June 2023 - Linux-stable-mirror

[merged mm-hotfixes-stable] zswap-do-not-shrink-if-cgroup-may-not-zswap.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: zswap: do not shrink if cgroup may not zswap has been removed from the -mm tree. Its filename was zswap-do-not-shrink-if-cgroup-may-not-zswap.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Nhat Pham <nphamcs(a)gmail.com> Subject: zswap: do not shrink if cgroup may not zswap Date: Tue, 30 May 2023 15:24:40 -0700 Before storing a page, zswap first checks if the number of stored pages exceeds the limit specified by memory.zswap.max, for each cgroup in the hierarchy. If this limit is reached or exceeded, then zswap shrinking is triggered and short-circuits the store attempt. However, since the zswap's LRU is not memcg-aware, this can create the following pathological behavior: the cgroup whose zswap limit is 0 will evict pages from other cgroups continually, without lowering its own zswap usage. This means the shrinking will continue until the need for swap ceases or the pool becomes empty. As a result of this, we observe a disproportionate amount of zswap writeback and a perpetually small zswap pool in our experiments, even though the pool limit is never hit. More generally, a cgroup might unnecessarily evict pages from other cgroups before we drive the memcg back below its limit. This patch fixes the issue by rejecting zswap store attempt without shrinking the pool when obj_cgroup_may_zswap() returns false. [akpm(a)linux-foundation.org: fix return of unintialized value] [akpm(a)linux-foundation.org: s/ENOSPC/ENOMEM/] Link: https://lkml.kernel.org/r/20230530222440.2777700-1-nphamcs@gmail.com Link: https://lkml.kernel.org/r/20230530232435.3097106-1-nphamcs@gmail.com Fixes: f4840ccfca25 ("zswap: memcg accounting") Signed-off-by: Nhat Pham <nphamcs(a)gmail.com> Cc: Dan Streetman <ddstreet(a)ieee.org> Cc: Domenico Cerasuolo <cerasuolodomenico(a)gmail.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Seth Jennings <sjenning(a)redhat.com> Cc: Vitaly Wool <vitaly.wool(a)konsulko.com> Cc: Yosry Ahmed <yosryahmed(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/zswap.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) --- a/mm/zswap.c~zswap-do-not-shrink-if-cgroup-may-not-zswap +++ a/mm/zswap.c @@ -1174,9 +1174,16 @@ static int zswap_frontswap_store(unsigne goto reject; } + /* + * XXX: zswap reclaim does not work with cgroups yet. Without a + * cgroup-aware entry LRU, we will push out entries system-wide based on + * local cgroup limits. + */ objcg = get_obj_cgroup_from_page(page); - if (objcg && !obj_cgroup_may_zswap(objcg)) - goto shrink; + if (objcg && !obj_cgroup_may_zswap(objcg)) { + ret = -ENOMEM; + goto reject; + } /* reclaim space if needed */ if (zswap_is_full()) { _ Patches currently in -mm which might be from nphamcs(a)gmail.com are workingset-refactor-lru-refault-to-expose-refault-recency-check.patch cachestat-implement-cachestat-syscall.patch cachestat-implement-cachestat-syscall-fix.patch cachestat-wire-up-cachestat-for-other-architectures.patch cachestat-wire-up-cachestat-for-other-architectures-fix.patch selftests-add-selftests-for-cachestat.patch

