August 2021 - Kernel - lists.openatom.io

[PATCH OpenHarmony-4.19 0/6] OpenHarmony-4.19 cve bugfix 0825
by Yu Changchun 27 Aug '21

27 Aug '21

There are cves based on OpenHarmony-4.19 as follows: CVE-2021-37159 CVE-2021-35477 CVE-2021-34556 ---------------------------------------------------------------------- Alexei Starovoitov (1): bpf: track spill/fill of constants Daniel Borkmann (2): bpf: Introduce BPF nospec instruction for mitigating Spectre v4 bpf: Fix leakage due to insufficient speculative store bypass mitigation Dongliang Mu (1): usb: hso: fix error handling code of hso_create_net_device Edward Cree (1): bpf/verifier: per-register parent pointers Oliver Neukum (1): hso: fix bailout in error case of probe arch/arm/net/bpf_jit_32.c | 3 + arch/arm64/net/bpf_jit_comp.c | 13 ++ arch/mips/net/ebpf_jit.c | 3 + arch/powerpc/net/bpf_jit_comp64.c | 6 + arch/s390/net/bpf_jit_comp.c | 5 + arch/sparc/net/bpf_jit_comp_64.c | 3 + arch/x86/net/bpf_jit_comp.c | 7 + arch/x86/net/bpf_jit_comp32.c | 6 + drivers/net/usb/hso.c | 39 ++-- include/linux/bpf_verifier.h | 10 +- include/linux/filter.h | 15 ++ kernel/bpf/core.c | 18 +- kernel/bpf/disasm.c | 16 +- kernel/bpf/verifier.c | 328 ++++++++++++------------------ 14 files changed, 244 insertions(+), 228 deletions(-) -- 2.22.0

2 7

[PATCH OpenHarmony-4.19] module: delay kobject uevent until after module init call
by Yu Changchun 19 Aug '21

19 Aug '21

From: Jessica Yu <jeyu(a)kernel.org> stable inclusion from linux-4.19.165 commit 74925430503eccee4ddf20f3b46a580ca6a72bab category: bugfix issue: #I468RF CVE: NA -------------------------------- [ Upstream commit 38dc717e97153e46375ee21797aa54777e5498f3 ] Apparently there has been a longstanding race between udev/systemd and the module loader. Currently, the module loader sends a uevent right after sysfs initialization, but before the module calls its init function. However, some udev rules expect that the module has initialized already upon receiving the uevent. This race has been triggered recently (see link in references) in some systemd mount unit files. For instance, the configfs module creates the /sys/kernel/config mount point in its init function, however the module loader issues the uevent before this happens. sys-kernel-config.mount expects to be able to mount /sys/kernel/config upon receipt of the module loading uevent, but if the configfs module has not called its init function yet, then this directory will not exist and the mount unit fails. A similar situation exists for sys-fs-fuse-connections.mount, as the fuse sysfs mount point is created during the fuse module's init function. If udev is faster than module initialization then the mount unit would fail in a similar fashion. To fix this race, delay the module KOBJ_ADD uevent until after the module has finished calling its init routine. References: https://github.com/systemd/systemd/issues/17586 Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Tested-By: Nicolas Morey-Chaisemartin <nmoreychaisemartin(a)suse.com> Signed-off-by: Jessica Yu <jeyu(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Yu Changchun <yuchangchun1(a)huawei.com> --- kernel/module.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel/module.c b/kernel/module.c index efa25f7b3..ff945a4ce 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -1815,7 +1815,6 @@ static int mod_sysfs_init(struct module *mod) if (err) mod_kobject_put(mod); - /* delay uevent until full sysfs population */ out: return err; } @@ -1852,7 +1851,6 @@ static int mod_sysfs_setup(struct module *mod, add_sect_attrs(mod, info); add_notes_attrs(mod, info); - kobject_uevent(&mod->mkobj.kobj, KOBJ_ADD); return 0; out_unreg_modinfo_attrs: @@ -3508,6 +3506,9 @@ static noinline int do_init_module(struct module *mod) blocking_notifier_call_chain(&module_notify_list, MODULE_STATE_LIVE, mod); + /* Delay uevent until module has finished its init routine */ + kobject_uevent(&mod->mkobj.kobj, KOBJ_ADD); + /* * We need to finish all async code before the module init sequence * is done. This has potential to deadlock. For example, a newly -- 2.25.1

