This is the start of the stable review cycle for the 4.4.217 release.
There are 93 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 21 Mar 2020 12:37:04 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.217-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.217-rc1
Matteo Croce <mcroce(a)redhat.com>
ipv4: ensure rcu_read_lock() in cipso_v4_error()
Jann Horn <jannh(a)google.com>
mm: slub: add missing TID bump in kmem_cache_alloc_bulk()
Kees Cook <keescook(a)chromium.org>
ARM: 8958/1: rename missed uaccess .fixup section
Florian Fainelli <f.fainelli(a)gmail.com>
ARM: 8957/1: VDSO: Match ARMv8 timer in cntvct_functional()
Qian Cai <cai(a)lca.pw>
jbd2: fix data races at struct journal_head
Linus Torvalds <torvalds(a)linux-foundation.org>
signal: avoid double atomic counter increments for user accounting
Marek Vasut <marex(a)denx.de>
net: ks8851-ml: Fix IRQ handling and locking
Kim Phillips <kim.phillips(a)amd.com>
perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Don't schedule OGM for disabled interface
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid free/alloc race when handling OGM buffer
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Only read OGM tvlv_len after buffer len check
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Reduce tt_global hash refcnt only for removed entry
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Reduce tt_local hash refcnt only for removed entry
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Reduce claim hash refcnt only for removed entry
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Prevent duplicated tvlv handler
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Prevent duplicated global TT entry
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Prevent duplicated nc_node entry
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Prevent duplicated gateway_node entry
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: Avoid storing non-TT-sync flags on singular entries too
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix debugfs path for renamed softif
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix debugfs path for renamed hardif
Marek Lindner <mareklindner(a)neomailbox.ch>
batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: Fix TT sync flags for intermediate TT responses
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid race in TT TVLV allocator helper
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix skbuff rcsum on packet reroute
Matthias Schiffer <mschiffer(a)universe-factory.net>
batman-adv: update data pointers after skb_cow()
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix internal interface indices types
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: fix TT sync flag inconsistencies
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix rx packet/bytes stats on local ARP reply
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: Fix transmission of final, 16th fragment
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix double free during fragment merge error
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Add missing refcnt for last_candidate
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix speedy join in gateway client mode
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Free last_bonding_candidate on release of orig_node
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix reference leak in batadv_find_router
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix non-atomic bla_claim::backbone_gw access
Simon Wunderlich <sw(a)simonwunderlich.de>
batman-adv: lock crc access in bridge loop avoidance
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix orig_node_vlan leak on orig_node_release
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid nullptr dereference in dat after vlan_insert_tag
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid nullptr dereference in bla after vlan_insert_tag
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Clean up untagged vlan when destroying via rtnl-link
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix ICMP RR ethernet access after skb_linearize
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix use-after-free/double-free of tt_req_node
Florian Westphal <fw(a)strlen.de>
batman-adv: fix skb deref after free
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: Avoid duplicate neigh_node additions
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix reference counting of vlan object for tt_local_entry
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Drop reference to netdevice on last reference
