The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 05946d4b7a7349ae58bfa2d51ae832e64a394c2d Mon Sep 17 00:00:00 2001
From: Vincent Whitchurch <vincent.whitchurch(a)axis.com>
Date: Wed, 10 Mar 2021 13:20:40 +0100
Subject: [PATCH] cifs: Fix preauth hash corruption
smb311_update_preauth_hash() uses the shash in server->secmech without
appropriate locking, and this can lead to sessions corrupting each
other's preauth hashes.
The following script can easily trigger the problem:
#!/bin/sh -e
NMOUNTS=10
for i in $(seq $NMOUNTS);
mkdir -p /tmp/mnt$i
umount /tmp/mnt$i 2>/dev/null || :
done
while :; do
for i in $(seq $NMOUNTS); do
mount -t cifs //192.168.0.1/test /tmp/mnt$i -o ... &
done
wait
for i in $(seq $NMOUNTS); do
umount /tmp/mnt$i
done
done
Usually within seconds this leads to one or more of the mounts failing
with the following errors, and a "Bad SMB2 signature for message" is
seen in the server logs:
CIFS: VFS: \\192.168.0.1 failed to connect to IPC (rc=-13)
CIFS: VFS: cifs_mount failed w/return code = -13
Fix it by holding the server mutex just like in the other places where
the shashes are used.
Fixes: 8bd68c6e47abff34e4 ("CIFS: implement v3.11 preauth integrity")
Signed-off-by: Vincent Whitchurch <vincent.whitchurch(a)axis.com>
CC: <stable(a)vger.kernel.org>
Reviewed-by: Aurelien Aptel <aaptel(a)suse.com>
Signed-off-by: Steve French <stfrench(a)microsoft.com>
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 007d99437c77..c1725b55f364 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -1196,9 +1196,12 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
/*
* Compounding is never used during session establish.
*/
- if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP))
+ if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP)) {
+ mutex_lock(&server->srv_mutex);
smb311_update_preauth_hash(ses, rqst[0].rq_iov,
rqst[0].rq_nvec);
+ mutex_unlock(&server->srv_mutex);
+ }
for (i = 0; i < num_rqst; i++) {
rc = wait_for_response(server, midQ[i]);
@@ -1266,7 +1269,9 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
.iov_base = resp_iov[0].iov_base,
.iov_len = resp_iov[0].iov_len
};
+ mutex_lock(&server->srv_mutex);
smb311_update_preauth_hash(ses, &iov, 1);
+ mutex_unlock(&server->srv_mutex);
}
out:
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 05946d4b7a7349ae58bfa2d51ae832e64a394c2d Mon Sep 17 00:00:00 2001
From: Vincent Whitchurch <vincent.whitchurch(a)axis.com>
Date: Wed, 10 Mar 2021 13:20:40 +0100
Subject: [PATCH] cifs: Fix preauth hash corruption
smb311_update_preauth_hash() uses the shash in server->secmech without
appropriate locking, and this can lead to sessions corrupting each
other's preauth hashes.
The following script can easily trigger the problem:
#!/bin/sh -e
NMOUNTS=10
for i in $(seq $NMOUNTS);
mkdir -p /tmp/mnt$i
umount /tmp/mnt$i 2>/dev/null || :
done
while :; do
for i in $(seq $NMOUNTS); do
mount -t cifs //192.168.0.1/test /tmp/mnt$i -o ... &
done
wait
for i in $(seq $NMOUNTS); do
umount /tmp/mnt$i
done
done
Usually within seconds this leads to one or more of the mounts failing
with the following errors, and a "Bad SMB2 signature for message" is
seen in the server logs:
CIFS: VFS: \\192.168.0.1 failed to connect to IPC (rc=-13)
CIFS: VFS: cifs_mount failed w/return code = -13
Fix it by holding the server mutex just like in the other places where
the shashes are used.
Fixes: 8bd68c6e47abff34e4 ("CIFS: implement v3.11 preauth integrity")
Signed-off-by: Vincent Whitchurch <vincent.whitchurch(a)axis.com>
CC: <stable(a)vger.kernel.org>
Reviewed-by: Aurelien Aptel <aaptel(a)suse.com>
Signed-off-by: Steve French <stfrench(a)microsoft.com>
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 007d99437c77..c1725b55f364 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -1196,9 +1196,12 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
/*
* Compounding is never used during session establish.
