The patch titled
Subject: squashfs: fix xattr id and id lookup sanity checks
has been removed from the -mm tree. Its filename was
squashfs-fix-xattr-id-and-id-lookup-sanity-checks.patch
This patch was dropped because an updated version will be merged
------------------------------------------------------
From: Phillip Lougher <phillip(a)squashfs.org.uk>
Subject: squashfs: fix xattr id and id lookup sanity checks
The checks for maximum metadata block size is missing
SQUASHFS_BLOCK_OFFSET (the two byte length count). As a consequence
the user will be unable to mount the filesystem, because it will fail
the sanity check.
Link: https://lkml.kernel.org/r/2069685113.2081245.1614583677427@webmail.123-reg.…
Fixes: f37aa4c7366e23f ("squashfs: add more sanity checks in id lookup")
Signed-off-by: Phillip Lougher <phillip(a)squashfs.org.uk>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/squashfs/id.c | 6 ++++--
fs/squashfs/xattr_id.c | 6 ++++--
2 files changed, 8 insertions(+), 4 deletions(-)
--- a/fs/squashfs/id.c~squashfs-fix-xattr-id-and-id-lookup-sanity-checks
+++ a/fs/squashfs/id.c
@@ -97,14 +97,16 @@ __le64 *squashfs_read_id_index_table(str
start = le64_to_cpu(table[n]);
end = le64_to_cpu(table[n + 1]);
- if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
+ if (start >= end || (end - start) >
+ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
kfree(table);
return ERR_PTR(-EINVAL);
}
}
start = le64_to_cpu(table[indexes - 1]);
- if (start >= id_table_start || (id_table_start - start) > SQUASHFS_METADATA_SIZE) {
+ if (start >= id_table_start || (id_table_start - start) >
+ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
kfree(table);
return ERR_PTR(-EINVAL);
}
--- a/fs/squashfs/xattr_id.c~squashfs-fix-xattr-id-and-id-lookup-sanity-checks
+++ a/fs/squashfs/xattr_id.c
@@ -109,14 +109,16 @@ __le64 *squashfs_read_xattr_id_table(str
start = le64_to_cpu(table[n]);
end = le64_to_cpu(table[n + 1]);
- if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
+ if (start >= end || (end - start) >
+ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
kfree(table);
return ERR_PTR(-EINVAL);
}
}
start = le64_to_cpu(table[indexes - 1]);
- if (start >= table_start || (table_start - start) > SQUASHFS_METADATA_SIZE) {
+ if (start >= table_start || (table_start - start) >
+ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
kfree(table);
return ERR_PTR(-EINVAL);
}
_
Patches currently in -mm which might be from phillip(a)squashfs.org.uk are
This is the start of the stable review cycle for the 5.4.104 release.
There are 22 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 10 Mar 2021 12:27:05 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.104-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.104-rc1
Heiner Kallweit <hkallweit1(a)gmail.com>
r8169: fix resuming from suspend on RTL8105e if machine runs on battery
Dan Carpenter <dan.carpenter(a)oracle.com>
rsxx: Return -EFAULT if copy_to_user() fails
Chen Jun <chenjun102(a)huawei.com>
ftrace: Have recordmcount use w8 to read relp->r_info in arm64_is_fake_mcount
Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
ALSA: hda: intel-nhlt: verify config type
YueHaibing <yuehaibing(a)huawei.com>
IB/mlx5: Add missing error code
Julian Braha <julianbraha(a)gmail.com>
RDMA/rxe: Fix missing kconfig dependency on CRYPTO
Colin Ian King <colin.king(a)canonical.com>
ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4 bits
Antonio Borneo <borneo.antonio(a)gmail.com>
usbip: tools: fix build error for multiple definition
Ard Biesheuvel <ardb(a)kernel.org>
crypto - shash: reduce minimum alignment of shash_desc structure
Timothy E Baldwin <T.E.Baldwin99(a)members.leeds.ac.uk>
arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)
Kevin Wang <kevin1.wang(a)amd.com>
drm/amdgpu: fix parameter error of RREG32_PCIE() in amdgpu_regs_pcie
Milan Broz <gmazyland(a)gmail.com>
dm verity: fix FEC for RS roots unaligned to block size
Mikulas Patocka <mpatocka(a)redhat.com>
dm bufio: subtract the number of initial sectors in dm_bufio_get_device_size
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
PM: runtime: Update device status before letting suppliers suspend
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix warning when creating a directory with smack enabled
