May 2020 - Linux-stable-mirror

FAILED: patch "[PATCH] btrfs: fix block group leak when removing fails" failed to apply to 4.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From f6033c5e333238f299c3ae03fac8cc1365b23b77 Mon Sep 17 00:00:00 2001 From: Xiyu Yang <xiyuyang19(a)fudan.edu.cn> Date: Tue, 21 Apr 2020 10:54:11 +0800 Subject: [PATCH] btrfs: fix block group leak when removing fails btrfs_remove_block_group() invokes btrfs_lookup_block_group(), which returns a local reference of the block group that contains the given bytenr to "block_group" with increased refcount. When btrfs_remove_block_group() returns, "block_group" becomes invalid, so the refcount should be decreased to keep refcount balanced. The reference counting issue happens in several exception handling paths of btrfs_remove_block_group(). When those error scenarios occur such as btrfs_alloc_path() returns NULL, the function forgets to decrease its refcnt increased by btrfs_lookup_block_group() and will cause a refcnt leak. Fix this issue by jumping to "out_put_group" label and calling btrfs_put_block_group() when those error scenarios occur. CC: stable(a)vger.kernel.org # 4.4+ Signed-off-by: Xiyu Yang <xiyuyang19(a)fudan.edu.cn> Signed-off-by: Xin Tan <tanxin.ctf(a)gmail.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c index af9e9a008724..696f47103cfc 100644 --- a/fs/btrfs/block-group.c +++ b/fs/btrfs/block-group.c @@ -916,7 +916,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, path = btrfs_alloc_path(); if (!path) { ret = -ENOMEM; - goto out; + goto out_put_group; } /* @@ -954,7 +954,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, ret = btrfs_orphan_add(trans, BTRFS_I(inode)); if (ret) { btrfs_add_delayed_iput(inode); - goto out; + goto out_put_group; } clear_nlink(inode); /* One for the block groups ref */ @@ -977,13 +977,13 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, ret = btrfs_search_slot(trans, tree_root, &key, path, -1, 1); if (ret < 0) - goto out; + goto out_put_group; if (ret > 0) btrfs_release_path(path); if (ret == 0) { ret = btrfs_del_item(trans, tree_root, path); if (ret) - goto out; + goto out_put_group; btrfs_release_path(path); } @@ -1102,9 +1102,9 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, ret = remove_block_group_free_space(trans, block_group); if (ret) - goto out; + goto out_put_group; - btrfs_put_block_group(block_group); + /* Once for the block groups rbtree */ btrfs_put_block_group(block_group); ret = btrfs_search_slot(trans, root, &key, path, -1, 1); @@ -1127,6 +1127,10 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, /* once for the tree */ free_extent_map(em); } + +out_put_group: + /* Once for the lookup reference */ + btrfs_put_block_group(block_group); out: if (remove_rsv) btrfs_delayed_refs_rsv_release(fs_info, 1);

4 years, 8 months

1
0
0 0

FAILED: patch "[PATCH] btrfs: fix transaction leak in btrfs_recover_relocation" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 1402d17dfd9657be0da8458b2079d03c2d61c86a Mon Sep 17 00:00:00 2001 From: Xiyu Yang <xiyuyang19(a)fudan.edu.cn> Date: Mon, 20 Apr 2020 13:39:39 +0800 Subject: [PATCH] btrfs: fix transaction leak in btrfs_recover_relocation btrfs_recover_relocation() invokes btrfs_join_transaction(), which joins a btrfs_trans_handle object into transactions and returns a reference of it with increased refcount to "trans". When btrfs_recover_relocation() returns, "trans" becomes invalid, so the refcount should be decreased to keep refcount balanced. The reference counting issue happens in one exception handling path of btrfs_recover_relocation(). When read_fs_root() failed, the refcnt increased by btrfs_join_transaction() is not decreased, causing a refcnt leak. Fix this issue by calling btrfs_end_transaction() on this error path when read_fs_root() failed. Fixes: 79787eaab461 ("btrfs: replace many BUG_ONs with proper error handling") CC: stable(a)vger.kernel.org # 4.4+ Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: Xiyu Yang <xiyuyang19(a)fudan.edu.cn> Signed-off-by: Xin Tan <tanxin.ctf(a)gmail.com> Signed-off-by: David Sterba <dsterba(a)suse.com> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index d35936c934ab..03bc7134e8cb 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -4559,6 +4559,7 @@ int btrfs_recover_relocation(struct btrfs_root *root) if (IS_ERR(fs_root)) { err = PTR_ERR(fs_root); list_add_tail(&reloc_root->root_list, &reloc_roots); + btrfs_end_transaction(trans); goto out_unset; }