*/
- if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP))
+ if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP)) {
+ mutex_lock(&server->srv_mutex);
smb311_update_preauth_hash(ses, rqst[0].rq_iov,
rqst[0].rq_nvec);
+ mutex_unlock(&server->srv_mutex);
+ }
for (i = 0; i < num_rqst; i++) {
rc = wait_for_response(server, midQ[i]);
@@ -1266,7 +1269,9 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
.iov_base = resp_iov[0].iov_base,
.iov_len = resp_iov[0].iov_len
};
+ mutex_lock(&server->srv_mutex);
smb311_update_preauth_hash(ses, &iov, 1);
+ mutex_unlock(&server->srv_mutex);
}
out:
This is the start of the stable review cycle for the 5.4.107 release.
There are 18 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 21 Mar 2021 12:17:37 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.107-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.107-rc1
Florian Fainelli <f.fainelli(a)gmail.com>
net: dsa: b53: Support setting learning on port
DENG Qingfang <dqfext(a)gmail.com>
net: dsa: tag_mtk: fix 802.1ad VLAN egress
Ard Biesheuvel <ardb(a)kernel.org>
crypto: x86/aes-ni-xts - use direct calls to and 4-way stride
Uros Bizjak <ubizjak(a)gmail.com>
crypto: aesni - Use TEST %reg,%reg instead of CMP $0,%reg
Kees Cook <keescook(a)chromium.org>
crypto: x86 - Regularize glue function prototypes
Amir Goldstein <amir73il(a)gmail.com>
fuse: fix live lock in fuse_iget()
Colin Xu <colin.xu(a)intel.com>
drm/i915/gvt: Fix vfio_edid issue for BXT/APL
Colin Xu <colin.xu(a)intel.com>
drm/i915/gvt: Fix port number for BDW on EDID region setup
Colin Xu <colin.xu(a)intel.com>
drm/i915/gvt: Fix virtual display setup for BXT/APL
Colin Xu <colin.xu(a)intel.com>
drm/i915/gvt: Fix mmio handler break on BXT/APL.
Colin Xu <colin.xu(a)intel.com>
drm/i915/gvt: Set SNOOP for PAT3 on BXT/APL to workaround GPU BB hang
Qu Wenruo <wqu(a)suse.com>
btrfs: scrub: Don't check free space before marking a block group RO
Piotr Krysiuk <piotras(a)gmail.com>
bpf, selftests: Fix up some test_verifier cases for unprivileged
Piotr Krysiuk <piotras(a)gmail.com>
bpf: Add sanity check for upper ptr_limit
Piotr Krysiuk <piotras(a)gmail.com>
bpf: Simplify alu_limit masking for pointer arithmetic
Piotr Krysiuk <piotras(a)gmail.com>
bpf: Fix off-by-one for area size in creating mask to left
Piotr Krysiuk <piotras(a)gmail.com>
bpf: Prohibit alu ops for pointer types not defining ptr_limit
Suzuki K Poulose <suzuki.poulose(a)arm.com>
KVM: arm64: nvhe: Save the SPE context early
-------------
Diffstat:
Makefile | 4 +-
arch/arm64/include/asm/kvm_hyp.h | 3 +
arch/arm64/kvm/hyp/debug-sr.c | 24 ++-
arch/arm64/kvm/hyp/switch.c | 13 +-
arch/x86/crypto/aesni-intel_asm.S | 137 +++++++------
arch/x86/crypto/aesni-intel_avx-x86_64.S | 20 +-
