- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 1/4] ext4: fix bug_on in __es_tree_search caused by bad quota inode
by Yongqiang Liu 01 Nov '22

01 Nov '22

From: Baokun Li <libaokun1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187821,https://gitee.com/openeuler/kernel/issues/I5X9U0 CVE: NA -------------------------------- We got a issue as fllows: Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> ================================================================== kernel BUG at fs/ext4/extents_status.c:202! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 1 PID: 810 Comm: mount Not tainted 6.1.0-rc1-next-g9631525255e3 #352 RIP: 0010:__es_tree_search.isra.0+0xb8/0xe0 RSP: 0018:ffffc90001227900 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000077512a0f RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000002a10 RDI: ffff8881004cd0c8 RBP: ffff888177512ac8 R08: 47ffffffffffffff R09: 0000000000000001 R10: 0000000000000001 R11: 00000000000679af R12: 0000000000002a10 R13: ffff888177512d88 R14: 0000000077512a10 R15: 0000000000000000 FS: 00007f4bd76dbc40(0000)GS:ffff88842fd00000(0000)knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005653bf993cf8 CR3: 000000017bfdf000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ext4_es_cache_extent+0xe2/0x210 ext4_cache_extents+0xd2/0x110 ext4_find_extent+0x5d5/0x8c0 ext4_ext_map_blocks+0x9c/0x1d30 ext4_map_blocks+0x431/0xa50 ext4_getblk+0x82/0x340 ext4_bread+0x14/0x110 ext4_quota_read+0xf0/0x180 v2_read_header+0x24/0x90 v2_check_quota_file+0x2f/0xa0 dquot_load_quota_sb+0x26c/0x760 dquot_load_quota_inode+0xa5/0x190 ext4_enable_quotas+0x14c/0x300 __ext4_fill_super+0x31cc/0x32c0 ext4_fill_super+0x115/0x2d0 get_tree_bdev+0x1d2/0x360 ext4_get_tree+0x19/0x30 vfs_get_tree+0x26/0xe0 path_mount+0x81d/0xfc0 do_mount+0x8d/0xc0 __x64_sys_mount+0xc0/0x160 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> ================================================================== Above issue may happen as follows: ------------------------------------- ext4_fill_super ext4_orphan_cleanup ext4_enable_quotas ext4_quota_enable ext4_iget --> get error inode <5> ext4_ext_check_inode --> Wrong imode makes it escape inspection make_bad_inode(inode) --> EXT4_BOOT_LOADER_INO set imode dquot_load_quota_inode vfs_setup_quota_inode --> check pass dquot_load_quota_sb v2_check_quota_file v2_read_header ext4_quota_read ext4_bread ext4_getblk ext4_map_blocks ext4_ext_map_blocks ext4_find_extent ext4_cache_extents ext4_es_cache_extent __es_tree_search.isra.0 ext4_es_end --> Wrong extents trigger BUG_ON In the above issue, s_usr_quota_inum is set to 5, but inode<5> contains incorrect imode and disordered extents. Because 5 is EXT4_BOOT_LOADER_INO, the ext4_ext_check_inode check in the ext4_iget function can be bypassed, finally, the extents that are not checked trigger the BUG_ON in the __es_tree_search function. To solve this issue, check whether the inode is bad_inode in vfs_setup_quota_inode(). Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/quota/dquot.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index ddb379abd919..316f49cbc032 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -2312,6 +2312,10 @@ static int vfs_load_quota_inode(struct inode *inode, int type, int format_id, if (!fmt) return -ESRCH; + if (is_bad_inode(inode)) { + error = -EUCLEAN; + goto out_fmt; + } if (!S_ISREG(inode->i_mode)) { error = -EACCES; goto out_fmt; -- 2.25.1

1 3

[PATCH openEuler-5.10-LTS 00/66] Backport 5.10.129 LTS
by Zheng Zengkai 01 Nov '22