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Deactivate TO_BE_ACTIVATED hardif on shutdown
Marek Lindner <mareklindner(a)neomailbox.ch>
batman-adv: init neigh node last seen field
Sven Eckelmann <sven.eckelmann(a)open-mesh.com>
batman-adv: Fix integer overflow in batadv_iv_ogm_calc_tq
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix unexpected free of bcast_own on add_if error
Andrew Lunn <andrew(a)lunn.ch>
batman-adv: Avoid endless loop in bat-on-bat netdevice check
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Only put orig_node_vlan list reference when removed
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Only put gw_node list reference when removed
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix invalid read while copying bat_iv.bcast_own
Vladis Dronov <vdronov(a)redhat.com>
efi: Add a sanity check to efivar_store_raw()
Eric Dumazet <edumazet(a)google.com>
ipv6: restrict IPV6_ADDRFORM operation
qize wang <wangqize888888888(a)gmail.com>
mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()
Daniel Drake <drake(a)endlessm.com>
iommu/vt-d: Ignore devices with out-of-spec domain number
Zhenzhong Duan <zhenzhong.duan(a)gmail.com>
iommu/vt-d: Fix the wrong printing in RHSA parsing
Jakub Kicinski <kuba(a)kernel.org>
netfilter: cthelper: add missing attribute validation for cthelper
Jakub Kicinski <kuba(a)kernel.org>
nl80211: add missing attribute validation for channel switch
Jakub Kicinski <kuba(a)kernel.org>
nl80211: add missing attribute validation for critical protocol indication
Yonghyun Hwang <yonghyun(a)google.com>
iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page
Hans de Goede <hdegoede(a)redhat.com>
iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint
Vladis Dronov <vdronov(a)redhat.com>
efi: Fix a race and a buffer overflow while reading efivars via sysfs
Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
ARC: define __ALIGN_STR and __ALIGN symbols for ARC
Vitaly Kuznetsov <vkuznets(a)redhat.com>
KVM: x86: clear stale x86_emulate_ctxt->intercept value
Al Viro <viro(a)zeniv.linux.org.uk>
gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache
Colin Ian King <colin.king(a)canonical.com>
drm/amd/display: remove duplicated assignment to grph_obj_type
Hans de Goede <hdegoede(a)redhat.com>
iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint
Jakub Kicinski <kuba(a)kernel.org>
net: fq: add missing attribute validation for orphan mask
Eric Dumazet <edumazet(a)google.com>
bonding/alb: make sure arp header is pulled before accessing it
Eric Dumazet <edumazet(a)google.com>
slip: make slhc_compress() more robust against malicious packets
Jakub Kicinski <kuba(a)kernel.org>
net: fec: validate the new settings in fec_enet_set_coalesce()
Mahesh Bandewar <maheshb(a)google.com>
macvlan: add cond_resched() during multicast processing
Mahesh Bandewar <maheshb(a)google.com>
ipvlan: don't deref eth hdr before checking it's set
Eric Dumazet <edumazet(a)google.com>
ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast()
Paolo Abeni <pabeni(a)redhat.com>
ipvlan: egress mcast packets are not exceptional
Jiri Wiesner <jwiesner(a)suse.com>
ipvlan: do not add hardware address of master to its unicast filter list
Mahesh Bandewar <maheshb(a)google.com>
ipvlan: add cond_resched_rcu() while processing muticast backlog
Jakub Kicinski <kuba(a)kernel.org>
nfc: add missing attribute validation for vendor subcommand
Jakub Kicinski <kuba(a)kernel.org>
nfc: add missing attribute validation for SE API
Jakub Kicinski <kuba(a)kernel.org>
team: add missing attribute validation for array index
Jakub Kicinski <kuba(a)kernel.org>
team: add missing attribute validation for port ifindex
Jakub Kicinski <kuba(a)kernel.org>
nl802154: add missing attribute validation for dev_type
Jakub Kicinski <kuba(a)kernel.org>
nl802154: add missing attribute validation
Jakub Kicinski <kuba(a)kernel.org>
fib: add missing attribute validation for tun_id
Vasundhara Volam <vasundhara-v.volam(a)broadcom.com>
bnxt_en: reinitialize IRQs when MTU is modified
Dan Carpenter <dan.carpenter(a)oracle.com>
net: nfc: fix bounds checking bugs on "pipe"
You-Sheng Yang <vicamo.yang(a)canonical.com>
r8152: check disconnect status after long sleep
Petr Malat <oss(a)malat.biz>
NFS: Remove superfluous kmap in nfs_readdir_xdr_to_array
-------------
Diffstat:
Makefile | 4 +-
arch/arc/include/asm/linkage.h | 2 +
arch/arm/kernel/vdso.c | 2 +
arch/arm/lib/copy_from_user.S | 2 +-
arch/x86/kernel/cpu/perf_event_amd_uncore.c | 16 +-
arch/x86/kvm/emulate.c | 1 +
drivers/firmware/efi/efivars.c | 32 +++-
drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 3 +-
drivers/iommu/dmar.c | 21 ++-