4 years, 8 months

1
0
0 0

FAILED: patch "[PATCH] btrfs: fix transaction leak in btrfs_recover_relocation" failed to apply to 4.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 1402d17dfd9657be0da8458b2079d03c2d61c86a Mon Sep 17 00:00:00 2001 From: Xiyu Yang <xiyuyang19(a)fudan.edu.cn> Date: Mon, 20 Apr 2020 13:39:39 +0800 Subject: [PATCH] btrfs: fix transaction leak in btrfs_recover_relocation btrfs_recover_relocation() invokes btrfs_join_transaction(), which joins a btrfs_trans_handle object into transactions and returns a reference of it with increased refcount to "trans". When btrfs_recover_relocation() returns, "trans" becomes invalid, so the refcount should be decreased to keep refcount balanced. The reference counting issue happens in one exception handling path of btrfs_recover_relocation(). When read_fs_root() failed, the refcnt increased by btrfs_join_transaction() is not decreased, causing a refcnt leak. Fix this issue by calling btrfs_end_transaction() on this error path when read_fs_root() failed. Fixes: 79787eaab461 ("btrfs: replace many BUG_ONs with proper error handling") CC: stable(a)vger.kernel.org # 4.4+ Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: Xiyu Yang <xiyuyang19(a)fudan.edu.cn> Signed-off-by: Xin Tan <tanxin.ctf(a)gmail.com> Signed-off-by: David Sterba <dsterba(a)suse.com> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index d35936c934ab..03bc7134e8cb 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -4559,6 +4559,7 @@ int btrfs_recover_relocation(struct btrfs_root *root) if (IS_ERR(fs_root)) { err = PTR_ERR(fs_root); list_add_tail(&reloc_root->root_list, &reloc_roots); + btrfs_end_transaction(trans); goto out_unset; }

4 years, 8 months

1
0
0 0

FAILED: patch "[PATCH] btrfs: fix transaction leak in btrfs_recover_relocation" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 1402d17dfd9657be0da8458b2079d03c2d61c86a Mon Sep 17 00:00:00 2001 From: Xiyu Yang <xiyuyang19(a)fudan.edu.cn> Date: Mon, 20 Apr 2020 13:39:39 +0800 Subject: [PATCH] btrfs: fix transaction leak in btrfs_recover_relocation btrfs_recover_relocation() invokes btrfs_join_transaction(), which joins a btrfs_trans_handle object into transactions and returns a reference of it with increased refcount to "trans". When btrfs_recover_relocation() returns, "trans" becomes invalid, so the refcount should be decreased to keep refcount balanced. The reference counting issue happens in one exception handling path of btrfs_recover_relocation(). When read_fs_root() failed, the refcnt increased by btrfs_join_transaction() is not decreased, causing a refcnt leak. Fix this issue by calling btrfs_end_transaction() on this error path when read_fs_root() failed. Fixes: 79787eaab461 ("btrfs: replace many BUG_ONs with proper error handling") CC: stable(a)vger.kernel.org # 4.4+ Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: Xiyu Yang <xiyuyang19(a)fudan.edu.cn> Signed-off-by: Xin Tan <tanxin.ctf(a)gmail.com> Signed-off-by: David Sterba <dsterba(a)suse.com> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index d35936c934ab..03bc7134e8cb 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -4559,6 +4559,7 @@ int btrfs_recover_relocation(struct btrfs_root *root) if (IS_ERR(fs_root)) { err = PTR_ERR(fs_root); list_add_tail(&reloc_root->root_list, &reloc_roots); + btrfs_end_transaction(trans); goto out_unset; }