01 Nov '22

Backport 5.10.129 LTS patches from upstream. git cherry-pick v5.10.128..v5.10.129~1 -s Already merged(-10): 8f74cb27c2b4 net: rose: fix UAF bugs caused by timer handler da61388f9a75 xfs: Skip repetitive warnings about mount options f874e16870cc xfs: update superblock counters correctly for !lazysbcount 9203dfb3ed6b xfs: fix xfs_reflink_unshare usage of filemap_write_and_wait_range cfea428030be xen/blkfront: fix leaking data in shared pages 728d68bfe68d xen/netfront: fix leaking data in shared pages 4923217af574 xen/netfront: force data bouncing when backend is untrusted cbbd2d253153 xen/blkfront: force data bouncing when backend is untrusted 547b7c640df5 xen-netfront: restore __skb_queue_tail() positioning in xennet_get_responses() 43c8d33ce353 xen/arm: Fix race in RB-tree based P2M accounting Defered(-2): b261cd005ab9 xfs: use current->journal_info for detecting transaction recursion 6b7dab812cba xfs: rename variable mp to parsing_mp Total patches: 78 - 10 - 2 = 66 Alexey Khoroshilov (1): NFSD: restore EINVAL error translation in nfsd_commit() Anthony Iliopoulos (1): xfs: fix xfs_trans slab cache name Carlo Lobrano (1): net: usb: qmi_wwan: add Telit 0x1060 composition Chris Ye (1): nvdimm: Fix badblocks clear off-by-one error Christophe Leroy (1): powerpc/book3e: Fix PUD allocation size in map_kernel_page() Chuck Lever (1): SUNRPC: Fix READ_PLUS crasher Daniele Palmas (1): net: usb: qmi_wwan: add Telit 0x1070 composition Demi Marie Obenour (1): xen/gntdev: Avoid blocking in unmap_grant_pages() Dimitris Michailidis (1): selftests/net: pass ipv6_args to udpgso_bench's IPv6 TCP test Doug Berger (1): net: dsa: bcm_sf2: force pause link settings Enguerrand de Ribaucourt (2): net: dp83822: disable false carrier interrupt net: dp83822: disable rx error interrupt Eric Dumazet (3): net: bonding: fix possible NULL deref in rlb code tunnels: do not assume mac header is set in skb_tunnel_check_pmtu() tcp: add a missing nf_reset_ct() in 3WHS handling Gao Xiang (1): xfs: ensure xfs_errortag_random_default matches XFS_ERRTAG_MAX Greg Kroah-Hartman (1): clocksource/drivers/ixp4xx: remove EXPORT_SYMBOL_GPL from ixp4xx_timer_setup() Heinz Mauelshagen (1): dm raid: fix accesses beyond end of raid member array Jakub Kicinski (3): net: tun: unlink NAPI from device on destruction net: tun: stop NAPI when detaching queues net: tun: avoid disabling NAPI twice Jason A. Donenfeld (1): s390/archrandom: simplify back to earlier design and initialize earlier Jason Wang (2): virtio-net: fix race between ndo_open() and virtio_device_ready() caif_virtio: fix race between virtio_device_ready() and ndo_open() Jens Axboe (1): io_uring: ensure that send/sendmsg and recv/recvmsg check sqe->ioprio Jose Alonso (1): net: usb: ax88179_178a: Fix packet receiving Kamal Heib (1): RDMA/qedr: Fix reporting QP timeout attribute Krzysztof Kozlowski (1): nfc: nfcmrvl: Fix irq_of_parse_and_map() return value Liam Howlett (1): powerpc/prom_init: Fix kernel config grep Liang He (1): drivers: cpufreq: Add missing of_node_put() in qoriq-cpufreq.c Masahiro Yamada (1): s390: remove unneeded 'select BUILD_BIN2C' Mathieu Desnoyers (15): selftests/rseq: introduce own copy of rseq uapi header selftests/rseq: Remove useless assignment to cpu variable selftests/rseq: Remove volatile from __rseq_abi selftests/rseq: Introduce rseq_get_abi() helper selftests/rseq: Introduce thread pointer getters selftests/rseq: Uplift rseq selftests for compatibility with glibc-2.35 selftests/rseq: Fix ppc32: wrong rseq_cs 32-bit field pointer on big endian selftests/rseq: Fix ppc32 missing instruction selection "u" and "x" for load/store selftests/rseq: Fix ppc32 offsets by using long rather than off_t selftests/rseq: Fix warnings about #if checks of undefined tokens selftests/rseq: Remove arm/mips asm goto compiler work-around selftests/rseq: Fix: work-around asm goto compiler bugs selftests/rseq: x86-64: use %fs segment selector for accessing rseq thread area selftests/rseq: x86-32: use %gs segment selector for accessing rseq thread area selftests/rseq: Change type of rseq_offset to ptrdiff_t Miaoqian Lin (2): RDMA/cm: Fix memory leak in ib_cm_insert_listen PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events Michael Walle (1): NFC: nxp-nci: Don't issue a zero length i2c_master_read() Mikulas Patocka (1): dm raid: fix KASAN warning in raid5_add_disks Naveen N. Rao (1): powerpc/bpf: Fix use of user_pt_regs in uapi Nicolas Dichtel (1): ipv6: take care of disable_policy when restoring routes Oliver Neukum (1): usbnet: fix memory allocation in helpers Pablo Greco (1): nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG SX6000LNP (AKA SPECTRIX S40G) Pablo Neira Ayuso (1): netfilter: nft_dynset: restore set element counter when failing to update Ruili Ji (1): drm/amdgpu: To flush tlb for MMHUB of RAVEN series Shuah Khan (1): selftests/rseq: remove ARRAY_SIZE define from individual tests Tao Liu (1): linux/dim: Fix divide by 0 in RDMA DIM Tong Zhang (1): epic100: fix use after free on rmmod Victor Nogueira (1): net/sched: act_api: Notify user space if any actions were flushed before error Xin Long (1): tipc: move bc link creation back to tipc_node_create Yang Yingliang (1): hwmon: (ibmaem) don't call platform_device_del() if platform_device_add() fails Yevhen Orlov (1): net: bonding: fix use-after-free after 802.3ad slave unbind YueHaibing (1): net: ipv6: unexport __init-annotated seg6_hmac_net_init() katrinzhou (1): ipv6/sit: fix ipip6_tunnel_get_prl return value kernel test robot (1): sit: use min arch/powerpc/include/asm/bpf_perf_event.h | 9 + .../powerpc/include/uapi/asm/bpf_perf_event.h | 9 - arch/powerpc/kernel/prom_init_check.sh | 2 +- arch/powerpc/mm/nohash/book3e_pgtable.c | 6 +- arch/s390/Kconfig | 1 - arch/s390/crypto/arch_random.c | 111 +--------- arch/s390/include/asm/archrandom.h | 13 +- arch/s390/kernel/setup.c | 5 + drivers/clocksource/timer-ixp4xx.c | 1 - drivers/cpufreq/qoriq-cpufreq.c | 1 + drivers/devfreq/event/exynos-ppmu.