drivers/iommu/intel-iommu.c | 13 +-
drivers/net/bonding/bond_alb.c | 20 +--
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +-
drivers/net/ethernet/freescale/fec_main.c | 6 +-
drivers/net/ethernet/micrel/ks8851_mll.c | 14 +-
drivers/net/ipvlan/ipvlan_core.c | 19 +-
drivers/net/ipvlan/ipvlan_main.c | 5 +-
drivers/net/macvlan.c | 2 +
drivers/net/slip/slhc.c | 14 +-
drivers/net/team/team.c | 2 +
drivers/net/usb/r8152.c | 6 +
drivers/net/wireless/mwifiex/tdls.c | 70 +++++++-
fs/gfs2/inode.c | 2 +-
fs/jbd2/transaction.c | 8 +-
fs/nfs/dir.c | 2 -
include/net/fib_rules.h | 1 +
kernel/signal.c | 23 ++-
mm/slub.c | 9 +
net/batman-adv/bat_iv_ogm.c | 115 +++++++++----
net/batman-adv/bridge_loop_avoidance.c | 152 +++++++++++++---
net/batman-adv/debugfs.c | 40 +++++
net/batman-adv/debugfs.h | 11 ++
net/batman-adv/distributed-arp-table.c | 15 +-
net/batman-adv/fragmentation.c | 14 +-
net/batman-adv/gateway_client.c | 18 +-
net/batman-adv/hard-interface.c | 89 ++++++++--
net/batman-adv/hard-interface.h | 6 +-
net/batman-adv/main.c | 8 +-
net/batman-adv/network-coding.c | 33 ++--
net/batman-adv/originator.c | 26 ++-
net/batman-adv/originator.h | 4 +-
net/batman-adv/routing.c | 111 +++++++++---
net/batman-adv/send.c | 4 +-
net/batman-adv/soft-interface.c | 9 +
net/batman-adv/translation-table.c | 249 ++++++++++++++++++---------
net/batman-adv/types.h | 23 ++-
net/ieee802154/nl_policy.c | 6 +
net/ipv4/cipso_ipv4.c | 7 +-
net/ipv6/ipv6_sockglue.c | 10 +-
net/netfilter/nfnetlink_cthelper.c | 2 +
net/nfc/hci/core.c | 19 +-
net/nfc/netlink.c | 3 +
net/sched/sch_fq.c | 1 +
net/wireless/nl80211.c | 3 +
53 files changed, 963 insertions(+), 318 deletions(-)
This brings the outdated Documentation/security/credentials.rst
back in line with the current implementation, and describes the
purpose of current->signal->exec_update_mutex,
current->signal->exec_guard_mutex and
current->signal->unsafe_execve_in_progress.
Signed-off-by: Bernd Edlinger <bernd.edlinger(a)hotmail.de>
---
Documentation/security/credentials.rst | 29 +++++++++++++++++++++--------
1 file changed, 21 insertions(+), 8 deletions(-)
diff --git a/Documentation/security/credentials.rst b/Documentation/security/credentials.rst
index 282e79f..fe4cd76 100644
--- a/Documentation/security/credentials.rst
+++ b/Documentation/security/credentials.rst
@@ -437,15 +437,30 @@ new set of credentials by calling::
struct cred *prepare_creds(void);
-this locks current->cred_replace_mutex and then allocates and constructs a
-duplicate of the current process's credentials, returning with the mutex still
-held if successful. It returns NULL if not successful (out of memory).
+this allocates and constructs a duplicate of the current process's credentials.
+It returns NULL if not successful (out of memory).
+
+If called from __do_execve_file, the mutex current->signal->exec_guard_mutex
+is acquired before this function gets called, and usually released after
+the new process mmap and credentials are installed. However if one of the
+sibling threads are being traced when the execve is invoked, there is no
+guarantee how long it takes to terminate all sibling threads, and therefore
+the variable current->signal->unsafe_execve_in_progress is set, and the
+exec_guard_mutex is released immediately. Functions that may have effect
+on the credentials of a different thread need to lock the exec_guard_mutex
+and additionally check the unsafe_execve_in_progress status, and fail with
+-EAGAIN if that variable is set.
The mutex prevents ``ptrace()`` from altering the ptrace state of a process
while security checks on credentials construction and changing is taking place
as the ptrace state may alter the outcome, particularly in the case of
``execve()``.
+The mutex current->signal->exec_update_mutex is acquired when only a single
+thread is remaining, and the credentials and the process mmap are actually
+changed. Functions that only need to access to a consistent state of the
+credentials and the process mmap do only need to aquire this mutex.
+
The new credentials set should be altered appropriately, and any security
checks and hooks done. Both the current and the proposed sets of credentials
are available for this purpose as current_cred() will return the current set
@@ -466,9 +481,8 @@ by calling::
This will alter various aspects of the credentials and the process, giving the
LSM a chance to do likewise, then it will use ``rcu_assign_pointer()`` to
-actually commit the new credentials to ``current->cred``, it will release
-``current->cred_replace_mutex`` to allow ``ptrace()`` to take place, and it
-will notify the scheduler and others of the changes.
