- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/1] CVE-2024-49891
by Yongqiang Liu 27 Nov '24

27 Nov '24

Justin Tee (1): scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_hbadisc.c | 3 ++- drivers/scsi/lpfc/lpfc_scsi.c | 13 +++++++++++-- drivers/scsi/lpfc/lpfc_sli.c | 15 +++++++++++++++ 4 files changed, 29 insertions(+), 3 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS-SP1] scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths
by Yongqiang Liu 27 Nov '24

27 Nov '24

From: Justin Tee <justin.tee(a)broadcom.com> mainline inclusion from mainline-v6.12-rc1 commit 2be1d4f11944cd6283cb97268b3e17c4424945ca category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9Z CVE: CVE-2024-49891 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When the HBA is undergoing a reset or is handling an errata event, NULL ptr dereference crashes may occur in routines such as lpfc_sli_flush_io_rings(), lpfc_dev_loss_tmo_callbk(), or lpfc_abort_handler(). Add NULL ptr checks before dereferencing hdwq pointers that may have been freed due to operations colliding with a reset or errata event handler. Signed-off-by: Justin Tee <justin.tee(a)broadcom.com> Link: https://lore.kernel.org/r/20240726231512.92867-4-justintee8345@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflicts: drivers/scsi/lpfc/lpfc.h drivers/scsi/lpfc/lpfc_hbadisc.c drivers/scsi/lpfc/lpfc_scsi.c drivers/scsi/lpfc/lpfc_sli.c [Yongqiang: add HBA_SETUP flag from commit 02243836ad6f("scsi: lpfc: Add support for the CM framework") for teardown logic] Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_hbadisc.c | 3 ++- drivers/scsi/lpfc/lpfc_scsi.c | 13 +++++++++++-- drivers/scsi/lpfc/lpfc_sli.c | 15 +++++++++++++++ 4 files changed, 29 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h index cf69f831a725..103ff1ce2aef 100644 --- a/drivers/scsi/lpfc/lpfc.h +++ b/drivers/scsi/lpfc/lpfc.h @@ -772,6 +772,7 @@ struct lpfc_hba { */ #define HBA_FLOGI_ISSUED 0x100000 /* FLOGI was issued */ #define HBA_DEFER_FLOGI 0x800000 /* Defer FLOGI till read_sparm cmpl */ +#define HBA_SETUP 0x1000000 /* Signifies HBA setup is completed */ struct completion *fw_dump_cmpl; /* cmpl event tracker for fw_dump */ uint32_t fcp_ring_in_use; /* When polling test if intr-hndlr active*/ diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c index d1f28364356e..5d8f3797b1b6 100644 --- a/drivers/scsi/lpfc/lpfc_hbadisc.c +++ b/drivers/scsi/lpfc/lpfc_hbadisc.c @@ -140,7 +140,8 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport) * or unloading the driver. The unload will cleanup the node * appropriately we just need to cleanup the ndlp rport info here. */ - if (vport->load_flag & FC_UNLOADING) { + if (vport->load_flag & FC_UNLOADING || + !(phba->hba_flag & HBA_SETUP)) { put_node = rdata->pnode != NULL; put_rport = ndlp->rport != NULL; rdata->pnode = NULL; diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c index 983eeb0e3d07..2d2276aa0b63 100644 --- a/drivers/scsi/lpfc/lpfc_scsi.c +++ b/drivers/scsi/lpfc/lpfc_scsi.c @@ -4769,11 +4769,20 @@ lpfc_abort_handler(struct scsi_cmnd *cmnd) iocb = &lpfc_cmd->cur_iocbq; if (phba->sli_rev == LPFC_SLI_REV4) { - pring_s4 = phba->sli4_hba.hdwq[iocb->hba_wqidx].io_wq->pring; - if (!pring_s4) { + /* if the io_wq & pring are gone, the port was reset. */ + if (!phba->sli4_hba.hdwq[iocb->hba_wqidx].io_wq || + !phba->sli4_hba.hdwq[iocb->hba_wqidx].io_wq->pring) { + lpfc_printf_vlog(vport, KERN_WARNING, LOG_FCP, + "2877 SCSI Layer I/O Abort Request " + "IO CMPL Status x%x ID %d LUN %llu " + "HBA_SETUP %d\n", FAILED, + cmnd->device->id, + (u64)cmnd->device->lun, + phba->hba_flag & HBA_SETUP); ret = FAILED; goto out_unlock_buf; } + pring_s4 = phba->sli4_hba.hdwq[iocb->hba_wqidx].io_wq->pring; spin_lock(&pring_s4->ring_lock); } /* the command is in process of being cancelled */ diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c index 28fee498a3d2..e6f6ddc80ee5 100644 --- a/drivers/scsi/lpfc/lpfc_sli.c +++ b/drivers/scsi/lpfc/lpfc_sli.c @@ -4156,6 +4156,17 @@ lpfc_sli_flush_io_rings(struct lpfc_hba *phba) /* Look on all the FCP Rings for the iotag */ if (phba->sli_rev >= LPFC_SLI_REV4) { for (i = 0; i < phba->cfg_hdw_queue; i++) { + if (!phba->sli4_hba.hdwq || + !phba->sli4_hba.hdwq[i].io_wq) { + lpfc_printf_log(phba, KERN_ERR, LOG_SLI, + "7777 hdwq's deleted %x " + "%x %x %x\n", + phba->pport->load_flag, + phba->hba_flag, + phba->link_state, + phba->sli.sli_flag); + return; + } pring = phba->sli4_hba.hdwq[i].io_wq->pring; spin_lock_irq(&pring->ring_lock); @@ -4304,6 +4315,7 @@ lpfc_sli_brdready_s4(struct lpfc_hba *phba, uint32_t mask) } else phba->sli4_hba.intr_enable = 0; + phba->hba_flag &= ~HBA_SETUP; return retval; } @@ -4623,6 +4635,7 @@ lpfc_sli4_brdreset(struct lpfc_hba *phba) phba->link_events = 0; phba->pport->fc_myDID = 0; phba->pport->fc_prevDID = 0; + phba->hba_flag &= ~HBA_SETUP; spin_lock_irq(&phba->hbalock); psli->sli_flag &= ~(LPFC_PROCESS_LA); @@ -7989,6 +8002,8 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba) } } mempool_free(mboxq, phba->mbox_mem_pool); + + phba->hba_flag |= HBA_SETUP; return rc; out_io_buff_free: /* Free allocated IO Buffers */ -- 2.25.1

