- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] arm64/mpam: modify mpam irq register error log
by Tiancheng Lu 11 May '23

11 May '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I71UGQ CVE: NA Reference: N/A ---------------------------------------------------------------- MPAM interrupts are used to report error information and are non-functional interrupts. The current interrupt number is set to the default value 0. As a result, the device startup log contains the error indicating that the MPAM interrupt registration fails, which is sensitive. Therefore, the log level is changed to alarm. Signed-off-by: Tiancheng Lu <lutiancheng5(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index 2aa9a3ab59f2..50bdc56ca005 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -499,7 +499,7 @@ static void mpam_enable_irqs(void) rc = request_irq(irq, mpam_handle_error_irq, request_flags, "MPAM ERR IRQ", dev); if (rc) { - pr_err_ratelimited("Failed to register irq %u\n", irq); + pr_warn_ratelimited("Not support to register irq %u\n", irq); continue; } -- 2.17.1

1 0

[PATCH openEuler-1.0-LTS] arm64/mpam: modify mpam irq register error log
by Tiancheng Lu 11 May '23

11 May '23

From: l00797255 <l00797255(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I71UGQ CVE: NA Reference: N/A ---------------------------------------------------------------- MPAM interrupts are used to report error information and are non-functional interrupts. The current interrupt number is set to the default value 0. As a result, the device startup log contains the error indicating that the MPAM interrupt registration fails, which is sensitive. Therefore, the log level is changed to alarm. Signed-off-by: Tiancheng Lu <lutiancheng5(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index 6455c69f132f..adf4bc034a51 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -499,7 +499,7 @@ static void mpam_enable_irqs(void) rc = request_irq(irq, mpam_handle_error_irq, request_flags, "MPAM ERR IRQ", dev); if (rc) { - pr_err_ratelimited("Failed to register irq %u\n", irq); + pr_warn_ratelimited("Not support to register irq %u\n", irq); continue; } -- 2.17.1

1 0

[PATCH openEuler-1.0-LTS] mm: memcontrol: switch to rcu protection in drain_all_stock()
by Yongqiang Liu 10 May '23

10 May '23

From: Roman Gushchin <guro(a)fb.com> mainline inclusion from mainline-v5.4-rc1 commit e1a366be5cb4f849ec4de170d50eebc08bb0af20 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I70T8Z CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit 72f0184c8a00 ("mm, memcg: remove hotplug locking from try_charge") introduced css_tryget()/css_put() calls in drain_all_stock(), which are supposed to protect the target memory cgroup from being released during the mem_cgroup_is_descendant() call. However, it's not completely safe. In theory, memcg can go away between reading stock->cached pointer and calling css_tryget(). This can happen if drain_all_stock() races with drain_local_stock() performed on the remote cpu as a result of a work, scheduled by the previous invocation of drain_all_stock(). The race is a bit theoretical and there are few chances to trigger it, but the current code looks a bit confusing, so it makes sense to fix it anyway. The code looks like as if css_tryget() and css_put() are used to protect stocks drainage. It's not necessary because stocked pages are holding references to the cached cgroup. And it obviously won't work for works, scheduled on other cpus. So, let's read the stock->cached pointer and evaluate the memory cgroup inside a rcu read section, and get rid of css_tryget()/css_put() calls. Link: http://lkml.kernel.org/r/20190802192241.3253165-1-guro@fb.com Signed-off-by: Roman Gushchin <guro(a)fb.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Cc: Hillf Danton <hdanton(a)sina.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/memcontrol.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 8b073a584e9f..aff8c05b2c72 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -2225,21 +2225,22 @@ static void drain_all_stock(struct mem_cgroup *root_memcg) for_each_online_cpu(cpu) { struct memcg_stock_pcp *stock = &per_cpu(memcg_stock, cpu); struct mem_cgroup *memcg; + bool flush = false; + rcu_read_lock(); memcg = stock->cached; - if (!memcg || !stock->nr_pages || !css_tryget(&memcg->css)) - continue; - if (!mem_cgroup_is_descendant(memcg, root_memcg)) { - css_put(&memcg->css); - continue; - } - if (!test_and_set_bit(FLUSHING_CACHED_CHARGE, &stock->flags)) { + if (memcg && stock->nr_pages && + mem_cgroup_is_descendant(memcg, root_memcg)) + flush = true; + rcu_read_unlock(); + + if (flush && + !test_and_set_bit(FLUSHING_CACHED_CHARGE, &stock->flags)) { if (cpu == curcpu) drain_local_stock(&stock->work); else schedule_work_on(cpu, &stock->work); } - css_put(&memcg->css); } put_cpu(); mutex_unlock(&percpu_charge_mutex); -- 2.25.1