1 year, 6 months

1
0
0 0

[merged mm-hotfixes-stable] ocfs2-check-new-file-size-on-fallocate-call.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: ocfs2: check new file size on fallocate call has been removed from the -mm tree. Its filename was ocfs2-check-new-file-size-on-fallocate-call.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Lu��s Henriques <ocfs2-devel(a)oss.oracle.com> Subject: ocfs2: check new file size on fallocate call Date: Mon, 29 May 2023 16:26:45 +0100 When changing a file size with fallocate() the new size isn't being checked. In particular, the FSIZE ulimit isn't being checked, which makes fstest generic/228 fail. Simply adding a call to inode_newsize_ok() fixes this issue. Link: https://lkml.kernel.org/r/20230529152645.32680-1-lhenriques@suse.de Signed-off-by: Lu��s Henriques <lhenriques(a)suse.de> Reviewed-by: Mark Fasheh <mark(a)fasheh.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/ocfs2/file.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) --- a/fs/ocfs2/file.c~ocfs2-check-new-file-size-on-fallocate-call +++ a/fs/ocfs2/file.c @@ -2100,14 +2100,20 @@ static long ocfs2_fallocate(struct file struct ocfs2_space_resv sr; int change_size = 1; int cmd = OCFS2_IOC_RESVSP64; + int ret = 0; if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE)) return -EOPNOTSUPP; if (!ocfs2_writes_unwritten_extents(osb)) return -EOPNOTSUPP; - if (mode & FALLOC_FL_KEEP_SIZE) + if (mode & FALLOC_FL_KEEP_SIZE) { change_size = 0; + } else { + ret = inode_newsize_ok(inode, offset + len); + if (ret) + return ret; + } if (mode & FALLOC_FL_PUNCH_HOLE) cmd = OCFS2_IOC_UNRESVSP64; _ Patches currently in -mm which might be from ocfs2-devel(a)oss.oracle.com are

1 year, 6 months

1
0
0 0

[merged mm-hotfixes-stable] mm-damon-core-fix-divide-error-in-damon_nr_accesses_to_accesses_bp.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/damon/core: fix divide error in damon_nr_accesses_to_accesses_bp() has been removed from the -mm tree. Its filename was mm-damon-core-fix-divide-error-in-damon_nr_accesses_to_accesses_bp.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Kefeng Wang <wangkefeng.wang(a)huawei.com> Subject: mm/damon/core: fix divide error in damon_nr_accesses_to_accesses_bp() Date: Sat, 27 May 2023 11:21:01 +0800 If 'aggr_interval' is smaller than 'sample_interval', max_nr_accesses in damon_nr_accesses_to_accesses_bp() becomes zero which leads to divide error, let's validate the values of them in damon_set_attrs() to fix it, which similar to others attrs check. Link: https://lkml.kernel.org/r/20230527032101.167788-1-wangkefeng.wang@huawei.com Fixes: 2f5bef5a590b ("mm/damon/core: update monitoring results for new monitoring attributes") Reported-by: syzbot+841a46899768ec7bec67(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=841a46899768ec7bec67 Link: https://lore.kernel.org/damon/00000000000055fc4e05fc975bc2@google.com/ Reviewed-by: SeongJae Park <sj(a)kernel.org> Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/damon/core.c | 2 ++ 1 file changed, 2 insertions(+) --- a/mm/damon/core.c~mm-damon-core-fix-divide-error-in-damon_nr_accesses_to_accesses_bp +++ a/mm/damon/core.c @@ -551,6 +551,8 @@ int damon_set_attrs(struct damon_ctx *ct return -EINVAL; if (attrs->min_nr_regions > attrs->max_nr_regions) return -EINVAL; + if (attrs->sample_interval > attrs->aggr_interval) + return -EINVAL; damon_update_monitoring_results(ctx, attrs); ctx->attrs = *attrs; _ Patches currently in -mm which might be from wangkefeng.wang(a)huawei.com are mm-memory_failure-move-memory_failure_attr_group-under-memory_failure.patch mm-memory-failure-move-sysctl-register-in-memory_failure_init.patch mm-page_alloc-move-mirrored_kernelcore-into-mm_initc.patch mm-page_alloc-move-init_on_alloc-free-into-mm_initc.patch mm-page_alloc-move-set_zone_contiguous-into-mm_initc.patch mm-page_alloc-collect-mem-statistic-into-show_memc.patch mm-page_alloc-squash-page_is_consistent.patch mm-page_alloc-remove-alloc_contig_dump_pages-stub.patch mm-page_alloc-split-out-fail_page_alloc.patch mm-page_alloc-split-out-debug_pagealloc.patch mm-page_alloc-move-mark_free_page-into-snapshotc.patch mm-page_alloc-move-pm_-function-into-power.patch mm-vmscan-use-gfp_has_io_fs.patch mm-page_alloc-move-sysctls-into-it-own-fils.patch mm-page_alloc-move-is_check_pages_enabled-into-page_allocc.patch

