November 2023 - Linux-stable-mirror

stable-rc/queue/5.15 baseline: 142 runs, 4 regressions (v5.15.139-172-gb60494a37c0c)

by kernelci.org bot

stable-rc/queue/5.15 baseline: 142 runs, 4 regressions (v5.15.139-172-gb60494a37c0c) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions --------------------+-------+---------------+----------+--------------------+------------ qemu_arm-virt-gicv2 | arm | lab-baylibre | gcc-10 | multi_v7_defconfig | 1 r8a77960-ulcb | arm64 | lab-collabora | gcc-10 | defconfig | 1 sun50i-h6-pine-h64 | arm64 | lab-clabbe | gcc-10 | defconfig | 1 sun50i-h6-pine-h64 | arm64 | lab-collabora | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F5.15/kernel/v5.15.13… Test: baseline Tree: stable-rc Branch: queue/5.15 Describe: v5.15.139-172-gb60494a37c0c URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: b60494a37c0cc3a25cf54580748c08d8e36e92ee Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions --------------------+-------+---------------+----------+--------------------+------------ qemu_arm-virt-gicv2 | arm | lab-baylibre | gcc-10 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/655e0b9a9a14a99e157e4a6f Results: 0 PASS, 1 FAIL, 0 SKIP Full config: multi_v7_defconfig Compiler: gcc-10 (arm-linux-gnueabihf-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.139-172-gb60494a37… HTML log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.139-172-gb60494a37… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0b9a9a14a99e157e4a70 new failure (last pass: v5.15.114-13-g095e387c3889) platform | arch | lab | compiler | defconfig | regressions --------------------+-------+---------------+----------+--------------------+------------ r8a77960-ulcb | arm64 | lab-collabora | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/655e09d9cac48bea247e4a70 Results: 4 PASS, 2 FAIL, 1 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.139-172-gb60494a37… HTML log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.139-172-gb60494a37… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/655e09d9cac48bea247e4a79 new failure (last pass: v5.15.114-13-g095e387c3889) 2023-11-22T14:08:24.456846 / # # 2023-11-22T14:08:24.558569 export SHELL=/bin/sh 2023-11-22T14:08:24.558812 # 2023-11-22T14:08:24.659340 / # export SHELL=/bin/sh. /lava-12059227/environment 2023-11-22T14:08:24.659602 2023-11-22T14:08:24.760295 / # . /lava-12059227/environment/lava-12059227/bin/lava-test-runner /lava-12059227/1 2023-11-22T14:08:24.761445 2023-11-22T14:08:24.765678 / # /lava-12059227/bin/lava-test-runner /lava-12059227/1 2023-11-22T14:08:24.828348 + export 'TESTRUN_ID=1_bootrr' 2023-11-22T14:08:24.828856 + cd /lav<8>[ 16.067872] <LAVA_SIGNAL_STARTRUN 1_bootrr 12059227_1.5.2.4.5> ... (28 line(s) more) platform | arch | lab | compiler | defconfig | regressions --------------------+-------+---------------+----------+--------------------+------------ sun50i-h6-pine-h64 | arm64 | lab-clabbe | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/655e09d8d04ebc4db37e4a7f Results: 5 PASS, 1 FAIL, 1 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.139-172-gb60494a37… HTML log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.139-172-gb60494a37… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/655e09d8d04ebc4db37e4a88 new failure (last pass: v5.15.105-206-g4548859116b8) 2023-11-22T14:01:51.768508 <8>[ 16.148541] <LAVA_SIGNAL_ENDRUN 0_dmesg 444835_1.5.2.4.1> 2023-11-22T14:01:51.873527 / # # 2023-11-22T14:01:51.975171 export SHELL=/bin/sh 2023-11-22T14:01:51.975793 # 2023-11-22T14:01:52.076784 / # export SHELL=/bin/sh. /lava-444835/environment 2023-11-22T14:01:52.077360 2023-11-22T14:01:52.178392 / # . /lava-444835/environment/lava-444835/bin/lava-test-runner /lava-444835/1 2023-11-22T14:01:52.179257 2023-11-22T14:01:52.183858 / # /lava-444835/bin/lava-test-runner /lava-444835/1 2023-11-22T14:01:52.215904 + export 'TESTRUN_ID=1_bootrr' ... (11 line(s) more) platform | arch | lab | compiler | defconfig | regressions --------------------+-------+---------------+----------+--------------------+------------ sun50i-h6-pine-h64 | arm64 | lab-collabora | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/655e09edd04ebc4db37e4a95 Results: 5 PASS, 1 FAIL, 1 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.139-172-gb60494a37… HTML log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.139-172-gb60494a37… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/655e09edd04ebc4db37e4a9e new failure (last pass: v5.15.105-206-g4548859116b8) 2023-11-22T14:08:37.256903 / # # 2023-11-22T14:08:37.358557 export SHELL=/bin/sh 2023-11-22T14:08:37.358769 # 2023-11-22T14:08:37.459404 / # export SHELL=/bin/sh. /lava-12059234/environment 2023-11-22T14:08:37.459615 2023-11-22T14:08:37.560166 / # . /lava-12059234/environment/lava-12059234/bin/lava-test-runner /lava-12059234/1 2023-11-22T14:08:37.560482 2023-11-22T14:08:37.601513 / # /lava-12059234/bin/lava-test-runner /lava-12059234/1 2023-11-22T14:08:37.634147 + export 'TESTRUN_ID=1_bootrr' 2023-11-22T14:08:37.634651 + cd /lava-1205923<8>[ 16.835830] <LAVA_SIGNAL_STARTRUN 1_bootrr 12059234_1.5.2.4.5> ... (10 line(s) more)

1 year, 5 months

1
0
0 0

stable-rc/queue/4.14 baseline: 116 runs, 24 regressions (v4.14.330-29-geb49d51a5785)

