October 2022 - Linux-stable-mirror

[PATCH stable-6.0 0/6] io_uring 6.0 backports

by Pavel Begunkov

io_uring patches that has failed to be applied today with their dependencies. Pavel Begunkov (6): io_uring/net: refactor io_sr_msg types io_uring/net: use io_sr_msg for sendzc io_uring/net: don't lose partial send_zc on fail io_uring/net: rename io_sendzc() io_uring/net: don't skip notifs for failed requests io_uring/net: fix notif cqe reordering io_uring/net.c | 60 ++++++++++++++++++++++++++---------------------- io_uring/net.h | 7 +++--- io_uring/opdef.c | 7 +++--- 3 files changed, 40 insertions(+), 34 deletions(-) -- 2.38.0

2 years, 2 months

2
7
0 0

FAILED: patch "[PATCH] btrfs: enhance unsupported compat RO flags handling" failed to apply to 4.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. Possible dependencies: 81d5d61454c3 ("btrfs: enhance unsupported compat RO flags handling") dfe8aec4520b ("btrfs: add a btrfs_block_group_root() helper") b6e9f16c5fda ("btrfs: replace open coded while loop with proper construct") 42437a6386ff ("btrfs: introduce mount option rescue=ignorebadroots") 68319c18cb21 ("btrfs: show rescue=usebackuproot in /proc/mounts") ab0b4a3ebf14 ("btrfs: add a helper to print out rescue= options") ceafe3cc3992 ("btrfs: sysfs: export supported rescue= mount options") 334c16d82cfe ("btrfs: push the NODATASUM check into btrfs_lookup_bio_sums") d70bf7484f72 ("btrfs: unify the ro checking for mount options") 7573df5547c0 ("btrfs: sysfs: export supported send stream version") 3ef3959b29c4 ("btrfs: don't show full path of bind mounts in subvol=") 74ef00185eb8 ("btrfs: introduce "rescue=" mount option") e3ba67a108ff ("btrfs: factor out reading of bg from find_frist_block_group") 89d7da9bc592 ("btrfs: get mapping tree directly from fsinfo in find_first_block_group") c730ae0c6bb3 ("btrfs: convert comments to fallthrough annotations") aeb935a45581 ("btrfs: don't set SHAREABLE flag for data reloc tree") 92a7cc425223 ("btrfs: rename BTRFS_ROOT_REF_COWS to BTRFS_ROOT_SHAREABLE") 3be4d8efe3cf ("btrfs: block-group: rename write_one_cache_group()") 97f4728af888 ("btrfs: block-group: refactor how we insert a block group item") 7357623a7f4b ("btrfs: block-group: refactor how we delete one block group item") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 81d5d61454c365718655cfc87d8200c84e25d596 Mon Sep 17 00:00:00 2001 From: Qu Wenruo <wqu(a)suse.com> Date: Tue, 9 Aug 2022 13:02:16 +0800 Subject: [PATCH] btrfs: enhance unsupported compat RO flags handling Currently there are two corner cases not handling compat RO flags correctly: - Remount We can still mount the fs RO with compat RO flags, then remount it RW. We should not allow any write into a fs with unsupported RO flags. - Still try to search block group items In fact, behavior/on-disk format change to extent tree should not need a full incompat flag. And since we can ensure fs with unsupported RO flags never got any writes (with above case fixed), then we can even skip block group items search at mount time. This patch will enhance the unsupported RO compat flags by: - Reject read-write remount if there are unsupported RO compat flags - Go dummy block group items directly for unsupported RO compat flags In fact, only changes to chunk/subvolume/root/csum trees should go incompat flags. The latter part should allow future change to extent tree to be compat RO flags. Thus this patch also needs to be backported to all stable trees. CC: stable(a)vger.kernel.org # 4.9+ Reviewed-by: Nikolay Borisov <nborisov(a)suse.com> Signed-off-by: Qu Wenruo <wqu(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c index 53c44c52cb79..e7b5a54c8258 100644 --- a/fs/btrfs/block-group.c +++ b/fs/btrfs/block-group.c @@ -2164,7 +2164,16 @@ int btrfs_read_block_groups(struct btrfs_fs_info *info) int need_clear = 0; u64 cache_gen; - if (!root) + /* + * Either no extent root (with ibadroots rescue option) or we have + * unsupported RO options. The fs can never be mounted read-write, so no + * need to waste time searching block group items. + * + * This also allows new extent tree related changes to be RO compat, + * no need for a full incompat flag. + */ + if (!root || (btrfs_super_compat_ro_flags(info->super_copy) & + ~BTRFS_FEATURE_COMPAT_RO_SUPP)) return fill_dummy_bgs(info); key.objectid = 0; diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c index 7291e9d67e92..eb0ae7e396ef 100644 --- a/fs/btrfs/super.c +++ b/fs/btrfs/super.c @@ -2117,6 +2117,15 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data) ret = -EINVAL; goto restore; } + if (btrfs_super_compat_ro_flags(fs_info->super_copy) & + ~BTRFS_FEATURE_COMPAT_RO_SUPP) { + btrfs_err(fs_info, + "can not remount read-write due to unsupported optional flags 0x%llx", + btrfs_super_compat_ro_flags(fs_info->super_copy) & + ~BTRFS_FEATURE_COMPAT_RO_SUPP); + ret = -EINVAL; + goto restore; + } if (fs_info->fs_devices->rw_devices == 0) { ret = -EACCES; goto restore;