4 years, 8 months

1
0
0 0

FAILED: patch "[PATCH] drm/qxl: qxl_release use after free" failed to apply to 4.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 933db73351d359f74b14f4af095808260aff11f9 Mon Sep 17 00:00:00 2001 From: Vasily Averin <vvs(a)virtuozzo.com> Date: Wed, 29 Apr 2020 12:01:24 +0300 Subject: [PATCH] drm/qxl: qxl_release use after free qxl_release should not be accesses after qxl_push_*_ring_release() calls: userspace driver can process submitted command quickly, move qxl_release into release_ring, generate interrupt and trigger garbage collector. It can lead to crashes in qxl driver or trigger memory corruption in some kmalloc-192 slab object Gerd Hoffmann proposes to swap the qxl_release_fence_buffer_objects() + qxl_push_{cursor,command}_ring_release() calls to close that race window. cc: stable(a)vger.kernel.org Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/fa17b338-66ae-f299-68fe-8d3241… Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c index fa8762d15d0f..05863b253d68 100644 --- a/drivers/gpu/drm/qxl/qxl_cmd.c +++ b/drivers/gpu/drm/qxl/qxl_cmd.c @@ -500,8 +500,8 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev, /* no need to add a release to the fence for this surface bo, since it is only released when we ask to destroy the surface and it would never signal otherwise */ - qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); surf->hw_surf_alloc = true; spin_lock(&qdev->surf_id_idr_lock); @@ -543,9 +543,8 @@ int qxl_hw_surface_dealloc(struct qxl_device *qdev, cmd->surface_id = id; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); - qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); return 0; } diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c index 09583a08e141..91f398d51cfa 100644 --- a/drivers/gpu/drm/qxl/qxl_display.c +++ b/drivers/gpu/drm/qxl/qxl_display.c @@ -510,8 +510,8 @@ static int qxl_primary_apply_cursor(struct drm_plane *plane) cmd->u.set.visible = 1; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); return ret; @@ -652,8 +652,8 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane, cmd->u.position.y = plane->state->crtc_y + fb->hot_y; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); if (old_cursor_bo != NULL) qxl_bo_unpin(old_cursor_bo); @@ -700,8 +700,8 @@ static void qxl_cursor_atomic_disable(struct drm_plane *plane, cmd->type = QXL_CURSOR_HIDE; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); } static void qxl_update_dumb_head(struct qxl_device *qdev, diff --git a/drivers/gpu/drm/qxl/qxl_draw.c b/drivers/gpu/drm/qxl/qxl_draw.c index f8776d60d08e..3599db096973 100644 --- a/drivers/gpu/drm/qxl/qxl_draw.c +++ b/drivers/gpu/drm/qxl/qxl_draw.c @@ -243,8 +243,8 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev, } qxl_bo_kunmap(clips_bo); - qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); out_release_backoff: if (ret) diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index 8117a45b3610..72f3f1bbb40c 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -261,11 +261,8 @@ static int qxl_process_single_command(struct qxl_device *qdev, apply_surf_reloc(qdev, &reloc_info[i]); } + qxl_release_fence_buffer_objects(release); ret = qxl_push_command_ring_release(qdev, release, cmd->type, true); - if (ret) - qxl_release_backoff_reserve_list(release); - else - qxl_release_fence_buffer_objects(release); out_free_bos: out_free_release:

4 years, 8 months

1
0
0 0

FAILED: patch "[PATCH] drm/qxl: qxl_release use after free" failed to apply to 4.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 933db73351d359f74b14f4af095808260aff11f9 Mon Sep 17 00:00:00 2001 From: Vasily Averin <vvs(a)virtuozzo.com> Date: Wed, 29 Apr 2020 12:01:24 +0300 Subject: [PATCH] drm/qxl: qxl_release use after free qxl_release should not be accesses after qxl_push_*_ring_release() calls: userspace driver can process submitted command quickly, move qxl_release into release_ring, generate interrupt and trigger garbage collector. It can lead to crashes in qxl driver or trigger memory corruption in some kmalloc-192 slab object Gerd Hoffmann proposes to swap the qxl_release_fence_buffer_objects() + qxl_push_{cursor,command}_ring_release() calls to close that race window. cc: stable(a)vger.kernel.org Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/fa17b338-66ae-f299-68fe-8d3241… Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c index fa8762d15d0f..05863b253d68 100644 --- a/drivers/gpu/drm/qxl/qxl_cmd.c +++ b/drivers/gpu/drm/qxl/qxl_cmd.c @@ -500,8 +500,8 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev, /* no need to add a release to the fence for this surface bo, since it is only released when we ask to destroy the surface and it would never signal otherwise */ - qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); surf->hw_surf_alloc = true; spin_lock(&qdev->surf_id_idr_lock); @@ -543,9 +543,8 @@ int qxl_hw_surface_dealloc(struct qxl_device *qdev, cmd->surface_id = id; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); - qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); return 0; } diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c index 09583a08e141..91f398d51cfa 100644 --- a/drivers/gpu/drm/qxl/qxl_display.c +++ b/drivers/gpu/drm/qxl/qxl_display.c @@ -510,8 +510,8 @@ static int qxl_primary_apply_cursor(struct drm_plane *plane) cmd->u.set.visible = 1; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); return ret; @@ -652,8 +652,8 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane, cmd->u.position.y = plane->state->crtc_y + fb->hot_y; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); if (old_cursor_bo != NULL) qxl_bo_unpin(old_cursor_bo); @@ -700,8 +700,8 @@ static void qxl_cursor_atomic_disable(struct drm_plane *plane, cmd->type = QXL_CURSOR_HIDE; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); } static void qxl_update_dumb_head(struct qxl_device *qdev, diff --git a/drivers/gpu/drm/qxl/qxl_draw.c b/drivers/gpu/drm/qxl/qxl_draw.c index f8776d60d08e..3599db096973 100644 --- a/drivers/gpu/drm/qxl/qxl_draw.c +++ b/drivers/gpu/drm/qxl/qxl_draw.c @@ -243,8 +243,8 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev, } qxl_bo_kunmap(clips_bo); - qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); out_release_backoff: if (ret) diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index 8117a45b3610..72f3f1bbb40c 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -261,11 +261,8 @@ static int qxl_process_single_command(struct qxl_device *qdev, apply_surf_reloc(qdev, &reloc_info[i]); } + qxl_release_fence_buffer_objects(release); ret = qxl_push_command_ring_release(qdev, release, cmd->type, true); - if (ret) - qxl_release_backoff_reserve_list(release); - else - qxl_release_fence_buffer_objects(release); out_free_bos: out_free_release:

4 years, 8 months

1
0
0 0

FAILED: patch "[PATCH] drm/qxl: qxl_release leak in qxl_draw_dirty_fb()" failed to apply to 4.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 85e9b88af1e6164f19ec71381efd5e2bcfc17620 Mon Sep 17 00:00:00 2001 From: Vasily Averin <vvs(a)virtuozzo.com> Date: Mon, 27 Apr 2020 08:32:46 +0300 Subject: [PATCH] drm/qxl: qxl_release leak in qxl_draw_dirty_fb() ret should be changed to release allocated struct qxl_release Cc: stable(a)vger.kernel.org Fixes: 8002db6336dd ("qxl: convert qxl driver to proper use for reservations") Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/22cfd55f-07c8-95d0-a2f7-191b71… Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> diff --git a/drivers/gpu/drm/qxl/qxl_draw.c b/drivers/gpu/drm/qxl/qxl_draw.c index 5bebf1ea1c5d..f8776d60d08e 100644 --- a/drivers/gpu/drm/qxl/qxl_draw.c +++ b/drivers/gpu/drm/qxl/qxl_draw.c @@ -209,9 +209,10 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev, goto out_release_backoff; rects = drawable_set_clipping(qdev, num_clips, clips_bo); - if (!rects) + if (!rects) { + ret = -EINVAL; goto out_release_backoff; - + } drawable = (struct qxl_drawable *)qxl_release_map(qdev, release); drawable->clip.type = SPICE_CLIP_TYPE_RECTS;

4 years, 8 months

1
0
0 0

[PATCH 01/12] aio: fix async fsync creds

by Miklos Szeredi

Avi Kivity reports that on fuse filesystems running in a user namespace asyncronous fsync fails with EOVERFLOW. The reason is that f_ops->fsync() is called with the creds of the kthread performing aio work instead of the creds of the process originally submitting IOCB_CMD_FSYNC. Fuse sends the creds of the caller in the request header and it needs to translate the uid and gid into the server's user namespace. Since the kthread is running in init_user_ns, the translation will fail and the operation returns an error. It can be argued that fsync doesn't actually need any creds, but just zeroing out those fields in the header (as with requests that currently don't take creds) is a backward compatibility risk. Instead of working around this issue in fuse, solve the core of the problem by calling the filesystem with the proper creds. Reported-by: Avi Kivity <avi(a)scylladb.com> Tested-by: Giuseppe Scrivano <gscrivan(a)redhat.com> Fixes: c9582eb0ff7d ("fuse: Fail all requests with invalid uids or gids") Cc: stable(a)vger.kernel.org # 4.18+ Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> --- fs/aio.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/aio.c b/fs/aio.c index 0d9a559d488c..37828773e2fe 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -176,6 +176,7 @@ struct fsync_iocb { struct file *file; struct work_struct work; bool datasync; + struct cred *creds; }; struct poll_iocb { @@ -1589,8 +1590,11 @@ static int aio_write(struct kiocb *req, const struct iocb *iocb, static void aio_fsync_work(struct work_struct *work) { struct aio_kiocb *iocb = container_of(work, struct aio_kiocb, fsync.work); + const struct cred *old_cred = override_creds(iocb->fsync.creds); iocb->ki_res.res = vfs_fsync(iocb->fsync.file, iocb->fsync.datasync); + revert_creds(old_cred); + put_cred(iocb->fsync.creds); iocb_put(iocb); } @@ -1604,6 +1608,10 @@ static int aio_fsync(struct fsync_iocb *req, const struct iocb *iocb, if (unlikely(!req->file->f_op->fsync)) return -EINVAL; + req->creds = prepare_creds(); + if (!req->creds) + return -ENOMEM; + req->datasync = datasync; INIT_WORK(&req->work, aio_fsync_work); schedule_work(&req->work); -- 2.21.0

4 years, 8 months

3
2
0 0

DRM broke for AMDGPU in 5.6.10

by Linus Torvalds

See https://bugzilla.kernel.org/show_bug.cgi?id=207561 and the fix seems to be to back-port commit 8623b5255ae7 ("drm/scheduler: fix drm_sched_get_cleanup_job"). I think Artem will (has?) make a report too, but I thought I'd just mention it to make sure since I was on the bugzilla. Linus

