- 26 9月, 2021 40 次提交
-
-
由 Yonglong Liu 提交于
mainline inclusion from mainline-v5.14 commit b15c072a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I46N6O CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b15c072a9f4a404c09ad589477f4389034742a8b ---------------------------------------------------------------------- In bond 4, when the link goes down and up repeatedly, the bond may get an unknown speed, and then this port can not work. The driver notify netif_carrier_on() before update the link state, when the bond receive carrier on, will query the speed of the port, if the query operation happens before updating the link state, will get an unknown speed. So need to notify netif_carrier_on() after update the link state. Fixes: 46a3df9f ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support") Fixes: e2cb1dec ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support") Signed-off-by: NYonglong Liu <liuyonglong@huawei.com> Signed-off-by: NGuangbin Huang <huangguangbin2@huawei.com> Signed-off-by: NJakub Kicinski <kuba@kernel.org> Reviewed-by: NYongxin Li <liyongxin1@huawei.com> Signed-off-by: NJunxin Chen <chenjunxin1@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Yufeng Mo 提交于
mainline inclusion from mainline-v5.14 commit a96d9330 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I46N6O CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a96d9330b02a3d051ae689bc2c5e7d3a2ba25594 ---------------------------------------------------------------------- After the cmdq registers are cleared, the firmware may take time to clear out possible left over commands in the cmdq. Driver must release cmdq memory only after firmware has completed processing of left over commands. Fixes: 232d0d55 ("net: hns3: uninitialize command queue while unloading PF driver") Signed-off-by: NYufeng Mo <moyufeng@huawei.com> Signed-off-by: NGuangbin Huang <huangguangbin2@huawei.com> Signed-off-by: NJakub Kicinski <kuba@kernel.org> Reviewed-by: NYongxin Li <liyongxin1@huawei.com> Signed-off-by: NJunxin Chen <chenjunxin1@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Yufeng Mo 提交于
mainline inclusion from mainline-v5.14 commit 1a6d2819 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I46N6O CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1a6d281946c330cee2855f6d0cd796616e54601f ---------------------------------------------------------------------- If a PF is bonded to a virtual machine and the virtual machine exits unexpectedly, some hardware resource cannot be cleared. In this case, loading driver may cause exceptions. Therefore, the hardware resource needs to be cleared when the driver is loaded. Fixes: 46a3df9f ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support") Signed-off-by: NYufeng Mo <moyufeng@huawei.com> Signed-off-by: NSalil Mehta <salil.mehta@huawei.com> Signed-off-by: NGuangbin Huang <huangguangbin2@huawei.com> Signed-off-by: NJakub Kicinski <kuba@kernel.org> Reviewed-by: NYongxin Li <liyongxin1@huawei.com> Signed-off-by: NJunxin Chen <chenjunxin1@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Colin Ian King 提交于
mainline inclusion from mainline-master commit 0bc277cb category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I46N6O CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0bc277cb8234f8e6fcf8842e318e0873dd223565 ---------------------------------------------------------------------- Don't populate the array spec_opcode on the stack but instead it static const. Makes the object code smaller by 158 bytes: Before: text data bss dec hex filename 12271 3976 128 16375 3ff7 .../hisilicon/hns3/hns3pf/hclge_cmd.o After: text data bss dec hex filename 12017 4072 128 16217 3f59 .../hisilicon/hns3/hns3pf/hclge_cmd.o (gcc version 10.3.0) Signed-off-by: NColin Ian King <colin.king@canonical.com> Signed-off-by: NDavid S. Miller <davem@davemloft.net> Reviewed-by: NYongxin Li <liyongxin1@huawei.com> Signed-off-by: NJunxin Chen <chenjunxin1@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Disable digest list checks in non-root ima namespaces. Digest lists can be re-enabled when they are namespaced. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Introduce ima-ns-sig template: "d-ng|n-ng|ns|sig" Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- The build_appraise_rules may be a zero length array depends on the kernel configuration. This is (vaguely) forbidden in a standard and leads to the compiler optimisation where the address of the build_appraise_rules is the same as the default_appraise_rules. That leads to the unexpected flow in add_rules() where condition: if (entries != build_appraise_rules) is false for entries equal to default_appraise_rules. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Set ML template based on the ima_template string. It can be defined by the user through kcmd_for_children ima securityfs entry. Acceptable values are the same as for the ima_template kernel boot parameter. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Add dummy boot aggregate entry to the ima measurement list, for every new ima namespace, when the first process is born into that namespace. There is at most one TPM chip in the system and one measurement list associated to one of its PCRs. IMA namespace IDs can be re-used after namespace is destroyed. The per namespace boot aggregate entry marks the moment of the ima namespace creation. It is useful when host's root parses the global measurement list to find entries for destroyed containers. If the ima namespace ID is reused, the user will know, that the given entry belongs to a different container. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- If configured, load the x509 certificate when the first process is born into the new ima namespace. User can set the path to the certificate by writing to the x509_for_children entry in the ima securityfs. The certificate may be appraised in the parent ima namespace, in that case it may need to be signed with the parent ns' key. Appraisal of the key in the newly created namespace is disabled as for the original ima. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Add key domain tag to the search criteria in digsig module. If the domain tag is not set for the keys from the given keyring, it is set to NULL and the behaviour is unchanged. The key domain tag is added to the ima appraisal keys loaded to the system ima keyring. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Add key domain to the ima namespace. This will allow to bind the appraisal keys with the namespace and store all appraisal keys in the ima system keyring. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Add KEY_ALLOC_DOMAIN_* flags so that the key domain tag can be specified on the key creation. This is done to separate the key domain setting from the key type. If applied to the keyring, it will set the requested domain tag for every key added to that keyring. IMA uses the existing key_type_asymmetric for appraisal, but also has to specify the key domain to bind appraisal key with the ima namespace. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Add domain tag to the key_match_data. If set, check domain tag in the default match function and asymmetric keys match functions. This will allow to use the key domain tag in the search criteria for the iterative search, not only for the direct lookup that is based on the index key. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Add keyring_search_tag() version of keyring_search(), that allows to specify the key domain tag. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- If subject based rule is added to the policy before the user namespace uid mapping is defined, ID has to be recalculated. It can happen if the new user namespace is created alongside the new ima namespace. The default policy rules are loaded when the first process is born into the new ima namespace. In that case, user has no chance to define the mapping. It can also happen for the custom policy rules loaded from within the new ima namespace, before the mapping is created. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Add function that checks if the UID map is defined. It will be used by ima to check if ID remapping in subject-based rules is necessary. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Parse per ima namespace policy file. The path is passed as for the root ima namespace through the ima securityfs 'policy' entry. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Add ima securityfs entries to configure per ima namespace: - path to the x509 certificate - ima kernel boot parameters The x509 certificate will be parsed and loaded when the first process is born into the new ima namespace, paths are not validated when written. Kernel boot parameters are pre-parsed and applied when the first process is born into the new namespace. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- It's possible that the user first unshares the ima namespace and then creates a new user namespace using clone3(). In that case the owning user namespace is the newly created one, because it is associated with the first process in the new ima namespace. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- The violations are now tracked per namespace. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Add "others" permissions to the namespaced ima securityfs entries. It is necessary so that the root in the user namespace that is the parent of the given ima namespace has access to the ima related data. Loosened DAC restrictrions are compensated by an extra check for SYS_ADMIN capabilities in the ima code. The access is given only to the namespaced data, e.g. root user in the new ima namespace will see measurement list entries collected for that namespace and not for the other existing namespaces. The only exception is made for the admin in the initial user namespace, who has access to all the data. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- To detect ToMToU violations reader counter of the given inode is checked. This is not enough, because the reader may exist in a different ima namespace. Per inode reader counter tracks readers in all ima namespaces, whereas the per namespace counter is necessary to avoid false positives. Add a new reader counter to the integrity inode cache entry. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Modify ima securityfs interface, so that only measurement list entries that belong to the given ima namespace are visible/counted. The initial ima namespace is an exception, its processes have access to all measurement list entries. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Add a new ima-ns template: "d-ng|n-ng|ns" Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Compare the namespace id during the digest entry lookup. Remove digests from hash table when the namespace is destroyed, but keep the global measurement list entry. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Maintain per ima namespace measurement list. It will be used to provide information about the namespace measurements in securityfs and to clean up hash table entries when the namespace is destroyed. The global measurement list remains and is not modified. It is necessary to keep it so that the PCR value can be recreated. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Add ima namespace id to the ima_event_data and ima_template_entry. This is done so that the template entries can be tracked per ima namespace. The following patches will add new templates that will include the namespace id, but the namespace id has to be stored separately so that the namespace functionality is enabled for every template. After kexec, all entries from the old measurement list will be associated with the new root ima namespace. This will prevent users in the new ima namespaces from accessing the old entries if the ima namespace id is reused. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Set ima policy per namespace and remove the global settings. Operations on the objects may now have impact in more than one ima namespace and therefore iterate all active ima namespaces when necessary. Read-write violations can now happen across namespaces and should be checked in all namespaces for each relevant ima hook. Inform all concerned ima namespaces about the actions on the objects when the object is freed. E.g. if an object had been appraised in the ima_ns_1 and then modified in the ima_ns_2, appraised flag in the ima_ns_1 is cleared and the object will be re-appraised in the ima_ns_1 namespace. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Add an iint tree to the ima namespace. Each namespace should track operations on its objects separately. Per namespace iint tree is not yet used, it will be done in the following patches. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Inode integrity cache will be maintained per ima namespace. Add new functions that allow to specify the iint tree to use. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Add ima namespace pointer to the input parameters of the relevant functions. This is a preparation for the policy namespacing, more functions may be modified later, when other aspects of the ima are namespaced. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- IMA subsystem is configured at boot time using kernel command-line parameters, e.g.: ima_policy=tcb|appraise_tcb|secure_boot. The same configuration options should be available for the new ima namespace. Add new functions to parse configuration string and store parsed data in the new policy data structures. Don't implement it yet, just add the dummy interface. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Collate global variables describing the ima policy in one structure and add it to the ima namespace. Collate setup data (parsed kernel boot parameters) in a separate structure. Per namespace policy is not yet properly set and it is not used. This will be done in the following patches. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- IMA namespace reference will be required in ima_file_free() to check the policy and find inode integrity data for the correct ima namespace. ima_file_free() is called on __fput(), and __fput() may be called after releasing namespaces in exit_task_namespaces() in do_exit() and therefore nsproxy reference cannot be used - it is already set to NULL. This is a preparation for namespacing policy and inode integrity data. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- Add a list of the installed ima namespaces. IMA namespace is considered installed, if there is at least one process born in that namespace. This list will be used to check the read-write violations and to detect any object related changes relevant across namespaces. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Krzysztof Struczynski 提交于
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA -------------------------------- IMA namespace wraps global ima resources in an abstraction, to enable ima to work with the containers. Currently, ima namespace contains no useful data but a dummy interface. IMA resources related to different aspects of IMA, namely IMA-audit, IMA-measurement, IMA-appraisal will be added in the following patches. The way how ima namespace is created is analogous to the time namespace: unshare(CLONE_NEWIMA) system call creates a new ima namespace but doesn't assign it to the current process. All children of the process will be born in the new ima namespace, or a process can use setns() system call to join the new ima namespace. Call to clone3(CLONE_NEWIMA) system call creates a new namespace, which the new process joins instantly. This scheme, allows to configure the new ima namespace before any process appears in it. If user initially unshares the new ima namespace, ima can be configured using ima entries in the securityfs. If user calls clone3() system call directly, the new ima namespace can be configured using clone arguments. To allow this, new securityfs entries have to be added, and structures clone_args and kernel_clone_args have to be extended. Early configuration is crucial. The new ima polices must apply to the first process in the new namespace, and the appraisal key has to be loaded beforehand. Add a new CONFIG_IMA_NS option to the kernel configuration, that enables one to create a new IMA namespace. IMA namespace functionality is disabled by default. Signed-off-by: NKrzysztof Struczynski <krzysztof.struczynski@huawei.com> Reviewed-by: NZhang Tianxing <zhangtianxing3@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Chuck Lever 提交于
