- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 1/7] ath: Use safer key clearing with key cache entries
by Yang Yingliang 08 Nov '21

08 Nov '21

From: Jouni Malinen <jouni(a)codeaurora.org> stable inclusion from linux-4.19.205 commit dd5815f023b89c9a28325d8a2a5f0779b57b7190 CVE: CVE-2020-3702 -------------------------------- commit 56c5485c9e444c2e85e11694b6c44f1338fc20fd upstream. It is possible for there to be pending frames in TXQs with a reference to the key cache entry that is being deleted. If such a key cache entry is cleared, those pending frame in TXQ might get transmitted without proper encryption. It is safer to leave the previously used key into the key cache in such cases. Instead, only clear the MAC address to prevent RX processing from using this key cache entry. This is needed in particularly in AP mode where the TXQs cannot be flushed on station disconnection. This change alone may not be able to address all cases where the key cache entry might get reused for other purposes immediately (the key cache entry should be released for reuse only once the TXQs do not have any remaining references to them), but this makes it less likely to get unprotected frames and the more complete changes may end up being significantly more complex. Signed-off-by: Jouni Malinen <jouni(a)codeaurora.org> Signed-off-by: Kalle Valo <kvalo(a)codeaurora.org> Link: https://lore.kernel.org/r/20201214172118.18100-2-jouni@codeaurora.org Cc: Pali Rohár <pali(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/wireless/ath/key.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c index 1816b4e7dc264..59618bb41f6c5 100644 --- a/drivers/net/wireless/ath/key.c +++ b/drivers/net/wireless/ath/key.c @@ -583,7 +583,16 @@ EXPORT_SYMBOL(ath_key_config); */ void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key) { - ath_hw_keyreset(common, key->hw_key_idx); + /* Leave CCMP and TKIP (main key) configured to avoid disabling + * encryption for potentially pending frames already in a TXQ with the + * keyix pointing to this key entry. Instead, only clear the MAC address + * to prevent RX processing from using this key cache entry. + */ + if (test_bit(key->hw_key_idx, common->ccmp_keymap) || + test_bit(key->hw_key_idx, common->tkip_keymap)) + ath_hw_keysetmac(common, key->hw_key_idx, NULL); + else + ath_hw_keyreset(common, key->hw_key_idx); if (key->hw_key_idx < IEEE80211_WEP_NKID) return; -- 2.25.1

1 6

[PATCH kernel-4.19] vfs: move cap_convert_nscap() call into vfs_setxattr()
by zhangyue 08 Nov '21

08 Nov '21

mainline inclusion category: feature bugzilla:https://gitee.com/openeuler/kernel/issues/I4GVH3?from=project-issue CVE: NA cap_convert_nscap() does permission checking as well as conversion of the xattr value conditionally based on fs's user-ns. This is needed by overlayfs and probably other layered fs (ecryptfs) and is what vfs_foo() is supposed to do anyway. Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Acked-by: James Morris <jamorris(a)linux.microsoft.com> Signed-off-by: zhangyue <zhangyue1(a)kylinos.cn> --- fs/xattr.c | 18 ++++++++++++------ include/linux/capability.h | 2 +- security/commoncap.c | 3 +-- 3 files changed, 14 insertions(+), 9 deletions(-) diff --git a/fs/xattr.c b/fs/xattr.c index adb11cb82be5..653e12d6060f 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -263,8 +263,16 @@ vfs_setxattr(struct dentry *dentry, const char *name, const void *value, { struct inode *inode = dentry->d_inode; struct inode *delegated_inode = NULL; + const void *orig_value = value; int error; + if (size && strcmp(name, XATTR_NAME_CAPS) == 0) { + error = cap_convert_nscap(dentry, &value, size); + if (error < 0) + return error; + size = error; + } + retry_deleg: inode_lock(inode); error = __vfs_setxattr_locked(dentry, name, value, size, flags, @@ -276,6 +284,10 @@ vfs_setxattr(struct dentry *dentry, const char *name, const void *value, if (!error) goto retry_deleg; } + + if (value != orig_value) + kfree(value); + return error; } EXPORT_SYMBOL_GPL(vfs_setxattr); @@ -530,12 +542,6 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value, if ((strcmp(kname, XATTR_NAME_POSIX_ACL_ACCESS) == 0) || (strcmp(kname, XATTR_NAME_POSIX_ACL_DEFAULT) == 0)) posix_acl_fix_xattr_from_user(kvalue, size); - else if (strcmp(kname, XATTR_NAME_CAPS) == 0) { - error = cap_convert_nscap(d, &kvalue, size); - if (error < 0) - goto out; - size = error; - } } error = vfs_setxattr(d, kname, kvalue, size, flags); diff --git a/include/linux/capability.h b/include/linux/capability.h index f640dcbc880c..9fee9a86505c 100644 --- a/include/linux/capability.h +++ b/include/linux/capability.h @@ -249,6 +249,6 @@ extern bool ptracer_capable(struct task_struct *tsk, struct user_namespace *ns); /* audit system wants to get cap info from files as well */ extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps); -extern int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size); +extern int cap_convert_nscap(struct dentry *dentry, const void **ivalue, size_t size); #endif /* !_LINUX_CAPABILITY_H */ diff --git a/security/commoncap.c b/security/commoncap.c index 876cfe01d939..83546a782796 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -498,7 +498,7 @@ static bool validheader(size_t size, const struct vfs_cap_data *cap) * * If all is ok, we return the new size, on error return < 0. */ -int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size) +int cap_convert_nscap(struct dentry *dentry, const void **ivalue, size_t size) { struct vfs_ns_cap_data *nscap; uid_t nsrootid; @@ -541,7 +541,6 @@ int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size) nscap->magic_etc = cpu_to_le32(nsmagic); memcpy(&nscap->data, &cap->data, sizeof(__le32) * 2 * VFS_CAP_U32); - kvfree(*ivalue); *ivalue = nscap; return newsize; } -- 2.30.0