4 years, 8 months

2
1
0 0

[PATCH 4.14 000/117] 4.14.178-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.178 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 04 May 2020 06:40:34 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.178-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.178-rc2 Al Viro <viro(a)zeniv.linux.org.uk> propagate_one(): mnt_set_mountpoint() needs mount_lock Ritesh Harjani <riteshh(a)linux.ibm.com> ext4: check for non-zero journal inum in ext4_calculate_overhead Yuval Basson <ybason(a)marvell.com> qed: Fix use after free in qed_chain_free Colin Ian King <colin.king(a)canonical.com> ext4: unsigned int compared against zero Theodore Ts'o <tytso(a)mit.edu> ext4: fix block validity checks for journal inodes using indirect blocks Theodore Ts'o <tytso(a)mit.edu> ext4: don't perform block validity checks on the journal inode Theodore Ts'o <tytso(a)mit.edu> ext4: protect journal inode's blocks using block_validity Theodore Ts'o <tytso(a)mit.edu> ext4: avoid declaring fs inconsistent due to invalid file handles Sascha Hauer <s.hauer(a)pengutronix.de> hwmon: (jc42) Fix name to have no illegal characters Theodore Ts'o <tytso(a)mit.edu> ext4: convert BUG_ON's to WARN_ON's in mballoc.c Theodore Ts'o <tytso(a)mit.edu> ext4: increase wait time needed before reuse of deleted inode numbers yangerkun <yangerkun(a)huawei.com> ext4: use matching invalidatepage in ext4_writepage Fangrui Song <maskray(a)google.com> arm64: Delete the space separator in __emit_inst Juergen Gross <jgross(a)suse.com> xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status Josh Poimboeuf <jpoimboe(a)redhat.com> objtool: Support Clang non-section symbols in ORC dump Josh Poimboeuf <jpoimboe(a)redhat.com> objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings Bodo Stroesser <bstroesser(a)ts.fujitsu.com> scsi: target: fix PR IN / READ FULL STATUS for FC Darrick J. Wong <darrick.wong(a)oracle.com> xfs: fix partially uninitialized structure in xfs_reflink_remap_extent Olaf Hering <olaf(a)aepfle.de> x86: hyperv: report value of misc_features Luke Nelson <lukenels(a)cs.washington.edu> bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B Yang Shi <yang.shi(a)linux.alibaba.com> mm: shmem: disable interrupt when acquiring info->lock in userfaultfd_copy path Ian Rogers <irogers(a)google.com> perf/core: fix parent pid/tid in task exit events Nicolas Saenz Julienne <nsaenzjulienne(a)suse.de> ARM: dts: bcm283x: Disable dsi0 node Jason Gunthorpe <jgg(a)mellanox.com> net/cxgb4: Check the return from t4_query_params properly Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: altera: use proper variable to hold errno Vasily Averin <vvs(a)virtuozzo.com> nfsd: memory corruption in nfsd4_lock() YueHaibing <yuehaibing(a)huawei.com> iio:ad7797: Use correct attribute_group Nathan Chancellor <natechancellor(a)gmail.com> usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: gadget: Do link recovery for SS and SSP Tyler Hicks <tyhicks(a)canonical.com> binder: take read mode of mmap_sem in binder_alloc_free_page() Christian Borntraeger <borntraeger(a)de.ibm.com> include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap Liu Jian <liujian56(a)huawei.com> mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer Clement Leger <cleger(a)kalray.eu> remoteproc: Fix wrong rvring index computation kaixuxia <xiakaixu1987(a)gmail.com> xfs: Fix deadlock between AGI and AGF with RENAME_WHITEOUT Darrick J. Wong <darrick.wong(a)oracle.com> xfs: validate sb_logsunit is a multiple of the fs blocksize Kazuhiro Fujita <kazuhiro.fujita.jg(a)renesas.com> serial: sh-sci: Make sure status register SCxSR is read in correct sequence Udipto Goswami <ugoswami(a)codeaurora.org> usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset() Oliver Neukum <oneukum(a)suse.com> UAS: fix deadlock in