2 years, 2 months

3
2
0 0

[PATCH 5.10.y] arm64: topology: fix possible overflow in amu_fie_setup()

by Sergey Shtylyov

Commit d4955c0ad77dbc684fc716387070ac24801b8bca upstream. cpufreq_get_hw_max_freq() returns max frequency in kHz as *unsigned int*, while freq_inv_set_max_ratio() gets passed this frequency in Hz as 'u64'. Multiplying max frequency by 1000 can potentially result in overflow -- multiplying by 1000ULL instead should avoid that... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: cd0ed03a8903 ("arm64: use activity monitors for frequency invariance") Signed-off-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> Link: https://lore.kernel.org/r/01493d64-2bce-d968-86dc-11a122a9c07d@omp.ru Signed-off-by: Will Deacon <will(a)kernel.org> --- arch/arm64/kernel/topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: linux-stable/arch/arm64/kernel/topology.c =================================================================== --- linux-stable.orig/arch/arm64/kernel/topology.c +++ linux-stable/arch/arm64/kernel/topology.c @@ -158,7 +158,7 @@ static int validate_cpu_freq_invariance_ } /* Convert maximum frequency from KHz to Hz and validate */ - max_freq_hz = cpufreq_get_hw_max_freq(cpu) * 1000; + max_freq_hz = cpufreq_get_hw_max_freq(cpu) * 1000ULL; if (unlikely(!max_freq_hz)) { pr_debug("CPU%d: invalid maximum frequency.\n", cpu); return -EINVAL;

2 years, 2 months

2
1
0 0

Re: Patch "media: v4l2-ctrls: allocate space for arrays" has been added to the 6.0-stable tree