2 1

[PATCH OpenHarmony-4.19 0/6] OpenHarmony-4.19 cve bugfix 0812
by Yu Changchun 12 Aug '21

12 Aug '21

There are cves based on OpenHarmony-4.19 as follows: CVE-2021-33909 CVE-2021-3655 Eric Sandeen (1): seq_file: disallow extremely large seq buffer allocations Marcelo Ricardo Leitner (5): sctp: validate from_addr_param return sctp: add size validation when walking chunks sctp: fix return value check in __sctp_rcv_asconf_lookup sctp: add param size validation for SCTP_PARAM_SET_PRIMARY sctp: validate chunk size in __rcv_asconf_lookup fs/seq_file.c | 3 +++ include/net/sctp/structs.h | 2 +- net/sctp/bind_addr.c | 19 +++++++++-------- net/sctp/input.c | 11 +++++++--- net/sctp/ipv6.c | 7 ++++++- net/sctp/protocol.c | 7 ++++++- net/sctp/sm_make_chunk.c | 42 +++++++++++++++++++++++--------------- 7 files changed, 61 insertions(+), 30 deletions(-) -- 2.22.0

1 6

[PATCH OpenHarmony-5.10 00/94] OpenHarmony-5.10 baseline patch 0806
by Yu Changchun 06 Aug '21