by kernelci.org bot

stable-rc/queue/4.14 baseline: 116 runs, 24 regressions (v4.14.330-29-geb49d51a5785) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv2 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv2 | arm64 | lab-baylibre | gcc-10 | defconfig+arm64-chromebook | 1 qemu_arm64-virt-gicv2 | arm64 | lab-broonie | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv2 | arm64 | lab-broonie | gcc-10 | defconfig+arm64-chromebook | 1 qemu_arm64-virt-gicv2 | arm64 | lab-collabora | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv2 | arm64 | lab-collabora | gcc-10 | defconfig+arm64-chromebook | 1 qemu_arm64-virt-gicv2-uefi | arm64 | lab-baylibre | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv2-uefi | arm64 | lab-baylibre | gcc-10 | defconfig+arm64-chromebook | 1 qemu_arm64-virt-gicv2-uefi | arm64 | lab-broonie | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv2-uefi | arm64 | lab-broonie | gcc-10 | defconfig+arm64-chromebook | 1 qemu_arm64-virt-gicv2-uefi | arm64 | lab-collabora | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv2-uefi | arm64 | lab-collabora | gcc-10 | defconfig+arm64-chromebook | 1 qemu_arm64-virt-gicv3 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv3 | arm64 | lab-baylibre | gcc-10 | defconfig+arm64-chromebook | 1 qemu_arm64-virt-gicv3 | arm64 | lab-broonie | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv3 | arm64 | lab-broonie | gcc-10 | defconfig+arm64-chromebook | 1 qemu_arm64-virt-gicv3 | arm64 | lab-collabora | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv3 | arm64 | lab-collabora | gcc-10 | defconfig+arm64-chromebook | 1 qemu_arm64-virt-gicv3-uefi | arm64 | lab-baylibre | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv3-uefi | arm64 | lab-baylibre | gcc-10 | defconfig+arm64-chromebook | 1 qemu_arm64-virt-gicv3-uefi | arm64 | lab-broonie | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv3-uefi | arm64 | lab-broonie | gcc-10 | defconfig+arm64-chromebook | 1 qemu_arm64-virt-gicv3-uefi | arm64 | lab-collabora | gcc-10 | defconfig | 1 qemu_arm64-virt-gicv3-uefi | arm64 | lab-collabora | gcc-10 | defconfig+arm64-chromebook | 1 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F4.14/kernel/v4.14.33… Test: baseline Tree: stable-rc Branch: queue/4.14 Describe: v4.14.330-29-geb49d51a5785 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: eb49d51a5785e08e9cd51a1e1acd9804830dc60f Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv2 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/655e0a582e2f1031447e4a8f Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0a582e2f1031447e4a90 failing since 561 days (last pass: v4.14.277-54-gfa6de16ffc4e, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv2 | arm64 | lab-baylibre | gcc-10 | defconfig+arm64-chromebook | 1 Details: https://kernelci.org/test/plan/id/655e0abc5cb1bd757b7e4b2c Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig+arm64-chromebook Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0abc5cb1bd757b7e4b2d failing since 561 days (last pass: v4.14.277-54-gf277f09f64f4, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv2 | arm64 | lab-broonie | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/655e0a64f22cf832e37e4a78 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0a64f22cf832e37e4a79 failing since 561 days (last pass: v4.14.277-54-gfa6de16ffc4e, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv2 | arm64 | lab-broonie | gcc-10 | defconfig+arm64-chromebook | 1 Details: https://kernelci.org/test/plan/id/655e0cb25978705cdd7e4a72 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig+arm64-chromebook Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0cb25978705cdd7e4a73 failing since 561 days (last pass: v4.14.277-54-gf277f09f64f4, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv2 | arm64 | lab-collabora | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/655e0a5d168b9621dc7e4ac7 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0a5d168b9621dc7e4ac8 failing since 561 days (last pass: v4.14.277-54-gfa6de16ffc4e, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv2 | arm64 | lab-collabora | gcc-10 | defconfig+arm64-chromebook | 1 Details: https://kernelci.org/test/plan/id/655e0c01264fca114d7e4abe Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig+arm64-chromebook Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0c01264fca114d7e4abf failing since 561 days (last pass: v4.14.277-54-gf277f09f64f4, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv2-uefi | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/655e0a592e2f1031447e4a92 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0a592e2f1031447e4a93 failing since 561 days (last pass: v4.14.277-54-gfa6de16ffc4e, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv2-uefi | arm64 | lab-baylibre | gcc-10 | defconfig+arm64-chromebook | 1 Details: https://kernelci.org/test/plan/id/655e0abe28c320c9127e4ab9 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig+arm64-chromebook Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0abe28c320c9127e4aba failing since 561 days (last pass: v4.14.277-54-gf277f09f64f4, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv2-uefi | arm64 | lab-broonie | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/655e0a9d5cb1bd757b7e4a6f Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0a9d5cb1bd757b7e4a70 failing since 561 days (last pass: v4.14.277-54-gfa6de16ffc4e, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv2-uefi | arm64 | lab-broonie | gcc-10 | defconfig+arm64-chromebook | 1 Details: https://kernelci.org/test/plan/id/655e0d2ea38b43a46f7e4a7c Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig+arm64-chromebook Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0d2ea38b43a46f7e4a7d failing since 561 days (last pass: v4.14.277-54-gf277f09f64f4, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv2-uefi | arm64 | lab-collabora | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/655e0a6ff6881f3d2d7e4ac5 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0a6ff6881f3d2d7e4ac6 failing since 561 days (last pass: v4.14.277-54-gfa6de16ffc4e, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv2-uefi | arm64 | lab-collabora | gcc-10 | defconfig+arm64-chromebook | 1 Details: https://kernelci.org/test/plan/id/655e0c1698a457a96d7e4b28 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig+arm64-chromebook Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0c1698a457a96d7e4b29 failing since 561 days (last pass: v4.14.277-54-gf277f09f64f4, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv3 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/655e0a5a168b9621dc7e4abf Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0a5a168b9621dc7e4ac0 failing since 561 days (last pass: v4.14.277-54-gfa6de16ffc4e, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv3 | arm64 | lab-baylibre | gcc-10 | defconfig+arm64-chromebook | 1 Details: https://kernelci.org/test/plan/id/655e0abd28c320c9127e4ab6 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig+arm64-chromebook Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0abd28c320c9127e4ab7 failing since 561 days (last pass: v4.14.277-54-gf277f09f64f4, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv3 | arm64 | lab-broonie | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/655e0b54f207a85db27e4b00 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0b54f207a85db27e4b01 failing since 561 days (last pass: v4.14.277-54-gfa6de16ffc4e, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv3 | arm64 | lab-broonie | gcc-10 | defconfig+arm64-chromebook | 1 Details: https://kernelci.org/test/plan/id/655e0cbc50307c691f7e4a7c Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig+arm64-chromebook Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0cbc50307c691f7e4a7d failing since 561 days (last pass: v4.14.277-54-gf277f09f64f4, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv3 | arm64 | lab-collabora | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/655e0a85f6881f3d2d7e4b31 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0a85f6881f3d2d7e4b32 failing since 561 days (last pass: v4.14.277-54-gfa6de16ffc4e, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv3 | arm64 | lab-collabora | gcc-10 | defconfig+arm64-chromebook | 1 Details: https://kernelci.org/test/plan/id/655e0c1598a457a96d7e4b25 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig+arm64-chromebook Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0c1598a457a96d7e4b26 failing since 561 days (last pass: v4.14.277-54-gf277f09f64f4, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv3-uefi | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/655e0a5b168b9621dc7e4ac4 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0a5b168b9621dc7e4ac5 failing since 561 days (last pass: v4.14.277-54-gfa6de16ffc4e, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv3-uefi | arm64 | lab-baylibre | gcc-10 | defconfig+arm64-chromebook | 1 Details: https://kernelci.org/test/plan/id/655e0ac0e28e11b1287e4a95 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig+arm64-chromebook Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0ac0e28e11b1287e4a96 failing since 561 days (last pass: v4.14.277-54-gf277f09f64f4, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv3-uefi | arm64 | lab-broonie | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/655e0b7c3a71f1e2fd7e4a8f Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0b7c3a71f1e2fd7e4a90 failing since 561 days (last pass: v4.14.277-54-gfa6de16ffc4e, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv3-uefi | arm64 | lab-broonie | gcc-10 | defconfig+arm64-chromebook | 1 Details: https://kernelci.org/test/plan/id/655e0d2fcbe90fff807e4a7c Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig+arm64-chromebook Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0d2fcbe90fff807e4a7d failing since 561 days (last pass: v4.14.277-54-gf277f09f64f4, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv3-uefi | arm64 | lab-collabora | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/655e0b752a237f38487e4b65 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0b752a237f38487e4b66 failing since 561 days (last pass: v4.14.277-54-gfa6de16ffc4e, first fail: v4.14.277-75-g7a298ff98d4a) platform | arch | lab | compiler | defconfig | regressions ---------------------------+-------+---------------+----------+----------------------------+------------ qemu_arm64-virt-gicv3-uefi | arm64 | lab-collabora | gcc-10 | defconfig+arm64-chromebook | 1 Details: https://kernelci.org/test/plan/id/655e0c291d39fdfe017e4a75 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig+arm64-chromebook Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.330-29-geb49d51a57… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/655e0c291d39fdfe017e4a76 failing since 561 days (last pass: v4.14.277-54-gf277f09f64f4, first fail: v4.14.277-75-g7a298ff98d4a)