by Hans Verkuil

Hi Sasha, Please don't add this patch: it is not a fix, it is an internal change preparing for a new feature (see commit 0975274557d1). So no need to backport this patch. Regards, Hans On 10/17/22 04:24, Sasha Levin wrote: > This is a note to let you know that I've just added the patch titled > > media: v4l2-ctrls: allocate space for arrays > > to the 6.0-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > media-v4l2-ctrls-allocate-space-for-arrays.patch > and it can be found in the queue-6.0 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > > > > commit 5cc036de01c402cf40cccf04dcb95af5e18e8313 > Author: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> > Date: Mon Jul 11 12:21:07 2022 +0200 > > media: v4l2-ctrls: allocate space for arrays > > [ Upstream commit 5f2c5c69a61dc5411d436c1a422f8a1ee195a924 ] > > Just like dynamic arrays, also allocate space for regular arrays. > > This is in preparation for allowing to change the array size from > a driver. > > Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> > Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas(a)ideasonboard.com> > Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> > Stable-dep-of: 211f8304fa21 ("media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop") > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > > diff --git a/drivers/media/v4l2-core/v4l2-ctrls-api.c b/drivers/media/v4l2-core/v4l2-ctrls-api.c > index 50d012ba3c02..1b90bd7c4010 100644 > --- a/drivers/media/v4l2-core/v4l2-ctrls-api.c > +++ b/drivers/media/v4l2-core/v4l2-ctrls-api.c > @@ -105,8 +105,8 @@ static int user_to_new(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl) > > ctrl->is_new = 0; > if (ctrl->is_dyn_array && > - c->size > ctrl->p_dyn_alloc_elems * ctrl->elem_size) { > - void *old = ctrl->p_dyn; > + c->size > ctrl->p_array_alloc_elems * ctrl->elem_size) { > + void *old = ctrl->p_array; > void *tmp = kvzalloc(2 * c->size, GFP_KERNEL); > > if (!tmp) > @@ -115,8 +115,8 @@ static int user_to_new(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl) > memcpy(tmp + c->size, ctrl->p_cur.p, ctrl->elems * ctrl->elem_size); > ctrl->p_new.p = tmp; > ctrl->p_cur.p = tmp + c->size; > - ctrl->p_dyn = tmp; > - ctrl->p_dyn_alloc_elems = c->size / ctrl->elem_size; > + ctrl->p_array = tmp; > + ctrl->p_array_alloc_elems = c->size / ctrl->elem_size; > kvfree(old); > } > > diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c > index 1f85828d6694..9871c77f559b 100644 > --- a/drivers/media/v4l2-core/v4l2-ctrls-core.c > +++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c > @@ -1135,14 +1135,14 @@ int req_to_new(struct v4l2_ctrl_ref *ref) > > /* > * Check if the number of elements in the request is more than the > - * elements in ctrl->p_dyn. If so, attempt to realloc ctrl->p_dyn. > - * Note that p_dyn is allocated with twice the number of elements > + * elements in ctrl->p_array. If so, attempt to realloc ctrl->p_array. > + * Note that p_array is allocated with twice the number of elements > * in the dynamic array since it has to store both the current and > * new value of such a control. > */ > - if (ref->p_req_elems > ctrl->p_dyn_alloc_elems) { > + if (ref->p_req_elems > ctrl->p_array_alloc_elems) { > unsigned int sz = ref->p_req_elems * ctrl->elem_size; > - void *old = ctrl->p_dyn; > + void *old = ctrl->p_array; > void *tmp = kvzalloc(2 * sz, GFP_KERNEL); > > if (!tmp) > @@ -1151,8 +1151,8 @@ int req_to_new(struct v4l2_ctrl_ref *ref) > memcpy(tmp + sz, ctrl->p_cur.p, ctrl->elems * ctrl->elem_size); > ctrl->p_new.p = tmp; > ctrl->p_cur.p = tmp + sz; > - ctrl->p_dyn = tmp; > - ctrl->p_dyn_alloc_elems = ref->p_req_elems; > + ctrl->p_array = tmp; > + ctrl->p_array_alloc_elems = ref->p_req_elems; > kvfree(old); > } > > @@ -1252,7 +1252,7 @@ void v4l2_ctrl_handler_free(struct v4l2_ctrl_handler *hdl) > list_del(&ctrl->node); > list_for_each_entry_safe(sev, next_sev, &ctrl->ev_subs, node) > list_del(&sev->node); > - kvfree(ctrl->p_dyn); > + kvfree(ctrl->p_array); > kvfree(ctrl); > } > kvfree(hdl->buckets); > @@ -1584,11 +1584,10 @@ static struct v4l2_ctrl *v4l2_ctrl_new(struct v4l2_ctrl_handler *hdl, > V4L2_CTRL_FLAG_EXECUTE_ON_WRITE; > else if (type == V4L2_CTRL_TYPE_CTRL_CLASS) > flags |= V4L2_CTRL_FLAG_READ_ONLY; > - else if (!