+actually commit the new credentials to ``current->cred``, and it will notify
+the scheduler and others of the changes.
This function is guaranteed to return 0, so that it can be tail-called at the
end of such functions as ``sys_setresuid()``.
@@ -486,8 +500,7 @@ invoked::
void abort_creds(struct cred *new);
-This releases the lock on ``current->cred_replace_mutex`` that
-``prepare_creds()`` got and then releases the new credentials.
+This releases the new credentials.
A typical credentials alteration function would look something like this::
--
1.9.1
This is the start of the stable review cycle for the 4.9.217 release.
There are 90 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 21 Mar 2020 12:37:04 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.217-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.217-rc1
Matteo Croce <mcroce(a)redhat.com>
ipv4: ensure rcu_read_lock() in cipso_v4_error()
Jann Horn <jannh(a)google.com>
mm: slub: add missing TID bump in kmem_cache_alloc_bulk()
Kees Cook <keescook(a)chromium.org>
ARM: 8958/1: rename missed uaccess .fixup section
Florian Fainelli <f.fainelli(a)gmail.com>
ARM: 8957/1: VDSO: Match ARMv8 timer in cntvct_functional()
Qian Cai <cai(a)lca.pw>
jbd2: fix data races at struct journal_head
Linus Torvalds <torvalds(a)linux-foundation.org>
signal: avoid double atomic counter increments for user accounting
Madhuparna Bhowmik <madhuparnabhowmik10(a)gmail.com>
mac80211: rx: avoid RCU list traversal under mutex
Marek Vasut <marex(a)denx.de>
net: ks8851-ml: Fix IRQ handling and locking
Johannes Berg <johannes.berg(a)intel.com>
cfg80211: check reg_rule for NULL in handle_channel_custom()
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
HID: i2c-hid: add Trekstor Surfbook E11B to descriptor override
Mansour Behabadi <mansour(a)oxplot.com>
HID: apple: Add support for recent firmware on Magic Keyboards
Jean Delvare <jdelvare(a)suse.de>
ACPI: watchdog: Allow disabling WDAT at boot
Kim Phillips <kim.phillips(a)amd.com>
perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Use explicit tvlv padding for ELP packets
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid probe ELP information leak
Matthias Schiffer <mschiffer(a)universe-factory.net>
batman-adv: update data pointers after skb_cow()
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Don't schedule OGM for disabled interface
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid free/alloc race when handling OGM buffer
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid free/alloc race when handling OGM2 buffer
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix duplicated OGMs on NETDEV_UP
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Prevent duplicated gateway_node entry
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: Fix multicast TT issues with bogus ROAM flags
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: Avoid storing non-TT-sync flags on singular entries too
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix debugfs path for renamed softif
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix debugfs path for renamed hardif
Marek Lindner <mareklindner(a)neomailbox.ch>
batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: Fix TT sync flags for intermediate TT responses
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid race in TT TVLV allocator helper
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix internal interface indices types
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq
Sven Eckelmann <sven.eckelmann(a)openmesh.com>
batman-adv: Fix check of retrieved orig_gw in batadv_v_gw_is_eligible
Sven Eckelmann <sven.eckelmann(a)open-mesh.com>
batman-adv: Always initialize fragment header priority
Sven Eckelmann <sven.eckelmann(a)openmesh.com>
batman-adv: Avoid spurious warnings from bat_v neigh_cmp implementation
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: fix TT sync flag inconsistencies
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Accept only filled wifi station info
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Use default throughput value on cfg80211 error
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix rx packet/bytes stats on local ARP reply
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Initialize gw sel_class via batadv_algo
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: Fix transmission of final, 16th fragment
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix double free during fragment merge error
Vladis Dronov <vdronov(a)redhat.com>