1 0

[PATCH openEuler-22.03-LTS-SP1] USB: gadgetfs: Fix race between mounting and unmounting
by Jialin Zhang 10 May '23

10 May '23

From: Alan Stern <stern(a)rowland.harvard.edu> mainline inclusion from mainline-v6.2-rc5 commit d18dcfe9860e842f394e37ba01ca9440ab2178f4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I66IZK CVE: CVE-2022-4382 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- The syzbot fuzzer and Gerald Lee have identified a use-after-free bug in the gadgetfs driver, involving processes concurrently mounting and unmounting the gadgetfs filesystem. In particular, gadgetfs_fill_super() can race with gadgetfs_kill_sb(), causing the latter to deallocate the_device while the former is using it. The output from KASAN says, in part: BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:102 [inline] BUG: KASAN: use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline] BUG: KASAN: use-after-free in __refcount_sub_and_test include/linux/refcount.h:272 [inline] BUG: KASAN: use-after-free in __refcount_dec_and_test include/linux/refcount.h:315 [inline] BUG: KASAN: use-after-free in refcount_dec_and_test include/linux/refcount.h:333 [inline] BUG: KASAN: use-after-free in put_dev drivers/usb/gadget/legacy/inode.c:159 [inline] BUG: KASAN: use-after-free in gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 Write of size 4 at addr ffff8880276d7840 by task syz-executor126/18689 CPU: 0 PID: 18689 Comm: syz-executor126 Not tainted 6.1.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> ... atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline] __refcount_sub_and_test include/linux/refcount.h:272 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] put_dev drivers/usb/gadget/legacy/inode.c:159 [inline] gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 deactivate_locked_super+0xa7/0xf0 fs/super.c:332 vfs_get_super fs/super.c:1190 [inline] get_tree_single+0xd0/0x160 fs/super.c:1207 vfs_get_tree+0x88/0x270 fs/super.c:1531 vfs_fsconfig_locked fs/fsopen.c:232 [inline] The simplest solution is to ensure that gadgetfs_fill_super() and gadgetfs_kill_sb() are serialized by making them both acquire a new mutex. Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Reported-and-tested-by: syzbot+33d7ad66d65044b93f16(a)syzkaller.appspotmail.com Reported-and-tested-by: Gerald Lee <sundaywind2004(a)gmail.com> Link: https://lore.kernel.org/linux-usb/CAO3qeMVzXDP-JU6v1u5Ags6Q-bb35kg3=C6d04Dj… Fixes: e5d82a7360d1 ("vfs: Convert gadgetfs to use the new mount API") CC: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/Y6XCPXBpn3tmjdCC@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Reviewed-by: tong tiangen <tongtiangen(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/usb/gadget/legacy/inode.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c index cd097474b6c3..cbe801640916 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -229,6 +229,7 @@ static void put_ep (struct ep_data *data) */ static const char *CHIP; +static DEFINE_MUTEX(sb_mutex); /* Serialize superblock operations */ /*----------------------------------------------------------------------*/ @@ -2012,13 +2013,20 @@ gadgetfs_fill_super (struct super_block *sb, struct fs_context *fc) { struct inode *inode; struct dev_data *dev; + int rc; - if (the_device) - return -ESRCH; + mutex_lock(&sb_mutex); + + if (the_device) { + rc = -ESRCH; + goto Done; + } CHIP = usb_get_gadget_udc_name(); - if (!CHIP) - return -ENODEV; + if (!CHIP) { + rc = -ENODEV; + goto Done; + } /* superblock */ sb->s_blocksize = PAGE_SIZE; @@ -2055,13 +2063,17 @@ gadgetfs_fill_super (struct super_block *sb, struct fs_context *fc) * from binding to a controller. */ the_device = dev; - return 0; + rc = 0; + goto Done; -Enomem: + Enomem: kfree(CHIP); CHIP = NULL; + rc = -ENOMEM; - return -ENOMEM; + Done: + mutex_unlock(&sb_mutex); + return rc; } /* "mount -t gadgetfs path /dev/gadget" ends up here */ @@ -2083,6 +2095,7 @@ static int gadgetfs_init_fs_context(struct fs_context *fc) static void gadgetfs_kill_sb (struct super_block *sb) { + mutex_lock(&sb_mutex); kill_litter_super (sb); if (the_device) { put_dev (the_device); @@ -2090,6 +2103,7 @@ gadgetfs_kill_sb (struct super_block *sb) } kfree(CHIP); CHIP = NULL; + mutex_unlock(&sb_mutex); } /*----------------------------------------------------------------------*/ -- 2.25.1