06 Aug '21

The following patches are for OpenHarmony 5.10 kernel. These patches refer to some bugfixes (ext4/sched/mm, etc) and 2 major features (arm kasan and kaslr with dependent patches). ------------------------------------------------------------- Ard Biesheuvel (33): ARM: 9028/1: disable KASAN in call stack capturing routines ARM: module: add support for place relative relocations ARM: p2v: move patching code to separate assembler source file ARM: p2v: factor out shared loop processing ARM: p2v: factor out BE8 handling ARM: p2v: drop redundant 'type' argument from __pv_stub ARM: p2v: use relative references in patch site arrays ARM: p2v: simplify __fixup_pv_table() ARM: p2v: switch to MOVW for Thumb2 and ARM/LPAE ARM: p2v: reduce p2v alignment requirement to 2 MiB ARM: head-common.S: use PC-relative insn sequence for __proc_info ARM: head-common.S: use PC-relative insn sequence for idmap creation ARM: head.S: use PC-relative insn sequence for secondary_data ARM: kernel: use relative references for UP/SMP alternatives ARM: head: use PC-relative insn sequence for __smp_alt ARM: sleep.S: use PC-relative insn sequence for sleep_save_sp/mpidr_hash ARM: head.S: use PC relative insn sequence to calculate PHYS_OFFSET ARM: kvm: replace open coded VA->PA calculations with adr_l call ARM: 9031/1: hyp-stub: remove unused .L__boot_cpu_mode_offset symbol asm-generic: add .data.rel.ro sections to __ro_after_init arm-soc: exynos: replace open coded VA->PA conversions arm-soc: mvebu: replace open coded VA->PA conversion arm-soc: various: replace open coded VA->PA calculation of pen_release ARM: kernel: switch to relative exception tables ARM: kernel: make vmlinux buildable as a PIE executable ARM: kernel: use PC-relative symbol references in MMU switch code ARM: kernel: use PC relative symbol references in suspend/resume code ARM: mm: export default vmalloc base address ARM: kernel: refer to swapper_pg_dir via its symbol arm: vectors: use local symbol names for vector entry points ARM: kernel: implement randomization of the kernel load address ARM: decompressor: explicitly map decompressor binary cacheable ARM: decompressor: add KASLR support Arnd Bergmann (1): ARM: kprobes: fix gcc-7 build warning Chen Jun (1): rockchip: Make cdn_dp_resume depend on CONFIG_PM_SLEEP Cheng Jian (1): sched, rt: fix isolated CPUs leaving task_group indefinitely throttled Cui GaoSheng (6): arm32: kaslr: Add missing sections about relocatable arm32: kaslr: Fix the bug of module install failure arm32: kaslr: Fix the bug of hidden symbols when decompressing code is compiled arm32: kaslr: Adapt dts files of multiple memory nodes arm32: kaslr: Fix the bug of symbols relocation arm32: kaslr: Print the real kaslr offset when kernel panic Fangrui Song (1): ARM: 9022/1: Change arch/arm/lib/mem*.S to use WEAK instead of .weak Gaosheng Cui (2): arm32: kaslr: Bugfix of fiq when enabled kaslr arm32: kaslr: Bugfix of BSS size calculation when enabled kaslr Gu Zheng (1): mtd: avoid blktrans_open/release race and avoid insmod ftl.ko deadlock Jan Kara (13): ext4: remove redundant sb checksum recomputation ext4: standardize error message in ext4_protect_reserved_inode() ext4: make ext4_abort() use __ext4_error() ext4: move functions in super.c ext4: simplify ext4 error translation ext4: defer saving error info from atomic context ext4: combine ext4_handle_error() and save_error_info() ext4: drop sync argument of ext4_commit_super() ext4: protect superblock modifications with a buffer lock ext4: save error info to sb through journal if available ext4: use sbi instead of EXT4_SB(sb) in ext4_update_super() ext4: drop ext4_handle_dirty_super() ext4: fix timer use-after-free on failed mount Jens Axboe (1): io_uring: convert io_buffer_idr to XArray JeongHyeon Lee (1): dm verity: allow only one error handling mode Kefeng Wang (2): mm, page_alloc: avoid page_to_pfn() in move_freepages() mm: Move HOLES_IN_ZONE into mm Li Bin (1): sched/deadline.c: pick and check task if double_lock_balance() unlock the rq Linus Walleij (5): ARM: 9013/2: Disable KASan instrumentation for some code ARM: 9014/2: Replace string mem* functions for KASan ARM: 9015/2: Define the virtual space of KASan's shadow region ARM: 9016/2: Initialize the mapping of KASan shadow memory ARM: 9017/2: Enable KASan for ARM Liu Shixin (1): mm/page_alloc: fix counting of managed_pages Lorenzo Stoakes (1): mm: page_alloc: refactor setup_per_zone_lowmem_reserve() Lu Jialin (1): cgroup: Return ERSCH when add Z process into task Matthew Wilcox (Oracle) (1): io_uring: Convert personality_idr to XArray Mauricio Faria de Oliveira (1): loop: fix I/O error on fsync() in detached loop devices Oscar Salvador (1): mm,hwpoison: return -EBUSY when migration fails Xie XiuQi (1): Document: add guideline to submitting patches to OpenHarmony kernel Xiongfeng Wang (3): PCI: add a member in 'struct pci_bus' to record the original 'pci_ops' PCI/AER: increments pci bus reference count in aer-inject process sysrq: avoid concurrently info printing by 'sysrq-trigger' Yang Jihong (1): arm_pmu: Fix write counter error in ARMv7 big-endian mode Yang Yingliang (1): drm/radeon: check the alloc_workqueue return value Ye Bin (6): arm32: kaslr: Add missing sections about relocatable arm: kaslr: Fix memtop calculate, when there is no memory top info, we can't use zero instead it. arm32: kaslr: When boot with vxboot, we must adjust dtb address before kaslr_early_init, and store dtb address after init. arm32: kaslr: pop visibility when compile decompress boot code as we need relocate BSS by GOT. arm32: kaslr: print kaslr offset when kernel panic arm32: kaslr: Fix clock_gettime and gettimeofday performance degradation when configure CONFIG_RANDOMIZE_BASE Yejune Deng (1): io_uring: simplify io_remove_personalities() Zefan Li (2): cgroup: check if cgroup root is alive in cgroupstats_show() cgroup: wait for cgroup destruction to complete when umount Zhou Chengming (1): sched/rt.c: pick and check task if double_lock_balance() unlock the rq liujian (1): driver: input: fix UBSAN warning in input_defuzz_abs_event yangerkun (1): proc: fix ubsan warning in mem_lseek zhangyi (F) (1): aio: add timeout validity check for io_[p]getevents Documentation/arm/memory.rst | 5 + Documentation/dev-tools/kasan.rst | 4 +- .../features/debug/KASAN/arch-support.txt | 2 +- README | 252 +++++++++ arch/arm/Kconfig | 29 +- arch/arm/Makefile | 6 + arch/arm/boot/compressed/Makefile | 19 +- arch/arm/boot/compressed/head.S | 154 +++++- arch/arm/boot/compressed/kaslr.c | 453 ++++++++++++++++ arch/arm/boot/compressed/misc.c | 1 - arch/arm/boot/compressed/string.c | 19 + arch/arm/include/asm/Kbuild | 1 - arch/arm/include/asm/assembler.h | 22 +- arch/arm/include/asm/elf.h | 5 + arch/arm/include/asm/extable.h | 47 ++ arch/arm/include/asm/futex.h | 6 +- arch/arm/include/asm/kasan.h | 33 ++ arch/arm/include/asm/kasan_def.h | 81 +++ arch/arm/include/asm/memory.h | 76 ++- arch/arm/include/asm/pgalloc.h | 8 +- arch/arm/include/asm/pgtable.h | 1 + arch/arm/include/asm/processor.h | 2 +- arch/arm/include/asm/string.h | 26 + arch/arm/include/asm/thread_info.h | 8 + arch/arm/include/asm/uaccess-asm.h | 2 +- arch/arm/include/asm/uaccess.h | 17 +- arch/arm/include/asm/vmlinux.lds.h | 13 +- arch/arm/include/asm/word-at-a-time.h | 6 +- arch/arm/kernel/Makefile | 4 + arch/arm/kernel/entry-armv.S | 44 +- arch/arm/kernel/entry-common.S | 9 +- arch/arm/kernel/fiq.c | 7 + arch/arm/kernel/head-common.S | 88 +--- arch/arm/kernel/head.S | 308 ++++------- arch/arm/kernel/hyp-stub.S | 33 +- arch/arm/kernel/module.c | 20 +- arch/arm/kernel/perf_event_v7.c | 4 +- arch/arm/kernel/phys2virt.S | 238 +++++++++ arch/arm/kernel/setup.c | 32 ++ arch/arm/kernel/sleep.S | 26 +- arch/arm/kernel/swp_emulate.c | 8 +- arch/arm/kernel/unwind.c | 6 +- arch/arm/kernel/vmlinux.lds.S | 19 + arch/arm/lib/backtrace.S | 13 +- arch/arm/lib/getuser.S | 24 +- arch/arm/lib/memcpy.S | 4 +- arch/arm/lib/memmove.S | 6 +- arch/arm/lib/memset.S | 4 +- arch/arm/lib/putuser.S | 15 +- arch/arm/mach-exynos/headsmp.S | 9 +- arch/arm/mach-exynos/sleep.S | 26 +- arch/arm/mach-mvebu/coherency_ll.S | 8 +- arch/arm/mach-prima2/headsmp.S | 11 +- arch/arm/mach-spear/headsmp.S | 11 +- arch/arm/mm/Makefile | 5 + arch/arm/mm/alignment.c | 24 +- arch/arm/mm/extable.c | 2 +- arch/arm/mm/kasan_init.c | 291 +++++++++++ arch/arm/mm/mmu.c | 21 +- arch/arm/mm/pgd.c | 16 +- arch/arm/nwfpe/entry.S | 6 +- arch/arm/plat-versatile/headsmp.S | 9 +- arch/arm/probes/kprobes/Makefile | 4 + arch/arm/vdso/Makefile | 2 + arch/arm/vdso/vgettimeofday.c | 5 + arch/arm64/Kconfig | 4 +- arch/ia64/Kconfig | 5 +- arch/mips/Kconfig | 3 - drivers/block/loop.c | 3 + drivers/gpu/drm/radeon/radeon_display.c | 7 +- drivers/gpu/drm/rockchip/cdn-dp-core.c | 2 + drivers/input/input.c | 13 +- drivers/md/dm-verity-target.c | 40 +- drivers/mtd/mtd_blkdevs.c | 31 +- drivers/mtd/mtdcore.c | 75 ++- drivers/mtd/mtdcore.h | 4 +- drivers/pci/bus.c | 2 + drivers/pci/pcie/aer_inject.c | 9 + drivers/pci/probe.c | 12 +- drivers/tty/sysrq.c | 6 + fs/aio.c | 11 +- fs/ext4/block_validity.c | 10 +- fs/ext4/ext4.h | 50 +- fs/ext4/ext4_jbd2.c | 21 +- fs/ext4/ext4_jbd2.h | 5 - fs/ext4/file.c | 5 +- fs/ext4/inode.c | 8 +- fs/ext4/namei.c | 10 +- fs/ext4/resize.c | 20 +- fs/ext4/super.c | 482 ++++++++++-------- fs/ext4/xattr.c | 5 +- fs/io_uring.c | 116 ++--- fs/proc/base.c | 32 +- fs/read_write.c | 5 - include/asm-generic/vmlinux.lds.h | 2 +- include/linux/cgroup-defs.h | 3 + include/linux/fs.h | 5 + include/linux/pci.h | 1 + kernel/cgroup/cgroup-v1.c | 8 +- kernel/cgroup/cgroup.c | 24 +- kernel/sched/deadline.c | 55 +- kernel/sched/rt.c | 66 ++- mm/Kconfig | 3 + mm/memory-failure.c | 6 +- mm/page_alloc.c | 61 +-- scripts/module.lds.S | 1 + scripts/sorttable.c | 2 +- 107 files changed, 2814 insertions(+), 1079 deletions(-) create mode 100644 arch/arm/boot/compressed/kaslr.c create mode 100644 arch/arm/include/asm/extable.h create mode 100644 arch/arm/include/asm/kasan.h create mode 100644 arch/arm/include/asm/kasan_def.h create mode 100644 arch/arm/kernel/phys2virt.S create mode 100644 arch/arm/mm/kasan_init.c -- 2.22.0