(flags & V4L2_CTRL_FLAG_DYNAMIC_ARRAY) && > + else if (!is_array && > (type == V4L2_CTRL_TYPE_INTEGER64 || > type == V4L2_CTRL_TYPE_STRING || > - type >= V4L2_CTRL_COMPOUND_TYPES || > - is_array)) > + type >= V4L2_CTRL_COMPOUND_TYPES)) > sz_extra += 2 * tot_ctrl_size; > > if (type >= V4L2_CTRL_COMPOUND_TYPES && p_def.p_const) > @@ -1632,14 +1631,14 @@ static struct v4l2_ctrl *v4l2_ctrl_new(struct v4l2_ctrl_handler *hdl, > ctrl->cur.val = ctrl->val = def; > data = &ctrl[1]; > > - if (ctrl->is_dyn_array) { > - ctrl->p_dyn_alloc_elems = elems; > - ctrl->p_dyn = kvzalloc(2 * elems * elem_size, GFP_KERNEL); > - if (!ctrl->p_dyn) { > + if (ctrl->is_array) { > + ctrl->p_array_alloc_elems = elems; > + ctrl->p_array = kvzalloc(2 * elems * elem_size, GFP_KERNEL); > + if (!ctrl->p_array) { > kvfree(ctrl); > return NULL; > } > - data = ctrl->p_dyn; > + data = ctrl->p_array; > } > > if (!ctrl->is_int) { > @@ -1651,7 +1650,7 @@ static struct v4l2_ctrl *v4l2_ctrl_new(struct v4l2_ctrl_handler *hdl, > } > > if (type >= V4L2_CTRL_COMPOUND_TYPES && p_def.p_const) { > - if (ctrl->is_dyn_array) > + if (ctrl->is_array) > ctrl->p_def.p = &ctrl[1]; > else > ctrl->p_def.p = ctrl->p_cur.p + tot_ctrl_size; > @@ -1664,7 +1663,7 @@ static struct v4l2_ctrl *v4l2_ctrl_new(struct v4l2_ctrl_handler *hdl, > } > > if (handler_new_ref(hdl, ctrl, NULL, false, false)) { > - kvfree(ctrl->p_dyn); > + kvfree(ctrl->p_array); > kvfree(ctrl); > return NULL; > } > diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h > index 00828a4f9404..5ddd506ae7b9 100644 > --- a/include/media/v4l2-ctrls.h > +++ b/include/media/v4l2-ctrls.h > @@ -203,7 +203,7 @@ typedef void (*v4l2_ctrl_notify_fnc)(struct v4l2_ctrl *ctrl, void *priv); > * @elem_size: The size in bytes of the control. > * @new_elems: The number of elements in p_new. This is the same as @elems, > * except for dynamic arrays. In that case it is in the range of > - * 1 to @p_dyn_alloc_elems. > + * 1 to @p_array_alloc_elems. > * @dims: The size of each dimension. > * @nr_of_dims:The number of dimensions in @dims. > * @menu_skip_mask: The control's skip mask for menu controls. This makes it > @@ -227,12 +227,11 @@ typedef void (*v4l2_ctrl_notify_fnc)(struct v4l2_ctrl *ctrl, void *priv); > * not freed when the control is deleted. Should this be needed > * then a new internal bitfield can be added to tell the framework > * to free this pointer. > - * @p_dyn: Pointer to the dynamically allocated array. Only valid if > - * @is_dyn_array is true. > - * @p_dyn_alloc_elems: The number of elements in the dynamically allocated > - * array for both the cur and new values. So @p_dyn is actually > - * sized for 2 * @p_dyn_alloc_elems * @elem_size. Only valid if > - * @is_dyn_array is true. > + * @p_array: Pointer to the allocated array. Only valid if @is_array is true. > + * @p_array_alloc_elems: The number of elements in the allocated > + * array for both the cur and new values. So @p_array is actually > + * sized for 2 * @p_array_alloc_elems * @elem_size. Only valid if > + * @is_array is true. > * @cur: Structure to store the current value. > * @cur.val: The control's current value, if the @type is represented via > * a u32 integer (see &enum v4l2_ctrl_type). > @@ -291,8 +290,8 @@ struct v4l2_ctrl { > }; > unsigned long flags; > void *priv; > - void *p_dyn; > - u32 p_dyn_alloc_elems; > + void *p_array; > + u32 p_array_alloc_elems; > s32 val; > struct { > s32 val;