1 0

[PATCH openEuler-22.03-LTS] USB: gadgetfs: Fix race between mounting and unmounting
by Jialin Zhang 10 May '23

10 May '23

From: Alan Stern <stern(a)rowland.harvard.edu> mainline inclusion from mainline-v6.2-rc5 commit d18dcfe9860e842f394e37ba01ca9440ab2178f4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I66IZK CVE: CVE-2022-4382 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- The syzbot fuzzer and Gerald Lee have identified a use-after-free bug in the gadgetfs driver, involving processes concurrently mounting and unmounting the gadgetfs filesystem. In particular, gadgetfs_fill_super() can race with gadgetfs_kill_sb(), causing the latter to deallocate the_device while the former is using it. The output from KASAN says, in part: BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:102 [inline] BUG: KASAN: use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline] BUG: KASAN: use-after-free in __refcount_sub_and_test include/linux/refcount.h:272 [inline] BUG: KASAN: use-after-free in __refcount_dec_and_test include/linux/refcount.h:315 [inline] BUG: KASAN: use-after-free in refcount_dec_and_test include/linux/refcount.h:333 [inline] BUG: KASAN: use-after-free in put_dev drivers/usb/gadget/legacy/inode.c:159 [inline] BUG: KASAN: use-after-free in gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 Write of size 4 at addr ffff8880276d7840 by task syz-executor126/18689 CPU: 0 PID: 18689 Comm: syz-executor126 Not tainted 6.1.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> ... atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline] __refcount_sub_and_test include/linux/refcount.h:272 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] put_dev drivers/usb/gadget/legacy/inode.c:159 [inline] gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 deactivate_locked_super+0xa7/0xf0 fs/super.c:332 vfs_get_super fs/super.c:1190 [inline] get_tree_single+0xd0/0x160 fs/super.c:1207 vfs_get_tree+0x88/0x270 fs/super.c:1531 vfs_fsconfig_locked fs/fsopen.c:232 [inline] The simplest solution is to ensure that gadgetfs_fill_super() and gadgetfs_kill_sb() are serialized by making them both acquire a new mutex. Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Reported-and-tested-by: syzbot+33d7ad66d65044b93f16(a)syzkaller.appspotmail.com Reported-and-tested-by: Gerald Lee <sundaywind2004(a)gmail.com> Link: https://lore.kernel.org/linux-usb/CAO3qeMVzXDP-JU6v1u5Ags6Q-bb35kg3=C6d04Dj… Fixes: e5d82a7360d1 ("vfs: Convert gadgetfs to use the new mount API") CC: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/Y6XCPXBpn3tmjdCC@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Reviewed-by: tong tiangen <tongtiangen(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/usb/gadget/legacy/inode.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c index cd097474b6c3..cbe801640916 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -229,6 +229,7 @@ static void put_ep (struct ep_data *data) */ static const char *CHIP; +static DEFINE_MUTEX(sb_mutex); /* Serialize superblock operations */ /*----------------------------------------------------------------------*/ @@ -2012,13 +2013,20 @@ gadgetfs_fill_super (struct super_block *sb, struct fs_context *fc) { struct inode *inode; struct dev_data *dev; + int rc; - if (the_device) - return -ESRCH; + mutex_lock(&sb_mutex); + + if (the_device) { + rc = -ESRCH; + goto Done; + } CHIP = usb_get_gadget_udc_name(); - if (!CHIP) - return -ENODEV; + if (!CHIP) { + rc = -ENODEV; + goto Done; + } /* superblock */ sb->s_blocksize = PAGE_SIZE; @@ -2055,13 +2063,17 @@ gadgetfs_fill_super (struct super_block *sb, struct fs_context *fc) * from binding to a controller. */ the_device = dev; - return 0; + rc = 0; + goto Done; -Enomem: + Enomem: kfree(CHIP); CHIP = NULL; + rc = -ENOMEM; - return -ENOMEM; + Done: + mutex_unlock(&sb_mutex); + return rc; } /* "mount -t gadgetfs path /dev/gadget" ends up here */ @@ -2083,6 +2095,7 @@ static int gadgetfs_init_fs_context(struct fs_context *fc) static void gadgetfs_kill_sb (struct super_block *sb) { + mutex_lock(&sb_mutex); kill_litter_super (sb); if (the_device) { put_dev (the_device); @@ -2090,6 +2103,7 @@ gadgetfs_kill_sb (struct super_block *sb) } kfree(CHIP); CHIP = NULL; + mutex_unlock(&sb_mutex); } /*----------------------------------------------------------------------*/ -- 2.25.1