1 year, 5 months

1
0
0 0

FAILED: patch "[PATCH] apparmor: Fix regression in mount mediation" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 157a3537d6bc28ceb9a11fc8cb67f2152d860146 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023112237-headsman-unshackle-d1e3@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: 157a3537d6bc ("apparmor: Fix regression in mount mediation") 90c436a64a6e ("apparmor: pass cred through to audit info.") d20f5a1a6e79 ("apparmor: rename audit_data->label to audit_data->subj_label") bd7bd201ca46 ("apparmor: combine common_audit_data and apparmor_audit_data") 25ff0ff2d628 ("apparmor: Fix kernel-doc warnings in apparmor/policy.c") 13c1748e2170 ("apparmor: Fix kernel-doc warnings in apparmor/resource.c") 892148228611 ("apparmor: Fix kernel-doc warnings in apparmor/lib.c") 26c9ecb34f5f ("apparmor: Fix kernel-doc warnings in apparmor/audit.c") 76862af5d1ad ("apparmor: fix kernel-doc complaints") 665b1856dc23 ("apparmor: Fix loading of child before parent") 2f7a29debae2 ("apparmor: remove useless static inline functions") 65f7f666f21c ("apparmor: make __aa_path_perm() static") 1ad22fcc4d0d ("apparmor: rework profile->rules to be a list") 217af7e2f4de ("apparmor: refactor profile rules and attachments") 3bf3d728a58d ("apparmor: verify loaded permission bits masks don't overlap") 3dfd16ab697f ("apparmor: cleanup: move perm accumulation into perms.h") 0bece4fa97a2 ("apparmor: make sure perm indexes are accumulated") 670f31774ab6 ("apparmor: verify permission table indexes") 371e50a0b19f ("apparmor: make unpack_array return a trianary value") ad596ea74e74 ("apparmor: group dfa policydb unpacking") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 157a3537d6bc28ceb9a11fc8cb67f2152d860146 Mon Sep 17 00:00:00 2001 From: John Johansen <john.johansen(a)canonical.com> Date: Sun, 10 Sep 2023 03:35:22 -0700 Subject: [PATCH] apparmor: Fix regression in mount mediation commit 2db154b3ea8e ("vfs: syscall: Add move_mount(2) to move mounts around") introduced a new move_mount(2) system call and a corresponding new LSM security_move_mount hook but did not implement this hook for any existing LSM. This creates a regression for AppArmor mediation of mount. This patch provides a base mapping of the move_mount syscall to the existing mount mediation. In the future we may introduce additional mediations around the new mount calls. Fixes: 2db154b3ea8e ("vfs: syscall: Add move_mount(2) to move mounts around") CC: stable(a)vger.kernel.org Reported-by: Andreas Steinmetz <anstein99(a)googlemail.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> diff --git a/security/apparmor/include/mount.h b/security/apparmor/include/mount.h index 10c76f906a65..46834f828179 100644 --- a/security/apparmor/include/mount.h +++ b/security/apparmor/include/mount.h @@ -38,9 +38,12 @@ int aa_mount_change_type(const struct cred *subj_cred, struct aa_label *label, const struct path *path, unsigned long flags); +int aa_move_mount_old(const struct cred *subj_cred, + struct aa_label *label, const struct path *path, + const char *old_name); int aa_move_mount(const struct cred *subj_cred, - struct aa_label *label, const struct path *path, - const char *old_name); + struct aa_label *label, const struct path *from_path, + const struct path *to_path); int aa_new_mount(const struct cred *subj_cred, struct aa_label *label, const char *dev_name, diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index ce4f3e7a784d..b047d1d355a9 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -722,8 +722,8 @@ static int apparmor_sb_mount(const char *dev_name, const struct path *path, error = aa_mount_change_type(current_cred(), label, path, flags); else if (flags & MS_MOVE) - error = aa_move_mount(current_cred(), label, path, - dev_name); + error = aa_move_mount_old(current_cred(), label, path, + dev_name); else error = aa_new_mount(current_cred(), label, dev_name, path, type, flags, data); @@ -733,6 +733,21 @@ static int apparmor_sb_mount(const char *dev_name, const struct path *path, return error; } +static int apparmor_move_mount(const struct path *from_path, + const struct path *to_path) +{ + struct aa_label *label; + int error = 0; + + label = __begin_current_label_crit_section(); + if (!unconfined(label)) + error = aa_move_mount(current_cred(), label, from_path, + to_path); + __end_current_label_crit_section(label); + + return error; +} + static int apparmor_sb_umount(struct vfsmount *mnt, int flags) { struct aa_label *label; @@ -1376,6 +1391,7 @@ static struct security_hook_list apparmor_hooks[] __ro_after_init = { LSM_HOOK_INIT(capget, apparmor_capget), LSM_HOOK_INIT(capable, apparmor_capable), + LSM_HOOK_INIT(move_mount, apparmor_move_mount), LSM_HOOK_INIT(sb_mount, apparmor_sb_mount), LSM_HOOK_INIT(sb_umount, apparmor_sb_umount), LSM_HOOK_INIT(sb_pivotroot, apparmor_sb_pivotroot), diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c index 3455dd4b1f99..fb30204c761a 100644 --- a/security/apparmor/mount.c +++ b/security/apparmor/mount.c @@ -483,36 +483,46 @@ int aa_mount_change_type(const struct cred *subj_cred, } int aa_move_mount(const struct cred *subj_cred, - struct aa_label *label, const struct path *path, - const char *orig_name) + struct aa_label *label, const struct path *from_path, + const struct path *to_path) { struct aa_profile *profile; - char *buffer = NULL, *old_buffer = NULL; - struct path old_path; + char *to_buffer = NULL, *from_buffer = NULL; int error; AA_BUG(!label); - AA_BUG(!path); + AA_BUG(!from_path); + AA_BUG(!to_path); + + to_buffer = aa_get_buffer(false); + from_buffer = aa_get_buffer(false); + error = -ENOMEM; + if (!to_buffer || !from_buffer) + goto out; + error = fn_for_each_confined(label, profile, + match_mnt(subj_cred, profile, to_path, to_buffer, + from_path, from_buffer, + NULL, MS_MOVE, NULL, false)); +out: + aa_put_buffer(to_buffer); + aa_put_buffer(from_buffer); + + return error; +} + +int aa_move_mount_old(const struct cred *subj_cred, struct aa_label *label, + const struct path *path, const char *orig_name) +{ + struct path old_path; + int error; if (!orig_name || !*orig_name) return -EINVAL; - error = kern_path(orig_name, LOOKUP_FOLLOW, &old_path); if (error) return error; - buffer = aa_get_buffer(false); - old_buffer = aa_get_buffer(false); - error = -ENOMEM; - if (!buffer || !old_buffer) - goto out; - error = fn_for_each_confined(label, profile, - match_mnt(subj_cred, profile, path, buffer, &old_path, - old_buffer, - NULL, MS_MOVE, NULL, false)); -out: - aa_put_buffer(buffer); - aa_put_buffer(old_buffer); + error = aa_move_mount(subj_cred, label, &old_path, path); path_put(&old_path); return error;