Nikolay Borisov <nborisov(a)suse.com>
btrfs: unlock extents in btrfs_zero_range in case of quota reservation errors
Nikolay Borisov <nborisov(a)suse.com>
btrfs: free correct amount of space in btrfs_delayed_inode_reserve_metadata
Dan Carpenter <dancarpenter(a)oracle.com>
btrfs: validate qgroup inherit for SNAP_CREATE_V2 ioctl
Ira Weiny <ira.weiny(a)intel.com>
btrfs: fix raid6 qstripe kmap
David Sterba <dsterba(a)suse.com>
btrfs: raid56: simplify tracking of Q stripe presence
Jarkko Sakkinen <jarkko(a)kernel.org>
tpm, tpm_tis: Decorate tpm_get_timeouts() with request_locality()
Lukasz Majczak <lma(a)semihalf.com>
tpm, tpm_tis: Decorate tpm_tis_gen_interrupt() with request_locality()
-------------
Diffstat:
Makefile | 4 +-
arch/arm64/kernel/ptrace.c | 2 +-
drivers/base/power/runtime.c | 62 +++++++++++++++++------------
drivers/block/rsxx/core.c | 8 ++--
drivers/char/tpm/tpm_tis_core.c | 30 +++++++++++---
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 4 +-
drivers/infiniband/hw/mlx5/devx.c | 4 +-
drivers/infiniband/sw/rxe/Kconfig | 1 +
drivers/md/dm-bufio.c | 4 ++
drivers/md/dm-verity-fec.c | 23 ++++++-----
drivers/net/ethernet/realtek/r8169_main.c | 2 +
fs/btrfs/delayed-inode.c | 2 +-
fs/btrfs/file.c | 5 ++-
fs/btrfs/ioctl.c | 19 ++++++++-
fs/btrfs/raid56.c | 58 ++++++++++++---------------
fs/btrfs/xattr.c | 31 +++++++++++++--
include/crypto/hash.h | 8 ++--
include/linux/crypto.h | 9 +++--
include/sound/intel-nhlt.h | 5 +++
scripts/recordmcount.c | 2 +-
sound/hda/intel-nhlt.c | 54 ++++++++++++++++++++-----
sound/pci/ctxfi/cthw20k2.c | 2 +-
tools/usb/usbip/libsrc/usbip_host_common.c | 2 +-
23 files changed, 232 insertions(+), 109 deletions(-)
commit a4c8dd9c2d0987cf542a2a0c42684c9c6d78a04e upstream.
According to the definition of dm_iterate_devices_fn:
* This function must iterate through each section of device used by the
* target until it encounters a non-zero return code, which it then returns.
* Returns zero if no callout returned non-zero.
For some target type (e.g. dm-stripe), one call of iterate_devices() may
iterate multiple underlying devices internally, in which case a non-zero
return code returned by iterate_devices_callout_fn will stop the iteration
in advance. No iterate_devices_callout_fn should return non-zero unless
device iteration should stop.
Rename dm_table_requires_stable_pages() to dm_table_any_dev_attr() and
elevate it for reuse to stop iterating (and return non-zero) on the
first device that causes iterate_devices_callout_fn to return non-zero.
Use dm_table_any_dev_attr() to properly iterate through devices.
Rename device_is_nonrot() to device_is_rotational() and invert logic
accordingly to fix improper disposition.
[jeffle: backport notes]
No stable writes. Also convert the no_sg_merge capability check,
which is introduced by commit 200612ec33e5 ("dm table: propagate
QUEUE_FLAG_NO_SG_MERGE"), and removed since commit 2705c93742e9 ("block:
kill QUEUE_FLAG_NO_SG_MERGE") in v5.1.
Fixes: c3c4555edd10 ("dm table: clear add_random unless all devices have it set")
Fixes: 4693c9668fdc ("dm table: propagate non rotational flag")
Cc: stable(a)vger.kernel.org
Signed-off-by: Jeffle Xu <jefflexu(a)linux.alibaba.com>
Signed-off-by: Mike Snitzer <snitzer(a)redhat.com>
---
drivers/md/dm-table.c | 83 +++++++++++++++++++++++++++----------------
1 file changed, 53 insertions(+), 30 deletions(-)
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index a5a6c7f073af..7ee520d4d216 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1210,6 +1210,46 @@ struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector)
return &t->targets[(KEYS_PER_NODE * n) + k];
}
+/*
+ * type->iterate_devices() should be called when the sanity check needs to
+ * iterate and check all underlying data devices. iterate_devices() will
+ * iterate all underlying data devices until it encounters a non-zero return
+ * code, returned by whether the input iterate_devices_callout_fn, or
+ * iterate_devices() itself internally.
+ *
+ * For some target type (e.g. dm-stripe), one call of iterate_devices() may
+ * iterate multiple underlying devices internally, in which case a non-zero
+ * return code returned by iterate_devices_callout_fn will stop the iteration
+ * in advance.
