May 2022 - Linux-stable-mirror

[PATCH v5.10] dm: interlock pending dm_io and dm_wait_for_bios_completion

by Mikulas Patocka

This is backport of the patch 9f6dc6337610 ("dm: interlock pending dm_io and dm_wait_for_bios_completion") for the kernel 5.10. The bugs fixed by this patch can cause random crashing when reloading dm table, so it is eligible for stable backport. Note that the percpu variable md->pending_io is not needed in the stable kernels, because the "in_flight" counter in struct disk_stats counts the same value, so it is not backported. In order to fix this bug, we swap the calls to bio_end_io_acct and dm_stats_account_io. Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Reviewed-by: Mike Snitzer <snitzer(a)kernel.org> --- drivers/md/dm.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) Index: linux-stable/drivers/md/dm.c =================================================================== --- linux-stable.orig/drivers/md/dm.c 2022-04-30 20:09:28.000000000 +0200 +++ linux-stable/drivers/md/dm.c 2022-04-30 20:10:19.000000000 +0200 @@ -612,13 +612,15 @@ static void end_io_acct(struct mapped_de { unsigned long duration = jiffies - start_time; - bio_end_io_acct(bio, start_time); - if (unlikely(dm_stats_used(&md->stats))) dm_stats_account_io(&md->stats, bio_data_dir(bio), bio->bi_iter.bi_sector, bio_sectors(bio), true, duration, stats_aux); + smp_wmb(); + + bio_end_io_acct(bio, start_time); + /* nudge anyone waiting on suspend queue */ if (unlikely(wq_has_sleeper(&md->wait))) wake_up(&md->wait); @@ -2348,6 +2350,8 @@ static int dm_wait_for_bios_completion(s } finish_wait(&md->wait, &wait); + smp_rmb(); + return r; }

2 years, 8 months

1
0
0 0

[PATCH v5.4] dm: interlock pending dm_io and dm_wait_for_bios_completion

by Mikulas Patocka

This is backport of the patch 9f6dc6337610 ("dm: interlock pending dm_io and dm_wait_for_bios_completion") for the kernel 5.4. The bugs fixed by this patch can cause random crashing when reloading dm table, so it is eligible for stable backport. Note that the percpu variable md->pending_io is not needed in the stable kernels, because the "in_flight" counter in struct disk_stats counts the same value, so it is not backported. In order to fix this bug, we swap the calls to generic_end_io_acct and dm_stats_account_io. Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Reviewed-by: Mike Snitzer <snitzer(a)kernel.org> --- drivers/md/dm.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) Index: linux-stable/drivers/md/dm.c =================================================================== --- linux-stable.orig/drivers/md/dm.c 2022-04-30 19:57:10.000000000 +0200 +++ linux-stable/drivers/md/dm.c 2022-04-30 19:58:57.000000000 +0200 @@ -681,14 +681,16 @@ static void end_io_acct(struct mapped_de { unsigned long duration = jiffies - start_time; - generic_end_io_acct(md->queue, bio_op(bio), &dm_disk(md)->part0, - start_time); - if (unlikely(dm_stats_used(&md->stats))) dm_stats_account_io(&md->stats, bio_data_dir(bio), bio->bi_iter.bi_sector, bio_sectors(bio), true, duration, stats_aux); + smp_wmb(); + + generic_end_io_acct(md->queue, bio_op(bio), &dm_disk(md)->part0, + start_time); + /* nudge anyone waiting on suspend queue */ if (unlikely(wq_has_sleeper(&md->wait))) wake_up(&md->wait); @@ -2494,6 +2496,8 @@ static int dm_wait_for_completion(struct } finish_wait(&md->wait, &wait); + smp_rmb(); + return r; }