1 0

[PATCH openEuler-22.03-LTS 00/18] Backport CVEs and bugfixes
by Jialin Zhang 09 May '23

09 May '23

Pull new CVEs: CVE-2023-0458 CVE-2023-2269 CVE-2023-2483 CVE-2023-31436 CVE-2023-2194 CVE-2023-2166 CVE-2023-2176 CVE-2023-2007 fs bugfixes from Baokun Li bpf bugfixes from Liu Jian Arnd Bergmann (1): scsi: dpt_i2o: Remove obsolete driver Baokun Li (3): writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs ext4: only update i_reserved_data_blocks on successful block allocation ext4: check iomap type only if ext4_iomap_begin() does not fail Gwangun Jung (1): net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg Jason Gunthorpe (1): RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests John Fastabend (5): bpf, sockmap: Fix race in ingress receive verdict with redirect to self bpf, sockmap: Fix return codes from tcp_bpf_recvmsg_parser() bpf, sockmap: Attach map progs to psock early for feature probes bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap bpf, sockmap: Fix double bpf_prog_put on error case in map_link Liu Jian (1): bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() Mike Snitzer (1): dm ioctl: fix nested locking in table_clear() to remove deadlock concern Oliver Hartkopp (1): can: af_can: fix NULL pointer dereference in can_rcv_filter Patrisious Haddad (1): RDMA/core: Refactor rdma_bind_addr Wei Chen (1): i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() Xia Fukun (1): prlimit: do_prlimit needs to have a speculation check Zheng Wang (1): net: qcom/emac: Fix use after free bug in emac_remove due to race condition .../userspace-api/ioctl/ioctl-number.rst | 2 +- MAINTAINERS | 8 - drivers/i2c/busses/i2c-xgene-slimpro.c | 3 + drivers/infiniband/core/cma.c | 246 +- drivers/infiniband/core/cma_priv.h | 1 + drivers/md/dm-ioctl.c | 7 +- drivers/net/ethernet/qualcomm/emac/emac.c | 6 + drivers/scsi/Kconfig | 11 - drivers/scsi/Makefile | 1 - drivers/scsi/dpt/dpti_i2o.h | 441 -- drivers/scsi/dpt/dpti_ioctl.h | 136 - drivers/scsi/dpt/dptsig.h | 336 -- drivers/scsi/dpt/osd_defs.h | 79 - drivers/scsi/dpt/osd_util.h | 358 -- drivers/scsi/dpt/sys_info.h | 417 -- drivers/scsi/dpt_i2o.c | 3549 ----------------- drivers/scsi/dpti.h | 331 -- fs/ext4/indirect.c | 8 + fs/ext4/inode.c | 12 +- fs/fs-writeback.c | 17 +- kernel/sys.c | 2 + mm/backing-dev.c | 12 +- net/can/af_can.c | 4 +- net/core/skmsg.c | 4 + net/core/sock_map.c | 34 +- net/ipv4/tcp_bpf.c | 77 + net/sched/sch_qfq.c | 13 +- 27 files changed, 296 insertions(+), 5819 deletions(-) delete mode 100644 drivers/scsi/dpt/dpti_i2o.h delete mode 100644 drivers/scsi/dpt/dpti_ioctl.h delete mode 100644 drivers/scsi/dpt/dptsig.h delete mode 100644 drivers/scsi/dpt/osd_defs.h delete mode 100644 drivers/scsi/dpt/osd_util.h delete mode 100644 drivers/scsi/dpt/sys_info.h delete mode 100644 drivers/scsi/dpt_i2o.c delete mode 100644 drivers/scsi/dpti.h -- 2.25.1