1 year, 6 months

1
0
0 0

[merged mm-hotfixes-stable] epoll-ep_autoremove_wake_function-should-use-list_del_init_careful.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: epoll: ep_autoremove_wake_function should use list_del_init_careful has been removed from the -mm tree. Its filename was epoll-ep_autoremove_wake_function-should-use-list_del_init_careful.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Benjamin Segall <bsegall(a)google.com> Subject: epoll: ep_autoremove_wake_function should use list_del_init_careful Date: Tue, 30 May 2023 11:32:28 -0700 autoremove_wake_function uses list_del_init_careful, so should epoll's more aggressive variant. It only doesn't because it was copied from an older wait.c rather than the most recent. [bsegall(a)google.com: add comment] Link: https://lkml.kernel.org/r/xm26bki0ulsr.fsf_-_@google.com Link: https://lkml.kernel.org/r/xm26pm6hvfer.fsf@google.com Fixes: a16ceb139610 ("epoll: autoremove wakers even more aggressively") Signed-off-by: Ben Segall <bsegall(a)google.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: Christian Brauner <brauner(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/eventpoll.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/fs/eventpoll.c~epoll-ep_autoremove_wake_function-should-use-list_del_init_careful +++ a/fs/eventpoll.c @@ -1805,7 +1805,11 @@ static int ep_autoremove_wake_function(s { int ret = default_wake_function(wq_entry, mode, sync, key); - list_del_init(&wq_entry->entry); + /* + * Pairs with list_empty_careful in ep_poll, and ensures future loop + * iterations see the cause of this wakeup. + */ + list_del_init_careful(&wq_entry->entry); return ret; } _ Patches currently in -mm which might be from bsegall(a)google.com are

1 year, 6 months

1
0
0 0

[merged mm-hotfixes-stable] mm-gup_test-fix-ioctl-fail-for-compat-task.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/gup_test: fix ioctl fail for compat task has been removed from the -mm tree. Its filename was mm-gup_test-fix-ioctl-fail-for-compat-task.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Haibo Li <haibo.li(a)mediatek.com> Subject: mm/gup_test: fix ioctl fail for compat task Date: Fri, 26 May 2023 10:21:25 +0800 When tools/testing/selftests/mm/gup_test.c is compiled as 32bit, then run on arm64 kernel, it reports "ioctl: Inappropriate ioctl for device". Fix it by filling compat_ioctl in gup_test_fops Link: https://lkml.kernel.org/r/20230526022125.175728-1-haibo.li@mediatek.com Signed-off-by: Haibo Li <haibo.li(a)mediatek.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Cc: Matthias Brugger <matthias.bgg(a)gmail.com> Cc: John Hubbard <jhubbard(a)nvidia.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/gup_test.c | 1 + 1 file changed, 1 insertion(+) --- a/mm/gup_test.c~mm-gup_test-fix-ioctl-fail-for-compat-task +++ a/mm/gup_test.c @@ -381,6 +381,7 @@ static int gup_test_release(struct inode static const struct file_operations gup_test_fops = { .open = nonseekable_open, .unlocked_ioctl = gup_test_ioctl, + .compat_ioctl = compat_ptr_ioctl, .release = gup_test_release, }; _ Patches currently in -mm which might be from haibo.li(a)mediatek.com are

