- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 30 Jul '24

30 Jul '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): kvm: add coda feature Signed-off-by: JunBin Li <lijunbin4(a)huawei.com> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.25.1

2 2

[openeuler:openEuler-1.0-LTS 15750/23378] fs/.tmp_select.o: warning: objtool: poll_select_finish()+0xc6: can't find switch jump table
by kernel test robot 30 Jul '24

30 Jul '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 87e97edb9d08052dcb1df91827fb9dd9edecf612 commit: 44ae3d3e5f1f99c0fd5f040e4da88b0c5b3ec76b [15750/23378] select: shift restore_saved_sigmask_unless() into poll_select_copy_remaining() config: x86_64-buildonly-randconfig-001-20240729 (https://download.01.org/0day-ci/archive/20240730/202407301459.O1t38ucj-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240730/202407301459.O1t38ucj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407301459.O1t38ucj-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/.tmp_select.o: warning: objtool: poll_select_finish()+0xc6: can't find switch jump table -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] filelock: Fix fcntl/close race recovery compat path
by Yifan Qiao 30 Jul '24

30 Jul '24

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v6.6.43 commit 73ae349534ebc377328e7d21891e589626c6e82c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEF4 CVE: CVE-2024-41020 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f8138f2ad2f745b9a1c696a05b749eabe44337ea upstream. When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies of the code I was patching: The normal version, and the version for 64-bit offsets on 32-bit kernels. Thanks to Greg KH for stumbling over this while doing the stable backport... Apply exactly the same fix to the compat path for 32-bit kernels. Fixes: c293621bbf67 ("[PATCH] stale POSIX lock handling") Cc: stable(a)kernel.org Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2563 Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20240723-fs-lock-recover-compatfix-v1-1-148096719… Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/locks.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/locks.c b/fs/locks.c index 76ad05f8070a..ae62ee373704 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -2504,8 +2504,9 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, error = do_lock_file_wait(filp, cmd, file_lock); /* - * Attempt to detect a close/fcntl race and recover by releasing the - * lock that was just acquired. There is no need to do that when we're + * Detect close/fcntl races and recover by zapping all POSIX locks + * associated with this file and our files_struct, just like on + * filp_flush(). There is no need to do that when we're * unlocking though, or for OFD locks. */ if (!error && file_lock->fl_type != F_UNLCK && @@ -2520,9 +2521,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, f = files_lookup_fd_locked(files, fd); spin_unlock(&files->file_lock); if (f != filp) { - file_lock->fl_type = F_UNLCK; - error = do_lock_file_wait(filp, cmd, file_lock); - WARN_ON_ONCE(error); + locks_remove_posix(filp, files); error = -EBADF; } } -- 2.39.2

2 1

[PATCH OLK-5.10 0/2] CVE-2024-41020
by Yifan Qiao 30 Jul '24

30 Jul '24

Eric W. Biederman (1): file: Factor files_lookup_fd_locked out of fcheck_files Jann Horn (1): filelock: Fix fcntl/close race recovery compat path include/linux/fdtable.h | 7 +++++++ fs/file.c | 2 +- fs/locks.c | 23 ++++++++++++----------- fs/proc/fd.c | 2 +- 4 files changed, 21 insertions(+), 13 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-41020
by Yifan Qiao 30 Jul '24

30 Jul '24

Eric W. Biederman (1): file: Factor files_lookup_fd_locked out of fcheck_files Jann Horn (1): filelock: Fix fcntl/close race recovery compat path include/linux/fdtable.h | 7 +++++++ fs/file.c | 2 +- fs/locks.c | 23 ++++++++++++----------- fs/proc/fd.c | 2 +- 4 files changed, 21 insertions(+), 13 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
by Yang Yingliang 30 Jul '24

30 Jul '24

From: Hagar Hemdan <hagarhem(a)amazon.com> mainline inclusion from mainline-v6.10-rc6 commit adec57ff8e66aee632f3dd1f93787c13d112b7a1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEP4 CVE: CVE-2024-42090 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- In create_pinctrl(), pinctrl_maps_mutex is acquired before calling add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl() calls pinctrl_free(). However, pinctrl_free() attempts to acquire pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to a potential deadlock. This patch resolves the issue by releasing pinctrl_maps_mutex before calling pinctrl_free(), preventing the deadlock. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Fixes: 42fed7ba44e4 ("pinctrl: move subsystem mutex to pinctrl_dev struct") Suggested-by: Maximilian Heyne <mheyne(a)amazon.de> Signed-off-by: Hagar Hemdan <hagarhem(a)amazon.com> Link: https://lore.kernel.org/r/20240604085838.3344-1-hagarhem@amazon.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> --- drivers/pinctrl/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index 82b3cd6903c8..8ecb8dc19208 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -1084,8 +1084,8 @@ static struct pinctrl *create_pinctrl(struct device *dev, * an -EPROBE_DEFER later, as that is the worst case. */ if (ret == -EPROBE_DEFER) { - pinctrl_free(p, false); mutex_unlock(&pinctrl_maps_mutex); + pinctrl_free(p, false); return ERR_PTR(ret); } } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
by Yang Yingliang 30 Jul '24

