In case we have a region 1 ASCE, our shadow/g3 address can have any value.
Unfortunately, (-1UL << 64) is undefined and triggers sometimes,
rejecting valid shadow addresses when trying to walk our shadow table
hierarchy.
The result is that the prefix cannot get mapped and will loop basically
forever trying to map it (-EAGAIN loop).
After all, the broken check is only a sanity check, our table shadowing
code in kvm_s390_shadow_tables() already checks these conditions, injecting
proper translation exceptions. Turn it into a WARN_ON_ONCE().
Fixes: 4be130a08420 ("s390/mm: add shadow gmap support")
Cc: <stable(a)vger.kernel.org> # v4.8+
Reported-by: Janosch Frank <frankja(a)linux.ibm.com>
Signed-off-by: David Hildenbrand <david(a)redhat.com>
---
arch/s390/mm/gmap.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
index 2fbece47ef6f..f3dbc5bdde50 100644
--- a/arch/s390/mm/gmap.c
+++ b/arch/s390/mm/gmap.c
@@ -787,14 +787,18 @@ static void gmap_call_notifier(struct gmap *gmap, unsigned long start,
static inline unsigned long *gmap_table_walk(struct gmap *gmap,
unsigned long gaddr, int level)
{
+ const int asce_type = gmap->asce & _ASCE_TYPE_MASK;
unsigned long *table;
if ((gmap->asce & _ASCE_TYPE_MASK) + 4 < (level * 4))
return NULL;
if (gmap_is_shadow(gmap) && gmap->removed)
return NULL;
- if (gaddr & (-1UL << (31 + ((gmap->asce & _ASCE_TYPE_MASK) >> 2)*11)))
+
+ if (WARN_ON_ONCE(asce_type != _ASCE_TYPE_REGION1) &&
+ gaddr & (-1UL << (31 + (asce_type >> 2) * 11)))
return NULL;
+
table = gmap->table;
switch (gmap->asce & _ASCE_TYPE_MASK) {
case _ASCE_TYPE_REGION1:
--
2.25.1
Hi Greg,
Syzbot has been complaining about KASAN splats due to use-after-free
issues in the l2tp code on 4.4 Android kernels (although I reproduced
with latest 4.4 stable on my laptop):
https://syzkaller.appspot.com/bug?id=de316389db0fa0cd7ced6e564601ea8e56625e…
These have been fixed upstream, but for some reason didn't get picked up
for stable. This series applies to 4.4.y and I've sent patches for 4.9
separately.
Thanks,
Will
--->8
Gao Feng (1):
l2tp: Refactor the codes with existing macros instead of literal
number
Guillaume Nault (5):
l2tp: fix race in l2tp_recv_common()
l2tp: ensure session can't get removed during pppol2tp_session_ioctl()
l2tp: fix duplicate session creation
l2tp: ensure sessions are freed after their PPPOL2TP socket
l2tp: fix race between l2tp_session_delete() and
l2tp_tunnel_closeall()
Shmulik Ladkani (1):
net: l2tp: Make l2tp_ip6 namespace aware
phil.turnbull(a)oracle.com (1):
l2tp: Correctly return -EBADF from pppol2tp_getname.
net/l2tp/l2tp_core.c | 149 ++++++++++++++++++++++++++++++++++---------
net/l2tp/l2tp_core.h | 4 ++
net/l2tp/l2tp_eth.c | 10 +--
net/l2tp/l2tp_ip.c | 17 +++--
net/l2tp/l2tp_ip6.c | 28 +++++---
net/l2tp/l2tp_ppp.c | 110 ++++++++++++++++----------------
6 files changed, 211 insertions(+), 107 deletions(-)
--
2.26.0.rc2.310.g2932bb562d-goog
On 4/3/20 1:34 PM, Christian Brauner wrote:
> On Fri, Apr 03, 2020 at 02:11:39PM +0200, Michael Kerrisk (man-pages) wrote:
>> Dmitry, Andrei,
>>
>> Looking at the contents of the /proc/PID/ns/time_for_children
>> symlink shows an anomaly:
>>
>> $ ls -l /proc/self/ns/* |awk '{print $9, $10, $11}'
>> ...
>> /proc/self/ns/pid -> pid:[4026531836]
>> /proc/self/ns/pid_for_children -> pid:[4026531836]
>> /proc/self/ns/time -> time:[4026531834]
>> /proc/self/ns/time_for_children -> time_for_children:[4026531834]
>> /proc/self/ns/user -> user:[4026531837]
>> ...
>>
>> The reference for 'time_for_children' should be a 'time' namespace,
>> just as the reference for 'pid_for_children' is a 'pid' namespace.
>> In other words, I think the above time_for_children link should read:
>>
>> /proc/self/ns/time_for_children -> time:[4026531834]
>>
>> If you agree with this patch, then it should be marked for
>> stable(a)vger.kernel.org.
>>
>> Signed-off-by: Michael Kerrisk <mtk.manpages(a)gmail.com>
>
> Yeah, that just seems like an oversight.
>
> Acked-by: Christian Brauner <christian.brauner(a)ubuntu.com>
Thanks,
Reviewed-by: Dmitry Safonov <dima(a)arista.com>
Fixes: 769071ac9f20 ("ns: Introduce Time Namespace")
+Cc: stable # v5.6
--
Dmitry