1 year, 6 months

1
0
0 0

[merged mm-hotfixes-stable] nilfs2-reject-devices-with-insufficient-block-count.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: nilfs2: reject devices with insufficient block count has been removed from the -mm tree. Its filename was nilfs2-reject-devices-with-insufficient-block-count.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Subject: nilfs2: reject devices with insufficient block count Date: Fri, 26 May 2023 11:13:32 +0900 The current sanity check for nilfs2 geometry information lacks checks for the number of segments stored in superblocks, so even for device images that have been destructively truncated or have an unusually high number of segments, the mount operation may succeed. This causes out-of-bounds block I/O on file system block reads or log writes to the segments, the latter in particular causing "a_ops->writepages" to repeatedly fail, resulting in sync_inodes_sb() to hang. Fix this issue by checking the number of segments stored in the superblock and avoiding mounting devices that can cause out-of-bounds accesses. To eliminate the possibility of overflow when calculating the number of blocks required for the device from the number of segments, this also adds a helper function to calculate the upper bound on the number of segments and inserts a check using it. Link: https://lkml.kernel.org/r/20230526021332.3431-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+7d50f1e54a12ba3aeae2(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=7d50f1e54a12ba3aeae2 Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/nilfs2/the_nilfs.c | 43 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 42 insertions(+), 1 deletion(-) --- a/fs/nilfs2/the_nilfs.c~nilfs2-reject-devices-with-insufficient-block-count +++ a/fs/nilfs2/the_nilfs.c @@ -405,6 +405,18 @@ unsigned long nilfs_nrsvsegs(struct the_ 100)); } +/** + * nilfs_max_segment_count - calculate the maximum number of segments + * @nilfs: nilfs object + */ +static u64 nilfs_max_segment_count(struct the_nilfs *nilfs) +{ + u64 max_count = U64_MAX; + + do_div(max_count, nilfs->ns_blocks_per_segment); + return min_t(u64, max_count, ULONG_MAX); +} + void nilfs_set_nsegments(struct the_nilfs *nilfs, unsigned long nsegs) { nilfs->ns_nsegments = nsegs; @@ -414,6 +426,8 @@ void nilfs_set_nsegments(struct the_nilf static int nilfs_store_disk_layout(struct the_nilfs *nilfs, struct nilfs_super_block *sbp) { + u64 nsegments, nblocks; + if (le32_to_cpu(sbp->s_rev_level) < NILFS_MIN_SUPP_REV) { nilfs_err(nilfs->ns_sb, "unsupported revision (superblock rev.=%d.%d, current rev.=%d.%d). Please check the version of mkfs.nilfs(2).", @@ -457,7 +471,34 @@ static int nilfs_store_disk_layout(struc return -EINVAL; } - nilfs_set_nsegments(nilfs, le64_to_cpu(sbp->s_nsegments)); + nsegments = le64_to_cpu(sbp->s_nsegments); + if (nsegments > nilfs_max_segment_count(nilfs)) { + nilfs_err(nilfs->ns_sb, + "segment count %llu exceeds upper limit (%llu segments)", + (unsigned long long)nsegments, + (unsigned long long)nilfs_max_segment_count(nilfs)); + return -EINVAL; + } + + nblocks = sb_bdev_nr_blocks(nilfs->ns_sb); + if (nblocks) { + u64 min_block_count = nsegments * nilfs->ns_blocks_per_segment; + /* + * To avoid failing to mount early device images without a + * second superblock, exclude that block count from the + * "min_block_count" calculation. + */ + + if (nblocks < min_block_count) { + nilfs_err(nilfs->ns_sb, + "total number of segment blocks %llu exceeds device size (%llu blocks)", + (unsigned long long)min_block_count, + (unsigned long long)nblocks); + return -EINVAL; + } + } + + nilfs_set_nsegments(nilfs, nsegments); nilfs->ns_crc_seed = le32_to_cpu(sbp->s_crc_seed); return 0; } _ Patches currently in -mm which might be from konishi.ryusuke(a)gmail.com are