1 year, 5 months

1
0
0 0

FAILED: patch "[PATCH] apparmor: Fix regression in mount mediation" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 157a3537d6bc28ceb9a11fc8cb67f2152d860146 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023112236-payphone-economic-a97d@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: 157a3537d6bc ("apparmor: Fix regression in mount mediation") 90c436a64a6e ("apparmor: pass cred through to audit info.") d20f5a1a6e79 ("apparmor: rename audit_data->label to audit_data->subj_label") bd7bd201ca46 ("apparmor: combine common_audit_data and apparmor_audit_data") 25ff0ff2d628 ("apparmor: Fix kernel-doc warnings in apparmor/policy.c") 13c1748e2170 ("apparmor: Fix kernel-doc warnings in apparmor/resource.c") 892148228611 ("apparmor: Fix kernel-doc warnings in apparmor/lib.c") 26c9ecb34f5f ("apparmor: Fix kernel-doc warnings in apparmor/audit.c") 76862af5d1ad ("apparmor: fix kernel-doc complaints") 665b1856dc23 ("apparmor: Fix loading of child before parent") 2f7a29debae2 ("apparmor: remove useless static inline functions") 65f7f666f21c ("apparmor: make __aa_path_perm() static") 1ad22fcc4d0d ("apparmor: rework profile->rules to be a list") 217af7e2f4de ("apparmor: refactor profile rules and attachments") 3bf3d728a58d ("apparmor: verify loaded permission bits masks don't overlap") 3dfd16ab697f ("apparmor: cleanup: move perm accumulation into perms.h") 0bece4fa97a2 ("apparmor: make sure perm indexes are accumulated") 670f31774ab6 ("apparmor: verify permission table indexes") 371e50a0b19f ("apparmor: make unpack_array return a trianary value") ad596ea74e74 ("apparmor: group dfa policydb unpacking") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 157a3537d6bc28ceb9a11fc8cb67f2152d860146 Mon Sep 17 00:00:00 2001 From: John Johansen <john.johansen(a)canonical.com> Date: Sun, 10 Sep 2023 03:35:22 -0700 Subject: [PATCH] apparmor: Fix regression in mount mediation commit 2db154b3ea8e ("vfs: syscall: Add move_mount(2) to move mounts around") introduced a new move_mount(2) system call and a corresponding new LSM security_move_mount hook but did not implement this hook for any existing LSM. This creates a regression for AppArmor mediation of mount. This patch provides a base mapping of the move_mount syscall to the existing mount mediation. In the future we may introduce additional mediations around the new mount calls. Fixes: 2db154b3ea8e ("vfs: syscall: Add move_mount(2) to move mounts around") CC: stable(a)vger.kernel.org Reported-by: Andreas Steinmetz <anstein99(a)googlemail.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> diff --git a/security/apparmor/include/mount.h b/security/apparmor/include/mount.h index 10c76f906a65..46834f828179 100644 --- a/security/apparmor/include/mount.h +++ b/security/apparmor/include/mount.h @@ -38,9 +38,12 @@ int aa_mount_change_type(const struct cred *subj_cred, struct aa_label *label, const struct path *path, unsigned long flags); +int aa_move_mount_old(const struct cred *subj_cred, + struct aa_label *label, const struct path *path, + const char *old_name); int aa_move_mount(const struct cred *subj_cred, - struct aa_label *label, const struct path *path, - const char *old_name); + struct aa_label *label, const struct path *from_path, + const struct path *to_path); int aa_new_mount(const struct cred *subj_cred, struct aa_label *label, const char *dev_name, diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index ce4f3e7a784d..b047d1d355a9 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -722,8 +722,8 @@ static int apparmor_sb_mount(const char *dev_name, const struct path *path, error = aa_mount_change_type(current_cred(), label, path, flags); else if (flags & MS_MOVE) - error = aa_move_mount(current_cred(), label, path, - dev_name); + error = aa_move_mount_old(current_cred(), label, path, + dev_name); else error = aa_new_mount(current_cred(), label, dev_name, path, type, flags, data); @@ -733,6 +733,21 @@ static int apparmor_sb_mount(const char *dev_name, const struct path *path, return error; } +static int apparmor_move_mount(const struct path *from_path, + const struct path *to_path) +{ + struct aa_label *label; + int error = 0; + + label = __begin_current_label_crit_section(); + if (!unconfined(label)) + error = aa_move_mount(current_cred(), label, from_path, + to_path); + __end_current_label_crit_section(label); + + return error; +} + static int apparmor_sb_umount(struct vfsmount *mnt, int flags) { struct aa_label *label; @@ -1376,6 +1391,7 @@ static struct security_hook_list apparmor_hooks[] __ro_after_init = { LSM_HOOK_INIT(capget, apparmor_capget), LSM_HOOK_INIT(capable, apparmor_capable), + LSM_HOOK_INIT(move_mount, apparmor_move_mount), LSM_HOOK_INIT(sb_mount, apparmor_sb_mount), LSM_HOOK_INIT(sb_umount, apparmor_sb_umount), LSM_HOOK_INIT(sb_pivotroot, apparmor_sb_pivotroot), diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c index 3455dd4b1f99..fb30204c761a 100644 --- a/security/apparmor/mount.c +++ b/security/apparmor/mount.c @@ -483,36 +483,46 @@ int aa_mount_change_type(const struct cred *subj_cred, } int aa_move_mount(const struct cred *subj_cred, - struct aa_label *label, const struct path *path, - const char *orig_name) + struct aa_label *label, const struct path *from_path, + const struct path *to_path) { struct aa_profile *profile; - char *buffer = NULL, *old_buffer = NULL; - struct path old_path; + char *to_buffer = NULL, *from_buffer = NULL; int error; AA_BUG(!label); - AA_BUG(!path); + AA_BUG(!from_path); + AA_BUG(!to_path); + + to_buffer = aa_get_buffer(false); + from_buffer = aa_get_buffer(false); + error = -ENOMEM; + if (!to_buffer || !from_buffer) + goto out; + error = fn_for_each_confined(label, profile, + match_mnt(subj_cred, profile, to_path, to_buffer, + from_path, from_buffer, + NULL, MS_MOVE, NULL, false)); +out: + aa_put_buffer(to_buffer); + aa_put_buffer(from_buffer); + + return error; +} + +int aa_move_mount_old(const struct cred *subj_cred, struct aa_label *label, + const struct path *path, const char *orig_name) +{ + struct path old_path; + int error; if (!orig_name || !*orig_name) return -EINVAL; - error = kern_path(orig_name, LOOKUP_FOLLOW, &old_path); if (error) return error; - buffer = aa_get_buffer(false); - old_buffer = aa_get_buffer(false); - error = -ENOMEM; - if (!buffer || !old_buffer) - goto out; - error = fn_for_each_confined(label, profile, - match_mnt(subj_cred, profile, path, buffer, &old_path, - old_buffer, - NULL, MS_MOVE, NULL, false)); -out: - aa_put_buffer(buffer); - aa_put_buffer(old_buffer); + error = aa_move_mount(subj_cred, label, &old_path, path); path_put(&old_path); return error;