efi: Add a sanity check to efivar_store_raw()
Eric Dumazet <edumazet(a)google.com>
ipv6: restrict IPV6_ADDRFORM operation
Daniel Drake <drake(a)endlessm.com>
iommu/vt-d: Ignore devices with out-of-spec domain number
Zhenzhong Duan <zhenzhong.duan(a)gmail.com>
iommu/vt-d: Fix the wrong printing in RHSA parsing
qize wang <wangqize888888888(a)gmail.com>
mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()
Jakub Kicinski <kuba(a)kernel.org>
netfilter: cthelper: add missing attribute validation for cthelper
Jakub Kicinski <kuba(a)kernel.org>
nl80211: add missing attribute validation for channel switch
Jakub Kicinski <kuba(a)kernel.org>
nl80211: add missing attribute validation for beacon report scanning
Jakub Kicinski <kuba(a)kernel.org>
nl80211: add missing attribute validation for critical protocol indication
Yonghyun Hwang <yonghyun(a)google.com>
iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page
Hans de Goede <hdegoede(a)redhat.com>
iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint
Vladis Dronov <vdronov(a)redhat.com>
efi: Fix a race and a buffer overflow while reading efivars via sysfs
Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
ARC: define __ALIGN_STR and __ALIGN symbols for ARC
Vitaly Kuznetsov <vkuznets(a)redhat.com>
KVM: x86: clear stale x86_emulate_ctxt->intercept value
Al Viro <viro(a)zeniv.linux.org.uk>
gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache
Al Viro <viro(a)zeniv.linux.org.uk>
cifs_atomic_open(): fix double-put on late allocation failure
Colin Ian King <colin.king(a)canonical.com>
drm/amd/display: remove duplicated assignment to grph_obj_type
Hillf Danton <hdanton(a)sina.com>
workqueue: don't use wq_select_unbound_cpu() for bound works
Hans de Goede <hdegoede(a)redhat.com>
iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint
Halil Pasic <pasic(a)linux.ibm.com>
virtio-blk: fix hw_queue stopped on arbitrary error
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: fix MDIO bus PM PHY resuming
Shakeel Butt <shakeelb(a)google.com>
cgroup: memcg: net: do not associate sock with unrelated cgroup
Eric Dumazet <edumazet(a)google.com>
bonding/alb: make sure arp header is pulled before accessing it
Eric Dumazet <edumazet(a)google.com>
slip: make slhc_compress() more robust against malicious packets
Jakub Kicinski <kuba(a)kernel.org>
net: fec: validate the new settings in fec_enet_set_coalesce()
Mahesh Bandewar <maheshb(a)google.com>
macvlan: add cond_resched() during multicast processing
Mahesh Bandewar <maheshb(a)google.com>
ipvlan: don't deref eth hdr before checking it's set
Eric Dumazet <edumazet(a)google.com>
ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast()
Paolo Abeni <pabeni(a)redhat.com>
ipvlan: egress mcast packets are not exceptional
Jiri Wiesner <jwiesner(a)suse.com>
ipvlan: do not add hardware address of master to its unicast filter list
Mahesh Bandewar <maheshb(a)google.com>
ipvlan: add cond_resched_rcu() while processing muticast backlog
Jakub Kicinski <kuba(a)kernel.org>
nfc: add missing attribute validation for vendor subcommand
Jakub Kicinski <kuba(a)kernel.org>
nfc: add missing attribute validation for SE API
Jakub Kicinski <kuba(a)kernel.org>
team: add missing attribute validation for array index
Jakub Kicinski <kuba(a)kernel.org>
team: add missing attribute validation for port ifindex
Jakub Kicinski <kuba(a)kernel.org>
net: fq: add missing attribute validation for orphan mask
Jakub Kicinski <kuba(a)kernel.org>
macsec: add missing attribute validation for port
Jakub Kicinski <kuba(a)kernel.org>
nl802154: add missing attribute validation for dev_type
Jakub Kicinski <kuba(a)kernel.org>
nl802154: add missing attribute validation
Jakub Kicinski <kuba(a)kernel.org>
fib: add missing attribute validation for tun_id
Vasundhara Volam <vasundhara-v.volam(a)broadcom.com>
bnxt_en: reinitialize IRQs when MTU is modified
You-Sheng Yang <vicamo.yang(a)canonical.com>
r8152: check disconnect status after long sleep
Dan Carpenter <dan.carpenter(a)oracle.com>
net: nfc: fix bounds checking bugs on "pipe"
Dmitry Bogdanov <dbogdanov(a)marvell.com>
net: macsec: update SCI upon MAC address change.
Hangbin Liu <liuhangbin(a)gmail.com>
ipv6/addrconf: call ipv6_mc_up() for non-Ethernet interface
Eric Dumazet <edumazet(a)google.com>
gre: fix uninit-value in __iptunnel_pull_header
Dmitry Yakunin <zeil(a)yandex-team.ru>
cgroup, netclassid: periodically release file_lock on classid updating
Florian Fainelli <f.fainelli(a)gmail.com>
net: phy: Avoid multiple suspends
David S. Miller <davem(a)davemloft.net>
phy: Revert toggling reset changes.