1 0

[PATCH openEuler-1.0-LTS] ext4: if zeroout fails fall back to splitting the extent node
by Yang Yingliang 08 Nov '21

08 Nov '21

From: Theodore Ts'o <tytso(a)mit.edu> mainline inclusion from mainline-5.15-rc1 commit 308c57ccf4318236be75dfa251c84713e694457b category: bugfix bugzilla: 109297 CVE: NA --------------------------- If the underlying storage device is using thin-provisioning, it's possible for a zeroout operation to return ENOSPC. Commit df22291ff0fd ("ext4: Retry block allocation if we have free blocks left") added logic to retry block allocation since we might get free block after we commit a transaction. But the ENOSPC from thin-provisioning will confuse ext4, and lead to an infinite loop. Since using zeroout instead of splitting the extent node is an optimization, if it fails, we might as well fall back to splitting the extent node. Reported-by: yangerkun <yangerkun(a)huawei.com> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: yangerkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/ext4/extents.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index fc00a78163117..10298c13a67d7 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -3696,7 +3696,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle, split_map.m_len - ee_block); err = ext4_ext_zeroout(inode, &zero_ex1); if (err) - goto out; + goto fallback; split_map.m_len = allocated; } if (split_map.m_lblk - ee_block + split_map.m_len < @@ -3710,7 +3710,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle, ext4_ext_pblock(ex)); err = ext4_ext_zeroout(inode, &zero_ex2); if (err) - goto out; + goto fallback; } split_map.m_len += split_map.m_lblk - ee_block; @@ -3719,6 +3719,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle, } } +fallback: err = ext4_split_extent(handle, inode, ppath, &split_map, split_flag, flags); if (err > 0) -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] dccp: don't duplicate ccid when cloning dccp sock
by Yang Yingliang 08 Nov '21