1 year, 5 months

1
0
0 0

FAILED: patch "[PATCH] apparmor: Fix regression in mount mediation" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 157a3537d6bc28ceb9a11fc8cb67f2152d860146 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023112235-lumpish-zap-8c3f@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: 157a3537d6bc ("apparmor: Fix regression in mount mediation") 90c436a64a6e ("apparmor: pass cred through to audit info.") d20f5a1a6e79 ("apparmor: rename audit_data->label to audit_data->subj_label") bd7bd201ca46 ("apparmor: combine common_audit_data and apparmor_audit_data") 25ff0ff2d628 ("apparmor: Fix kernel-doc warnings in apparmor/policy.c") 13c1748e2170 ("apparmor: Fix kernel-doc warnings in apparmor/resource.c") 892148228611 ("apparmor: Fix kernel-doc warnings in apparmor/lib.c") 26c9ecb34f5f ("apparmor: Fix kernel-doc warnings in apparmor/audit.c") 76862af5d1ad ("apparmor: fix kernel-doc complaints") 665b1856dc23 ("apparmor: Fix loading of child before parent") 2f7a29debae2 ("apparmor: remove useless static inline functions") 65f7f666f21c ("apparmor: make __aa_path_perm() static") 1ad22fcc4d0d ("apparmor: rework profile->rules to be a list") 217af7e2f4de ("apparmor: refactor profile rules and attachments") 3bf3d728a58d ("apparmor: verify loaded permission bits masks don't overlap") 3dfd16ab697f ("apparmor: cleanup: move perm accumulation into perms.h") 0bece4fa97a2 ("apparmor: make sure perm indexes are accumulated") 670f31774ab6 ("apparmor: verify permission table indexes") 371e50a0b19f ("apparmor: make unpack_array return a trianary value") ad596ea74e74 ("apparmor: group dfa policydb unpacking") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 157a3537d6bc28ceb9a11fc8cb67f2152d860146 Mon Sep 17 00:00:00 2001 From: John Johansen <john.johansen(a)canonical.com> Date: Sun, 10 Sep 2023 03:35:22 -0700 Subject: [PATCH] apparmor: Fix regression in mount mediation commit 2db154b3ea8e ("vfs: syscall: Add move_mount(2) to move mounts around") introduced a new move_mount(2) system call and a corresponding new LSM security_move_mount hook but did not implement this hook for any existing LSM. This creates a regression for AppArmor mediation of mount. This patch provides a base mapping of the move_mount syscall to the existing mount mediation. In the future we may introduce additional mediations around the new mount calls. Fixes: 2db154b3ea8e ("vfs: syscall: Add move_mount(2) to move mounts around") CC: stable(a)vger.kernel.org Reported-by: Andreas Steinmetz <anstein99(a)googlemail.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> diff --git a/security/apparmor/include/mount.h b/security/apparmor/include/mount.h index 10c76f906a65..46834f828179 100644 --- a/security/apparmor/include/mount.h +++ b/security/apparmor/include/mount.h @@ -38,9 +38,12 @@ int aa_mount_change_type(const struct cred *subj_cred, struct aa_label *label, const struct path *path, unsigned long flags); +int aa_move_mount_old(const struct cred *subj_cred, + struct aa_label *label, const struct path *path, + const char *old_name); int aa_move_mount(const struct cred *subj_cred, - struct aa_label *label, const struct path *path, - const char *old_name); + struct aa_label *label, const struct path *from_path, + const struct path *to_path); int aa_new_mount(const struct cred *subj_cred, struct aa_label *label, const char *dev_name, diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index ce4f3e7a784d..b047d1d355a9 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -722,8 +722,8 @@ static int apparmor_sb_mount(const char *dev_name, const struct path *path, error = aa_mount_change_type(current_cred(), label, path, flags); else if (flags & MS_MOVE) - error = aa_move_mount(current_cred(), label, path, - dev_name); + error = aa_move_mount_old(current_cred(), label, path, + dev_name); else error = aa_new_mount(current_cred(), label, dev_name, path, type, flags, data); @@ -733,6 +733,21 @@ static int apparmor_sb_mount(const char *dev_name, const struct path *path, return error; } +static int apparmor_move_mount(const struct path *from_path, + const struct path *to_path) +{ + struct aa_label *label; + int error = 0; + + label = __begin_current_label_crit_section(); + if (!unconfined(label)) + error = aa_move_mount(current_cred(), label, from_path, + to_path); + __end_current_label_crit_section(label); + + return error; +} + static int apparmor_sb_umount(struct vfsmount *mnt, int flags) { struct aa_label *label; @@ -1376,6 +1391,7 @@ static struct security_hook_list apparmor_hooks[] __ro_after_init = { LSM_HOOK_INIT(capget, apparmor_capget), LSM_HOOK_INIT(capable, apparmor_capable), + LSM_HOOK_INIT(move_mount, apparmor_move_mount), LSM_HOOK_INIT(sb_mount, apparmor_sb_mount), LSM_HOOK_INIT(sb_umount, apparmor_sb_umount), LSM_HOOK_INIT(sb_pivotroot, apparmor_sb_pivotroot), diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c index 3455dd4b1f99..fb30204c761a 100644 --- a/security/apparmor/mount.c +++ b/security/apparmor/mount.c @@ -483,36 +483,46 @@ int aa_mount_change_type(const struct cred *subj_cred, } int aa_move_mount(const struct cred *subj_cred, - struct aa_label *label, const struct path *path, - const char *orig_name) + struct aa_label *label, const struct path *from_path, + const struct path *to_path) { struct aa_profile *profile; - char *buffer = NULL, *old_buffer = NULL; - struct path old_path; + char *to_buffer = NULL, *from_buffer = NULL; int error; AA_BUG(!label); - AA_BUG(!path); + AA_BUG(!from_path); + AA_BUG(!to_path); + + to_buffer = aa_get_buffer(false); + from_buffer = aa_get_buffer(false); + error = -ENOMEM; + if (!to_buffer || !from_buffer) + goto out; + error = fn_for_each_confined(label, profile, + match_mnt(subj_cred, profile, to_path, to_buffer, + from_path, from_buffer, + NULL, MS_MOVE, NULL, false)); +out: + aa_put_buffer(to_buffer); + aa_put_buffer(from_buffer); + + return error; +} + +int aa_move_mount_old(const struct cred *subj_cred, struct aa_label *label, + const struct path *path, const char *orig_name) +{ + struct path old_path; + int error; if (!orig_name || !*orig_name) return -EINVAL; - error = kern_path(orig_name, LOOKUP_FOLLOW, &old_path); if (error) return error; - buffer = aa_get_buffer(false); - old_buffer = aa_get_buffer(false); - error = -ENOMEM; - if (!buffer || !old_buffer) - goto out; - error = fn_for_each_confined(label, profile, - match_mnt(subj_cred, profile, path, buffer, &old_path, - old_buffer, - NULL, MS_MOVE, NULL, false)); -out: - aa_put_buffer(buffer); - aa_put_buffer(old_buffer); + error = aa_move_mount(subj_cred, label, &old_path, path); path_put(&old_path); return error;