1 year, 6 months

1
0
0 0

[merged mm-hotfixes-stable] ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: ocfs2: fix use-after-free when unmounting read-only filesystem has been removed from the -mm tree. Its filename was ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Lu��s Henriques <ocfs2-devel(a)oss.oracle.com> Subject: ocfs2: fix use-after-free when unmounting read-only filesystem Date: Mon, 22 May 2023 11:21:12 +0100 It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra.0+0x3e/0xf0 [ocfs2] ocfs2_dismount_volume+0xdd/0x450 [ocfs2] generic_shutdown_super+0xaa/0x280 kill_block_super+0x46/0x70 deactivate_locked_super+0x4d/0xb0 cleanup_mnt+0x135/0x1f0 ... </TASK> Allocated by task 632: kasan_save_stack+0x1c/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x8b/0x90 ocfs2_local_read_info+0xe3/0x9a0 [ocfs2] dquot_load_quota_sb+0x34b/0x680 dquot_load_quota_inode+0xfe/0x1a0 ocfs2_enable_quotas+0x190/0x2f0 [ocfs2] ocfs2_fill_super+0x14ef/0x2120 [ocfs2] mount_bdev+0x1be/0x200 legacy_get_tree+0x6c/0xb0 vfs_get_tree+0x3e/0x110 path_mount+0xa90/0xe10 __x64_sys_mount+0x16f/0x1a0 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 650: kasan_save_stack+0x1c/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x50 __kasan_slab_free+0xf9/0x150 __kmem_cache_free+0x89/0x180 ocfs2_local_free_info+0x2ba/0x3f0 [ocfs2] dquot_disable+0x35f/0xa70 ocfs2_susp_quotas.isra.0+0x159/0x1a0 [ocfs2] ocfs2_remount+0x150/0x580 [ocfs2] reconfigure_super+0x1a5/0x3a0 path_mount+0xc8a/0xe10 __x64_sys_mount+0x16f/0x1a0 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Link: https://lkml.kernel.org/r/20230522102112.9031-1-lhenriques@suse.de Signed-off-by: Lu��s Henriques <lhenriques(a)suse.de> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Tested-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/ocfs2/super.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/fs/ocfs2/super.c~ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem +++ a/fs/ocfs2/super.c @@ -952,8 +952,10 @@ static void ocfs2_disable_quotas(struct for (type = 0; type < OCFS2_MAXQUOTAS; type++) { if (!sb_has_quota_loaded(sb, type)) continue; - oinfo = sb_dqinfo(sb, type)->dqi_priv; - cancel_delayed_work_sync(&oinfo->dqi_sync_work); + if (!sb_has_quota_suspended(sb, type)) { + oinfo = sb_dqinfo(sb, type)->dqi_priv; + cancel_delayed_work_sync(&oinfo->dqi_sync_work); + } inode = igrab(sb->s_dquot.files[type]); /* Turn off quotas. This will remove all dquot structures from * memory and so they will be automatically synced to global _ Patches currently in -mm which might be from ocfs2-devel(a)oss.oracle.com are