08 Nov '21

From: "Lin, Zhenpeng" <zplin(a)psu.edu> mainline inclusion from mainline-v5.15-rc2 commit d9ea761fdd197351890418acd462c51f241014a7 category: bugfix bugzilla: 85666 CVE: CVE-2020-16119 ------------------------------------------------- Commit 2677d2067731 ("dccp: don't free ccid2_hc_tx_sock ...") fixed a UAF but reintroduced CVE-2017-6074. When the sock is cloned, two dccps_hc_tx_ccid will reference to the same ccid. So one can free the ccid object twice from two socks after cloning. This issue was found by "Hadar Manor" as well and assigned with CVE-2020-16119, which was fixed in Ubuntu's kernel. So here I port the patch from Ubuntu to fix it. The patch prevents cloned socks from referencing the same ccid. Fixes: 2677d2067731410 ("dccp: don't free ccid2_hc_tx_sock ...") Signed-off-by: Zhenpeng Lin <zplin(a)psu.edu> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/dccp/minisocks.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c index ba6fc3c1186b9..e91838a7b8497 100644 --- a/net/dccp/minisocks.c +++ b/net/dccp/minisocks.c @@ -98,6 +98,8 @@ struct sock *dccp_create_openreq_child(const struct sock *sk, newdp->dccps_role = DCCP_ROLE_SERVER; newdp->dccps_hc_rx_ackvec = NULL; newdp->dccps_service_list = NULL; + newdp->dccps_hc_rx_ccid = NULL; + newdp->dccps_hc_tx_ccid = NULL; newdp->dccps_service = dreq->dreq_service; newdp->dccps_timestamp_echo = dreq->dreq_timestamp_echo; newdp->dccps_timestamp_time = dreq->dreq_timestamp_time; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 01/14] Revert "selftests/bpf: add test_spec_readahead_xfs_file to support specail async readahead"
by Yang Yingliang 05 Nov '21

05 Nov '21

From: Hou Tao <houtao1(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4H3JT CVE: NA --------------------------- There are two issues with the current solution: 1) tracepoint xfs_read_file is visible in tracefs It forms an ABI for userspace. It is bad because new field may be added into xfs_writable_file to export more information to userspace. 2) tracepoint xfs_read_file is specific to xfs HDFS can be stacked on ext4. A new solution is proposed which uses vfs bare tracepoint, so reverts commit 69513cfbe62d267c4a5e6025f31741b1f2cb946c. Signed-off-by: Hou Tao <houtao1(a)huawei.com> Reviewed-by: Kuohai Xu <xukuohai(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- tools/include/uapi/linux/xfs.h | 1 - tools/testing/selftests/bpf/Makefile | 3 +- .../bpf/test_spec_readahead_xfs_file.c | 39 ------------------- tools/testing/selftests/bpf/test_xfs_file.c | 9 +---- 4 files changed, 3 insertions(+), 49 deletions(-) delete mode 100644 tools/testing/selftests/bpf/test_spec_readahead_xfs_file.c diff --git a/tools/include/uapi/linux/xfs.h b/tools/include/uapi/linux/xfs.h index 1409b45affd34..a0d37e411ee18 100644 --- a/tools/include/uapi/linux/xfs.h +++ b/tools/include/uapi/linux/xfs.h @@ -6,7 +6,6 @@ #define FMODE_RANDOM (0x1000) #define FMODE_WILLNEED (0x400000) -#define FMODE_SPC_READAHEAD (0x800000) struct xfs_writable_file { const unsigned char *name; diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile index 46b1d5b864f5a..8d2737285f185 100644 --- a/tools/testing/selftests/bpf/Makefile +++ b/tools/testing/selftests/bpf/Makefile @@ -36,8 +36,7 @@ TEST_GEN_FILES = test_pkt_access.o test_xdp.o test_l4lb.o test_tcp_estats.o test test_get_stack_rawtp.o test_sockmap_kern.o test_sockhash_kern.o \ test_lwt_seg6local.o sendmsg4_prog.o sendmsg6_prog.o test_lirc_mode2_kern.o \ get_cgroup_id_kern.o socket_cookie_prog.o test_select_reuseport_kern.o \ - test_skb_cgroup_id_kern.o test_set_xfs_file.o test_clear_xfs_file.o \ - test_spec_readahead_xfs_file.o + test_skb_cgroup_id_kern.o test_set_xfs_file.o test_clear_xfs_file.o # Order correspond to 'make run_tests' order TEST_PROGS := test_kmod.sh \ diff --git a/tools/testing/selftests/bpf/test_spec_readahead_xfs_file.c b/tools/testing/selftests/bpf/test_spec_readahead_xfs_file.c deleted file mode 100644 index ff8794a14cdcd..0000000000000 --- a/tools/testing/selftests/bpf/test_spec_readahead_xfs_file.c +++ /dev/null @@ -1,39 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0 - -#include <linux/bpf.h> -#include "bpf_helpers.h" -#include <string.h> -#include <linux/xfs.h> - -/* from /sys/kernel/debug/tracing/events/xfs/xfs_read_file */ -struct xfs_read_buffer_args { - struct xfs_writable_file *file; -}; - -SEC("tracepoint/xfs/xfs_file_read") -int bpf_prog1(struct xfs_read_buffer_args *ctx) -{ - char fmt[] = "name: %s, set f_mode: %u\n"; - struct xfs_writable_file *file = ctx->file; - char name[64] = {}; - char *tmp; - unsigned long i_size; - int len; - - bpf_probe_read(&tmp, 8, &(file->name)); - len = bpf_probe_read_str(name, 64, tmp); - bpf_probe_read(&i_size, 8, &(file->i_size)); - - if (!strncmp("blk_", name, 4)) { - /* blk_xxx.meta or blk_xxx with size < 2M */ - if (len == 27 || (len == 15 && i_size <= 2 * 1024 * 1024)) - file->f_mode |= FMODE_WILLNEED; - else if (len == 15) /* blk_xxx */ - file->f_mode |= FMODE_SPC_READAHEAD; - bpf_trace_printk(fmt, sizeof(fmt), name, file->f_mode); - } - return 0; -} - -char _license[] SEC("license") = "GPL"; -__u32 _version SEC("version") = 1; diff --git a/tools/testing/selftests/bpf/test_xfs_file.c b/tools/testing/selftests/bpf/test_xfs_file.c index 89e79d959677c..247c42be029b2 100644 --- a/tools/testing/selftests/bpf/test_xfs_file.c +++ b/tools/testing/selftests/bpf/test_xfs_file.c @@ -20,7 +20,6 @@ int main(int argc, char *argv[]) { const char *set_file = "./test_set_xfs_file.o"; const char *clear_file = "./test_clear_xfs_file.o"; - const char *spec_readahead_file = "./test_spec_readahead_xfs_file.o"; const char *file = set_file; struct bpf_object *obj; int efd, err, prog_fd; @@ -32,12 +31,8 @@ int main(int argc, char *argv[]) delay = strtol(str, &endptr, 10); } - if (argc >= 2) { - if (!strcmp("clear", argv[1])) - file = clear_file; - if (!strcmp("spec_readahead", argv[1])) - file = spec_readahead_file; - } + if (argc >= 2 && !strcmp("clear", argv[1])) + file = clear_file; err = bpf_prog_load(file, BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE, &obj, &prog_fd); -- 2.25.1