error handling and PM flushing work Oliver Neukum <oneukum(a)suse.com> UAS: no use logging any details in case of ENODEV Oliver Neukum <oneukum(a)suse.com> cdc-acm: introduce a cool down Oliver Neukum <oneukum(a)suse.com> cdc-acm: close race betrween suspend() and acm_softint Malcolm Priestley <tvboxspy(a)gmail.com> staging: vt6656: Power save stop wake_up_count wrap around. Malcolm Priestley <tvboxspy(a)gmail.com> staging: vt6656: Fix pairwise key entry save. Malcolm Priestley <tvboxspy(a)gmail.com> staging: vt6656: Fix drivers TBTT timing counter. Malcolm Priestley <tvboxspy(a)gmail.com> staging: vt6656: Fix calling conditions of vnt_set_bss_mode Malcolm Priestley <tvboxspy(a)gmail.com> staging: vt6656: Don't set RCR_MULTICAST or RCR_BROADCAST by default. Nicolas Pitre <nico(a)fluxnic.net> vt: don't hardcode the mem allocation upper bound Xiyu Yang <xiyuyang19(a)fudan.edu.cn> staging: comedi: Fix comedi_device refcnt leak in comedi_open Ian Abbott <abbotti(a)mev.co.uk> staging: comedi: dt2815: fix writing hi byte of analog output Chris Packham <chris.packham(a)alliedtelesis.co.nz> powerpc/setup_64: Set cache-line-size based on cache-block-size Ahmad Fatoum <a.fatoum(a)pengutronix.de> ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y Johannes Berg <johannes.berg(a)intel.com> iwlwifi: pcie: actually release queue memory in TVQM Gyeongtaek Lee <gt82.lee(a)samsung.com> ASoC: dapm: fixup dapm kcontrol widget Paul Moore <paul(a)paul-moore.com> audit: check the length of userspace generated audit records Alan Stern <stern(a)rowland.harvard.edu> usb-storage: Add unusual_devs entry for JMicron JMS566 Jiri Slaby <jslaby(a)suse.cz> tty: rocket, avoid OOB access Andrew Melnychenko <andrew(a)daynix.com> tty: hvc: fix buffer overflow during hvc_alloc(). Uros Bizjak <ubizjak(a)gmail.com> KVM: VMX: Enable machine check support for 32bit targets Sean Christopherson <sean.j.christopherson(a)intel.com> KVM: Check validity of resolved slot when searching memslots George Wilson <gcwilson(a)linux.ibm.com> tpm: ibmvtpm: retry on H_CLOSED in tpm_ibmvtpm_send() Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com> tpm/tpm_tis: Free IRQ if probing fails Alexander Tsoy <alexander(a)tsoy.me> ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices Xiyu Yang <xiyuyang19(a)fudan.edu.cn> ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif Kailang Yang <kailang(a)realtek.com> ALSA: hda/realtek - Add new codec supported for ALC245 Takashi Iwai <tiwai(a)suse.de> ALSA: usx2y: Fix potential NULL dereference Lucas Stach <l.stach(a)pengutronix.de> tools/vm: fix cross-compile build Muchun Song <songmuchun(a)bytedance.com> mm/ksm: fix NULL pointer dereference when KSM zero page is enabled Longpeng <longpeng2(a)huawei.com> mm/hugetlb: fix a addressing exception caused by huge_pte_offset Jann Horn <jannh(a)google.com> vmalloc: fix remap_vmalloc_range() bounds checks Jason Gunthorpe <jgg(a)mellanox.com> overflow.h: Add arithmetic shift helper Alan Stern <stern(a)rowland.harvard.edu> USB: hub: Fix handling of connect changes during sleep Alan Stern <stern(a)rowland.harvard.edu> USB: core: Fix free-while-in-use bug in the USB S-Glibrary Jann Horn <jannh(a)google.com> USB: early: Handle AMD's spec-compliant identifiers, too Jonathan Cox <jonathan(a)jdcox.net> USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70 RGB RAPIDFIRE Changming Liu <liu.changm(a)northeastern.edu> USB: sisusbvga: Change port variable from signed to unsigned Piotr Krysiuk <piotras(a)gmail.com> fs/namespace.c: fix mountpoint reference counter race Lars-Peter Clausen <lars(a)metafoo.de> iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode Lars-Peter Clausen <lars(a)metafoo.de> iio: xilinx-xadc: Fix clearing interrupt when enabling trigger Lars-Peter Clausen <lars(a)metafoo.de> iio: xilinx-xadc: Fix ADC-B powerdown