2 1

[PATCH PATCH openEuler-22.03-LTS-SP1 0/9] fix CVE-2024-49861
by Xiaomeng Zhang 27 Nov '24

27 Nov '24

*** BLURB HERE *** Daniel Borkmann (6): bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit bpf: Remove truncation test in bpf_strtol and bpf_strtoul helpers bpf: Fix helper writes to read-only maps bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types selftests/bpf: Fix ARG_PTR_TO_LONG {half-,}uninitialized test selftests/bpf: Rename ARG_PTR_TO_LONG test description Joanne Koong (1): bpf: Add MEM_UNINIT as a bpf_type_flag Maxim Mikityanskiy (1): bpf: Allow helpers to accept pointers with a fixed size Xiaomeng Zhang (1): bpf: Fix kabi breakage in enum bpf_type_flag include/linux/bpf.h | 39 ++++-- kernel/bpf/helpers.c | 18 ++- kernel/bpf/verifier.c | 114 ++++++++---------- .../testing/selftests/bpf/verifier/int_ptr.c | 15 +-- 4 files changed, 91 insertions(+), 95 deletions(-) -- 2.34.1

1 9

[PATCH v1 OLK-5.10 0/3] KVM: arm64: Workaround firmware wrongly advertising GICv2-on-v3 compatibility
by Yanan Wang 27 Nov '24

27 Nov '24

Backport 3 patches that are required on ARM64 platforms having firmware wrongly advertising GICv2 compatibility. Reference:https://lore.kernel.org/all/20210325091424.26348-1-shameerali.kol… Marc Zyngier (3): KVM: arm64: Rename __vgic_v3_get_ich_vtr_el2() to __vgic_v3_get_gic_config() KVM: arm64: Workaround firmware wrongly advertising GICv2-on-v3 compatibility KVM: arm64: Fix CPU interface MMIO compatibility detection arch/arm64/include/asm/kvm_asm.h | 4 +-- arch/arm64/kvm/hyp/nvhe/hyp-main.c | 4 +-- arch/arm64/kvm/hyp/vgic-v3-sr.c | 49 ++++++++++++++++++++++++++++-- arch/arm64/kvm/vgic/vgic-v3.c | 12 ++++++-- 4 files changed, 60 insertions(+), 9 deletions(-) -- 2.33.0

2 4

[PATCH openEuler-22.03-LTS-SP1] RDMA/bnxt_re: Add a check for memory allocation
by Wang Liang 27 Nov '24