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 3 +- drivers/hwmon/ibmaem.c | 12 +- drivers/infiniband/core/cm.c | 4 +- drivers/infiniband/hw/qedr/qedr.h | 1 + drivers/infiniband/hw/qedr/verbs.c | 4 +- drivers/md/dm-raid.c | 34 +-- drivers/md/raid5.c | 1 + drivers/net/bonding/bond_3ad.c | 3 +- drivers/net/bonding/bond_alb.c | 2 +- drivers/net/caif/caif_virtio.c | 10 +- drivers/net/dsa/bcm_sf2.c | 5 + drivers/net/ethernet/smsc/epic100.c | 4 +- drivers/net/phy/dp83822.c | 4 +- drivers/net/tun.c | 15 +- drivers/net/usb/ax88179_178a.c | 101 ++++++--- drivers/net/usb/qmi_wwan.c | 2 + drivers/net/usb/usbnet.c | 4 +- drivers/net/virtio_net.c | 8 +- drivers/nfc/nfcmrvl/i2c.c | 6 +- drivers/nfc/nfcmrvl/spi.c | 6 +- drivers/nfc/nxp-nci/i2c.c | 3 + drivers/nvdimm/bus.c | 4 +- drivers/nvme/host/pci.c | 3 +- drivers/xen/gntdev-common.h | 7 + drivers/xen/gntdev.c | 140 ++++++++---- fs/io_uring.c | 4 + fs/nfsd/vfs.c | 3 +- fs/xfs/xfs_error.c | 2 + fs/xfs/xfs_super.c | 2 +- include/linux/dim.h | 2 +- net/ipv4/ip_tunnel_core.c | 2 +- net/ipv4/tcp_ipv4.c | 4 +- net/ipv6/addrconf.c | 4 - net/ipv6/route.c | 9 +- net/ipv6/seg6_hmac.c | 1 - net/ipv6/sit.c | 10 +- net/netfilter/nft_set_hash.c | 2 + net/sched/act_api.c | 22 +- net/sunrpc/xdr.c | 2 +- net/tipc/node.c | 41 ++-- tools/testing/selftests/net/udpgso_bench.sh | 2 +- tools/testing/selftests/rseq/Makefile | 2 +- .../selftests/rseq/basic_percpu_ops_test.c | 5 +- tools/testing/selftests/rseq/compiler.h | 30 +++ tools/testing/selftests/rseq/param_test.c | 8 +- tools/testing/selftests/rseq/rseq-abi.h | 151 +++++++++++++ tools/testing/selftests/rseq/rseq-arm.h | 110 +++++----- tools/testing/selftests/rseq/rseq-arm64.h | 79 +++++-- .../rseq/rseq-generic-thread-pointer.h | 25 +++ tools/testing/selftests/rseq/rseq-mips.h | 71 ++----- .../selftests/rseq/rseq-ppc-thread-pointer.h | 30 +++ tools/testing/selftests/rseq/rseq-ppc.h | 128 +++++++---- tools/testing/selftests/rseq/rseq-s390.h | 55 +++-- tools/testing/selftests/rseq/rseq-skip.h | 2 +- .../selftests/rseq/rseq-thread-pointer.h | 19 ++ .../selftests/rseq/rseq-x86-thread-pointer.h | 40 ++++ tools/testing/selftests/rseq/rseq-x86.h | 200 ++++++++++++------ tools/testing/selftests/rseq/rseq.c | 165 +++++++-------- tools/testing/selftests/rseq/rseq.h | 30 ++- 70 files changed, 1167 insertions(+), 647 deletions(-) create mode 100644 arch/powerpc/include/asm/bpf_perf_event.h delete mode 100644 arch/powerpc/include/uapi/asm/bpf_perf_event.h create mode 100644 tools/testing/selftests/rseq/compiler.h create mode 100644 tools/testing/selftests/rseq/rseq-abi.h create mode 100644 tools/testing/selftests/rseq/rseq-generic-thread-pointer.h create mode 100644 tools/testing/selftests/rseq/rseq-ppc-thread-pointer.h create mode 100644 tools/testing/selftests/rseq/rseq-thread-pointer.h create mode 100644 tools/testing/selftests/rseq/rseq-x86-thread-pointer.h -- 2.20.1

