From: Jessica Yu <jeyu(a)kernel.org>
stable inclusion
from linux-4.19.165
commit 74925430503eccee4ddf20f3b46a580ca6a72bab
category: bugfix
issue: #I468RF
CVE: NA
--------------------------------
[ Upstream commit 38dc717e97153e46375ee21797aa54777e5498f3 ]
Apparently there has been a longstanding race between udev/systemd and
the module loader. Currently, the module loader sends a uevent right
after sysfs initialization, but before the module calls its init
function. However, some udev rules expect that the module has
initialized already upon receiving the uevent.
This race has been triggered recently (see link in references) in some
systemd mount unit files. For instance, the configfs module creates the
/sys/kernel/config mount point in its init function, however the module
loader issues the uevent before this happens. sys-kernel-config.mount
expects to be able to mount /sys/kernel/config upon receipt of the
module loading uevent, but if the configfs module has not called its
init function yet, then this directory will not exist and the mount unit
fails. A similar situation exists for sys-fs-fuse-connections.mount, as
the fuse sysfs mount point is created during the fuse module's init
function. If udev is faster than module initialization then the mount
unit would fail in a similar fashion.
To fix this race, delay the module KOBJ_ADD uevent until after the
module has finished calling its init routine.
References: https://github.com/systemd/systemd/issues/17586
Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Tested-By: Nicolas Morey-Chaisemartin <nmoreychaisemartin(a)suse.com>
Signed-off-by: Jessica Yu <jeyu(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com>
Signed-off-by: Yu Changchun <yuchangchun1(a)huawei.com>
---
kernel/module.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/kernel/module.c b/kernel/module.c
index efa25f7b3..ff945a4ce 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1815,7 +1815,6 @@ static int mod_sysfs_init(struct module *mod)
if (err)
mod_kobject_put(mod);
- /* delay uevent until full sysfs population */
out:
return err;
}
@@ -1852,7 +1851,6 @@ static int mod_sysfs_setup(struct module *mod,
add_sect_attrs(mod, info);
add_notes_attrs(mod, info);
- kobject_uevent(&mod->mkobj.kobj, KOBJ_ADD);
return 0;
out_unreg_modinfo_attrs:
@@ -3508,6 +3506,9 @@ static noinline int do_init_module(struct module *mod)
blocking_notifier_call_chain(&module_notify_list,
MODULE_STATE_LIVE, mod);
+ /* Delay uevent until module has finished its init routine */
+ kobject_uevent(&mod->mkobj.kobj, KOBJ_ADD);
+
/*
* We need to finish all async code before the module init sequence
* is done. This has potential to deadlock. For example, a newly
--
2.25.1
There are cves based on OpenHarmony-4.19 as follows:
CVE-2021-21781
CVE-2021-22555
CVE-2021-35039
CVE-2021-3609
CVE-2021-34693
CVE-2021-32078
CVE-2021-33624
note CVE-2021-33624 has some bpf selftests pre-dependent patches.
-----------------------------------
Alexei Starovoitov (1):
bpf: extend is_branch_taken to registers
Andrey Ignatov (1):
selftests/bpf: Test narrow loads with off > 0 in test_verifier
Daniel Borkmann (5):
bpf, test_verifier: switch bpf_get_stack's 0 s> r8 test
bpf: Update selftests to reflect new error states
bpf: Inherit expanded/patched seen count from old aux data
bpf: Do not mark insn as seen under speculative path verification
bpf: Fix leakage under speculation on mispredicted branches
Florian Westphal (1):
netfilter: x_tables: fix compat match/target pad out-of-bound write
John Fastabend (1):
bpf: Test_verifier, bpf_get_stack return value add <0
Mimi Zohar (1):
module: limit enabling module.sig_enforce
Norbert Slusarek (1):
can: bcm: fix infoleak in struct bcm_msg_head
Ovidiu Panait (2):
bpf: fix up selftests after backports were fixed
selftests/bpf: add selftest part of "bpf: improve verifier branch
analysis"
Piotr Krysiuk (1):
bpf, selftests: Fix up some test_verifier cases for unprivileged
Russell King (2):
ARM: footbridge: remove personal server platform
ARM: ensure the signal page contains defined contents
Thadeu Lima de Souza Cascardo (1):
can: bcm: delay release of struct bcm_op after synchronize_rcu()
arch/arm/configs/footbridge_defconfig | 1 -
arch/arm/kernel/signal.c | 14 +--
arch/arm/mach-footbridge/Kconfig | 21 ----
arch/arm/mach-footbridge/Makefile | 2 -
arch/arm/mach-footbridge/personal-pci.c | 58 ----------
arch/arm/mach-footbridge/personal.c | 25 -----
kernel/bpf/verifier.c | 95 +++++++++++++----
kernel/module.c | 9 ++
net/can/bcm.c | 10 +-
net/ipv4/netfilter/arp_tables.c | 2 +
net/ipv4/netfilter/ip_tables.c | 2 +
net/ipv6/netfilter/ip6_tables.c | 2 +
net/netfilter/x_tables.c | 10 +-
tools/testing/selftests/bpf/test_verifier.c | 112 +++++++++++++++-----
14 files changed, 196 insertions(+), 167 deletions(-)
delete mode 100644 arch/arm/mach-footbridge/personal-pci.c
delete mode 100644 arch/arm/mach-footbridge/personal.c
--
2.22.0
There are cves based on OpenHarmony-4.19 as follows:
CVE: CVE-2021-3573
CVE: CVE-2021-0129
CVE: CVE-2021-0512
CVE: CVE-2021-3587
CVE: CVE-2021-3564
CVE: CVE-2020-36385
CVE: CVE-2021-33200
Daniel Borkmann (3):
bpf: Wrap aux data inside bpf_sanitize_info container
bpf: Fix mask direction swap upon off reg sign change
bpf: No need to simulate speculative domain for immediates
Jason Gunthorpe (1):
RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy
Krzysztof Kozlowski (1):
nfc: fix NULL ptr dereference in llcp_sock_getname() after failed
connect
Lin Ma (2):
Bluetooth: fix the erroneous flush_work() order
Bluetooth: use correct lock to prevent UAF of hdev object
Luiz Augusto von Dentz (1):
Bluetooth: SMP: Fail if remote and local public keys are identical
Will McVicker (1):
HID: make arrays usage and value to be the same
drivers/hid/hid-core.c | 6 +--
drivers/infiniband/core/ucma.c | 78 +++++++++++++---------------------
kernel/bpf/verifier.c | 46 ++++++++++++--------
net/bluetooth/hci_core.c | 7 ++-
net/bluetooth/hci_sock.c | 4 +-
net/bluetooth/smp.c | 9 ++++
net/nfc/llcp_sock.c | 2 +
7 files changed, 79 insertions(+), 73 deletions(-)
--
2.25.1