2 19

[PATCH openEuler-22.03-LTS 00/18] Backport CVEs and bugfixes
by Jialin Zhang 09 May '23

09 May '23

Pull new CVEs: CVE-2023-0458 CVE-2023-2269 CVE-2023-2483 CVE-2023-31436 CVE-2023-2194 CVE-2023-2166 CVE-2023-2176 CVE-2023-2007 fs bugfixes from Baokun Li bpf bugfixes from Liu Jian Arnd Bergmann (1): scsi: dpt_i2o: Remove obsolete driver Baokun Li (3): writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs ext4: only update i_reserved_data_blocks on successful block allocation ext4: check iomap type only if ext4_iomap_begin() does not fail Gwangun Jung (1): net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg Jason Gunthorpe (1): RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests John Fastabend (5): bpf, sockmap: Fix race in ingress receive verdict with redirect to self bpf, sockmap: Fix return codes from tcp_bpf_recvmsg_parser() bpf, sockmap: Attach map progs to psock early for feature probes bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap bpf, sockmap: Fix double bpf_prog_put on error case in map_link Liu Jian (1): bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() Mike Snitzer (1): dm ioctl: fix nested locking in table_clear() to remove deadlock concern Oliver Hartkopp (1): can: af_can: fix NULL pointer dereference in can_rcv_filter Patrisious Haddad (1): RDMA/core: Refactor rdma_bind_addr Wei Chen (1): i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() Xia Fukun (1): prlimit: do_prlimit needs to have a speculation check Zheng Wang (1): net: qcom/emac: Fix use after free bug in emac_remove due to race condition .../userspace-api/ioctl/ioctl-number.rst | 2 +- MAINTAINERS | 8 - drivers/i2c/busses/i2c-xgene-slimpro.c | 3 + drivers/infiniband/core/cma.c | 246 +- drivers/infiniband/core/cma_priv.h | 1 + drivers/md/dm-ioctl.c | 7 +- drivers/net/ethernet/qualcomm/emac/emac.c | 6 + drivers/scsi/Kconfig | 11 - drivers/scsi/Makefile | 1 - drivers/scsi/dpt/dpti_i2o.h | 441 -- drivers/scsi/dpt/dpti_ioctl.h | 136 - drivers/scsi/dpt/dptsig.h | 336 -- drivers/scsi/dpt/osd_defs.h | 79 - drivers/scsi/dpt/osd_util.h | 358 -- drivers/scsi/dpt/sys_info.h | 417 -- drivers/scsi/dpt_i2o.c | 3549 ----------------- drivers/scsi/dpti.h | 331 -- fs/ext4/indirect.c | 8 + fs/ext4/inode.c | 12 +- fs/fs-writeback.c | 17 +- kernel/sys.c | 2 + mm/backing-dev.c | 12 +- net/can/af_can.c | 4 +- net/core/skmsg.c | 4 + net/core/sock_map.c | 34 +- net/ipv4/tcp_bpf.c | 77 + net/sched/sch_qfq.c | 13 +- 27 files changed, 296 insertions(+), 5819 deletions(-) delete mode 100644 drivers/scsi/dpt/dpti_i2o.h delete mode 100644 drivers/scsi/dpt/dpti_ioctl.h delete mode 100644 drivers/scsi/dpt/dptsig.h delete mode 100644 drivers/scsi/dpt/osd_defs.h delete mode 100644 drivers/scsi/dpt/osd_util.h delete mode 100644 drivers/scsi/dpt/sys_info.h delete mode 100644 drivers/scsi/dpt_i2o.c delete mode 100644 drivers/scsi/dpti.h -- 2.25.1

