Forward to the stable mailing list.
Ryusuke Konishi
On Sun, Dec 10, 2023 at 11:37 AM Ryusuke Konishi wrote:
>
> Hi Greg,
>
> Please drop this patch from the 5.4-stable, 4.19-stable, and 4.14-stable queues.
>
> This patch uses nilfs_error() instead of nilfs_err(), which does not
> yet exist in these versions, but these are different routines and
> nilfs_error() should not be used as an alternative for init_nilfs(),
> as it can cause deadlock.
>
> I'll try to post a separate patch to replace it for these versions.
>
> Thanks,
> Ryusuke Konishi
>
> On Sat, Dec 9, 2023 at 9:32 PM wrote:
> >
> >
> > This is a note to let you know that I've just added the patch titled
> >
> > nilfs2: fix missing error check for sb_set_blocksize call
> >
> > to the 5.4-stable tree which can be found at:
> > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
> >
> > The filename of the patch is:
> > nilfs2-fix-missing-error-check-for-sb_set_blocksize-call.patch
> > and it can be found in the queue-5.4 subdirectory.
> >
> > If you, or anyone else, feels it should not be added to the stable tree,
> > please let <stable(a)vger.kernel.org> know about it.
> >
> >
> > From d61d0ab573649789bf9eb909c89a1a193b2e3d10 Mon Sep 17 00:00:00 2001
> > From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
> > Date: Wed, 29 Nov 2023 23:15:47 +0900
> > Subject: nilfs2: fix missing error check for sb_set_blocksize call
> >
> > From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
> >
> > commit d61d0ab573649789bf9eb909c89a1a193b2e3d10 upstream.
> >
> > When mounting a filesystem image with a block size larger than the page
> > size, nilfs2 repeatedly outputs long error messages with stack traces to
> > the kernel log, such as the following:
> >
> > getblk(): invalid block size 8192 requested
> > logical block size: 512
> > ...
> > Call Trace:
> > dump_stack_lvl+0x92/0xd4
> > dump_stack+0xd/0x10
> > bdev_getblk+0x33a/0x354
> > __breadahead+0x11/0x80
> > nilfs_search_super_root+0xe2/0x704 [nilfs2]
> > load_nilfs+0x72/0x504 [nilfs2]
> > nilfs_mount+0x30f/0x518 [nilfs2]
> > legacy_get_tree+0x1b/0x40
> > vfs_get_tree+0x18/0xc4
> > path_mount+0x786/0xa88
> > __ia32_sys_mount+0x147/0x1a8
> > __do_fast_syscall_32+0x56/0xc8
> > do_fast_syscall_32+0x29/0x58
> > do_SYSENTER_32+0x15/0x18
> > entry_SYSENTER_32+0x98/0xf1
> > ...
> >
> > This overloads the system logger. And to make matters worse, it sometimes
> > crashes the kernel with a memory access violation.
> >
> > This is because the return value of the sb_set_blocksize() call, which
> > should be checked for errors, is not checked.
> >
> > The latter issue is due to out-of-buffer memory being accessed based on a
> > large block size that caused sb_set_blocksize() to fail for buffers read
> > with the initial minimum block size that remained unupdated in the
> > super_block structure.
> >
> > Since nilfs2 mkfs tool does not accept block sizes larger than the system
> > page size, this has been overlooked. However, it is possible to create
> > this situation by intentionally modifying the tool or by passing a
> > filesystem image created on a system with a large page size to a system
> > with a smaller page size and mounting it.
> >
> > Fix this issue by inserting the expected error handling for the call to
> > sb_set_blocksize().