2 years, 2 months

2
1
0 0

[PATCH stable 5.15] mm: hugetlb: fix UAF in hugetlb_handle_userfault

by Liu Shixin

commit 958f32ce832ba781ac20e11bb2d12a9352ea28fc upstream. The vma_lock and hugetlb_fault_mutex are dropped before handling userfault and reacquire them again after handle_userfault(), but reacquire the vma_lock could lead to UAF[1,2] due to the following race, hugetlb_fault hugetlb_no_page /*unlock vma_lock */ hugetlb_handle_userfault handle_userfault /* unlock mm->mmap_lock*/ vm_mmap_pgoff do_mmap mmap_region munmap_vma_range /* clean old vma */ /* lock vma_lock again <--- UAF */ /* unlock vma_lock */ Since the vma_lock will unlock immediately after hugetlb_handle_userfault(), let's drop the unneeded lock and unlock in hugetlb_handle_userfault() to fix the issue. [1] https://lore.kernel.org/linux-mm/000000000000d5e00a05e834962e@google.com/ [2] https://lore.kernel.org/linux-mm/20220921014457.1668-1-liuzixian4@huawei.co… Reported-by: syzbot+193f9cee8638750b23cf(a)syzkaller.appspotmail.com Reported-by: Liu Zixian <liuzixian4(a)huawei.com> Fixes: 1a1aad8a9b7b ("userfaultfd: hugetlbfs: add userfaultfd hugetlb hook") CC: stable(a)vger.kernel.org # 4.14+ Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com> --- mm/hugetlb.c | 37 +++++++++++++++++-------------------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index d61b665c45d6..23085498f5c8 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -4844,7 +4844,6 @@ static inline vm_fault_t hugetlb_handle_userfault(struct vm_area_struct *vma, unsigned long haddr, unsigned long reason) { - vm_fault_t ret; u32 hash; struct vm_fault vmf = { .vma = vma, @@ -4861,18 +4860,14 @@ static inline vm_fault_t hugetlb_handle_userfault(struct vm_area_struct *vma, }; /* - * hugetlb_fault_mutex and i_mmap_rwsem must be - * dropped before handling userfault. Reacquire - * after handling fault to make calling code simpler. + * vma_lock and hugetlb_fault_mutex must be dropped before handling + * userfault. Also mmap_lock will be dropped during handling + * userfault, any vma operation should be careful from here. */ hash = hugetlb_fault_mutex_hash(mapping, idx); mutex_unlock(&hugetlb_fault_mutex_table[hash]); i_mmap_unlock_read(mapping); - ret = handle_userfault(&vmf, reason); - i_mmap_lock_read(mapping); - mutex_lock(&hugetlb_fault_mutex_table[hash]); - - return ret; + return handle_userfault(&vmf, reason); } static vm_fault_t hugetlb_no_page(struct mm_struct *mm, @@ -4889,6 +4884,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, spinlock_t *ptl; unsigned long haddr = address & huge_page_mask(h); bool new_page, new_pagecache_page = false; + u32 hash = hugetlb_fault_mutex_hash(mapping, idx); /* * Currently, we are forced to kill the process in the event the @@ -4898,7 +4894,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, if (is_vma_resv_set(vma, HPAGE_RESV_UNMAPPED)) { pr_warn_ratelimited("PID %d killed due to inadequate hugepage pool\n", current->pid); - return ret; + goto out; } /* @@ -4915,12 +4911,10 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, page = find_lock_page(mapping, idx); if (!page) { /* Check for page in userfault range */ - if (userfaultfd_missing(vma)) { - ret = hugetlb_handle_userfault(vma, mapping, idx, + if (userfaultfd_missing(vma)) + return hugetlb_handle_userfault(vma, mapping, idx, flags, haddr, VM_UFFD_MISSING); - goto out; - } page = alloc_huge_page(vma, haddr, 0); if (IS_ERR(page)) { @@ -4980,10 +4974,9 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, if (userfaultfd_minor(vma)) { unlock_page(page); put_page(page); - ret = hugetlb_handle_userfault(vma, mapping, idx, + return hugetlb_handle_userfault(vma, mapping, idx, flags, haddr, VM_UFFD_MINOR); - goto out; } } @@ -5034,6 +5027,8 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, unlock_page(page); out: + mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); return ret; backout: @@ -5131,10 +5126,12 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, mutex_lock(&hugetlb_fault_mutex_table[hash]); entry = huge_ptep_get(ptep); - if (huge_pte_none(entry)) { - ret = hugetlb_no_page(mm, vma, mapping, idx, address, ptep, flags); - goto out_mutex; - } + if (huge_pte_none(entry)) + /* + * hugetlb_no_page will drop vma lock and hugetlb fault + * mutex internally, which make us return immediately. + */ + return hugetlb_no_page(mm, vma, mapping, idx, address, ptep, flags); ret = 0; -- 2.25.1