1 66

[PATCH openEuler-5.10-LTS 0/5] Backport 5.10.128 LTS
by Zheng Zengkai 01 Nov '22

01 Nov '22

Backport 5.10.128 LTS patches from upstream. git cherry-pick v5.10.127..v5.10.128~1 -s Already merged(-3): 09c9902cd80a bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() db3f8110c3b0 xfs: use kmem_cache_free() for kmem_cache objects 0cdccc05da76 xfs: punch out data fork delalloc blocks on COW writeback failure Defered(-3): 1e76bd4c6722 xfs: Fix the free logic of state in xfs_attr_node_hasname 071e750ffb3d xfs: remove all COW fork extents when remounting readonly 6b734f7b7071 xfs: check sb_meta_uuid for dabuf buffer recovery Total patches: 11 - 3 - 3 = 5 Amir Goldstein (1): MAINTAINERS: add Amir as xfs maintainer for 5.10.y Christoph Hellwig (1): drm: remove drm_fb_helper_modinit Masahiro Yamada (1): tick/nohz: unexport __init-annotated tick_nohz_full_setup() Naveen N. Rao (1): powerpc/ftrace: Remove ftrace init tramp once kernel init is complete Vladimir Oltean (1): net: mscc: ocelot: allow unregistered IP multicast flooding MAINTAINERS | 3 ++- arch/powerpc/include/asm/ftrace.h | 4 +++- arch/powerpc/kernel/trace/ftrace.c | 15 ++++++++++--- arch/powerpc/mm/mem.c | 2 ++ drivers/gpu/drm/drm_crtc_helper_internal.h | 10 --------- drivers/gpu/drm/drm_fb_helper.c | 21 ------------------ drivers/gpu/drm/drm_kms_helper_common.c | 25 +++++++++++----------- drivers/net/ethernet/mscc/ocelot.c | 8 +++++-- kernel/time/tick-sched.c | 1 - 9 files changed, 37 insertions(+), 52 deletions(-) -- 2.20.1

1 5

[PATCH openEuler-1.0-LTS 1/2] ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate
by Yongqiang Liu 01 Nov '22

01 Nov '22

From: Zhang Yi <yi.zhang(a)huawei.com> mainline inclusion from mainline-v6.1-rc1 commit 0b73284c564d3ae4feef4bc920292f004acf4980 category: bugfix bugzilla: 187414, https://gitee.com/openeuler/kernel/issues/I5XZ6O CVE: NA -------------------------------- Recently we notice that ext4 filesystem would occasionally fail to read metadata from disk and report error message, but the disk and block layer looks fine. After analyse, we lockon commit 88dbcbb3a484 ("blkdev: avoid migration stalls for blkdev pages"). It provide a migration method for the bdev, we could move page that has buffers without extra users now, but it lock the buffers on the page, which breaks the fragile metadata read operation on ext4 filesystem, ext4_read_bh_lock() was copied from ll_rw_block(), it depends on the assumption of that locked buffer means it is under IO. So it just trylock the buffer and skip submit IO if it lock failed, after wait_on_buffer() we conclude IO error because the buffer is not uptodate. This issue could be easily reproduced by add some delay just after buffer_migrate_lock_buffers() in __buffer_migrate_folio() and do fsstress on ext4 filesystem. EXT4-fs error (device pmem1): __ext4_find_entry:1658: inode #73193: comm fsstress: reading directory lblock 0 EXT4-fs error (device pmem1): __ext4_find_entry:1658: inode #75334: comm fsstress: reading directory lblock 0 Fix it by removing the trylock logic in ext4_read_bh_lock(), just lock the buffer and submit IO if it's not uptodate, and also leave over readahead helper. Cc: stable(a)kernel.org Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20220831074629.3755110-1-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflict: fs/ext4/super.c Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/super.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index e4abf3de254f..37a2e66b77a7 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -195,19 +195,12 @@ int ext4_read_bh(struct buffer_head *bh, int op_flags, bh_end_io_t *end_io) int ext4_read_bh_lock(struct buffer_head *bh, int op_flags, bool wait) { - if (trylock_buffer(bh)) { - if (wait) - return ext4_read_bh(bh, op_flags, NULL); + lock_buffer(bh); + if (!wait) { ext4_read_bh_nowait(bh, op_flags, NULL); return 0; } - if (wait) { - wait_on_buffer(bh); - if (buffer_uptodate(bh)) - return 0; - return -EIO; - } - return 0; + return ext4_read_bh(bh, op_flags, NULL); } /* @@ -254,7 +247,8 @@ void ext4_sb_breadahead_unmovable(struct super_block *sb, sector_t block) struct buffer_head *bh = sb_getblk_gfp(sb, block, 0); if (likely(bh)) { - ext4_read_bh_lock(bh, REQ_RAHEAD, false); + if (trylock_buffer(bh)) + ext4_read_bh_nowait(bh, REQ_RAHEAD, NULL); brelse(bh); } } -- 2.25.1