30 Jul '24

From: Hagar Hemdan <hagarhem(a)amazon.com> mainline inclusion from mainline-v6.10-rc6 commit adec57ff8e66aee632f3dd1f93787c13d112b7a1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEP4 CVE: CVE-2024-42090 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- In create_pinctrl(), pinctrl_maps_mutex is acquired before calling add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl() calls pinctrl_free(). However, pinctrl_free() attempts to acquire pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to a potential deadlock. This patch resolves the issue by releasing pinctrl_maps_mutex before calling pinctrl_free(), preventing the deadlock. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Fixes: 42fed7ba44e4 ("pinctrl: move subsystem mutex to pinctrl_dev struct") Suggested-by: Maximilian Heyne <mheyne(a)amazon.de> Signed-off-by: Hagar Hemdan <hagarhem(a)amazon.com> Link: https://lore.kernel.org/r/20240604085838.3344-1-hagarhem@amazon.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> --- drivers/pinctrl/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index 82b3cd6903c8..8ecb8dc19208 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -1084,8 +1084,8 @@ static struct pinctrl *create_pinctrl(struct device *dev, * an -EPROBE_DEFER later, as that is the worst case. */ if (ret == -EPROBE_DEFER) { - pinctrl_free(p, false); mutex_unlock(&pinctrl_maps_mutex); + pinctrl_free(p, false); return ERR_PTR(ret); } } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
by Yang Yingliang 30 Jul '24

30 Jul '24

From: Hagar Hemdan <hagarhem(a)amazon.com> mainline inclusion from mainline-v6.10-rc6 commit adec57ff8e66aee632f3dd1f93787c13d112b7a1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEP4 CVE: CVE-2024-42090 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- In create_pinctrl(), pinctrl_maps_mutex is acquired before calling add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl() calls pinctrl_free(). However, pinctrl_free() attempts to acquire pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to a potential deadlock. This patch resolves the issue by releasing pinctrl_maps_mutex before calling pinctrl_free(), preventing the deadlock. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Fixes: 42fed7ba44e4 ("pinctrl: move subsystem mutex to pinctrl_dev struct") Suggested-by: Maximilian Heyne <mheyne(a)amazon.de> Signed-off-by: Hagar Hemdan <hagarhem(a)amazon.com> Link: https://lore.kernel.org/r/20240604085838.3344-1-hagarhem@amazon.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> --- drivers/pinctrl/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index b50968f0ce2e..f8952d01fc2c 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -1078,8 +1078,8 @@ static struct pinctrl *create_pinctrl(struct device *dev, * an -EPROBE_DEFER later, as that is the worst case. */ if (ret == -EPROBE_DEFER) { - pinctrl_free(p, false); mutex_unlock(&pinctrl_maps_mutex); + pinctrl_free(p, false); return ERR_PTR(ret); } } -- 2.25.1

2 1

[PATCH OLK-6.6 0/3] ovl: simplify ovl_parse_param_lowerdir()
by Zhihao Cheng 30 Jul '24

30 Jul '24

Christian Brauner (1): ovl: pass string to ovl_parse_layer() Zhihao Cheng (2): ovl: fix wrong lowerdir number check for parameter Opt_lowerdir ovl: ovl_parse_param_lowerdir: Add missed '\n' for pr_err fs/overlayfs/params.c | 49 ++++++++++--------------------------------- 1 file changed, 11 insertions(+), 38 deletions(-) -- 2.31.1

2 4

[PATCH openEuler-22.03-LTS-SP1] filelock: Fix fcntl/close race recovery compat path
by Yifan Qiao 30 Jul '24

30 Jul '24

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v4.19.319 commit a561145f3ae973ebf3e0aee41624e92a6c5cb38d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEF4 CVE: CVE-2024-41020 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f8138f2ad2f745b9a1c696a05b749eabe44337ea upstream. When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies of the code I was patching: The normal version, and the version for 64-bit offsets on 32-bit kernels. Thanks to Greg KH for stumbling over this while doing the stable backport... Apply exactly the same fix to the compat path for 32-bit kernels. Fixes: c293621bbf67 ("[PATCH] stale POSIX lock handling") Cc: stable(a)kernel.org Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2563 Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20240723-fs-lock-recover-compatfix-v1-1-148096719… Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/locks.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/locks.c b/fs/locks.c index 6e118955b9b6..7b805e2a7f7a 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -2530,8 +2530,9 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, error = do_lock_file_wait(filp, cmd, file_lock); /* - * Attempt to detect a close/fcntl race and recover by releasing the - * lock that was just acquired. There is no need to do that when we're + * Detect close/fcntl races and recover by zapping all POSIX locks + * associated with this file and our files_struct, just like on + * filp_flush(). There is no need to do that when we're * unlocking though, or for OFD locks. */ if (!error && file_lock->fl_type != F_UNLCK && @@ -2545,9 +2546,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, f = fcheck(fd); spin_unlock(&current->files->file_lock); if (f != filp) { - file_lock->fl_type = F_UNLCK; - error = do_lock_file_wait(filp, cmd, file_lock); - WARN_ON_ONCE(error); + locks_remove_posix(filp, &current->files); error = -EBADF; } } -- 2.39.2

2 1