2 years, 2 months

1
0
0 0

[PATCH stable 5.19,6.0] mm: hugetlb: fix UAF in hugetlb_handle_userfault

by Liu Shixin

commit 958f32ce832ba781ac20e11bb2d12a9352ea28fc upstream. The vma_lock and hugetlb_fault_mutex are dropped before handling userfault and reacquire them again after handle_userfault(), but reacquire the vma_lock could lead to UAF[1,2] due to the following race, hugetlb_fault hugetlb_no_page /*unlock vma_lock */ hugetlb_handle_userfault handle_userfault /* unlock mm->mmap_lock*/ vm_mmap_pgoff do_mmap mmap_region munmap_vma_range /* clean old vma */ /* lock vma_lock again <--- UAF */ /* unlock vma_lock */ Since the vma_lock will unlock immediately after hugetlb_handle_userfault(), let's drop the unneeded lock and unlock in hugetlb_handle_userfault() to fix the issue. [1] https://lore.kernel.org/linux-mm/000000000000d5e00a05e834962e@google.com/ [2] https://lore.kernel.org/linux-mm/20220921014457.1668-1-liuzixian4@huawei.co… Reported-by: syzbot+193f9cee8638750b23cf(a)syzkaller.appspotmail.com Reported-by: Liu Zixian <liuzixian4(a)huawei.com> Fixes: 1a1aad8a9b7b ("userfaultfd: hugetlbfs: add userfaultfd hugetlb hook") CC: stable(a)vger.kernel.org # 4.14+ Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com> --- mm/hugetlb.c | 37 +++++++++++++++++-------------------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 0bdfc7e1c933..9d1a6253dda3 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5478,7 +5478,6 @@ static inline vm_fault_t hugetlb_handle_userfault(struct vm_area_struct *vma, unsigned long addr, unsigned long reason) { - vm_fault_t ret; u32 hash; struct vm_fault vmf = { .vma = vma, @@ -5496,18 +5495,14 @@ static inline vm_fault_t hugetlb_handle_userfault(struct vm_area_struct *vma, }; /* - * hugetlb_fault_mutex and i_mmap_rwsem must be - * dropped before handling userfault. Reacquire - * after handling fault to make calling code simpler. + * vma_lock and hugetlb_fault_mutex must be dropped before handling + * userfault. Also mmap_lock will be dropped during handling + * userfault, any vma operation should be careful from here. */ hash = hugetlb_fault_mutex_hash(mapping, idx); mutex_unlock(&hugetlb_fault_mutex_table[hash]); i_mmap_unlock_read(mapping); - ret = handle_userfault(&vmf, reason); - i_mmap_lock_read(mapping); - mutex_lock(&hugetlb_fault_mutex_table[hash]); - - return ret; + return handle_userfault(&vmf, reason); } static vm_fault_t hugetlb_no_page(struct mm_struct *mm, @@ -5525,6 +5520,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, spinlock_t *ptl; unsigned long haddr = address & huge_page_mask(h); bool new_page, new_pagecache_page = false; + u32 hash = hugetlb_fault_mutex_hash(mapping, idx); /* * Currently, we are forced to kill the process in the event the @@ -5535,7 +5531,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, if (is_vma_resv_set(vma, HPAGE_RESV_UNMAPPED)) { pr_warn_ratelimited("PID %d killed due to inadequate hugepage pool\n", current->pid); - return ret; + goto out; } /* @@ -5552,12 +5548,10 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, page = find_lock_page(mapping, idx); if (!page) { /* Check for page in userfault range */ - if (userfaultfd_missing(vma)) { - ret = hugetlb_handle_userfault(vma, mapping, idx, + if (userfaultfd_missing(vma)) + return hugetlb_handle_userfault(vma, mapping, idx, flags, haddr, address, VM_UFFD_MISSING); - goto out; - } page = alloc_huge_page(vma, haddr, 0); if (IS_ERR(page)) { @@ -5617,10 +5611,9 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, if (userfaultfd_minor(vma)) { unlock_page(page); put_page(page); - ret = hugetlb_handle_userfault(vma, mapping, idx, + return hugetlb_handle_userfault(vma, mapping, idx, flags, haddr, address, VM_UFFD_MINOR); - goto out; } } @@ -5678,6 +5671,8 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, unlock_page(page); out: + mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); return ret; backout: @@ -5776,11 +5771,13 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, entry = huge_ptep_get(ptep); /* PTE markers should be handled the same way as none pte */ - if (huge_pte_none_mostly(entry)) { - ret = hugetlb_no_page(mm, vma, mapping, idx, address, ptep, + if (huge_pte_none_mostly(entry)) + /* + * hugetlb_no_page will drop vma lock and hugetlb fault + * mutex internally, which make us return immediately. + */ + return hugetlb_no_page(mm, vma, mapping, idx, address, ptep, entry, flags); - goto out_mutex; - } ret = 0; -- 2.25.1