2 years, 8 months

1
0
0 0

[PATCH v5.4] dm: fix mempool NULL pointer race when completing IO

by Mikulas Patocka

This is backport of the patch d208b89401e0 ("dm: fix mempool NULL pointer race when completing IO") for the kernel 5.4. The bugs fixed by this patch can cause random crashing when reloading dm table, so it is eligible for stable backport. Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Reviewed-by: Mike Snitzer <snitzer(a)kernel.org> --- drivers/md/dm.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) Index: linux-stable/drivers/md/dm.c =================================================================== --- linux-stable.orig/drivers/md/dm.c 2022-04-30 19:53:42.000000000 +0200 +++ linux-stable/drivers/md/dm.c 2022-04-30 19:57:03.000000000 +0200 @@ -676,19 +676,18 @@ static void start_io_acct(struct dm_io * false, 0, &io->stats_aux); } -static void end_io_acct(struct dm_io *io) +static void end_io_acct(struct mapped_device *md, struct bio *bio, + unsigned long start_time, struct dm_stats_aux *stats_aux) { - struct mapped_device *md = io->md; - struct bio *bio = io->orig_bio; - unsigned long duration = jiffies - io->start_time; + unsigned long duration = jiffies - start_time; generic_end_io_acct(md->queue, bio_op(bio), &dm_disk(md)->part0, - io->start_time); + start_time); if (unlikely(dm_stats_used(&md->stats))) dm_stats_account_io(&md->stats, bio_data_dir(bio), bio->bi_iter.bi_sector, bio_sectors(bio), - true, duration, &io->stats_aux); + true, duration, stats_aux); /* nudge anyone waiting on suspend queue */ if (unlikely(wq_has_sleeper(&md->wait))) @@ -909,6 +908,8 @@ static void dec_pending(struct dm_io *io blk_status_t io_error; struct bio *bio; struct mapped_device *md = io->md; + unsigned long start_time = 0; + struct dm_stats_aux stats_aux; /* Push-back supersedes any I/O errors */ if (unlikely(error)) { @@ -935,8 +936,10 @@ static void dec_pending(struct dm_io *io io_error = io->status; bio = io->orig_bio; - end_io_acct(io); + start_time = io->start_time; + stats_aux = io->stats_aux; free_io(md, io); + end_io_acct(md, bio, start_time, &stats_aux); if (io_error == BLK_STS_DM_REQUEUE) return;

2 years, 8 months

1
0
0 0

[PATCH v4.19] dm: interlock pending dm_io and dm_wait_for_bios_completion

by Mikulas Patocka

This is backport of the patch 9f6dc6337610 ("dm: interlock pending dm_io and dm_wait_for_bios_completion") for the kernel 4.19. The bugs fixed by this patch can cause random crashing when reloading dm table, so it is eligible for stable backport. Note that the kernel 4.19 uses md->pending to count the number of in-progress I/Os and md->pending is decremented after dm_stats_account_io, so the race condition doesn't really exist there (except for missing smp_rmb()). The percpu variable md->pending_io is not needed in the stable kernels, because md->pending counts the same value, so it is not backported. Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Reviewed-by: Mike Snitzer <snitzer(a)kernel.org> --- drivers/md/dm.c | 2 ++ 1 file changed, 2 insertions(+) Index: linux-stable/drivers/md/dm.c =================================================================== --- linux-stable.orig/drivers/md/dm.c 2022-05-01 16:26:09.000000000 +0200 +++ linux-stable/drivers/md/dm.c 2022-05-01 16:26:09.000000000 +0200 @@ -2475,6 +2475,8 @@ static int dm_wait_for_completion(struct } finish_wait(&md->wait, &wait); + smp_rmb(); /* paired with atomic_dec_return in end_io_acct */ + return r; }