Petr Malat <oss(a)malat.biz>
NFS: Remove superfluous kmap in nfs_readdir_xdr_to_array
-------------
Diffstat:
Documentation/filesystems/porting | 7 ++
Documentation/kernel-parameters.txt | 4 +
Makefile | 4 +-
arch/arc/include/asm/linkage.h | 2 +
arch/arm/kernel/vdso.c | 2 +
arch/arm/lib/copy_from_user.S | 2 +-
arch/x86/events/amd/uncore.c | 14 +--
arch/x86/kvm/emulate.c | 1 +
drivers/acpi/acpi_watchdog.c | 12 ++-
drivers/block/virtio_blk.c | 8 +-
drivers/firmware/efi/efivars.c | 32 ++++--
drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 3 +-
drivers/hid/hid-apple.c | 3 +-
drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++
drivers/iommu/dmar.c | 21 ++--
drivers/iommu/intel-iommu.c | 13 ++-
drivers/net/bonding/bond_alb.c | 20 ++--
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +-
drivers/net/ethernet/freescale/fec_main.c | 6 +-
drivers/net/ethernet/micrel/ks8851_mll.c | 14 +--
drivers/net/ipvlan/ipvlan_core.c | 19 ++--
drivers/net/ipvlan/ipvlan_main.c | 5 +-
drivers/net/macsec.c | 12 ++-
drivers/net/macvlan.c | 2 +
drivers/net/phy/phy_device.c | 18 ++--
drivers/net/slip/slhc.c | 14 ++-
drivers/net/team/team.c | 2 +
drivers/net/usb/r8152.c | 6 ++
drivers/net/wireless/marvell/mwifiex/tdls.c | 70 +++++++++++--
fs/cifs/dir.c | 1 -
fs/gfs2/inode.c | 2 +-
fs/jbd2/transaction.c | 8 +-
fs/nfs/dir.c | 2 -
fs/open.c | 3 -
include/linux/phy.h | 2 +
include/net/fib_rules.h | 1 +
kernel/cgroup.c | 4 +
kernel/signal.c | 23 +++--
kernel/workqueue.c | 14 +--
mm/memcontrol.c | 4 +
mm/slub.c | 9 ++
net/batman-adv/bat_iv_ogm.c | 105 +++++++++++++++----
net/batman-adv/bat_v.c | 25 +++--
net/batman-adv/bat_v_elp.c | 22 ++--
net/batman-adv/bat_v_ogm.c | 42 ++++++--
net/batman-adv/debugfs.c | 40 +++++++
net/batman-adv/debugfs.h | 11 ++
net/batman-adv/distributed-arp-table.c | 5 +-
net/batman-adv/fragmentation.c | 22 ++--
net/batman-adv/gateway_client.c | 11 +-
net/batman-adv/gateway_common.c | 5 +
net/batman-adv/hard-interface.c | 51 +++++++--
net/batman-adv/originator.c | 4 +-
net/batman-adv/originator.h | 4 +-
net/batman-adv/routing.c | 11 +-
net/batman-adv/soft-interface.c | 1 -
net/batman-adv/translation-table.c | 149 ++++++++++++++++++++++-----
net/batman-adv/types.h | 22 +++-
net/core/netclassid_cgroup.c | 47 +++++++--
net/ieee802154/nl_policy.c | 6 ++
net/ipv4/cipso_ipv4.c | 7 +-
net/ipv4/gre_demux.c | 12 ++-
net/ipv6/addrconf.c | 4 +
net/ipv6/ipv6_sockglue.c | 10 +-
net/mac80211/rx.c | 2 +-
net/netfilter/nfnetlink_cthelper.c | 2 +
net/nfc/hci/core.c | 19 +++-
net/nfc/netlink.c | 3 +
net/sched/sch_fq.c | 1 +
net/wireless/nl80211.c | 5 +
net/wireless/reg.c | 2 +-
71 files changed, 809 insertions(+), 242 deletions(-)
The patch titled
Subject: mm, slub: prevent kmalloc_node crashes and memory leaks
has been added to the -mm tree. Its filename is
mm-slub-prevent-kmalloc_node-crashes-and-memory-leaks.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-slub-prevent-kmalloc_node-crash…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-slub-prevent-kmalloc_node-crash…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Vlastimil Babka <vbabka(a)suse.cz>
Subject: mm, slub: prevent kmalloc_node crashes and memory leaks
Sachin reports [1] a crash in SLUB __slab_alloc():
BUG: Kernel NULL pointer dereference on read at 0x000073b0
Faulting instruction address: 0xc0000000003d55f4