2 years, 2 months

1
0
0 0

Бенефіціар

by Paul G.Allen Family Foundation

Шановний бенефіціар! Ви отримали 1 000 000,00 доларів США як благодійні пожертви/допомогу від Фонду сім’ї Пола Г. Аллена. Вашу електронну адресу було вибрано в Інтернеті під час випадкового пошуку. Будь ласка, зв’яжіться з нами якнайшвидше. Для отримання додаткової інформації відвідайте: https://pgafamilyfoundation.org/ Від імені фонду вітаємо вас. З найкращими побажаннями, Доктор Вел Буш

2 years, 2 months

1
0
0 0

[PATCH 5.10 0/2] Stable 5.10 backport of RS485 initial polarity fix

by Dominique Martinet

This is the backport of the RS485 polarity fixes discussed here: https://lkml.kernel.org/r/20221010085305.GA32599@wunner.de It fixes RS485 DE initially set wrong on driver init, blocking other devices from transmitting on the bus. Mizobuchi-san did the backport and tested on our imx-based platform, but we do not have any hardware to test other drivers. The commits also apply cleanly on 5.15, and for 5.19 the second commit does (first one has already been picked up), but these have not been tested so would require more checking. Kernels older than 5.10 do not have this particular polarity inversion problem and do not need this as far as I can see. (there might be other problems this addresses that I am not aware of though) Thanks, Lino Sanfilippo (1): serial: core: move RS485 configuration tasks from drivers into core Lukas Wunner (1): serial: Deassert Transmit Enable on probe in driver-specific way drivers/tty/serial/8250/8250_omap.c | 3 ++ drivers/tty/serial/8250/8250_pci.c | 9 +---- drivers/tty/serial/8250/8250_port.c | 12 +++--- drivers/tty/serial/fsl_lpuart.c | 7 ++-- drivers/tty/serial/imx.c | 8 +--- drivers/tty/serial/serial_core.c | 61 +++++++++++++++++++++++------ 6 files changed, 65 insertions(+), 35 deletions(-) -- 2.35.1

2 years, 2 months

2
4
0 0

[to-be-updated] ocfs2-fix-ocfs2-corrupt-when-iputting-an-inode.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: ocfs2: fix ocfs2 corrupt when iputting an inode has been removed from the -mm tree. Its filename was ocfs2-fix-ocfs2-corrupt-when-iputting-an-inode.patch This patch was dropped because an updated version will be merged ------------------------------------------------------ From: Wangyan <wangyan122(a)huawei.com> Subject: ocfs2: fix ocfs2 corrupt when iputting an inode In this condition, it will cause an bug on error. ocfs2_mkdir() ->ocfs2_mknod() ->ocfs2_mknod_locked() ->__ocfs2_mknod_locked() //Assume inode->i_generation is genN. ->inode->i_generation = osb->s_next_generation++; // The inode lockres has been initialized. ->ocfs2_populate_inode() ->ocfs2_create_new_inode_locks() ->An error happened, returned value is non-zero // free the start_bit x in bg_blkno ->ocfs2_free_suballoc_bits() ->... /* Another process execute mkdir success in this place, and it occupied the start_bit x in bg_blkno which has been freed before. Its inode->i_generation is genN + 1 */ ->iput(inode) ->evict() ->ocfs2_evict_inode() ->ocfs2_delete_inode() ->ocfs2_inode_lock() ->ocfs2_inode_lock_update() /* Bug on here, genN != genN + 1 */ ->mlog_bug_on_msg(inode->i_generation != le32_to_cpu(fe->i_generation)) So, we need not to reclaim the inode when the inode->ip_inode_lockres has been initialized. It will be freed in iput(). Link: http://lkml.kernel.org/r/ef080ca3-5d74-e276-17a1-d9e7c7e662c9@huawei.com Fixes: b1529a41f777 ("ocfs2: should reclaim the inode if '__ocfs2_mknod_locked' returns an error") Signed-off-by: Yan Wang <wangyan122(a)huawei.com> Reviewed-by: Jun Piao <piaojun(a)huawei.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Joseph Qi <jiangqi903(a)gmail.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/ocfs2/namei.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/fs/ocfs2/namei.c~ocfs2-fix-ocfs2-corrupt-when-iputting-an-inode +++ a/fs/ocfs2/namei.c @@ -641,7 +641,8 @@ static int ocfs2_mknod_locked(struct ocf status = __ocfs2_mknod_locked(dir, inode, dev, new_fe_bh, parent_fe_bh, handle, inode_ac, fe_blkno, suballoc_loc, suballoc_bit); - if (status < 0) { + if (status < 0 && !(OCFS2_I(inode)->ip_inode_lockres.l_flags & + OCFS2_LOCK_INITIALIZED)) { u64 bg_blkno = ocfs2_which_suballoc_group(fe_blkno, suballoc_bit); int tmp = ocfs2_free_suballoc_bits(handle, inode_ac->ac_inode, inode_ac->ac_bh, suballoc_bit, bg_blkno, 1); _ Patches currently in -mm which might be from wangyan122(a)huawei.com are