2 years, 8 months

1
0
0 0

[PATCH v4.19] dm: fix mempool NULL pointer race when completing IO

by Mikulas Patocka

This is backport of the patch d208b89401e0 ("dm: fix mempool NULL pointer race when completing IO") for the kernel 4.19. The bugs fixed by this patch can cause random crashing when reloading dm table, so it is eligible for stable backport. Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Reviewed-by: Mike Snitzer <snitzer(a)kernel.org> --- drivers/md/dm.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) Index: linux-stable/drivers/md/dm.c =================================================================== --- linux-stable.orig/drivers/md/dm.c 2022-04-30 20:13:27.000000000 +0200 +++ linux-stable/drivers/md/dm.c 2022-04-30 20:13:55.000000000 +0200 @@ -631,21 +631,20 @@ static void start_io_acct(struct dm_io * false, 0, &io->stats_aux); } -static void end_io_acct(struct dm_io *io) +static void end_io_acct(struct mapped_device *md, struct bio *bio, + unsigned long start_time, struct dm_stats_aux *stats_aux) { - struct mapped_device *md = io->md; - struct bio *bio = io->orig_bio; - unsigned long duration = jiffies - io->start_time; + unsigned long duration = jiffies - start_time; int pending; int rw = bio_data_dir(bio); generic_end_io_acct(md->queue, bio_op(bio), &dm_disk(md)->part0, - io->start_time); + start_time); if (unlikely(dm_stats_used(&md->stats))) dm_stats_account_io(&md->stats, bio_data_dir(bio), bio->bi_iter.bi_sector, bio_sectors(bio), - true, duration, &io->stats_aux); + true, duration, stats_aux); /* * After this is decremented the bio must not be touched if it is @@ -872,6 +871,8 @@ static void dec_pending(struct dm_io *io blk_status_t io_error; struct bio *bio; struct mapped_device *md = io->md; + unsigned long start_time = 0; + struct dm_stats_aux stats_aux; /* Push-back supersedes any I/O errors */ if (unlikely(error)) { @@ -898,8 +899,10 @@ static void dec_pending(struct dm_io *io io_error = io->status; bio = io->orig_bio; - end_io_acct(io); + start_time = io->start_time; + stats_aux = io->stats_aux; free_io(md, io); + end_io_acct(md, bio, start_time, &stats_aux); if (io_error == BLK_STS_DM_REQUEUE) return;

2 years, 8 months

1
0
0 0

[PATCH v4.14] dm: fix mempool NULL pointer race when completing IO

by Mikulas Patocka

This is backport of the patch d208b89401e0 ("dm: fix mempool NULL pointer race when completing IO") for the kernel 4.14. The bugs fixed by this patch can cause random crashing when reloading dm table, so it is eligible for stable backport. Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Reviewed-by: Mike Snitzer <snitzer(a)kernel.org> --- drivers/md/dm.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) Index: linux-stable/drivers/md/dm.c =================================================================== --- linux-stable.orig/drivers/md/dm.c 2022-04-30 19:14:50.000000000 +0200 +++ linux-stable/drivers/md/dm.c 2022-04-30 19:16:28.000000000 +0200 @@ -528,20 +528,19 @@ static void start_io_acct(struct dm_io * false, 0, &io->stats_aux); } -static void end_io_acct(struct dm_io *io) +static void end_io_acct(struct mapped_device *md, struct bio *bio, + unsigned long start_time, struct dm_stats_aux *stats_aux) { - struct mapped_device *md = io->md; - struct bio *bio = io->bio; - unsigned long duration = jiffies - io->start_time; + unsigned long duration = jiffies - start_time; int pending; int rw = bio_data_dir(bio); - generic_end_io_acct(md->queue, rw, &dm_disk(md)->part0, io->start_time); + generic_end_io_acct(md->queue, rw, &dm_disk(md)->part0, start_time); if (unlikely(dm_stats_used(&md->stats))) dm_stats_account_io(&md->stats, bio_data_dir(bio), bio->bi_iter.bi_sector, bio_sectors(bio), - true, duration, &io->stats_aux); + true, duration, stats_aux); /* * After this is decremented the bio must not be touched if it is @@ -775,6 +774,8 @@ static void dec_pending(struct dm_io *io blk_status_t io_error; struct bio *bio; struct mapped_device *md = io->md; + unsigned long start_time = 0; + struct dm_stats_aux stats_aux; /* Push-back supersedes any I/O errors */ if (unlikely(error)) { @@ -801,8 +802,10 @@ static void dec_pending(struct dm_io *io io_error = io->status; bio = io->bio; - end_io_acct(io); + start_time = io->start_time; + stats_aux = io->stats_aux; free_io(md, io); + end_io_acct(md, bio, start_time, &stats_aux); if (io_error == BLK_STS_DM_REQUEUE) return;