mainline inclusion from mainline-5.14-rc2 commit 06147843 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I3ZVL2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=061478438d04779181c2ce4d7ffeeca343a70a98 ------------------------------------------------- The author of commit b3b64ebd ("mm/page_alloc: do bulk array bounds check after checking populated elements") was possibly confused by the mixture of return values throughout the function. The API contract is clear that the function "Returns the number of pages on the list or array." It does not list zero as a unique return value with a special meaning. Therefore zero is a plausible return value only if @nr_pages is zero or less. Clean up the return logic to make it clear that the returned value is always the total number of pages in the array/list, not the number of pages that were allocated during this call. The only change in behavior with this patch is the value returned if prepare_alloc_pages() fails. To match the API contract, the number of pages currently in the array/list is returned in this case. The call site in __page_pool_alloc_pages_slow() also seems to be confused on this matter. It should be attended to by someone who is familiar with that code. [mel@techsingularity.net: Return nr_populated if 0 pages are requested] Link: https://lkml.kernel.org/r/20210713152100.10381-4-mgorman@techsingularity.netSigned-off-by: NChuck Lever <chuck.lever@oracle.com> Signed-off-by: NMel Gorman <mgorman@techsingularity.net> Acked-by: NJesper Dangaard Brouer <brouer@redhat.com> Cc: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com> Cc: Zhang Qiang <Qiang.Zhang@windriver.com> Cc: Yanfei Xu <yanfei.xu@windriver.com> Cc: Matteo Croce <mcroce@microsoft.com> Signed-off-by: NAndrew Morton <akpm@linux-foundation.org> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit 06147843) Signed-off-by: NYongqiang Liu <liuyongqiang13@huawei.com> Reviewed-by: Ntong tiangen <tongtiangen@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Yanfei Xu 提交于
mainline inclusion from mainline-5.14-rc2 commit e5c15cea category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I3ZVL2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e5c15cea339115edf99dc92282865f173cf84510 ------------------------------------------------- If the array passed in is already partially populated, we should return "nr_populated" even failing at preparing arguments stage. Link: https://lkml.kernel.org/r/20210713152100.10381-3-mgorman@techsingularity.netSigned-off-by: NYanfei Xu <yanfei.xu@windriver.com> Signed-off-by: NMel Gorman <mgorman@techsingularity.net> Link: https://lore.kernel.org/r/20210709102855.55058-1-yanfei.xu@windriver.comSigned-off-by: NAndrew Morton <akpm@linux-foundation.org> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit e5c15cea) Signed-off-by: NYongqiang Liu <liuyongqiang13@huawei.com> Reviewed-by: Ntong tiangen <tongtiangen@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Mel Gorman 提交于
mainline inclusion from mainline-5.14-rc2 commit 187ad460 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I3ZVL2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=187ad460b8413e863c951998cb321a117a717868 ------------------------------------------------- Syzbot is reporting potential deadlocks due to pagesets.lock when PAGE_OWNER is enabled. One example from Desmond Cheong Zhi Xi is as follows __alloc_pages_bulk() local_lock_irqsave(&pagesets.lock, flags) <---- outer lock here prep_new_page(): post_alloc_hook(): set_page_owner(): __set_page_owner(): save_stack(): stack_depot_save(): alloc_pages(): alloc_page_interleave(): __alloc_pages(): get_page_from_freelist(): rm_queue(): rm_queue_pcplist(): local_lock_irqsave(&pagesets.lock, flags); *** DEADLOCK *** Zhang, Qiang also reported BUG: sleeping function called from invalid context at mm/page_alloc.c:5179 in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 1, name: swapper/0 ..... __dump_stack lib/dump_stack.c:79 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:96 ___might_sleep.cold+0x1f1/0x237 kernel/sched/core.c:9153 prepare_alloc_pages+0x3da/0x580 mm/page_alloc.c:5179 __alloc_pages+0x12f/0x500 mm/page_alloc.c:5375 alloc_page_interleave+0x1e/0x200 mm/mempolicy.c:2147 alloc_pages+0x238/0x2a0 mm/mempolicy.c:2270 stack_depot_save+0x39d/0x4e0 lib/stackdepot.c:303 save_stack+0x15e/0x1e0 mm/page_owner.c:120 __set_page_owner+0x50/0x290 mm/page_owner.c:181 prep_new_page mm/page_alloc.c:2445 [inline] __alloc_pages_bulk+0x8b9/0x1870 mm/page_alloc.c:5313 alloc_pages_bulk_array_node include/linux/gfp.h:557 [inline] vm_area_alloc_pages mm/vmalloc.c:2775 [inline] __vmalloc_area_node mm/vmalloc.c:2845 [inline] __vmalloc_node_range+0x39d/0x960 mm/vmalloc.c:2947 __vmalloc_node mm/vmalloc.c:2996 [inline] vzalloc+0x67/0x80 mm/vmalloc.c:3066 There are a number of ways it could be fixed. The page owner code could be audited to strip GFP flags that allow sleeping but it'll impair the functionality of PAGE_OWNER if allocations fail. The bulk allocator could add a special case to release/reacquire the lock for prep_new_page and lookup PCP after the lock is reacquired at the cost of performance. The pages requiring prep could be tracked using the least significant bit and looping through the array although it is more complicated for the list interface. The options are relatively complex and the second one still incurs a performance penalty when PAGE_OWNER is active so this patch takes the simple approach -- disable bulk allocation of PAGE_OWNER is active. The caller will be forced to allocate one page at a time incurring a performance penalty but PAGE_OWNER is already a performance penalty. Link: https://lkml.kernel.org/r/20210708081434.GV3840@techsingularity.net Fixes: dbbee9d5 ("mm/page_alloc: convert per-cpu list protection to local_lock") Signed-off-by: NMel Gorman <mgorman@techsingularity.net> Reported-by: NDesmond Cheong Zhi Xi <desmondcheongzx@gmail.com> Reported-by: N"Zhang, Qiang" <Qiang.Zhang@windriver.com> Reported-by: syzbot+127fd7828d6eeb611703@syzkaller.appspotmail.com Tested-by: syzbot+127fd7828d6eeb611703@syzkaller.appspotmail.com Acked-by: NRafael Aquini <aquini@redhat.com> Cc: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: NAndrew Morton <akpm@linux-foundation.org> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org> Signed-off-by: NYongqiang Liu <liuyongqiang13@huawei.com> Reviewed-by: Ntong tiangen <tongtiangen@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-