Dear kernel developers!
I am using Linux Mint Xfce 20.3 with kernel version 5.16. I had to use
kernel 5.16 because with the standard kernel version of Linux mit 20.3
(which is 5.13) my laptop did not correctly resume, when I closed the
lid.
With kernel 5.16 my laptop perfectly went to to suspend when I closed
the lid and it perfectly resumed, when I opened the lid again. This
means: I had to press the power button once when I reopened the lid -
and then the laptop resumed (to the login screen). This was true until
kernel version 5.16.10. With kernel version > 5.16.10 my laptop does
not go into suspend anymore. This means: When I open the lid I am back
at the login screen immediately (I don't have to press the power button
anymore).
System information for my laptop:
----------------------------------------------------------------------
System: Kernel: 5.16.10-051610-generic x86_64 bits: 64 compiler: N/A
Desktop: Xfce 4.16.0
tk: Gtk 3.24.20 wm: xfwm4 dm: LightDM Distro: Linux Mint
20.3 Una
base: Ubuntu 20.04 focal
Machine: Type: Laptop System: HP product: HP ProBook 455 G8 Notebook
PC v: N/A serial: <filter>
Chassis: type: 10 serial: <filter>
Mobo: HP model: 8864 v: KBC Version 41.1E.00 serial:
<filter> UEFI: HP
v: T78 Ver. 01.07.00 date: 10/08/2021
Battery: ID-1: BAT0 charge: 43.8 Wh condition: 44.5/45.0 Wh (99%)
volts: 13.0/11.4
model: Hewlett-Packard Primary serial: <filter> status:
Unknown
CPU: Topology: 8-Core model: AMD Ryzen 7 5800U with Radeon
Graphics bits: 64 type: MT MCP
arch: Zen 3 L2 cache: 4096 KiB
flags: avx avx2 lm nx pae sse sse2 sse3 sse4_1 sse4_2 sse4a
ssse3 svm bogomips: 60685
Speed: 3497 MHz min/max: 1600/1900 MHz Core speeds (MHz): 1:
3474 2: 3464 3: 3473
4: 3471 5: 4362 6: 4332 7: 3478 8: 3455 9: 3459 10: 3452 11:
3462 12: 3468 13: 3468
14: 3468 15: 3467 16: 3472
Graphics: Device-1: AMD vendor: Hewlett-Packard driver: amdgpu v:
kernel bus ID: 05:00.0
chip ID: 1002:1638
Display: x11 server: X.Org 1.20.13 driver: amdgpu,ati
unloaded: fbdev,modesetting,vesa
resolution: 1920x1080~60Hz
OpenGL: renderer: AMD RENOIR (DRM 3.44.0 5.16.10-051610-
generic LLVM 12.0.0)
v: 4.6 Mesa 21.2.6 direct render: Yes
----------------------------------------------------------------------
Best regards,
Reinhold Mannsberger
Hi,
On 9/14/21 09:57, Qu Wenruo wrote:
> [BUG]
...
>
> ================================================
> WARNING: lock held when returning to user space!
> 5.15.0-rc1 #16 Not tainted
> ------------------------------------------------
> syz-executor/7579 is leaving the kernel with locks still held!
> 1 lock held by syz-executor/7579:
> #0: ffff888104b73da8 (btrfs-tree-01/1){+.+.}-{3:3}, at:
> __btrfs_tree_lock+0x2e/0x1a0 fs/btrfs/locking.c:112
>
> [CAUSE]
> In btrfs_alloc_tree_block(), after btrfs_init_new_buffer(), the new
> extent buffer @buf is locked, but if later operations like adding
> delayed tree ref fails, we just free @buf without unlocking it,
> resulting above warning.
This patch fixes CVE-2021-4149. Commit 19ea40dddf18
"btrfs: unlock newly allocated extent buffer after error" upstream.
The patch was backported to kernels 5.15, 5.10, 5.4 because it contains
"CC: stable(a)vger.kernel.org # 5.4+" in the commit message.
However, it looks to me like kernels 4.9, 4.14, 4.19 are also vulnerable.
In v4.9 kernel there is btrfs_init_new_buffer() call:
btrfs_alloc_tree_block(...)
{
...
buf = btrfs_init_new_buffer(trans, root, ins.objectid, level);
...
out_free_buf:
free_extent_buffer(buf);
...
}
and btrfs_init_new_buffer() contains btrfs_tree_lock(buf) inside it.
The patch can be cherry-picked to v4.9 kernel without a conflict.
Probably, the error was introduced in the commit 67b7859e9bfa
"btrfs: handle ENOMEM in btrfs_alloc_tree_block" It's in the kernel
since v4.1
Can you confirm that kernels v4.9, 4.14, 4.19 are also vulnerable?
Thanks,
Denis
>
> [FIX]
> Unlock @buf in out_free_buf: tag.
>
> Reported-by: Hao Sun <sunhao.th(a)gmail.com>
> Link: https://lore.kernel.org/linux-btrfs/CACkBjsZ9O6Zr0KK1yGn=1rQi6Crh1yeCRdTSBx…
> Signed-off-by: Qu Wenruo <wqu(a)suse.com>
> ---
> fs/btrfs/extent-tree.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
> index c88e7727a31a..8aa981ffe7b7 100644
> --- a/fs/btrfs/extent-tree.c
> +++ b/fs/btrfs/extent-tree.c
> @@ -4898,6 +4898,7 @@ struct extent_buffer *btrfs_alloc_tree_block(struct btrfs_trans_handle *trans,
> out_free_delayed:
> btrfs_free_delayed_extent_op(extent_op);
> out_free_buf:
> + btrfs_tree_unlock(buf);
> free_extent_buffer(buf);
> out_free_reserved:
> btrfs_free_reserved_extent(fs_info, ins.objectid, ins.offset, 0);