Oops: Kernel access of bad area, sig: 11 [#1]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
Modules linked in:
CPU: 19 PID: 1 Comm: systemd Not tainted 5.6.0-rc2-next-20200218-autotest #1
NIP: c0000000003d55f4 LR: c0000000003d5b94 CTR: 0000000000000000
REGS: c0000008b37836d0 TRAP: 0300 Not tainted (5.6.0-rc2-next-20200218-autotest)
MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24004844 XER: 00000000
CFAR: c00000000000dec4 DAR: 00000000000073b0 DSISR: 40000000 IRQMASK: 1
GPR00: c0000000003d5b94 c0000008b3783960 c00000000155d400 c0000008b301f500
GPR04: 0000000000000dc0 0000000000000002 c0000000003443d8 c0000008bb398620
GPR08: 00000008ba2f0000 0000000000000001 0000000000000000 0000000000000000
GPR12: 0000000024004844 c00000001ec52a00 0000000000000000 0000000000000000
GPR16: c0000008a1b20048 c000000001595898 c000000001750c18 0000000000000002
GPR20: c000000001750c28 c000000001624470 0000000fffffffe0 5deadbeef0000122
GPR24: 0000000000000001 0000000000000dc0 0000000000000002 c0000000003443d8
GPR28: c0000008b301f500 c0000008bb398620 0000000000000000 c00c000002287180
NIP [c0000000003d55f4] ___slab_alloc+0x1f4/0x760
LR [c0000000003d5b94] __slab_alloc+0x34/0x60
Call Trace:
[c0000008b3783960] [c0000000003d5734] ___slab_alloc+0x334/0x760 (unreliable)
[c0000008b3783a40] [c0000000003d5b94] __slab_alloc+0x34/0x60
[c0000008b3783a70] [c0000000003d6fa0] __kmalloc_node+0x110/0x490
[c0000008b3783af0] [c0000000003443d8] kvmalloc_node+0x58/0x110
[c0000008b3783b30] [c0000000003fee38] mem_cgroup_css_online+0x108/0x270
[c0000008b3783b90] [c000000000235aa8] online_css+0x48/0xd0
[c0000008b3783bc0] [c00000000023eaec] cgroup_apply_control_enable+0x2ec/0x4d0
[c0000008b3783ca0] [c000000000242318] cgroup_mkdir+0x228/0x5f0
[c0000008b3783d10] [c00000000051e170] kernfs_iop_mkdir+0x90/0xf0
[c0000008b3783d50] [c00000000043dc00] vfs_mkdir+0x110/0x230
[c0000008b3783da0] [c000000000441c90] do_mkdirat+0xb0/0x1a0
[c0000008b3783e20] [c00000000000b278] system_call+0x5c/0x68
This is a PowerPC platform with following NUMA topology:
available: 2 nodes (0-1)
node 0 cpus:
node 0 size: 0 MB
node 0 free: 0 MB
node 1 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
node 1 size: 35247 MB
node 1 free: 30907 MB
node distances:
node 0 1
0: 10 40
1: 40 10
possible numa nodes: 0-31
This only happens with a mmotm patch "mm/memcontrol.c: allocate shrinker_map on
appropriate NUMA node" [2] which effectively calls kmalloc_node for each
possible node. SLUB however only allocates kmem_cache_node on online
N_NORMAL_MEMORY nodes, and relies on node_to_mem_node to return such valid node
for other nodes since commit a561ce00b09e ("slub: fall back to
node_to_mem_node() node if allocating on memoryless node"). This is however not
true in this configuration where the _node_numa_mem_ array is not initialized
for nodes 0 and 2-31, thus it contains zeroes and get_partial() ends up
accessing non-allocated kmem_cache_node.
A related issue was reported by Bharata (originally by Ramachandran) [3] where
a similar PowerPC configuration, but with mainline kernel without patch [2]
ends up allocating large amounts of pages by kmalloc-1k kmalloc-512. This seems
to have the same underlying issue with node_to_mem_node() not behaving as
expected, and might probably also lead to an infinite loop with
CONFIG_SLUB_CPU_PARTIAL [4].