1 1

openEuler Kernel SIG双周例会
by openEuler conference 01 Nov '22

01 Nov '22

您好！ Kernel SIG 邀请您参加 2022-11-04 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1.进展update 2.议题征集中欢迎大家积极申报议题~（新增议题可以回复邮件反馈，或者录入会议看板）会议链接：https://us06web.zoom.us/j/87646118604?pwd=Q3doR3VOQW4zRm51QjZHZzBJcldYUT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-11-04 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1.进展update 2.议题征集中欢迎大家积极申报议题~（新增议题可以回复邮件反馈，或者录入会议看板） You can join the meeting at https://us06web.zoom.us/j/87646118604?pwd=Q3doR3VOQW4zRm51QjZHZzBJcldYUT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] scsi: stex: Properly zero out the passthrough command structure
by Yongqiang Liu 31 Oct '22

31 Oct '22

From: Linus Torvalds <torvalds(a)linux-foundation.org> stable inclusion from stable-v4.19.262 commit a99c5e38dc6c3dc3da28489b78db09a4b9ffc8c3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5ROPX CVE: CVE-2022-40768 ------------------------------- commit 6022f210461fef67e6e676fd8544ca02d1bcfa7a upstream. The passthrough structure is declared off of the stack, so it needs to be set to zero before copied back to userspace to prevent any unintentional data leakage. Switch things to be statically allocated which will fill the unused fields with 0 automatically. Link: https://lore.kernel.org/r/YxrjN3OOw2HHl9tx@kroah.com Cc: stable(a)kernel.org Cc: "James E.J. Bottomley" <jejb(a)linux.ibm.com> Cc: "Martin K. Petersen" <martin.petersen(a)oracle.com> Cc: Dan Carpenter <dan.carpenter(a)oracle.com> Reported-by: hdthky <hdthky0(a)gmail.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> Reviewed-by: GONG Ruiqi <gongruiqi1(a)huawei.com> Reviewed-by: Cai Xinchen <caixinchen1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/scsi/stex.c | 17 +++++++++-------- include/scsi/scsi_cmnd.h | 2 +- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/drivers/scsi/stex.c b/drivers/scsi/stex.c index 9b20643ab49d..124a5d0ec05c 100644 --- a/drivers/scsi/stex.c +++ b/drivers/scsi/stex.c @@ -673,16 +673,17 @@ stex_queuecommand_lck(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *)) return 0; case PASSTHRU_CMD: if (cmd->cmnd[1] == PASSTHRU_GET_DRVVER) { - struct st_drvver ver; + const struct st_drvver ver = { + .major = ST_VER_MAJOR, + .minor = ST_VER_MINOR, + .oem = ST_OEM, + .build = ST_BUILD_VER, + .signature[0] = PASSTHRU_SIGNATURE, + .console_id = host->max_id - 1, + .host_no = hba->host->host_no, + }; size_t cp_len = sizeof(ver); - ver.major = ST_VER_MAJOR; - ver.minor = ST_VER_MINOR; - ver.oem = ST_OEM; - ver.build = ST_BUILD_VER; - ver.signature[0] = PASSTHRU_SIGNATURE; - ver.console_id = host->max_id - 1; - ver.host_no = hba->host->host_no; cp_len = scsi_sg_copy_from_buffer(cmd, &ver, cp_len); cmd->result = sizeof(ver) == cp_len ? DID_OK << 16 | COMMAND_COMPLETE << 8 : diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h index 4c47157c01cc..d5ead17c9252 100644 --- a/include/scsi/scsi_cmnd.h +++ b/include/scsi/scsi_cmnd.h @@ -233,7 +233,7 @@ static inline struct scsi_data_buffer *scsi_out(struct scsi_cmnd *cmd) } static inline int scsi_sg_copy_from_buffer(struct scsi_cmnd *cmd, - void *buf, int buflen) + const void *buf, int buflen) { return sg_copy_from_buffer(scsi_sglist(cmd), scsi_sg_count(cmd), buf, buflen); -- 2.25.1

1 0

[Cancel] openEuler Kernel SIG双周例会
by openEuler conference 31 Oct '22

31 Oct '22

Sorry! The Zoom meeting will be held at 2022-11-04 14:00 scheduled by openEuler Kernel SIG has been cancelled.