2 years, 2 months

1
0
0 0

[to-be-updated] ocfs2-clear-links-count-in-ocfs2_mknod-if-an-error-occurs.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: ocfs2: clear links count in ocfs2_mknod() if an error occurs has been removed from the -mm tree. Its filename was ocfs2-clear-links-count-in-ocfs2_mknod-if-an-error-occurs.patch This patch was dropped because an updated version will be merged ------------------------------------------------------ From: Wangyan <wangyan122(a)huawei.com> Subject: ocfs2: clear links count in ocfs2_mknod() if an error occurs In this condition, the inode can not be wiped when error happened. ocfs2_mkdir() ->ocfs2_mknod() ->ocfs2_mknod_locked() ->__ocfs2_mknod_locked() ->ocfs2_set_links_count() // i_links_count is 2 -> ... // an error accrue, goto roll_back or leave. ->ocfs2_commit_trans() ->iput(inode) ->evict() ->ocfs2_evict_inode() ->ocfs2_delete_inode() ->ocfs2_inode_lock() ->ocfs2_inode_lock_update() ->ocfs2_refresh_inode() ->set_nlink(); // inode->i_nlink is 2 now. /* if wipe is 0, it will goto bail_unlock_inode */ ->ocfs2_query_inode_wipe() ->if (inode->i_nlink) return; // wipe is 0. /* inode can not be wiped */ ->ocfs2_wipe_inode() So, we need clear links before the transaction committed. Link: http://lkml.kernel.org/r/d8147c41-fb2b-bdf7-b660-1f3c8448c33f@huawei.com Signed-off-by: Yan Wang <wangyan122(a)huawei.com> Reviewed-by: Jun Piao <piaojun(a)huawei.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Joseph Qi <jiangqi903(a)gmail.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/ocfs2/namei.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) --- a/fs/ocfs2/namei.c~ocfs2-clear-links-count-in-ocfs2_mknod-if-an-error-occurs +++ a/fs/ocfs2/namei.c @@ -454,8 +454,12 @@ roll_back: leave: if (status < 0 && did_quota_inode) dquot_free_inode(inode); - if (handle) + if (handle) { + if (status < 0 && new_fe_bh != NULL) + ocfs2_set_links_count((struct ocfs2_dinode *) + new_fe_bh->b_data, 0); ocfs2_commit_trans(osb, handle); + } ocfs2_inode_unlock(dir, 1); if (did_block_signals) @@ -599,6 +603,8 @@ static int __ocfs2_mknod_locked(struct i leave: if (status < 0) { if (*new_fe_bh) { + if (fe) + ocfs2_set_links_count(fe, 0); brelse(*new_fe_bh); *new_fe_bh = NULL; } @@ -2028,8 +2034,12 @@ bail: ocfs2_clusters_to_bytes(osb->sb, 1)); if (status < 0 && did_quota_inode) dquot_free_inode(inode); - if (handle) + if (handle) { + if (status < 0 && new_fe_bh != NULL) + ocfs2_set_links_count((struct ocfs2_dinode *) + new_fe_bh->b_data, 0); ocfs2_commit_trans(osb, handle); + } ocfs2_inode_unlock(dir, 1); if (did_block_signals) _ Patches currently in -mm which might be from wangyan122(a)huawei.com are ocfs2-fix-ocfs2-corrupt-when-iputting-an-inode.patch

2 years, 2 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror October 2022