This patch should fix both issues by not relying on node_to_mem_node() anymore
and instead simply falling back to NUMA_NO_NODE, when kmalloc_node(node) is
attempted for a node that's not online, or has no usable memory. The "usable
memory" condition is also changed from node_present_pages() to N_NORMAL_MEMORY
node state, as that is exactly the condition that SLUB uses to allocate
kmem_cache_node structures. The check in get_partial() is removed completely,
as the checks in ___slab_alloc() are now sufficient to prevent get_partial()
being reached with an invalid node.
[1] https://lore.kernel.org/linux-next/3381CD91-AB3D-4773-BA04-E7A072A63968@lin…
[2] https://lore.kernel.org/linux-mm/fff0e636-4c36-ed10-281c-8cdb0687c839@virtu…
[3] https://lore.kernel.org/linux-mm/20200317092624.GB22538@in.ibm.com/
[4] https://lore.kernel.org/linux-mm/088b5996-faae-8a56-ef9c-5b567125ae54@suse.…
Link: http://lkml.kernel.org/r/20200320115533.9604-1-vbabka@suse.cz
Fixes: a561ce00b09e ("slub: fall back to node_to_mem_node() node if allocating on memoryless node")
Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz>
Reported-by: Sachin Sant <sachinp(a)linux.vnet.ibm.com>
Tested-by: Sachin Sant <sachinp(a)linux.vnet.ibm.com>
Reported-by: PUVICHAKRAVARTHY RAMACHANDRAN <puvichakravarthy(a)in.ibm.com>
Tested-by: Bharata B Rao <bharata(a)linux.ibm.com>
Debugged-by: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com>
Reviewed-by: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com>
Cc: Mel Gorman <mgorman(a)techsingularity.net>
Cc: Michael Ellerman <mpe(a)ellerman.id.au>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: Christopher Lameter <cl(a)linux.com>
Cc: linuxppc-dev(a)lists.ozlabs.org
Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com>
Cc: Pekka Enberg <penberg(a)kernel.org>
Cc: David Rientjes <rientjes(a)google.com>
Cc: Kirill Tkhai <ktkhai(a)virtuozzo.com>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: Nathan Lynch <nathanl(a)linux.ibm.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/slub.c | 26 +++++++++++++++++---------
1 file changed, 17 insertions(+), 9 deletions(-)
--- a/mm/slub.c~mm-slub-prevent-kmalloc_node-crashes-and-memory-leaks
+++ a/mm/slub.c
@@ -1973,8 +1973,6 @@ static void *get_partial(struct kmem_cac
if (node == NUMA_NO_NODE)
searchnode = numa_mem_id();
- else if (!node_present_pages(node))
- searchnode = node_to_mem_node(node);
object = get_partial_node(s, get_node(s, searchnode), c, flags);
if (object || node != NUMA_NO_NODE)
@@ -2563,17 +2561,27 @@ static void *___slab_alloc(struct kmem_c
struct page *page;
page = c->page;
- if (!page)
+ if (!page) {
+ /*
+ * if the node is not online or has no normal memory, just
+ * ignore the node constraint
+ */
+ if (unlikely(node != NUMA_NO_NODE &&
+ !node_state(node, N_NORMAL_MEMORY)))
+ node = NUMA_NO_NODE;
goto new_slab;
+ }
redo:
if (unlikely(!node_match(page, node))) {
- int searchnode = node;
-
- if (node != NUMA_NO_NODE && !node_present_pages(node))
- searchnode = node_to_mem_node(node);
-
- if (unlikely(!node_match(page, searchnode))) {
+ /*
+ * same as above but node_match() being false already
+ * implies node != NUMA_NO_NODE
+ */
+ if (!node_state(node, N_NORMAL_MEMORY)) {
+ node = NUMA_NO_NODE;
+ goto redo;
+ } else {
stat(s, ALLOC_NODE_MISMATCH);
deactivate_slab(s, page, c->freelist, c);
goto new_slab;
_
Patches currently in -mm which might be from vbabka(a)suse.cz are
mm-slub-prevent-kmalloc_node-crashes-and-memory-leaks.patch
revert-topology-add-support-for-node_to_mem_node-to-determine-the-fallback-node.patch
mm-compaction-fully-assume-capture-is-not-null-in-compact_zone_order.patch
mm-hugetlb-remove-unnecessary-memory-fetch-in-pageheadhuge.patch