2 19

[PATCH openEuler-22.03-LTS-SP1 00/18] Backport CVEs and bugfixes
by Jialin Zhang 09 May '23

09 May '23

Pull new CVEs: CVE-2023-0458 CVE-2023-2269 CVE-2023-2483 CVE-2023-31436 CVE-2023-2194 CVE-2023-2166 CVE-2023-2176 CVE-2023-2007 fs bugfixes from Baokun Li bpf bugfixes from Liu Jian Arnd Bergmann (1): scsi: dpt_i2o: Remove obsolete driver Baokun Li (3): writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs ext4: only update i_reserved_data_blocks on successful block allocation ext4: check iomap type only if ext4_iomap_begin() does not fail Gwangun Jung (1): net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg Jason Gunthorpe (1): RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests John Fastabend (5): bpf, sockmap: Fix race in ingress receive verdict with redirect to self bpf, sockmap: Fix return codes from tcp_bpf_recvmsg_parser() bpf, sockmap: Attach map progs to psock early for feature probes bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap bpf, sockmap: Fix double bpf_prog_put on error case in map_link Liu Jian (1): bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() Mike Snitzer (1): dm ioctl: fix nested locking in table_clear() to remove deadlock concern Oliver Hartkopp (1): can: af_can: fix NULL pointer dereference in can_rcv_filter Patrisious Haddad (1): RDMA/core: Refactor rdma_bind_addr Wei Chen (1): i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() Xia Fukun (1): prlimit: do_prlimit needs to have a speculation check Zheng Wang (1): net: qcom/emac: Fix use after free bug in emac_remove due to race condition .../userspace-api/ioctl/ioctl-number.rst | 2 +- MAINTAINERS | 8 - drivers/i2c/busses/i2c-xgene-slimpro.c | 3 + drivers/infiniband/core/cma.c | 246 +- drivers/infiniband/core/cma_priv.h | 1 + drivers/md/dm-ioctl.c | 7 +- drivers/net/ethernet/qualcomm/emac/emac.c | 6 + drivers/scsi/Kconfig | 11 - drivers/scsi/Makefile | 1 - drivers/scsi/dpt/dpti_i2o.h | 441 -- drivers/scsi/dpt/dpti_ioctl.h | 136 - drivers/scsi/dpt/dptsig.h | 336 -- drivers/scsi/dpt/osd_defs.h | 79 - drivers/scsi/dpt/osd_util.h | 358 -- drivers/scsi/dpt/sys_info.h | 417 -- drivers/scsi/dpt_i2o.c | 3549 ----------------- drivers/scsi/dpti.h | 331 -- fs/ext4/indirect.c | 8 + fs/ext4/inode.c | 12 +- fs/fs-writeback.c | 17 +- kernel/sys.c | 2 + mm/backing-dev.c | 12 +- net/can/af_can.c | 4 +- net/core/skmsg.c | 4 + net/core/sock_map.c | 34 +- net/ipv4/tcp_bpf.c | 77 + net/sched/sch_qfq.c | 13 +- 27 files changed, 296 insertions(+), 5819 deletions(-) delete mode 100644 drivers/scsi/dpt/dpti_i2o.h delete mode 100644 drivers/scsi/dpt/dpti_ioctl.h delete mode 100644 drivers/scsi/dpt/dptsig.h delete mode 100644 drivers/scsi/dpt/osd_defs.h delete mode 100644 drivers/scsi/dpt/osd_util.h delete mode 100644 drivers/scsi/dpt/sys_info.h delete mode 100644 drivers/scsi/dpt_i2o.c delete mode 100644 drivers/scsi/dpti.h -- 2.25.1