Olivier Moysan <olivier.moysan(a)st.com> iio: adc: stm32-adc: fix sleep in atomic context Takashi Iwai <tiwai(a)suse.de> ALSA: hda: Remove ASUS ROG Zenith from the blacklist Waiman Long <longman(a)redhat.com> KEYS: Avoid false positive ENOMEM error on key read David Ahern <dsahern(a)gmail.com> vrf: Check skb for XFRM_TRANSFORMED flag David Ahern <dsahern(a)gmail.com> xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish Florian Fainelli <f.fainelli(a)gmail.com> net: dsa: b53: Fix ARL register definitions Taehee Yoo <ap420073(a)gmail.com> team: fix hang in team_mode_get() Eric Dumazet <edumazet(a)google.com> tcp: cache line align MAX_TCP_HEADER Xiyu Yang <xiyuyang19(a)fudan.edu.cn> net/x25: Fix x25_neigh refcnt leak when receiving frame Xiyu Yang <xiyuyang19(a)fudan.edu.cn> net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node Doug Berger <opendmb(a)gmail.com> net: bcmgenet: correct per TX/RX ring statistics Taehee Yoo <ap420073(a)gmail.com> macvlan: fix null dereference in macvlan_device_event() Taehee Yoo <ap420073(a)gmail.com> macsec: avoid to set wrong mtu John Haxby <john.haxby(a)oracle.com> ipv6: fix restrict IPV6_ADDRFORM operation Rahul Lakkireddy <rahul.lakkireddy(a)chelsio.com> cxgb4: fix large delays in PTP synchronization Vlastimil Babka <vbabka(a)suse.cz> mm, slub: restore the original intention of prefetch_freepointer() Heiner Kallweit <hkallweit1(a)gmail.com> PCI/ASPM: Allow re-enabling Clock PM Jiri Olsa <jolsa(a)kernel.org> perf/core: Disable page faults when getting phys address Florian Fainelli <f.fainelli(a)gmail.com> pwm: bcm2835: Dynamically allocate base Geert Uytterhoeven <geert+renesas(a)glider.be> pwm: renesas-tpu: Fix late Runtime PM enablement Cornelia Huck <cohuck(a)redhat.com> s390/cio: avoid duplicated 'ADD' uevents Vasily Averin <vvs(a)virtuozzo.com> ipc/util.c: sysvipc_find_ipc() should increase position index Eric Biggers <ebiggers(a)google.com> selftests: kmod: fix handling test numbers above 9 Vasily Averin <vvs(a)virtuozzo.com> kernel/gcov/fs.c: gcov_seq_next() should increase position index Hans de Goede <hdegoede(a)redhat.com> ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map() Wu Bo <wubo40(a)huawei.com> scsi: iscsi: Report unbind session event when the target has been removed Geert Uytterhoeven <geert+renesas(a)glider.be> pwm: rcar: Fix late Runtime PM enablement Yan, Zheng <zyan(a)redhat.com> ceph: don't skip updating wanted caps when cap is stale Qiujun Huang <hqjagain(a)gmail.com> ceph: return ceph_mdsc_do_request() errors from __get_parent() James Smart <jsmart2021(a)gmail.com> scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login Tero Kristo <t-kristo(a)ti.com> watchdog: reset last_hw_keepalive time at start Jeremy Sowden <jeremy(a)azazel.net> vti4: removed duplicate log message. Wei Yongjun <weiyongjun1(a)huawei.com> crypto: mxs-dcp - make symbols 'sha1_null_hash' and 'sha256_null_hash' static Rob Clark <robdclark(a)chromium.org> drm/msm: Use the correct dma_sync calls harder David Howells <dhowells(a)redhat.com> keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h Arnd Bergmann <arnd(a)arndb.de> net: ipv4: avoid unused variable warning for sysctl Nicolai Stange <nstange(a)suse.de> net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg() Dmitry Monakhov <dmonakhov(a)gmail.com> ext4: fix extent_status fragmentation for plain files ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/bcm283x.dtsi | 1 + arch/arm/mach-imx/Makefile | 2 + arch/arm64/include/asm/sysreg.h | 4 +- arch/powerpc/kernel/setup_64.c | 2 + arch/x86/kernel/cpu/mshyperv.c | 4 +- arch/x86/kvm/vmx.c | 2 +- arch/x86/net/bpf_jit_comp.c | 18 ++- drivers/android/binder_alloc.c | 8 +- drivers/char/tpm/tpm_ibmvtpm.c | 136 ++++++++++++---------- drivers/char/tpm/tpm_tis_core.c | 8 +- drivers/crypto/mxs-dcp.c | 4 +- drivers/gpu/drm/msm/msm_gem.c | 4 +- drivers/hwmon/jc42.c | 2 +- drivers/i2c/busses/i2c-altera.c | 9 +- drivers/iio/adc/ad7793.c | 2 +- drivers/iio/adc/stm32-adc.c | 31 ++++- drivers/iio/adc/xilinx-xadc-core.c | 17 ++- drivers/mtd/chips/cfi_cmdset_0002.c | 6 +- drivers/net/dsa/b53/b53_regs.h | 4 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 3 + drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c | 27 +---- drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 +- drivers/net/ethernet/chelsio/cxgb4/t4_regs.h | 3 + drivers/net/ethernet/qlogic/qed/qed_dev.c | 38 +++--- drivers/net/macsec.c | 12 +- drivers/net/macvlan.c | 2 +- drivers/net/team/team.c | 4 + drivers/net/vrf.c | 6 +- drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 3 + drivers/pci/pcie/aspm.c | 18 +-- drivers/pwm/pwm-bcm2835.c | 1 + drivers/pwm/pwm-rcar.c | 10 +- drivers/pwm/pwm-renesas-tpu.c | 9 +- drivers/remoteproc/remoteproc_core.c | 2 +- drivers/s390/cio/device.c | 13 ++- drivers/scsi/lpfc/lpfc_sli.c | 2 + drivers/scsi/scsi_transport_iscsi.c | 4 +- drivers/staging/comedi/comedi_fops.c | 4 +- drivers/staging/comedi/drivers/dt2815.c | 3 + drivers/staging/vt6656/int.c | 3 +- drivers/staging/vt6656/key.c | 14 +-- drivers/staging/vt6656/main_usb.c | 31 ++--- drivers/target/target_core_fabric_lib.c | 2 +- drivers/tty/hvc/hvc_console.c | 23 ++-- drivers/tty/rocket.c | 25 ++-- drivers/tty/serial/sh-sci.c | 13 ++- drivers/tty/vt/vt.c | 2 +- drivers/usb/class/cdc-acm.c | 36 +++++- drivers/usb/class/cdc-acm.h | 5 +- drivers/usb/core/hub.c | 14 +++ drivers/usb/core/message.c | 9 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc3/gadget.c | 8 +- drivers/usb/early/xhci-dbc.c | 8 +- drivers/usb/early/xhci-dbc.h | 18 ++- drivers/usb/gadget/function/f_fs.c | 4 + drivers/usb/gadget/udc/bdc/bdc_ep.c | 2 +- drivers/usb/misc/sisusbvga/sisusb.c | 20 ++-- drivers/usb/misc/sisusbvga/sisusb_init.h | 14 +-- drivers/usb/storage/uas.c | 46 +++++++- drivers/usb/storage/unusual_devs.h | 7 ++ drivers/watchdog/watchdog_dev.c | 1 + drivers/xen/xenbus/xenbus_client.c | 9 +- fs/ceph/caps.c | 8 +- fs/ceph/export.c | 5 + fs/ext4/block_validity.c | 54 +++++++++ fs/ext4/ext4.h | 15 ++- fs/ext4/extents.c | 59 ++++++---- fs/ext4/ialloc.c | 4 +- fs/ext4/inode.c | 55 ++++++--- fs/ext4/ioctl.c | 2 +- fs/ext4/mballoc.c | 6 +- fs/ext4/namei.c | 4 +- fs/ext4/resize.c | 5 +- fs/ext4/super.c | 22 ++-- fs/ext4/xattr.c | 5 +- fs/namespace.c | 2 +- fs/nfsd/nfs4state.c | 2 + fs/pnode.c | 9 +- fs/proc/vmcore.c | 2 +- fs/xfs/xfs_inode.c | 85 +++++++------- fs/xfs/xfs_log.c | 14 ++- fs/xfs/xfs_reflink.c | 1 + include/linux/kvm_host.h | 2 +- include/linux/overflow.h | 31 +++++ include/linux/qed/qed_chain.h | 24 ++-- include/linux/vmalloc.h | 2 +- include/net/tcp.h | 2 +- include/uapi/linux/keyctl.h | 7 +- include/uapi/linux/swab.h | 4 +- ipc/util.c | 2 +- kernel/audit.c | 3 + kernel/events/core.c | 22 +++- kernel/gcov/fs.c | 2 +- mm/hugetlb.c | 14 ++- mm/ksm.c | 12 +- mm/shmem.c | 4 +- mm/slub.c | 3 +- mm/vmalloc.c | 16 ++- net/ipv4/ip_vti.c | 4 +- net/ipv4/raw.c | 4 +- net/ipv4/route.c | 3 +- net/ipv4/xfrm4_output.c | 2 - net/ipv6/ipv6_sockglue.c | 13 +-- net/ipv6/xfrm6_output.c | 2 - net/netrom/nr_route.c | 1 + net/x25/x25_dev.c | 4 +- security/keys/internal.h | 12 ++ security/keys/keyctl.c | 58 ++++++--- sound/pci/hda/hda_intel.c | 1 - sound/pci/hda/patch_realtek.c | 3 + sound/soc/intel/atom/sst-atom-controls.c | 2 + sound/soc/soc-dapm.c | 20 +++- sound/usb/format.c | 52 +++++++++ sound/usb/mixer_quirks.c | 12 +- sound/usb/usx2y/usbusx2yaudio.c | 2 + tools/objtool/check.c | 17 ++- tools/objtool/orc_dump.c | 44 ++++--- tools/testing/selftests/kmod/kmod.sh | 13 ++- tools/vm/Makefile | 2 + 121 files changed, 1047 insertions(+), 485 deletions(-)

4 years, 8 months

3
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror May 2020