1 13

[PATCH OLK-5.10 v3] Net:NIC:SPNIC:Fix compile error when O= is specififed
by Yanling Song 05 Nov '21

05 Nov '21

Ramaxel inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4CBDP CVE: NA Net:NIC:SPNIC:Fix compile error when O= is specififed Signed-off-by: Yanling Song <songyl(a)ramaxel.com> --- Changes from V2: Move the location of "Changes from" Changes from V1: 1. Change category from feature to bugfix; 2. Add description --- drivers/net/ethernet/ramaxel/spnic/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/ramaxel/spnic/Makefile b/drivers/net/ethernet/ramaxel/spnic/Makefile index f86ccff374f6..207e1d9c431a 100644 --- a/drivers/net/ethernet/ramaxel/spnic/Makefile +++ b/drivers/net/ethernet/ramaxel/spnic/Makefile @@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0-only obj-$(CONFIG_SPNIC) += spnic.o -subdir-ccflags-y += -I$(src)/hw +subdir-ccflags-y += -I$(srctree)/$(src)/hw spnic-objs := hw/sphw_common.o \ hw/sphw_hwif.o \ -- 2.27.0

1 0

[PATCH openEuler-1.0-LTS] EMMC: fix ascend hisi emmc probe failed problem according to mmc_host struct
by Yang Yingliang 04 Nov '21