2 19

[PATCH OLK-5.10 00/18] Backport CVEs and bugfixes
by Jialin Zhang 09 May '23

09 May '23

Pull new CVEs: CVE-2023-0458 CVE-2023-2269 CVE-2023-2483 CVE-2023-31436 CVE-2023-2194 CVE-2023-2166 CVE-2023-2176 CVE-2023-2007 fs bugfixes from Baokun Li bpf bugfixes from Liu Jian Arnd Bergmann (1): scsi: dpt_i2o: Remove obsolete driver Baokun Li (3): writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs ext4: only update i_reserved_data_blocks on successful block allocation ext4: check iomap type only if ext4_iomap_begin() does not fail Gwangun Jung (1): net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg Jason Gunthorpe (1): RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests John Fastabend (5): bpf, sockmap: Fix race in ingress receive verdict with redirect to self bpf, sockmap: Fix return codes from tcp_bpf_recvmsg_parser() bpf, sockmap: Attach map progs to psock early for feature probes bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap bpf, sockmap: Fix double bpf_prog_put on error case in map_link Liu Jian (1): bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() Mike Snitzer (1): dm ioctl: fix nested locking in table_clear() to remove deadlock concern Oliver Hartkopp (1): can: af_can: fix NULL pointer dereference in can_rcv_filter Patrisious Haddad (1): RDMA/core: Refactor rdma_bind_addr Wei Chen (1): i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() Xia Fukun (1): prlimit: do_prlimit needs to have a speculation check Zheng Wang (1): net: qcom/emac: Fix use after free bug in emac_remove due to race condition .../userspace-api/ioctl/ioctl-number.rst | 2 +- MAINTAINERS | 8 - drivers/i2c/busses/i2c-xgene-slimpro.c | 3 + drivers/infiniband/core/cma.c | 246 +- drivers/infiniband/core/cma_priv.h | 1 + drivers/md/dm-ioctl.c | 7 +- drivers/net/ethernet/qualcomm/emac/emac.c | 6 + drivers/scsi/Kconfig | 11 - drivers/scsi/Makefile | 1 - drivers/scsi/dpt/dpti_i2o.h | 441 -- drivers/scsi/dpt/dpti_ioctl.h | 136 - drivers/scsi/dpt/dptsig.h | 336 -- drivers/scsi/dpt/osd_defs.h | 79 - drivers/scsi/dpt/osd_util.h | 358 -- drivers/scsi/dpt/sys_info.h | 417 -- drivers/scsi/dpt_i2o.c | 3549 ----------------- drivers/scsi/dpti.h | 331 -- fs/ext4/indirect.c | 8 + fs/ext4/inode.c | 12 +- fs/fs-writeback.c | 17 +- kernel/sys.c | 2 + mm/backing-dev.c | 12 +- net/can/af_can.c | 4 +- net/core/skmsg.c | 4 + net/core/sock_map.c | 34 +- net/ipv4/tcp_bpf.c | 77 + net/sched/sch_qfq.c | 13 +- 27 files changed, 296 insertions(+), 5819 deletions(-) delete mode 100644 drivers/scsi/dpt/dpti_i2o.h delete mode 100644 drivers/scsi/dpt/dpti_ioctl.h delete mode 100644 drivers/scsi/dpt/dptsig.h delete mode 100644 drivers/scsi/dpt/osd_defs.h delete mode 100644 drivers/scsi/dpt/osd_util.h delete mode 100644 drivers/scsi/dpt/sys_info.h delete mode 100644 drivers/scsi/dpt_i2o.c delete mode 100644 drivers/scsi/dpti.h -- 2.25.1