2 years, 8 months

1
0
0 0

[PATCH v4.14] dm: interlock pending dm_io and dm_wait_for_bios_completion

by Mikulas Patocka

This is backport of the patch 9f6dc6337610 ("dm: interlock pending dm_io and dm_wait_for_bios_completion") for the kernel 4.14. The bugs fixed by this patch can cause random crashing when reloading dm table, so it is eligible for stable backport. Note that the kernel 4.14 uses md->pending to count the number of in-progress I/Os and md->pending is decremented after dm_stats_account_io, so the race condition doesn't really exist there (except for missing smp_rmb()). The percpu variable md->pending_io is not needed in the stable kernels, because md->pending counts the same value, so it is not backported. Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Reviewed-by: Mike Snitzer <snitzer(a)kernel.org> --- drivers/md/dm.c | 2 ++ 1 file changed, 2 insertions(+) Index: linux-stable/drivers/md/dm.c =================================================================== --- linux-stable.orig/drivers/md/dm.c 2022-04-30 19:16:55.000000000 +0200 +++ linux-stable/drivers/md/dm.c 2022-04-30 19:16:55.000000000 +0200 @@ -2230,6 +2230,8 @@ static int dm_wait_for_completion(struct } finish_wait(&md->wait, &wait); + smp_rmb(); /* paired with atomic_dec_return in end_io_acct */ + return r; }

2 years, 8 months

1
0
0 0

[PATCH v4.9] dm: fix mempool NULL pointer race when completing IO

by Mikulas Patocka

This is backport of the patch d208b89401e0 ("dm: fix mempool NULL pointer race when completing IO") for the kernel 4.9. The bugs fixed by this patch can cause random crashing when reloading dm table, so it is eligible for stable backport. Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Reviewed-by: Mike Snitzer <snitzer(a)kernel.org> --- drivers/md/dm.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) Index: linux-stable/drivers/md/dm.c =================================================================== --- linux-stable.orig/drivers/md/dm.c 2022-04-30 18:51:49.000000000 +0200 +++ linux-stable/drivers/md/dm.c 2022-04-30 19:03:08.000000000 +0200 @@ -524,20 +524,19 @@ static void start_io_acct(struct dm_io * false, 0, &io->stats_aux); } -static void end_io_acct(struct dm_io *io) +static void end_io_acct(struct mapped_device *md, struct bio *bio, + unsigned long start_time, struct dm_stats_aux *stats_aux) { - struct mapped_device *md = io->md; - struct bio *bio = io->bio; - unsigned long duration = jiffies - io->start_time; + unsigned long duration = jiffies - start_time; int pending; int rw = bio_data_dir(bio); - generic_end_io_acct(rw, &dm_disk(md)->part0, io->start_time); + generic_end_io_acct(rw, &dm_disk(md)->part0, start_time); if (unlikely(dm_stats_used(&md->stats))) dm_stats_account_io(&md->stats, bio_data_dir(bio), bio->bi_iter.bi_sector, bio_sectors(bio), - true, duration, &io->stats_aux); + true, duration, stats_aux); /* * After this is decremented the bio must not be touched if it is @@ -768,6 +767,8 @@ static void dec_pending(struct dm_io *io int io_error; struct bio *bio; struct mapped_device *md = io->md; + unsigned long start_time = 0; + struct dm_stats_aux stats_aux; /* Push-back supersedes any I/O errors */ if (unlikely(error)) { @@ -793,8 +794,10 @@ static void dec_pending(struct dm_io *io io_error = io->error; bio = io->bio; - end_io_acct(io); + start_time = io->start_time; + stats_aux = io->stats_aux; free_io(md, io); + end_io_acct(md, bio, start_time, &stats_aux); if (io_error == DM_ENDIO_REQUEUE) return;