1 year, 6 months

1
0
0 0

[merged mm-hotfixes-stable] nilfs2-fix-possible-out-of-bounds-segment-allocation-in-resize-ioctl.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: nilfs2: fix possible out-of-bounds segment allocation in resize ioctl has been removed from the -mm tree. Its filename was nilfs2-fix-possible-out-of-bounds-segment-allocation-in-resize-ioctl.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Subject: nilfs2: fix possible out-of-bounds segment allocation in resize ioctl Date: Wed, 24 May 2023 18:43:48 +0900 Syzbot reports that in its stress test for resize ioctl, the log writing function nilfs_segctor_do_construct hits a WARN_ON in nilfs_segctor_truncate_segments(). It turned out that there is a problem with the current implementation of the resize ioctl, which changes the writable range on the device (the range of allocatable segments) at the end of the resize process. This order is necessary for file system expansion to avoid corrupting the superblock at trailing edge. However, in the case of a file system shrink, if log writes occur after truncating out-of-bounds trailing segments and before the resize is complete, segments may be allocated from the truncated space. The userspace resize tool was fine as it limits the range of allocatable segments before performing the resize, but it can run into this issue if the resize ioctl is called alone. Fix this issue by changing nilfs_sufile_resize() to update the range of allocatable segments immediately after successful truncation of segment space in case of file system shrink. Link: https://lkml.kernel.org/r/20230524094348.3784-1-konishi.ryusuke@gmail.com Fixes: 4e33f9eab07e ("nilfs2: implement resize ioctl") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+33494cd0df2ec2931851(a)syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/0000000000005434c405fbbafdc5@google.com Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/nilfs2/sufile.c | 9 +++++++++ 1 file changed, 9 insertions(+) --- a/fs/nilfs2/sufile.c~nilfs2-fix-possible-out-of-bounds-segment-allocation-in-resize-ioctl +++ a/fs/nilfs2/sufile.c @@ -779,6 +779,15 @@ int nilfs_sufile_resize(struct inode *su goto out_header; sui->ncleansegs -= nsegs - newnsegs; + + /* + * If the sufile is successfully truncated, immediately adjust + * the segment allocation space while locking the semaphore + * "mi_sem" so that nilfs_sufile_alloc() never allocates + * segments in the truncated space. + */ + sui->allocmax = newnsegs - 1; + sui->allocmin = 0; } kaddr = kmap_atomic(header_bh->b_page); _ Patches currently in -mm which might be from konishi.ryusuke(a)gmail.com are

1 year, 6 months

1
0
0 0

[merged mm-hotfixes-stable] riscv-purgatory-remove-pgo-flags.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: riscv/purgatory: remove PGO flags has been removed from the -mm tree. Its filename was riscv-purgatory-remove-pgo-flags.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Ricardo Ribalda <ribalda(a)chromium.org> Subject: riscv/purgatory: remove PGO flags Date: Fri, 19 May 2023 16:47:39 +0200 If profile-guided optimization is enabled, the purgatory ends up with multiple .text sections. This is not supported by kexec and crashes the system. Link: https://lkml.kernel.org/r/20230321-kexec_clang16-v7-4-b05c520b7296@chromium… Fixes: 930457057abe ("kernel/kexec_file.c: split up __kexec_load_puragory") Signed-off-by: Ricardo Ribalda <ribalda(a)chromium.org> Acked-by: Palmer Dabbelt <palmer(a)rivosinc.com> Cc: <stable(a)vger.kernel.org> Cc: Albert Ou <aou(a)eecs.berkeley.edu> Cc: Baoquan He <bhe(a)redhat.com> Cc: Borislav Petkov (AMD) <bp(a)alien8.de> Cc: Christophe Leroy <christophe.leroy(a)csgroup.eu> Cc: Dave Hansen <dave.hansen(a)linux.intel.com> Cc: Dave Young <dyoung(a)redhat.com> Cc: Eric W. Biederman <ebiederm(a)xmission.com> Cc: "H. Peter Anvin" <hpa(a)zytor.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Michael Ellerman <mpe(a)ellerman.id.au> Cc: Nathan Chancellor <nathan(a)kernel.org> Cc: Nicholas Piggin <npiggin(a)gmail.com> Cc: Nick Desaulniers <ndesaulniers(a)google.com> Cc: Palmer Dabbelt <palmer(a)dabbelt.com> Cc: Paul Walmsley <paul.walmsley(a)sifive.com> Cc: Philipp Rudo <prudo(a)redhat.com> Cc: Ross Zwisler <zwisler(a)google.com> Cc: Simon Horman <horms(a)kernel.org> Cc: Steven Rostedt (Google) <rostedt(a)goodmis.org> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: Tom Rix <trix(a)redhat.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- arch/riscv/purgatory/Makefile | 5 +++++ 1 file changed, 5 insertions(+) --- a/arch/riscv/purgatory/Makefile~riscv-purgatory-remove-pgo-flags +++ a/arch/riscv/purgatory/Makefile @@ -35,6 +35,11 @@ CFLAGS_sha256.o := -D__DISABLE_EXPORTS CFLAGS_string.o := -D__DISABLE_EXPORTS CFLAGS_ctype.o := -D__DISABLE_EXPORTS +# When profile-guided optimization is enabled, llvm emits two different +# overlapping text sections, which is not supported by kexec. Remove profile +# optimization flags. +KBUILD_CFLAGS := $(filter-out -fprofile-sample-use=% -fprofile-use=%,$(KBUILD_CFLAGS)) + # When linking purgatory.ro with -r unresolved symbols are not checked, # also link a purgatory.chk binary without -r to check for unresolved symbols. PURGATORY_LDFLAGS := -e purgatory_start -z nodefaultlib _ Patches currently in -mm which might be from ribalda(a)chromium.org are