1 year, 5 months

1
0
0 0

FAILED: patch "[PATCH] apparmor: Fix regression in mount mediation" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 157a3537d6bc28ceb9a11fc8cb67f2152d860146 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023112234-footpath-shaping-b259@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: 157a3537d6bc ("apparmor: Fix regression in mount mediation") 90c436a64a6e ("apparmor: pass cred through to audit info.") d20f5a1a6e79 ("apparmor: rename audit_data->label to audit_data->subj_label") bd7bd201ca46 ("apparmor: combine common_audit_data and apparmor_audit_data") 25ff0ff2d628 ("apparmor: Fix kernel-doc warnings in apparmor/policy.c") 13c1748e2170 ("apparmor: Fix kernel-doc warnings in apparmor/resource.c") 892148228611 ("apparmor: Fix kernel-doc warnings in apparmor/lib.c") 26c9ecb34f5f ("apparmor: Fix kernel-doc warnings in apparmor/audit.c") 76862af5d1ad ("apparmor: fix kernel-doc complaints") 665b1856dc23 ("apparmor: Fix loading of child before parent") 2f7a29debae2 ("apparmor: remove useless static inline functions") 65f7f666f21c ("apparmor: make __aa_path_perm() static") 1ad22fcc4d0d ("apparmor: rework profile->rules to be a list") 217af7e2f4de ("apparmor: refactor profile rules and attachments") 3bf3d728a58d ("apparmor: verify loaded permission bits masks don't overlap") 3dfd16ab697f ("apparmor: cleanup: move perm accumulation into perms.h") 0bece4fa97a2 ("apparmor: make sure perm indexes are accumulated") 670f31774ab6 ("apparmor: verify permission table indexes") 371e50a0b19f ("apparmor: make unpack_array return a trianary value") ad596ea74e74 ("apparmor: group dfa policydb unpacking") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 157a3537d6bc28ceb9a11fc8cb67f2152d860146 Mon Sep 17 00:00:00 2001 From: John Johansen <john.johansen(a)canonical.com> Date: Sun, 10 Sep 2023 03:35:22 -0700 Subject: [PATCH] apparmor: Fix regression in mount mediation commit 2db154b3ea8e ("vfs: syscall: Add move_mount(2) to move mounts around") introduced a new move_mount(2) system call and a corresponding new LSM security_move_mount hook but did not implement this hook for any existing LSM. This creates a regression for AppArmor mediation of mount. This patch provides a base mapping of the move_mount syscall to the existing mount mediation. In the future we may introduce additional mediations around the new mount calls. Fixes: 2db154b3ea8e ("vfs: syscall: Add move_mount(2) to move mounts around") CC: stable(a)vger.kernel.org Reported-by: Andreas Steinmetz <anstein99(a)googlemail.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> diff --git a/security/apparmor/include/mount.h b/security/apparmor/include/mount.h index 10c76f906a65..46834f828179 100644 --- a/security/apparmor/include/mount.h +++ b/security/apparmor/include/mount.h @@ -38,9 +38,12 @@ int aa_mount_change_type(const struct cred *subj_cred, struct aa_label *label, const struct path *path, unsigned long flags); +int aa_move_mount_old(const struct cred *subj_cred, + struct aa_label *label, const struct path *path, + const char *old_name); int aa_move_mount(const struct cred *subj_cred, - struct aa_label *label, const struct path *path, - const char *old_name); + struct aa_label *label, const struct path *from_path, + const struct path *to_path); int aa_new_mount(const struct cred *subj_cred, struct aa_label *label, const char *dev_name, diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index ce4f3e7a784d..b047d1d355a9 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -722,8 +722,8 @@ static int apparmor_sb_mount(const char *dev_name, const struct path *path, error = aa_mount_change_type(current_cred(), label, path, flags); else if (flags & MS_MOVE) - error = aa_move_mount(current_cred(), label, path, - dev_name); + error = aa_move_mount_old(current_cred(), label, path, + dev_name); else error = aa_new_mount(current_cred(), label, dev_name, path, type, flags, data); @@ -733,6 +733,21 @@ static int apparmor_sb_mount(const char *dev_name, const struct path *path, return error; } +static int apparmor_move_mount(const struct path *from_path, + const struct path *to_path) +{ + struct aa_label *label; + int error = 0; + + label = __begin_current_label_crit_section(); + if (!unconfined(label)) + error = aa_move_mount(current_cred(), label, from_path, + to_path); + __end_current_label_crit_section(label); + + return error; +} + static int apparmor_sb_umount(struct vfsmount *mnt, int flags) { struct aa_label *label; @@ -1376,6 +1391,7 @@ static struct security_hook_list apparmor_hooks[] __ro_after_init = { LSM_HOOK_INIT(capget, apparmor_capget), LSM_HOOK_INIT(capable, apparmor_capable), + LSM_HOOK_INIT(move_mount, apparmor_move_mount), LSM_HOOK_INIT(sb_mount, apparmor_sb_mount), LSM_HOOK_INIT(sb_umount, apparmor_sb_umount), LSM_HOOK_INIT(sb_pivotroot, apparmor_sb_pivotroot), diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c index 3455dd4b1f99..fb30204c761a 100644 --- a/security/apparmor/mount.c +++ b/security/apparmor/mount.c @@ -483,36 +483,46 @@ int aa_mount_change_type(const struct cred *subj_cred, } int aa_move_mount(const struct cred *subj_cred, - struct aa_label *label, const struct path *path, - const char *orig_name) + struct aa_label *label, const struct path *from_path, + const struct path *to_path) { struct aa_profile *profile; - char *buffer = NULL, *old_buffer = NULL; - struct path old_path; + char *to_buffer = NULL, *from_buffer = NULL; int error; AA_BUG(!label); - AA_BUG(!path); + AA_BUG(!from_path); + AA_BUG(!to_path); + + to_buffer = aa_get_buffer(false); + from_buffer = aa_get_buffer(false); + error = -ENOMEM; + if (!to_buffer || !from_buffer) + goto out; + error = fn_for_each_confined(label, profile, + match_mnt(subj_cred, profile, to_path, to_buffer, + from_path, from_buffer, + NULL, MS_MOVE, NULL, false)); +out: + aa_put_buffer(to_buffer); + aa_put_buffer(from_buffer); + + return error; +} + +int aa_move_mount_old(const struct cred *subj_cred, struct aa_label *label, + const struct path *path, const char *orig_name) +{ + struct path old_path; + int error; if (!orig_name || !*orig_name) return -EINVAL; - error = kern_path(orig_name, LOOKUP_FOLLOW, &old_path); if (error) return error; - buffer = aa_get_buffer(false); - old_buffer = aa_get_buffer(false); - error = -ENOMEM; - if (!buffer || !old_buffer) - goto out; - error = fn_for_each_confined(label, profile, - match_mnt(subj_cred, profile, path, buffer, &old_path, - old_buffer, - NULL, MS_MOVE, NULL, false)); -out: - aa_put_buffer(buffer); - aa_put_buffer(old_buffer); + error = aa_move_mount(subj_cred, label, &old_path, path); path_put(&old_path); return error;