arch/x86/crypto/aesni-intel_glue.c | 54 +++---
arch/x86/crypto/camellia_aesni_avx2_glue.c | 74 ++++---
arch/x86/crypto/camellia_aesni_avx_glue.c | 72 ++++---
arch/x86/crypto/camellia_glue.c | 45 +++--
arch/x86/crypto/cast6_avx_glue.c | 68 +++----
arch/x86/crypto/glue_helper.c | 23 ++-
arch/x86/crypto/serpent_avx2_glue.c | 65 +++----
arch/x86/crypto/serpent_avx_glue.c | 63 +++---
arch/x86/crypto/serpent_sse2_glue.c | 30 +--
arch/x86/crypto/twofish_avx_glue.c | 75 ++++----
arch/x86/crypto/twofish_glue_3way.c | 37 ++--
arch/x86/include/asm/crypto/camellia.h | 63 +++---
arch/x86/include/asm/crypto/glue_helper.h | 18 +-
arch/x86/include/asm/crypto/serpent-avx.h | 20 +-
arch/x86/include/asm/crypto/serpent-sse2.h | 28 ++-
arch/x86/include/asm/crypto/twofish.h | 19 +-
crypto/cast6_generic.c | 18 +-
crypto/serpent_generic.c | 6 +-
drivers/gpu/drm/i915/gvt/display.c | 212 +++++++++++++++++++++
drivers/gpu/drm/i915/gvt/handlers.c | 40 +++-
drivers/gpu/drm/i915/gvt/mmio.c | 5 +
drivers/gpu/drm/i915/gvt/vgpu.c | 5 +-
drivers/net/dsa/b53/b53_common.c | 18 ++
drivers/net/dsa/b53/b53_regs.h | 1 +
drivers/net/dsa/bcm_sf2.c | 5 -
fs/btrfs/block-group.c | 48 +++--
fs/btrfs/block-group.h | 3 +-
fs/btrfs/relocation.c | 2 +-
fs/btrfs/scrub.c | 21 +-
fs/fuse/fuse_i.h | 1 +
include/crypto/cast6.h | 4 +-
include/crypto/serpent.h | 4 +-
include/crypto/xts.h | 2 -
kernel/bpf/verifier.c | 33 ++--
net/dsa/tag_mtk.c | 19 +-
.../selftests/bpf/verifier/bounds_deduction.c | 27 ++-
tools/testing/selftests/bpf/verifier/unpriv.c | 15 +-
.../selftests/bpf/verifier/value_ptr_arith.c | 23 ++-
44 files changed, 920 insertions(+), 547 deletions(-)
When filesystem mount fails because of corrupted filesystem we first
cancel the s_err_report timer reminding fs errors every day and only
then we flush s_error_work. However s_error_work may report another fs
error and re-arm timer thus resulting in timer use-after-free. Fix the
problem by first flushing the work and only after that canceling the
s_err_report timer.
Reported-by: syzbot+628472a2aac693ab0fcd(a)syzkaller.appspotmail.com
Fixes: 2d01ddc86606 ("ext4: save error info to sb through journal if available")
CC: stable(a)vger.kernel.org
Signed-off-by: Jan Kara <jack(a)suse.cz>
---
fs/ext4/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index ad34a37278cd..2e3d4c5c2eb4 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5149,8 +5149,8 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
failed_mount3a:
ext4_es_unregister_shrinker(sbi);
failed_mount3:
- del_timer_sync(&sbi->s_err_report);
flush_work(&sbi->s_error_work);
+ del_timer_sync(&sbi->s_err_report);
if (sbi->s_mmp_tsk)
kthread_stop(sbi->s_mmp_tsk);
failed_mount2:
--
2.26.2
This is the start of the stable review cycle for the 4.19.182 release.