1 0

openEuler Kernel SIG双周例会
by openEuler conference 31 Oct '22

31 Oct '22

您好！ Kernel SIG 邀请您参加 2022-11-04 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中欢迎大家积极申报议题~ 会议链接：https://us06web.zoom.us/j/88363936462?pwd=MEpPRWZKWFd2ejFWalNQQythd1JSdz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-11-04 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中欢迎大家积极申报议题~ You can join the meeting at https://us06web.zoom.us/j/88363936462?pwd=MEpPRWZKWFd2ejFWalNQQythd1JSdz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] nilfs2: fix leak of nilfs_root in case of writer thread creation failure
by Yongqiang Liu 29 Oct '22

29 Oct '22

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.1-rc1 commit d0d51a97063db4704a5ef6bc978dddab1636a306 category: bugfix bugzilla: 187884, https://gitee.com/src-openeuler/kernel/issues/I5X2OB CVE: CVE-2022-3646 -------------------------------- If nilfs_attach_log_writer() failed to create a log writer thread, it frees a data structure of the log writer without any cleanup. After commit e912a5b66837 ("nilfs2: use root object to get ifile"), this causes a leak of struct nilfs_root, which started to leak an ifile metadata inode and a kobject on that struct. In addition, if the kernel is booted with panic_on_warn, the above ifile metadata inode leak will cause the following panic when the nilfs2 kernel module is removed: kmem_cache_destroy nilfs2_inode_cache: Slab cache still has objects when called from nilfs_destroy_cachep+0x16/0x3a [nilfs2] WARNING: CPU: 8 PID: 1464 at mm/slab_common.c:494 kmem_cache_destroy+0x138/0x140 ... RIP: 0010:kmem_cache_destroy+0x138/0x140 Code: 00 20 00 00 e8 a9 55 d8 ff e9 76 ff ff ff 48 8b 53 60 48 c7 c6 20 70 65 86 48 c7 c7 d8 69 9c 86 48 8b 4c 24 28 e8 ef 71 c7 00 <0f> 0b e9 53 ff ff ff c3 48 81 ff ff 0f 00 00 77 03 31 c0 c3 53 48 ... Call Trace: <TASK> ? nilfs_palloc_freev.cold.24+0x58/0x58 [nilfs2] nilfs_destroy_cachep+0x16/0x3a [nilfs2] exit_nilfs_fs+0xa/0x1b [nilfs2] __x64_sys_delete_module+0x1d9/0x3a0 ? __sanitizer_cov_trace_pc+0x1a/0x50 ? syscall_trace_enter.isra.19+0x119/0x190 do_syscall_64+0x34/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd ... </TASK> Kernel panic - not syncing: panic_on_warn set ... This patch fixes these issues by calling nilfs_detach_log_writer() cleanup function if spawning the log writer thread fails. Link: https://lkml.kernel.org/r/20221007085226.57667-1-konishi.ryusuke@gmail.com Fixes: e912a5b66837 ("nilfs2: use root object to get ifile") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+7381dc4ad60658ca4c05(a)syzkaller.appspotmail.com Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflict: fs/nilfs2/segment.c Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/nilfs2/segment.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c index 445eef41bfaf..2104be29417b 100644 --- a/fs/nilfs2/segment.c +++ b/fs/nilfs2/segment.c @@ -2781,10 +2781,9 @@ int nilfs_attach_log_writer(struct super_block *sb, struct nilfs_root *root) return -ENOMEM; err = nilfs_segctor_start_thread(nilfs->ns_writer); - if (err) { - kfree(nilfs->ns_writer); - nilfs->ns_writer = NULL; - } + if (unlikely(err)) + nilfs_detach_log_writer(sb); + return err; } -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] vsock: Fix memory leak in vsock_connect()
by Yongqiang Liu 29 Oct '22