1 year, 5 months

1
0
0 0

FAILED: patch "[PATCH] apparmor: Fix regression in mount mediation" failed to apply to 6.5-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.5-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.5.y git checkout FETCH_HEAD git cherry-pick -x 157a3537d6bc28ceb9a11fc8cb67f2152d860146 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023112233-dreary-equal-0d84@gregkh' --subject-prefix 'PATCH 6.5.y' HEAD^.. Possible dependencies: 157a3537d6bc ("apparmor: Fix regression in mount mediation") 90c436a64a6e ("apparmor: pass cred through to audit info.") d20f5a1a6e79 ("apparmor: rename audit_data->label to audit_data->subj_label") bd7bd201ca46 ("apparmor: combine common_audit_data and apparmor_audit_data") 25ff0ff2d628 ("apparmor: Fix kernel-doc warnings in apparmor/policy.c") 13c1748e2170 ("apparmor: Fix kernel-doc warnings in apparmor/resource.c") 892148228611 ("apparmor: Fix kernel-doc warnings in apparmor/lib.c") 26c9ecb34f5f ("apparmor: Fix kernel-doc warnings in apparmor/audit.c") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 157a3537d6bc28ceb9a11fc8cb67f2152d860146 Mon Sep 17 00:00:00 2001 From: John Johansen <john.johansen(a)canonical.com> Date: Sun, 10 Sep 2023 03:35:22 -0700 Subject: [PATCH] apparmor: Fix regression in mount mediation commit 2db154b3ea8e ("vfs: syscall: Add move_mount(2) to move mounts around") introduced a new move_mount(2) system call and a corresponding new LSM security_move_mount hook but did not implement this hook for any existing LSM. This creates a regression for AppArmor mediation of mount. This patch provides a base mapping of the move_mount syscall to the existing mount mediation. In the future we may introduce additional mediations around the new mount calls. Fixes: 2db154b3ea8e ("vfs: syscall: Add move_mount(2) to move mounts around") CC: stable(a)vger.kernel.org Reported-by: Andreas Steinmetz <anstein99(a)googlemail.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> diff --git a/security/apparmor/include/mount.h b/security/apparmor/include/mount.h index 10c76f906a65..46834f828179 100644 --- a/security/apparmor/include/mount.h +++ b/security/apparmor/include/mount.h @@ -38,9 +38,12 @@ int aa_mount_change_type(const struct cred *subj_cred, struct aa_label *label, const struct path *path, unsigned long flags); +int aa_move_mount_old(const struct cred *subj_cred, + struct aa_label *label, const struct path *path, + const char *old_name); int aa_move_mount(const struct cred *subj_cred, - struct aa_label *label, const struct path *path, - const char *old_name); + struct aa_label *label, const struct path *from_path, + const struct path *to_path); int aa_new_mount(const struct cred *subj_cred, struct aa_label *label, const char *dev_name, diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index ce4f3e7a784d..b047d1d355a9 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -722,8 +722,8 @@ static int apparmor_sb_mount(const char *dev_name, const struct path *path, error = aa_mount_change_type(current_cred(), label, path, flags); else if (flags & MS_MOVE) - error = aa_move_mount(current_cred(), label, path, - dev_name); + error = aa_move_mount_old(current_cred(), label, path, + dev_name); else error = aa_new_mount(current_cred(), label, dev_name, path, type, flags, data); @@ -733,6 +733,21 @@ static int apparmor_sb_mount(const char *dev_name, const struct path *path, return error; } +static int apparmor_move_mount(const struct path *from_path, + const struct path *to_path) +{ + struct aa_label *label; + int error = 0; + + label = __begin_current_label_crit_section(); + if (!unconfined(label)) + error = aa_move_mount(current_cred(), label, from_path, + to_path); + __end_current_label_crit_section(label); + + return error; +} + static int apparmor_sb_umount(struct vfsmount *mnt, int flags) { struct aa_label *label; @@ -1376,6 +1391,7 @@ static struct security_hook_list apparmor_hooks[] __ro_after_init = { LSM_HOOK_INIT(capget, apparmor_capget), LSM_HOOK_INIT(capable, apparmor_capable), + LSM_HOOK_INIT(move_mount, apparmor_move_mount), LSM_HOOK_INIT(sb_mount, apparmor_sb_mount), LSM_HOOK_INIT(sb_umount, apparmor_sb_umount), LSM_HOOK_INIT(sb_pivotroot, apparmor_sb_pivotroot), diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c index 3455dd4b1f99..fb30204c761a 100644 --- a/security/apparmor/mount.c +++ b/security/apparmor/mount.c @@ -483,36 +483,46 @@ int aa_mount_change_type(const struct cred *subj_cred, } int aa_move_mount(const struct cred *subj_cred, - struct aa_label *label, const struct path *path, - const char *orig_name) + struct aa_label *label, const struct path *from_path, + const struct path *to_path) { struct aa_profile *profile; - char *buffer = NULL, *old_buffer = NULL; - struct path old_path; + char *to_buffer = NULL, *from_buffer = NULL; int error; AA_BUG(!label); - AA_BUG(!path); + AA_BUG(!from_path); + AA_BUG(!to_path); + + to_buffer = aa_get_buffer(false); + from_buffer = aa_get_buffer(false); + error = -ENOMEM; + if (!to_buffer || !from_buffer) + goto out; + error = fn_for_each_confined(label, profile, + match_mnt(subj_cred, profile, to_path, to_buffer, + from_path, from_buffer, + NULL, MS_MOVE, NULL, false)); +out: + aa_put_buffer(to_buffer); + aa_put_buffer(from_buffer); + + return error; +} + +int aa_move_mount_old(const struct cred *subj_cred, struct aa_label *label, + const struct path *path, const char *orig_name) +{ + struct path old_path; + int error; if (!orig_name || !*orig_name) return -EINVAL; - error = kern_path(orig_name, LOOKUP_FOLLOW, &old_path); if (error) return error; - buffer = aa_get_buffer(false); - old_buffer = aa_get_buffer(false); - error = -ENOMEM; - if (!buffer || !old_buffer) - goto out; - error = fn_for_each_confined(label, profile, - match_mnt(subj_cred, profile, path, buffer, &old_path, - old_buffer, - NULL, MS_MOVE, NULL, false)); -out: - aa_put_buffer(buffer); - aa_put_buffer(old_buffer); + error = aa_move_mount(subj_cred, label, &old_path, path); path_put(&old_path); return error;

1 year, 5 months

1
0
0 0

FAILED: patch "[PATCH] apparmor: Fix regression in mount mediation" failed to apply to 6.6-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x 157a3537d6bc28ceb9a11fc8cb67f2152d860146 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023112232-copy-ventricle-f1b9@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: 157a3537d6bc ("apparmor: Fix regression in mount mediation") 90c436a64a6e ("apparmor: pass cred through to audit info.") d20f5a1a6e79 ("apparmor: rename audit_data->label to audit_data->subj_label") bd7bd201ca46 ("apparmor: combine common_audit_data and apparmor_audit_data") 25ff0ff2d628 ("apparmor: Fix kernel-doc warnings in apparmor/policy.c") 13c1748e2170 ("apparmor: Fix kernel-doc warnings in apparmor/resource.c") 892148228611 ("apparmor: Fix kernel-doc warnings in apparmor/lib.c") 26c9ecb34f5f ("apparmor: Fix kernel-doc warnings in apparmor/audit.c") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 157a3537d6bc28ceb9a11fc8cb67f2152d860146 Mon Sep 17 00:00:00 2001 From: John Johansen <john.johansen(a)canonical.com> Date: Sun, 10 Sep 2023 03:35:22 -0700 Subject: [PATCH] apparmor: Fix regression in mount mediation commit 2db154b3ea8e ("vfs: syscall: Add move_mount(2) to move mounts around") introduced a new move_mount(2) system call and a corresponding new LSM security_move_mount hook but did not implement this hook for any existing LSM. This creates a regression for AppArmor mediation of mount. This patch provides a base mapping of the move_mount syscall to the existing mount mediation. In the future we may introduce additional mediations around the new mount calls. Fixes: 2db154b3ea8e ("vfs: syscall: Add move_mount(2) to move mounts around") CC: stable(a)vger.kernel.org Reported-by: Andreas Steinmetz <anstein99(a)googlemail.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> diff --git a/security/apparmor/include/mount.h b/security/apparmor/include/mount.h index 10c76f906a65..46834f828179 100644 --- a/security/apparmor/include/mount.h +++ b/security/apparmor/include/mount.h @@ -38,9 +38,12 @@ int aa_mount_change_type(const struct cred *subj_cred, struct aa_label *label, const struct path *path, unsigned long flags); +int aa_move_mount_old(const struct cred *subj_cred, + struct aa_label *label, const struct path *path, + const char *old_name); int aa_move_mount(const struct cred *subj_cred, - struct aa_label *label, const struct path *path, - const char *old_name); + struct aa_label *label, const struct path *from_path, + const struct path *to_path); int aa_new_mount(const struct cred *subj_cred, struct aa_label *label, const char *dev_name, diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index ce4f3e7a784d..b047d1d355a9 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -722,8 +722,8 @@ static int apparmor_sb_mount(const char *dev_name, const struct path *path, error = aa_mount_change_type(current_cred(), label, path, flags); else if (flags & MS_MOVE) - error = aa_move_mount(current_cred(), label, path, - dev_name); + error = aa_move_mount_old(current_cred(), label, path, + dev_name); else error = aa_new_mount(current_cred(), label, dev_name, path, type, flags, data); @@ -733,6 +733,21 @@ static int apparmor_sb_mount(const char *dev_name, const struct path *path, return error; } +static int apparmor_move_mount(const struct path *from_path, + const struct path *to_path) +{ + struct aa_label *label; + int error = 0; + + label = __begin_current_label_crit_section(); + if (!unconfined(label)) + error = aa_move_mount(current_cred(), label, from_path, + to_path); + __end_current_label_crit_section(label); + + return error; +} + static int apparmor_sb_umount(struct vfsmount *mnt, int flags) { struct aa_label *label; @@ -1376,6 +1391,7 @@ static struct security_hook_list apparmor_hooks[] __ro_after_init = { LSM_HOOK_INIT(capget, apparmor_capget), LSM_HOOK_INIT(capable, apparmor_capable), + LSM_HOOK_INIT(move_mount, apparmor_move_mount), LSM_HOOK_INIT(sb_mount, apparmor_sb_mount), LSM_HOOK_INIT(sb_umount, apparmor_sb_umount), LSM_HOOK_INIT(sb_pivotroot, apparmor_sb_pivotroot), diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c index 3455dd4b1f99..fb30204c761a 100644 --- a/security/apparmor/mount.c +++ b/security/apparmor/mount.c @@ -483,36 +483,46 @@ int aa_mount_change_type(const struct cred *subj_cred, } int aa_move_mount(const struct cred *subj_cred, - struct aa_label *label, const struct path *path, - const char *orig_name) + struct aa_label *label, const struct path *from_path, + const struct path *to_path) { struct aa_profile *profile; - char *buffer = NULL, *old_buffer = NULL; - struct path old_path; + char *to_buffer = NULL, *from_buffer = NULL; int error; AA_BUG(!label); - AA_BUG(!path); + AA_BUG(!from_path); + AA_BUG(!to_path); + + to_buffer = aa_get_buffer(false); + from_buffer = aa_get_buffer(false); + error = -ENOMEM; + if (!to_buffer || !from_buffer) + goto out; + error = fn_for_each_confined(label, profile, + match_mnt(subj_cred, profile, to_path, to_buffer, + from_path, from_buffer, + NULL, MS_MOVE, NULL, false)); +out: + aa_put_buffer(to_buffer); + aa_put_buffer(from_buffer); + + return error; +} + +int aa_move_mount_old(const struct cred *subj_cred, struct aa_label *label, + const struct path *path, const char *orig_name) +{ + struct path old_path; + int error; if (!orig_name || !*orig_name) return -EINVAL; - error = kern_path(orig_name, LOOKUP_FOLLOW, &old_path); if (error) return error; - buffer = aa_get_buffer(false); - old_buffer = aa_get_buffer(false); - error = -ENOMEM; - if (!buffer || !old_buffer) - goto out; - error = fn_for_each_confined(label, profile, - match_mnt(subj_cred, profile, path, buffer, &old_path, - old_buffer, - NULL, MS_MOVE, NULL, false)); -out: - aa_put_buffer(buffer); - aa_put_buffer(old_buffer); + error = aa_move_mount(subj_cred, label, &old_path, path); path_put(&old_path); return error;