There are 8 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 21 Mar 2021 12:17:37 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.182-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.182-rc1
Florian Fainelli <f.fainelli(a)gmail.com>
net: dsa: b53: Support setting learning on port
DENG Qingfang <dqfext(a)gmail.com>
net: dsa: tag_mtk: fix 802.1ad VLAN egress
Piotr Krysiuk <piotras(a)gmail.com>
bpf: Add sanity check for upper ptr_limit
Piotr Krysiuk <piotras(a)gmail.com>
bpf: Simplify alu_limit masking for pointer arithmetic
Piotr Krysiuk <piotras(a)gmail.com>
bpf: Fix off-by-one for area size in creating mask to left
Piotr Krysiuk <piotras(a)gmail.com>
bpf: Prohibit alu ops for pointer types not defining ptr_limit
Suzuki K Poulose <suzuki.poulose(a)arm.com>
KVM: arm64: nvhe: Save the SPE context early
Jan Kara <jack(a)suse.cz>
ext4: check journal inode extents more carefully
-------------
Diffstat:
Makefile | 4 ++--
arch/arm64/include/asm/kvm_hyp.h | 3 +++
arch/arm64/kvm/hyp/debug-sr.c | 24 +++++++++++++---------
arch/arm64/kvm/hyp/switch.c | 4 +++-
drivers/net/dsa/b53/b53_common.c | 19 ++++++++++++++++++
drivers/net/dsa/b53/b53_regs.h | 1 +
drivers/net/dsa/bcm_sf2.c | 5 -----
fs/ext4/block_validity.c | 43 ++++++++++++++++++++--------------------
fs/ext4/ext4.h | 6 +++---
fs/ext4/extents.c | 16 ++++++---------
fs/ext4/indirect.c | 6 ++----
fs/ext4/inode.c | 5 ++---
fs/ext4/mballoc.c | 4 ++--
kernel/bpf/verifier.c | 33 +++++++++++++++++++-----------
net/dsa/tag_mtk.c | 19 ++++++++++++------
15 files changed, 114 insertions(+), 78 deletions(-)
This is the start of the stable review cycle for the 5.10.25 release.
There are 13 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 21 Mar 2021 12:17:37 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.25-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.25-rc1
Florian Fainelli <f.fainelli(a)gmail.com>
net: dsa: b53: Support setting learning on port
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Don't avoid stopping the stream at disconnection
J. Bruce Fields <bfields(a)redhat.com>
Revert "nfsd4: a client's own opens needn't prevent delegations"
J. Bruce Fields <bfields(a)redhat.com>
Revert "nfsd4: remove check_conflicting_opens warning"
Amir Goldstein <amir73il(a)gmail.com>
fuse: fix live lock in fuse_iget()
Nicolas Morey-Chaisemartin <nmoreychaisemartin(a)suse.com>
RDMA/srp: Fix support for unpopulated and unbalanced NUMA nodes
Piotr Krysiuk <piotras(a)gmail.com>
bpf, selftests: Fix up some test_verifier cases for unprivileged
Piotr Krysiuk <piotras(a)gmail.com>
bpf: Add sanity check for upper ptr_limit
Piotr Krysiuk <piotras(a)gmail.com>
bpf: Simplify alu_limit masking for pointer arithmetic
Piotr Krysiuk <piotras(a)gmail.com>
bpf: Fix off-by-one for area size in creating mask to left
Piotr Krysiuk <piotras(a)gmail.com>
bpf: Prohibit alu ops for pointer types not defining ptr_limit
Ard Biesheuvel <ardb(a)kernel.org>
crypto: x86/aes-ni-xts - use direct calls to and 4-way stride
Uros Bizjak <ubizjak(a)gmail.com>
crypto: aesni - Use TEST %reg,%reg instead of CMP $0,%reg
-------------
Diffstat:
Makefile | 4 +-
arch/x86/crypto/aesni-intel_asm.S | 133 ++++++++++++---------
arch/x86/crypto/aesni-intel_avx-x86_64.S | 20 ++--
arch/x86/crypto/aesni-intel_glue.c | 25 ++--
drivers/infiniband/ulp/srp/ib_srp.c | 110 +++++++----------
drivers/net/dsa/b53/b53_common.c | 18 +++
drivers/net/dsa/b53/b53_regs.h | 1 +
drivers/net/dsa/bcm_sf2.c | 15 +--
fs/fuse/fuse_i.h | 1 +
fs/locks.c | 3 -
fs/nfsd/nfs4state.c | 53 +++-----
kernel/bpf/verifier.c | 33 +++--
sound/usb/endpoint.c | 3 -
sound/usb/pcm.c | 5 +-
.../selftests/bpf/verifier/bounds_deduction.c | 27 +++--
tools/testing/selftests/bpf/verifier/map_ptr.c | 4 +
tools/testing/selftests/bpf/verifier/unpriv.c | 15 ++-
.../selftests/bpf/verifier/value_ptr_arith.c | 23 +++-
18 files changed, 266 insertions(+), 227 deletions(-)