+ *
+ * Cases requiring _any_ underlying device supporting some kind of attribute,
+ * should use the iteration structure like dm_table_any_dev_attr(), or call
+ * it directly. @func should handle semantics of positive examples, e.g.
+ * capable of something.
+ *
+ * Cases requiring _all_ underlying devices supporting some kind of attribute,
+ * should use the iteration structure like dm_table_supports_nowait() or
+ * dm_table_supports_discards(). Or introduce dm_table_all_devs_attr() that
+ * uses an @anti_func that handle semantics of counter examples, e.g. not
+ * capable of something. So: return !dm_table_any_dev_attr(t, anti_func);
+ */
+static bool dm_table_any_dev_attr(struct dm_table *t,
+ iterate_devices_callout_fn func)
+{
+ struct dm_target *ti;
+ unsigned int i;
+
+ for (i = 0; i < dm_table_get_num_targets(t); i++) {
+ ti = dm_table_get_target(t, i);
+
+ if (ti->type->iterate_devices &&
+ ti->type->iterate_devices(ti, func, NULL))
+ return true;
+ }
+
+ return false;
+}
+
static int count_device(struct dm_target *ti, struct dm_dev *dev,
sector_t start, sector_t len, void *data)
{
@@ -1380,12 +1420,12 @@ static bool dm_table_discard_zeroes_data(struct dm_table *t)
return true;
}
-static int device_is_nonrot(struct dm_target *ti, struct dm_dev *dev,
- sector_t start, sector_t len, void *data)
+static int device_is_rotational(struct dm_target *ti, struct dm_dev *dev,
+ sector_t start, sector_t len, void *data)
{
struct request_queue *q = bdev_get_queue(dev->bdev);
- return q && blk_queue_nonrot(q);
+ return q && !blk_queue_nonrot(q);
}
static int device_is_not_random(struct dm_target *ti, struct dm_dev *dev,
@@ -1396,29 +1436,12 @@ static int device_is_not_random(struct dm_target *ti, struct dm_dev *dev,
return q && !blk_queue_add_random(q);
}
-static int queue_supports_sg_merge(struct dm_target *ti, struct dm_dev *dev,
- sector_t start, sector_t len, void *data)
+static int queue_no_sg_merge(struct dm_target *ti, struct dm_dev *dev,
+ sector_t start, sector_t len, void *data)
{
struct request_queue *q = bdev_get_queue(dev->bdev);
- return q && !test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags);
-}
-
-static bool dm_table_all_devices_attribute(struct dm_table *t,
- iterate_devices_callout_fn func)
-{
- struct dm_target *ti;
- unsigned i = 0;
-
- while (i < dm_table_get_num_targets(t)) {
- ti = dm_table_get_target(t, i++);
-
- if (!ti->type->iterate_devices ||
- !ti->type->iterate_devices(ti, func, NULL))
- return false;
- }
-
- return true;
+ return q && test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags);
}
static int device_not_write_same_capable(struct dm_target *ti, struct dm_dev *dev,
@@ -1511,18 +1534,18 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
q->limits.discard_zeroes_data = 0;
/* Ensure that all underlying devices are non-rotational. */
- if (dm_table_all_devices_attribute(t, device_is_nonrot))
- queue_flag_set_unlocked(QUEUE_FLAG_NONROT, q);
- else
+ if (dm_table_any_dev_attr(t, device_is_rotational))
queue_flag_clear_unlocked(QUEUE_FLAG_NONROT, q);
+ else
+ queue_flag_set_unlocked(QUEUE_FLAG_NONROT, q);
if (!dm_table_supports_write_same(t))
q->limits.max_write_same_sectors = 0;
- if (dm_table_all_devices_attribute(t, queue_supports_sg_merge))
- queue_flag_clear_unlocked(QUEUE_FLAG_NO_SG_MERGE, q);
- else
+ if (dm_table_any_dev_attr(t, queue_no_sg_merge))
queue_flag_set_unlocked(QUEUE_FLAG_NO_SG_MERGE, q);
+ else
+ queue_flag_clear_unlocked(QUEUE_FLAG_NO_SG_MERGE, q);
dm_table_verify_integrity(t);
@@ -1532,7 +1555,7 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
* Clear QUEUE_FLAG_ADD_RANDOM if any underlying device does not
* have it set.
*/
- if (blk_queue_add_random(q) && dm_table_all_devices_attribute(t, device_is_not_random))
+ if (blk_queue_add_random(q) && dm_table_any_dev_attr(t, device_is_not_random))
queue_flag_clear_unlocked(QUEUE_FLAG_ADD_RANDOM, q);
/*
--
2.27.0