1 year, 6 months

1
0
0 0

[merged mm-hotfixes-stable] powerpc-purgatory-remove-pgo-flags.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: powerpc/purgatory: remove PGO flags has been removed from the -mm tree. Its filename was powerpc-purgatory-remove-pgo-flags.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Ricardo Ribalda <ribalda(a)chromium.org> Subject: powerpc/purgatory: remove PGO flags Date: Fri, 19 May 2023 16:47:38 +0200 If profile-guided optimization is enabled, the purgatory ends up with multiple .text sections. This is not supported by kexec and crashes the system. Link: https://lkml.kernel.org/r/20230321-kexec_clang16-v7-3-b05c520b7296@chromium… Fixes: 930457057abe ("kernel/kexec_file.c: split up __kexec_load_puragory") Signed-off-by: Ricardo Ribalda <ribalda(a)chromium.org> Cc: Michael Ellerman <mpe(a)ellerman.id.au> Cc: Nicholas Piggin <npiggin(a)gmail.com> Cc: Christophe Leroy <christophe.leroy(a)csgroup.eu> Cc: <stable(a)vger.kernel.org> Cc: Albert Ou <aou(a)eecs.berkeley.edu> Cc: Baoquan He <bhe(a)redhat.com> Cc: Borislav Petkov (AMD) <bp(a)alien8.de> Cc: Dave Hansen <dave.hansen(a)linux.intel.com> Cc: Dave Young <dyoung(a)redhat.com> Cc: Eric W. Biederman <ebiederm(a)xmission.com> Cc: "H. Peter Anvin" <hpa(a)zytor.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Nathan Chancellor <nathan(a)kernel.org> Cc: Nick Desaulniers <ndesaulniers(a)google.com> Cc: Palmer Dabbelt <palmer(a)dabbelt.com> Cc: Palmer Dabbelt <palmer(a)rivosinc.com> Cc: Paul Walmsley <paul.walmsley(a)sifive.com> Cc: Philipp Rudo <prudo(a)redhat.com> Cc: Ross Zwisler <zwisler(a)google.com> Cc: Simon Horman <horms(a)kernel.org> Cc: Steven Rostedt (Google) <rostedt(a)goodmis.org> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: Tom Rix <trix(a)redhat.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- arch/powerpc/purgatory/Makefile | 5 +++++ 1 file changed, 5 insertions(+) --- a/arch/powerpc/purgatory/Makefile~powerpc-purgatory-remove-pgo-flags +++ a/arch/powerpc/purgatory/Makefile @@ -5,6 +5,11 @@ KCSAN_SANITIZE := n targets += trampoline_$(BITS).o purgatory.ro +# When profile-guided optimization is enabled, llvm emits two different +# overlapping text sections, which is not supported by kexec. Remove profile +# optimization flags. +KBUILD_CFLAGS := $(filter-out -fprofile-sample-use=% -fprofile-use=%,$(KBUILD_CFLAGS)) + LDFLAGS_purgatory.ro := -e purgatory_start -r --no-undefined $(obj)/purgatory.ro: $(obj)/trampoline_$(BITS).o FORCE _ Patches currently in -mm which might be from ribalda(a)chromium.org are

1 year, 6 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror June 2023