27 Nov '24

From: Kalesh AP <kalesh-anakkur.purayil(a)broadcom.com> stable inclusion from stable-v5.10.229 commit dbe51dd516e6d4e655f31c8a1cbc050dde7ba97b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YW8 CVE: CVE-2024-50209 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c5c1ae73b7741fa3b58e6e001b407825bb971225 ] __alloc_pbl() can return error when memory allocation fails. Driver is not checking the status on one of the instances. Fixes: 0c4dcd602817 ("RDMA/bnxt_re: Refactor hardware queue memory allocation") Link: https://patch.msgid.link/r/1726715161-18941-4-git-send-email-selvin.xavier@… Reviewed-by: Selvin Xavier <selvin.xavier(a)broadcom.com> Signed-off-by: Kalesh AP <kalesh-anakkur.purayil(a)broadcom.com> Signed-off-by: Selvin Xavier <selvin.xavier(a)broadcom.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c index a9c2359b0d07..5d7cf903a9cd 100644 --- a/drivers/infiniband/hw/bnxt_re/qplib_res.c +++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c @@ -251,6 +251,8 @@ int bnxt_qplib_alloc_init_hwq(struct bnxt_qplib_hwq *hwq, sginfo.pgsize = npde * pg_size; sginfo.npages = 1; rc = __alloc_pbl(res, &hwq->pbl[PBL_LVL_0], &sginfo); + if (rc) + goto fail; /* Alloc PBL pages */ sginfo.npages = npbl; -- 2.34.1

2 1

[PATCH OLK-5.10] RDMA/bnxt_re: Add a check for memory allocation
by Wang Liang 27 Nov '24

27 Nov '24

From: Kalesh AP <kalesh-anakkur.purayil(a)broadcom.com> stable inclusion from stable-v5.10.229 commit dbe51dd516e6d4e655f31c8a1cbc050dde7ba97b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YW8 CVE: CVE-2024-50209 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c5c1ae73b7741fa3b58e6e001b407825bb971225 ] __alloc_pbl() can return error when memory allocation fails. Driver is not checking the status on one of the instances. Fixes: 0c4dcd602817 ("RDMA/bnxt_re: Refactor hardware queue memory allocation") Link: https://patch.msgid.link/r/1726715161-18941-4-git-send-email-selvin.xavier@… Reviewed-by: Selvin Xavier <selvin.xavier(a)broadcom.com> Signed-off-by: Kalesh AP <kalesh-anakkur.purayil(a)broadcom.com> Signed-off-by: Selvin Xavier <selvin.xavier(a)broadcom.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c index e36a5c71a85b..f1afaa02d500 100644 --- a/drivers/infiniband/hw/bnxt_re/qplib_res.c +++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c @@ -243,6 +243,8 @@ int bnxt_qplib_alloc_init_hwq(struct bnxt_qplib_hwq *hwq, sginfo.pgsize = npde * pg_size; sginfo.npages = 1; rc = __alloc_pbl(res, &hwq->pbl[PBL_LVL_0], &sginfo); + if (rc) + goto fail; /* Alloc PBL pages */ sginfo.npages = npbl; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Fix problems of mounting nfs
by Li Lingfeng 27 Nov '24

27 Nov '24

Li Lingfeng (2): nfs: pass flags to second superblock nfs: ignore SB_RDONLY when mounting nfs fs/nfs/internal.h | 2 +- fs/nfs/nfs4super.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) -- 2.31.1

2 3

[PATCH openEuler-1.0-LTS 0/2] Fix problems of mounting nfs
by Li Lingfeng 27 Nov '24

27 Nov '24

Li Lingfeng (2): nfs: pass flags to second superblock nfs: ignore SB_RDONLY when mounting nfs fs/nfs/internal.h | 2 +- fs/nfs/nfs4super.c | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) -- 2.31.1

2 3

[PATCH OLK-5.10 0/2] Fix problems of mounting nfs
by Li Lingfeng 27 Nov '24

27 Nov '24

Li Lingfeng (2): nfs: pass flags to second superblock nfs: ignore SB_RDONLY when mounting nfs fs/nfs/internal.h | 2 +- fs/nfs/nfs4super.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) -- 2.31.1

2 3

[PATCH OLK-6.6 0/2] bpf: Fix helper writes to read-only maps
by Xiaomeng Zhang 27 Nov '24

27 Nov '24

*** BLURB HERE *** Daniel Borkmann (1): [Backport] bpf: Fix helper writes to read-only maps Xiaomeng Zhang (1): [Huawei] bpf: Fix kabi breakage in enum bpf_type_flag and bpf_arg_type include/linux/bpf.h | 10 ++++++++-- kernel/bpf/helpers.c | 6 ++++-- kernel/bpf/syscall.c | 3 ++- kernel/bpf/verifier.c | 41 +++++----------------------------------- kernel/trace/bpf_trace.c | 6 ++++-- net/core/filter.c | 6 ++++-- 6 files changed, 27 insertions(+), 45 deletions(-) -- 2.34.1

2 3