29 Oct '22

From: Peilin Ye <peilin.ye(a)bytedance.com> stable inclusion from stable-v4.19.256 commit 2fc2a7767f661e6083f69588718cdf6f07cb9330 category: bugfix bugzilla: 187891, https://gitee.com/src-openeuler/kernel/issues/I5WYLL CVE: CVE-2022-3629 -------------------------------- commit 7e97cfed9929eaabc41829c395eb0d1350fccb9d upstream. An O_NONBLOCK vsock_connect() request may try to reschedule @connect_work. Imagine the following sequence of vsock_connect() requests: 1. The 1st, non-blocking request schedules @connect_work, which will expire after 200 jiffies. Socket state is now SS_CONNECTING; 2. Later, the 2nd, blocking request gets interrupted by a signal after a few jiffies while waiting for the connection to be established. Socket state is back to SS_UNCONNECTED, but @connect_work is still pending, and will expire after 100 jiffies. 3. Now, the 3rd, non-blocking request tries to schedule @connect_work again. Since @connect_work is already scheduled, schedule_delayed_work() silently returns. sock_hold() is called twice, but sock_put() will only be called once in vsock_connect_timeout(), causing a memory leak reported by syzbot: BUG: memory leak unreferenced object 0xffff88810ea56a40 (size 1232): comm "syz-executor756", pid 3604, jiffies 4294947681 (age 12.350s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 28 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 (..@............ backtrace: [<ffffffff837c830e>] sk_prot_alloc+0x3e/0x1b0 net/core/sock.c:1930 [<ffffffff837cbe22>] sk_alloc+0x32/0x2e0 net/core/sock.c:1989 [<ffffffff842ccf68>] __vsock_create.constprop.0+0x38/0x320 net/vmw_vsock/af_vsock.c:734 [<ffffffff842ce8f1>] vsock_create+0xc1/0x2d0 net/vmw_vsock/af_vsock.c:2203 [<ffffffff837c0cbb>] __sock_create+0x1ab/0x2b0 net/socket.c:1468 [<ffffffff837c3acf>] sock_create net/socket.c:1519 [inline] [<ffffffff837c3acf>] __sys_socket+0x6f/0x140 net/socket.c:1561 [<ffffffff837c3bba>] __do_sys_socket net/socket.c:1570 [inline] [<ffffffff837c3bba>] __se_sys_socket net/socket.c:1568 [inline] [<ffffffff837c3bba>] __x64_sys_socket+0x1a/0x20 net/socket.c:1568 [<ffffffff84512815>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff84512815>] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80 [<ffffffff84600068>] entry_SYSCALL_64_after_hwframe+0x44/0xae <...> Use mod_delayed_work() instead: if @connect_work is already scheduled, reschedule it, and undo sock_hold() to keep the reference count balanced. Reported-and-tested-by: syzbot+b03f55bf128f9a38f064(a)syzkaller.appspotmail.com Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Co-developed-by: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: Stefano Garzarella <sgarzare(a)redhat.com> Reviewed-by: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: Peilin Ye <peilin.ye(a)bytedance.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/vmw_vsock/af_vsock.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index 4f9a0635d723..ed715ccca9a9 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -1213,7 +1213,14 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr, * timeout fires. */ sock_hold(sk); - schedule_delayed_work(&vsk->connect_work, timeout); + + /* If the timeout function is already scheduled, + * reschedule it, then ungrab the socket refcount to + * keep it balanced. + */ + if (mod_delayed_work(system_wq, &vsk->connect_work, + timeout)) + sock_put(sk); /* Skip ahead to preserve error code set above. */ goto out_wait; -- 2.25.1

1 0