> >
> > Link: https://lkml.kernel.org/r/20231129141547.4726-1-konishi.ryusuke@gmail.com
> > Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
> > Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
> > Cc: <stable(a)vger.kernel.org>
> > Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
> > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
> > ---
> > fs/nilfs2/the_nilfs.c | 6 +++++-
> > 1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > --- a/fs/nilfs2/the_nilfs.c
> > +++ b/fs/nilfs2/the_nilfs.c
> > @@ -688,7 +688,11 @@ int init_nilfs(struct the_nilfs *nilfs,
> > goto failed_sbh;
> > }
> > nilfs_release_super_block(nilfs);
> > - sb_set_blocksize(sb, blocksize);
> > + if (!sb_set_blocksize(sb, blocksize)) {
> > + nilfs_error(sb, "bad blocksize %d", blocksize);
> > + err = -EINVAL;
> > + goto out;
> > + }
> >
> > err = nilfs_load_super_block(nilfs, sb, blocksize, &sbp);
> > if (err)
> >
> >
> > Patches currently in stable-queue which might be from konishi.ryusuke(a)gmail.com are
> >
> > queue-5.4/nilfs2-prevent-warning-in-nilfs_sufile_set_segment_usage.patch
> > queue-5.4/nilfs2-fix-missing-error-check-for-sb_set_blocksize-call.patch
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x 705318a99a138c29a512a72c3e0043b3cd7f55f4
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023120911-ecosystem-diary-c2b7@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
705318a99a13 ("io_uring/af_unix: disable sending io_uring over sockets")
38eddb2c75fb ("io_uring: remove FFS_SCM")
735729844819 ("io_uring: move rsrc related data, core, and commands")
3b77495a9723 ("io_uring: split provided buffers handling into its own file")
7aaff708a768 ("io_uring: move cancelation into its own file")
329061d3e2f9 ("io_uring: move poll handling into its own file")
cfd22e6b3319 ("io_uring: add opcode name to io_op_defs")
92ac8beaea1f ("io_uring: include and forward-declaration sanitation")
c9f06aa7de15 ("io_uring: move io_uring_task (tctx) helpers into its own file")
a4ad4f748ea9 ("io_uring: move fdinfo helpers to its own file")
e5550a1447bf ("io_uring: use io_is_uring_fops() consistently")
17437f311490 ("io_uring: move SQPOLL related handling into its own file")
59915143e89f ("io_uring: move timeout opcodes and handling into its own file")
e418bbc97bff ("io_uring: move our reference counting into a header")
36404b09aa60 ("io_uring: move msg_ring into its own file")
f9ead18c1058 ("io_uring: split network related opcodes into its own file")
e0da14def1ee ("io_uring: move statx handling to its own file")
a9c210cebe13 ("io_uring: move epoll handler to its own file")
4cf90495281b ("io_uring: add a dummy -EOPNOTSUPP prep handler")
99f15d8d6136 ("io_uring: move uring_cmd handling to its own file")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 705318a99a138c29a512a72c3e0043b3cd7f55f4 Mon Sep 17 00:00:00 2001
From: Pavel Begunkov <asml.silence(a)gmail.com>
Date: Wed, 6 Dec 2023 13:26:47 +0000
Subject: [PATCH] io_uring/af_unix: disable sending io_uring over sockets
File reference cycles have caused lots of problems for io_uring
in the past, and it still doesn't work exactly right and races with
unix_stream_read_generic(). The safest fix would be to completely
disallow sending io_uring files via sockets via SCM_RIGHT, so there
are no possible cycles invloving registered files and thus rendering
SCM accounting on the io_uring side unnecessary.
Cc: <stable(a)vger.kernel.org>
Fixes: 0091bfc81741b ("io_uring/af_unix: defer registered files gc to io_uring release")
Reported-and-suggested-by: Jann Horn <jannh(a)google.com>
Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com>
Link: https://lore.kernel.org/r/c716c88321939156909cfa1bd8b0faaf1c804103.17018687…
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
diff --git a/io_uring/rsrc.h b/io_uring/rsrc.h
index 8625181fb87a..08ac0d8e07ef 100644
--- a/io_uring/rsrc.h
+++ b/io_uring/rsrc.h
@@ -77,17 +77,10 @@ int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
int __io_scm_file_account(struct io_ring_ctx *ctx, struct file *file);
-#if defined(CONFIG_UNIX)
-static inline bool io_file_need_scm(struct file *filp)
-{
- return !!unix_get_socket(filp);
-}
-#else
static inline bool io_file_need_scm(struct file *filp)
{
return false;
}
-#endif
static inline int io_scm_file_account(struct io_ring_ctx *ctx,
struct file *file)
diff --git a/net/core/scm.c b/net/core/scm.c
index 880027ecf516..7dc47c17d863 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -26,6 +26,7 @@
#include <linux/nsproxy.h>
#include <linux/slab.h>
#include <linux/errqueue.h>
+#include <linux/io_uring.h>
#include <linux/uaccess.h>
@@ -103,6 +104,11 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
if (fd < 0 || !(file = fget_raw(fd)))
return -EBADF;
+ /* don't allow io_uring files */
+ if (io_uring_get_socket(file)) {
+ fput(file);
+ return -EINVAL;
+ }
*fpp++ = file;
fpl->count++;
}