2 19

[PATCH openEuler-1.0-LTS 01/12] dm thin: fix deadlock when swapping to thin device
by Yongqiang Liu 08 May '23

08 May '23

From: Coly Li <colyli(a)suse.de> stable inclusion from stable-v4.19.280 commit 84e13235e08941ce37aa9ee238b6dd007170f0fc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I715PM CVE: NA -------------------------------- commit 9bbf5feecc7eab2c370496c1c161bbfe62084028 upstream. This is an already known issue that dm-thin volume cannot be used as swap, otherwise a deadlock may happen when dm-thin internal memory demand triggers swap I/O on the dm-thin volume itself. But thanks to commit a666e5c05e7c ("dm: fix deadlock when swapping to encrypted device"), the limit_swap_bios target flag can also be used for dm-thin to avoid the recursive I/O when it is used as swap. Fix is to simply set ti->limit_swap_bios to true in both pool_ctr() and thin_ctr(). In my test, I create a dm-thin volume /dev/vg/swap and use it as swap device. Then I run fio on another dm-thin volume /dev/vg/main and use large --blocksize to trigger swap I/O onto /dev/vg/swap. The following fio command line is used in my test, fio --name recursive-swap-io --lockmem 1 --iodepth 128 \ --ioengine libaio --filename /dev/vg/main --rw randrw \ --blocksize 1M --numjobs 32 --time_based --runtime=12h Without this fix, the whole system can be locked up within 15 seconds. With this fix, there is no any deadlock or hung task observed after 2 hours of running fio. Furthermore, if blocksize is changed from 1M to 128M, after around 30 seconds fio has no visible I/O, and the out-of-memory killer message shows up in kernel message. After around 20 minutes all fio processes are killed and the whole system is back to being alive. This is exactly what is expected when recursive I/O happens on dm-thin volume when it is used as swap. Depends-on: a666e5c05e7c ("dm: fix deadlock when swapping to encrypted device") Cc: stable(a)vger.kernel.org Signed-off-by: Coly Li <colyli(a)suse.de> Acked-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/md/dm-thin.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c index fd8c89e3fc54..d884bb9cef94 100644 --- a/drivers/md/dm-thin.c +++ b/drivers/md/dm-thin.c @@ -3361,6 +3361,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) pt->low_water_blocks = low_water_blocks; pt->adjusted_pf = pt->requested_pf = pf; ti->num_flush_bios = 1; + ti->limit_swap_bios = true; /* * Only need to enable discards if the pool should pass @@ -4244,6 +4245,7 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv) goto bad; ti->num_flush_bios = 1; + ti->limit_swap_bios = true; ti->flush_supported = true; ti->per_io_data_size = sizeof(struct dm_thin_endio_hook); -- 2.25.1

1 11