1 94

[PATCH OpenHarmony-4.19 00/17] OpenHarmony-4.19 cve bugfix 0731
by Yu Changchun 02 Aug '21

02 Aug '21

There are cves based on OpenHarmony-4.19 as follows: CVE-2021-21781 CVE-2021-22555 CVE-2021-35039 CVE-2021-3609 CVE-2021-34693 CVE-2021-32078 CVE-2021-33624 note CVE-2021-33624 has some bpf selftests pre-dependent patches. ----------------------------------- Alexei Starovoitov (1): bpf: extend is_branch_taken to registers Andrey Ignatov (1): selftests/bpf: Test narrow loads with off > 0 in test_verifier Daniel Borkmann (5): bpf, test_verifier: switch bpf_get_stack's 0 s> r8 test bpf: Update selftests to reflect new error states bpf: Inherit expanded/patched seen count from old aux data bpf: Do not mark insn as seen under speculative path verification bpf: Fix leakage under speculation on mispredicted branches Florian Westphal (1): netfilter: x_tables: fix compat match/target pad out-of-bound write John Fastabend (1): bpf: Test_verifier, bpf_get_stack return value add <0 Mimi Zohar (1): module: limit enabling module.sig_enforce Norbert Slusarek (1): can: bcm: fix infoleak in struct bcm_msg_head Ovidiu Panait (2): bpf: fix up selftests after backports were fixed selftests/bpf: add selftest part of "bpf: improve verifier branch analysis" Piotr Krysiuk (1): bpf, selftests: Fix up some test_verifier cases for unprivileged Russell King (2): ARM: footbridge: remove personal server platform ARM: ensure the signal page contains defined contents Thadeu Lima de Souza Cascardo (1): can: bcm: delay release of struct bcm_op after synchronize_rcu() arch/arm/configs/footbridge_defconfig | 1 - arch/arm/kernel/signal.c | 14 +-- arch/arm/mach-footbridge/Kconfig | 21 ---- arch/arm/mach-footbridge/Makefile | 2 - arch/arm/mach-footbridge/personal-pci.c | 58 ---------- arch/arm/mach-footbridge/personal.c | 25 ----- kernel/bpf/verifier.c | 95 +++++++++++++---- kernel/module.c | 9 ++ net/can/bcm.c | 10 +- net/ipv4/netfilter/arp_tables.c | 2 + net/ipv4/netfilter/ip_tables.c | 2 + net/ipv6/netfilter/ip6_tables.c | 2 + net/netfilter/x_tables.c | 10 +- tools/testing/selftests/bpf/test_verifier.c | 112 +++++++++++++++----- 14 files changed, 196 insertions(+), 167 deletions(-) delete mode 100644 arch/arm/mach-footbridge/personal-pci.c delete mode 100644 arch/arm/mach-footbridge/personal.c -- 2.22.0

2 34