2 years, 8 months

1
0
0 0

[PATCH v4] firmware_loader: use kernel credentials when reading firmware

by Thiébaud Weksteen

Device drivers may decide to not load firmware when probed to avoid slowing down the boot process should the firmware filesystem not be available yet. In this case, the firmware loading request may be done when a device file associated with the driver is first accessed. The credentials of the userspace process accessing the device file may be used to validate access to the firmware files requested by the driver. Ensure that the kernel assumes the responsibility of reading the firmware. This was observed on Android for a graphic driver loading their firmware when the device file (e.g. /dev/mali0) was first opened by userspace (i.e. surfaceflinger). The security context of surfaceflinger was used to validate the access to the firmware file (e.g. /vendor/firmware/mali.bin). Previously, Android configurations were not setting up the firmware_class.path command line argument and were relying on the userspace fallback mechanism. In this case, the security context of the userspace daemon (i.e. ueventd) was consistently used to read firmware files. More Android devices are now found to set firmware_class.path which gives the kernel the opportunity to read the firmware directly (via kernel_read_file_from_path_initns). In this scenario, the current process credentials were used, even if unrelated to the loading of the firmware file. Signed-off-by: Thiébaud Weksteen <tweek(a)google.com> Cc: <stable(a)vger.kernel.org> # 5.10 --- v4: Add stable to Cc v3: - Add call to put_cred to avoid a memory leak. Confirmed that no new memory leak occurs on a Pixel 4a. - Update commit log. v2: Add comment drivers/base/firmware_loader/main.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c index 94d1789a233e..406a907a4cae 100644 --- a/drivers/base/firmware_loader/main.c +++ b/drivers/base/firmware_loader/main.c @@ -735,6 +735,8 @@ _request_firmware(const struct firmware **firmware_p, const char *name, size_t offset, u32 opt_flags) { struct firmware *fw = NULL; + struct cred *kern_cred = NULL; + const struct cred *old_cred; bool nondirect = false; int ret; @@ -751,6 +753,18 @@ _request_firmware(const struct firmware **firmware_p, const char *name, if (ret <= 0) /* error or already assigned */ goto out; + /* + * We are about to try to access the firmware file. Because we may have been + * called by a driver when serving an unrelated request from userland, we use + * the kernel credentials to read the file. + */ + kern_cred = prepare_kernel_cred(NULL); + if (!kern_cred) { + ret = -ENOMEM; + goto out; + } + old_cred = override_creds(kern_cred); + ret = fw_get_filesystem_firmware(device, fw->priv, "", NULL); /* Only full reads can support decompression, platform, and sysfs. */ @@ -776,6 +790,9 @@ _request_firmware(const struct firmware **firmware_p, const char *name, } else ret = assign_fw(fw, device); + revert_creds(old_cred); + put_cred(kern_cred); + out: if (ret < 0) { fw_abort_batch_reqs(fw); -- 2.36.0.464.gb9c8b46e94-goog

2 years, 8 months

3
2
0 0

[PATCH v2 06/12] ptrace: Reimplement PTRACE_KILL by always sending SIGKILL

by Eric W. Biederman

Call send_sig_info in PTRACE_KILL instead of ptrace_resume. Calling ptrace_resume is not safe to call if the task has not been stopped with ptrace_freeze_traced. Cc: stable(a)vger.kernel.org Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Suggested-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: "Eric W. Biederman" <ebiederm(a)xmission.com> --- kernel/ptrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/ptrace.c b/kernel/ptrace.c index ccc4b465775b..43da5764b6f3 100644 --- a/kernel/ptrace.c +++ b/kernel/ptrace.c @@ -1238,7 +1238,7 @@ int ptrace_request(struct task_struct *child, long request, case PTRACE_KILL: if (child->exit_state) /* already dead */ return 0; - return ptrace_resume(child, request, SIGKILL); + return send_sig_info(SIGKILL, SEND_SIG_NOINFO, child); #ifdef CONFIG_HAVE_ARCH_TRACEHOOK case PTRACE_GETREGSET: -- 2.35.3

2 years, 8 months

2
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror May 2022