3pf/hclge_main.c | 58 +- .../hisilicon/hns3/hns3pf/hclge_main.h | 12 +- .../hisilicon/hns3/hns3pf/hclge_mbx.c | 2 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 7 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.h | 2 + 16 files changed, 2488 insertions(+), 27 deletions(-) create mode 100644 drivers/net/ethernet/hisilicon/hns3/hnae3_ext.h create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_ext.c create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_ext.h create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ext.c create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ext.h -- 2.30.0

2 20

[PATCH openEuler-1.0-LTS] crypto: scomp - fix req->dst buffer overflow
by GUO Zihua 11 Mar '24

11 Mar '24

From: Chengming Zhou <zhouchengming(a)bytedance.com> stable inclusion from stable-v4.19.306 commit 1142d65c5b881590962ad763f94505b6dd67d2fe category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I970CO CVE: NA Reference: https://github.com/gregkh/linux/commit/1142d65c5b881590962ad763f94505b6dd67… -------------------------------- [ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ] The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem. Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface") Reported-by: syzbot+3eff5e51bf1db122a16e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/ Signed-off-by: Chengming Zhou <zhouchengming(a)bytedance.com> Reviewed-by: Barry Song <v-songbaohua(a)oppo.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: crypto/scompress.c Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- crypto/scompress.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crypto/scompress.c b/crypto/scompress.c index 15641c96ff99..5f3fb6cbf531 100644 --- a/crypto/scompress.c +++ b/crypto/scompress.c @@ -149,6 +149,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) const int cpu = get_cpu(); u8 *scratch_src = *per_cpu_ptr(scomp_src_scratches, cpu); u8 *scratch_dst = *per_cpu_ptr(scomp_dst_scratches, cpu); + unsigned int dlen; int ret; if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) { @@ -164,6 +165,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE) req->dlen = SCOMP_SCRATCH_SIZE; + dlen = req->dlen; + scatterwalk_map_and_copy(scratch_src, req->src, 0, req->slen, 0); if (dir) ret = crypto_scomp_compress(scomp, scratch_src, req->slen, @@ -178,6 +181,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) ret = -ENOMEM; goto out; } + } else if (req->dlen > dlen) { + ret = -ENOSPC; + goto out; } scatterwalk_map_and_copy(scratch_dst, req->dst, 0, req->dlen, 1); -- 2.34.1

2 1