1 year, 5 months

1
0
0 0

FAILED: patch "[PATCH] hvc/xen: fix event channel handling for secondary consoles" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.14.y git checkout FETCH_HEAD git cherry-pick -x ef5dd8ec88ac11e8e353164407d55b73c988b369 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023112214-slaw-bootlace-8f7a@gregkh' --subject-prefix 'PATCH 4.14.y' HEAD^.. Possible dependencies: ef5dd8ec88ac ("hvc/xen: fix event channel handling for secondary consoles") fe415186b43d ("xen/console: harden hvc_xen against event channel storms") 3bd5371a4da6 ("xen/events: Remove unused bind_evtchn_to_irq_lateeoi()") 54c9de89895e ("xen/events: add a new "late EOI" evtchn framework") 0102e4efda76 ("xen: Use evtchn_type_t as a type for event channels") bce5963bcb4f ("xen/events: fix binding user event channels to cpus") 9f51c05dc41a ("pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock") 975ef94a0284 ("pvcalls-front: fixes incorrect error handling") 1d3145675538 ("xen/gntdev: Make private routines/structures accessible") 975ef7ff81bb ("xen/gntdev: Allow mappings for DMA buffers") 64d6871827b1 ("pvcalls-front: introduce a per sock_mapping refcount") a9a08845e9ac ("vfs: do bulk POLL* -> EPOLL* replacement") 68c5735eaa5e ("Merge tag 'media/v4.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From ef5dd8ec88ac11e8e353164407d55b73c988b369 Mon Sep 17 00:00:00 2001 From: David Woodhouse <dwmw(a)amazon.co.uk> Date: Fri, 20 Oct 2023 17:15:27 +0100 Subject: [PATCH] hvc/xen: fix event channel handling for secondary consoles MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The xencons_connect_backend() function allocates a local interdomain event channel with xenbus_alloc_evtchn(), then calls bind_interdomain_evtchn_to_irq_lateeoi() to bind to that port# on the *remote* domain. That doesn't work very well: (qemu) device_add xen-console,id=con1,chardev=pty0 [ 44.323872] xenconsole console-1: 2 xenbus_dev_probe on device/console/1 [ 44.323995] xenconsole: probe of console-1 failed with error -2 Fix it to use bind_evtchn_to_irq_lateeoi(), which does the right thing by just binding that *local* event channel to an irq. The backend will do the interdomain binding. This didn't affect the primary console because the setup for that is special — the toolstack allocates the guest event channel and the guest discovers it with HVMOP_get_param. Fixes: fe415186b43d ("xen/console: harden hvc_xen against event channel storms") Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk> Reviewed-by: Juergen Gross <jgross(a)suse.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20231020161529.355083-2-dwmw2@infradead.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c index 98764e740c07..f24e285b6441 100644 --- a/drivers/tty/hvc/hvc_xen.c +++ b/drivers/tty/hvc/hvc_xen.c @@ -433,7 +433,7 @@ static int xencons_connect_backend(struct xenbus_device *dev, if (ret) return ret; info->evtchn = evtchn; - irq = bind_interdomain_evtchn_to_irq_lateeoi(dev, evtchn); + irq = bind_evtchn_to_irq_lateeoi(evtchn); if (irq < 0) return irq; info->irq = irq;

1 year, 5 months

1
0
0 0

FAILED: patch "[PATCH] hvc/xen: fix event channel handling for secondary consoles" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x ef5dd8ec88ac11e8e353164407d55b73c988b369 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023112213-ladybug-starter-d2c2@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: ef5dd8ec88ac ("hvc/xen: fix event channel handling for secondary consoles") fe415186b43d ("xen/console: harden hvc_xen against event channel storms") 3bd5371a4da6 ("xen/events: Remove unused bind_evtchn_to_irq_lateeoi()") 54c9de89895e ("xen/events: add a new "late EOI" evtchn framework") 0102e4efda76 ("xen: Use evtchn_type_t as a type for event channels") bce5963bcb4f ("xen/events: fix binding user event channels to cpus") 9f51c05dc41a ("pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock") 975ef94a0284 ("pvcalls-front: fixes incorrect error handling") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From ef5dd8ec88ac11e8e353164407d55b73c988b369 Mon Sep 17 00:00:00 2001 From: David Woodhouse <dwmw(a)amazon.co.uk> Date: Fri, 20 Oct 2023 17:15:27 +0100 Subject: [PATCH] hvc/xen: fix event channel handling for secondary consoles MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The xencons_connect_backend() function allocates a local interdomain event channel with xenbus_alloc_evtchn(), then calls bind_interdomain_evtchn_to_irq_lateeoi() to bind to that port# on the *remote* domain. That doesn't work very well: (qemu) device_add xen-console,id=con1,chardev=pty0 [ 44.323872] xenconsole console-1: 2 xenbus_dev_probe on device/console/1 [ 44.323995] xenconsole: probe of console-1 failed with error -2 Fix it to use bind_evtchn_to_irq_lateeoi(), which does the right thing by just binding that *local* event channel to an irq. The backend will do the interdomain binding. This didn't affect the primary console because the setup for that is special — the toolstack allocates the guest event channel and the guest discovers it with HVMOP_get_param. Fixes: fe415186b43d ("xen/console: harden hvc_xen against event channel storms") Signed-off-by: David Woodhouse <dwmw(a)amazon.co.uk> Reviewed-by: Juergen Gross <jgross(a)suse.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20231020161529.355083-2-dwmw2@infradead.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c index 98764e740c07..f24e285b6441 100644 --- a/drivers/tty/hvc/hvc_xen.c +++ b/drivers/tty/hvc/hvc_xen.c @@ -433,7 +433,7 @@ static int xencons_connect_backend(struct xenbus_device *dev, if (ret) return ret; info->evtchn = evtchn; - irq = bind_interdomain_evtchn_to_irq_lateeoi(dev, evtchn); + irq = bind_evtchn_to_irq_lateeoi(evtchn); if (irq < 0) return irq; info->irq = irq;

1 year, 5 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror November 2023