04 Nov '21

From: zhangguijiang <zhangguijiang(a)huawei.com> ascend inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4GVSG CVE: NA ------------------- Struct mmc_host using variable private[0] to point the end of struct mmc_host, at deaf01a6 we modified struct mmc_host but ignored the role of private[0] and not put it to the end of struct mmc_host. It will make mmc card probe failed, so we fix this problem, and now ascend hisi mmc card is able to probe success. Signed-off-by: zhangguijiang <zhangguijiang(a)huawei.com> Reviewed-by: Ding Tianhong <dingtianhong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/mmc/core/sd.c | 38 +++----------------------------- drivers/mmc/host/dw_mmc_extern.h | 2 +- include/linux/mmc/host.h | 2 +- 3 files changed, 5 insertions(+), 37 deletions(-) diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c index 20ca371b9f874..8760b749292b8 100644 --- a/drivers/mmc/core/sd.c +++ b/drivers/mmc/core/sd.c @@ -1163,9 +1163,9 @@ static int _mmc_sd_suspend(struct mmc_host *host) err = mmc_deselect_cards(host); if (!err) { - if (!(mmc_is_ascend_customized(host->parent))) + if (!mmc_is_ascend_customized(host->parent)) mmc_power_off(host); - else if (mmc_card_keep_power(host)) + else if (!mmc_card_keep_power(host)) mmc_power_off(host); mmc_card_set_suspended(host->card); } @@ -1269,42 +1269,10 @@ static int mmc_sd_runtime_resume(struct mmc_host *host) return 0; } -#ifdef CONFIG_ASCEND_HISI_MMC -/*********************sd ops begin**********************/ -static int mmc_do_sd_reset(struct mmc_host *host) -{ - struct mmc_card *card = host->card; - - if (!host->bus_ops->power_restore) - return -EOPNOTSUPP; - - if (!card) - return -EINVAL; - - /* hw_reset for ip reset */ - if (host->ops->hw_reset) - host->ops->hw_reset(host); - - /* Only for K930/920 SD slow down clk*/ - if (host->ops->slowdown_clk) - host->ops->slowdown_clk(host, host->ios.timing); - - mmc_power_off(host); - mmc_set_clock(host, host->f_init); - /* Wait at least 200 ms */ - mmc_delay(200); - mmc_power_up(host, host->card->ocr); - (void)mmc_select_voltage(host, host->card->ocr); - - return host->bus_ops->power_restore(host); -} -#endif static int mmc_sd_hw_reset(struct mmc_host *host) { -#ifdef CONFIG_ASCEND_HISI_MMC if (mmc_is_ascend_customized(host->parent)) - return mmc_do_sd_reset(host); -#endif + return mmc_sd_reset(host); mmc_power_cycle(host, host->card->ocr); return mmc_sd_init_card(host, host->card->ocr, host->card); } diff --git a/drivers/mmc/host/dw_mmc_extern.h b/drivers/mmc/host/dw_mmc_extern.h index 04d8c23f39e9a..ab077b4955940 100644 --- a/drivers/mmc/host/dw_mmc_extern.h +++ b/drivers/mmc/host/dw_mmc_extern.h @@ -8,7 +8,7 @@ #include "dw_mmc.h" -#ifdef CONFIG_MMC_DW_HI3XXX_MODULE +#if defined(CONFIG_MMC_DW_HI3XXX) || defined(CONFIG_MMC_DW_HI3XXX_MODULE) extern void dw_mci_reg_dump(struct dw_mci *host); extern void dw_mci_set_timeout(struct dw_mci *host); extern bool dw_mci_stop_abort_cmd(struct mmc_command *cmd); diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h index 78b4d0a813b71..fabc23d156242 100644 --- a/include/linux/mmc/host.h +++ b/include/linux/mmc/host.h @@ -542,13 +542,13 @@ struct mmc_host { bool cqe_enabled; bool cqe_on; - unsigned long private[0] ____cacheline_aligned; #ifdef CONFIG_ASCEND_HISI_MMC const struct mmc_cmdq_host_ops *cmdq_ops; int sdio_present; unsigned int cmdq_slots; struct mmc_cmdq_context_info cmdq_ctx; #endif + unsigned long private[0] ____cacheline_aligned; }; struct device_node; -- 2.25.1

1 0

[PATCH OLK-5.10 v2] Net:NIC:SPNIC:Fix compile error when O= is specififed
by Yanling Song 04 Nov '21

04 Nov '21

Ramaxel inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4CBDP CVE: NA Change from V1: 1. Change category from feature to bugfix; 2. Add description Net:NIC:SPNIC:Fix compile error when O= is specififed Signed-off-by: Yanling Song <songyl(a)ramaxel.com> --- drivers/net/ethernet/ramaxel/spnic/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/ramaxel/spnic/Makefile b/drivers/net/ethernet/ramaxel/spnic/Makefile index f86ccff374f6..207e1d9c431a 100644 --- a/drivers/net/ethernet/ramaxel/spnic/Makefile +++ b/drivers/net/ethernet/ramaxel/spnic/Makefile @@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0-only obj-$(CONFIG_SPNIC) += spnic.o -subdir-ccflags-y += -I$(src)/hw +subdir-ccflags-y += -I$(srctree)/$(src)/hw spnic-objs := hw/sphw_common.o \ hw/sphw_hwif.o \ -- 2.27.0

2 1

[PATCH openEuler-1.0-LTS] Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails
by Yang Yingliang 04 Nov '21

04 Nov '21

From: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> mainline inclusion from mainline-v5.14-rc1 commit 3cfdf8fcaafa62a4123f92eb0f4a72650da3a479 category: bugfix bugzilla: NA CVE: CVE-2021-34981 ------------------------------------------------- When cmtp_attach_device fails, cmtp_add_connection returns the error value which leads to the caller to doing fput through sockfd_put. But cmtp_session kthread, which is stopped in this path will also call fput, leading to a potential refcount underflow or a use-after-free. Add a refcount before we signal the kthread to stop. The kthread will try to grab the cmtp_session_sem mutex before doing the fput, which is held when get_file is called, so there should be no races there. Reported-by: Ryota Shiga Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> Signed-off-by: Marcel Holtmann <marcel(a)holtmann.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: weiyang wang <wangweiyang2(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/bluetooth/cmtp/core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c index 7f26a5a19ff6d..9873684a9d8ff 100644 --- a/net/bluetooth/cmtp/core.c +++ b/net/bluetooth/cmtp/core.c @@ -391,6 +391,11 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock) if (!(session->flags & BIT(CMTP_LOOPBACK))) { err = cmtp_attach_device(session); if (err < 0) { + /* Caller will call fput in case of failure, and so + * will cmtp_session kthread. + */ + get_file(session->sock->file); + atomic_inc(&session->terminate); wake_up_interruptible(sk_sleep(session->sock->sk)); up_write(&cmtp_session_sem); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] scsi: hisi_sas: print status and error when sata io abnormally completed
by Yang Yingliang 04 Nov '21

04 Nov '21

From: Xingui Yang <yangxingui(a)huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA --------------------- To help debugging efforts, print d2h status and error D2H: FIS Status Bits = 0x53 BSY = 0... .... Off DRDY = .1.. .... On DF = ..0. .... Off DSC = ...1 .... On DRQ = .... 0... Off Alignment Error = .... .0.. Off Sense Data Available = .... ..1. On ERR = .... ...1 On FIS Error Bits = 0x40 ICRC = 0... .... Off UNC = .1.. .... On MC (O) = ..0. .... Off IDNF = ...0 .... Off MCR (O) = .... 0... Off ABRT = .... .0.. Off EOM = .... ..0. Off CCTO = .... ...0 Off Here is an example print: hisi_sas_v3_hw 0000:74:02.0: sata d2h status 0x53, error 0x40 Signed-off-by: Xingui Yang <yangxingui(a)huawei.com> Reviewed by kangfenglong <kangfenglong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c index babf6486af526..4508c4a2f02fc 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c @@ -2419,6 +2419,19 @@ slot_complete_v3_hw(struct hisi_hba *hisi_hba, struct hisi_sas_slot *slot) error_info[0], error_info[1], error_info[2], error_info[3]); + if ((complete_hdr->dw0 & CMPLT_HDR_RSPNS_XFRD_MSK) && + (task->task_proto & SAS_PROTOCOL_SATA || + task->task_proto & SAS_PROTOCOL_STP)) { + struct hisi_sas_status_buffer *status_buf = + hisi_sas_status_buf_addr_mem(slot); + u8 *iu = &status_buf->iu[0]; + struct dev_to_host_fis *d2h = + (struct dev_to_host_fis *)iu; + + dev_info(dev, "sata d2h status 0x%02x, error 0x%02x\n", + d2h->status, d2h->error); + } + if ((error_info[3] & RX_DATA_LEN_UNDERFLOW_MSK) && (task->task_proto == SAS_PROTOCOL_SSP)) { /*print detail sense info when data underflow happened*/ -- 2.25.1

1 0