A few commits from Yu Zhao have been merged into 6.12.
They need to be backported to 6.11.
- c2a967f6ab0ec ("mm/hugetlb_vmemmap: don't synchronize_rcu() without HVO")
- 95599ef684d01 ("mm/codetag: fix pgalloc_tag_split()")
- e0a955bf7f61c ("mm/codetag: add pgalloc_tag_copy()")
---
Changes in v2:
- Add signed off tag
- Link to v1: https://lore.kernel.org/r/20241017-stable-yuzhao-v1-0-3a4566660d44@kernel.o…
---
Yu Zhao (3):
mm/hugetlb_vmemmap: don't synchronize_rcu() without HVO
mm/codetag: fix pgalloc_tag_split()
mm/codetag: add pgalloc_tag_copy()
include/linux/alloc_tag.h | 24 ++++++++-----------
include/linux/mm.h | 57 +++++++++++++++++++++++++++++++++++++++++++++
include/linux/pgalloc_tag.h | 31 ------------------------
mm/huge_memory.c | 2 +-
mm/hugetlb_vmemmap.c | 40 +++++++++++++++----------------
mm/migrate.c | 1 +
mm/page_alloc.c | 4 ++--
7 files changed, 91 insertions(+), 68 deletions(-)
---
base-commit: 8e24a758d14c0b1cd42ab0aea980a1030eea811f
change-id: 20241016-stable-yuzhao-7779910482e8
Best regards,
--
Chris Li <chrisl(a)kernel.org>
commit 3c12466b6b7bf1e56f9b32c366a3d83d87afb4de upstream.
Currently EROFS can map another compressed buffer for inplace
decompression, that was used to handle the cases that some pages of
compressed data are actually not in-place I/O.
However, like most simple LZ77 algorithms, LZ4 expects the compressed
data is arranged at the end of the decompressed buffer and it
explicitly uses memmove() to handle overlapping:
__________________________________________________________
|_ direction of decompression --> ____ |_ compressed data _|
Although EROFS arranges compressed data like this, it typically maps two
individual virtual buffers so the relative order is uncertain.
Previously, it was hardly observed since LZ4 only uses memmove() for
short overlapped literals and x86/arm64 memmove implementations seem to
completely cover it up and they don't have this issue. Juhyung reported
that EROFS data corruption can be found on a new Intel x86 processor.
After some analysis, it seems that recent x86 processors with the new
FSRM feature expose this issue with "rep movsb".
Let's strictly use the decompressed buffer for lz4 inplace
decompression for now. Later, as an useful improvement, we could try
to tie up these two buffers together in the correct order.
Reported-and-tested-by: Juhyung Park <qkrwngud825(a)gmail.com>
Closes: https://lore.kernel.org/r/CAD14+f2AVKf8Fa2OO1aAUdDNTDsVzzR6ctU_oJSmTyd6zSYR…
Fixes: 0ffd71bcc3a0 ("staging: erofs: introduce LZ4 decompression inplace")
Fixes: 598162d05080 ("erofs: support decompress big pcluster for lz4 backend")
Cc: stable <stable(a)vger.kernel.org> # 5.4+
Tested-by: Yifan Zhao <zhaoyifan(a)sjtu.edu.cn>
Link: https://lore.kernel.org/r/20231206045534.3920847-1-hsiangkao@linux.alibaba.…
Signed-off-by: Gao Xiang <hsiangkao(a)linux.alibaba.com>
---
The remaining stable patch to address the issue "CVE-2023-52497" for
5.4.y, which is the same as the 5.10.y one [1].
[1] https://lore.kernel.org/r/20240224063248.2157885-1-hsiangkao@linux.alibaba.…
fs/erofs/decompressor.c | 24 ++++++++++++++----------
1 file changed, 14 insertions(+), 10 deletions(-)
diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c
index 38eeec5e3032..d06a3b77fb39 100644
--- a/fs/erofs/decompressor.c
+++ b/fs/erofs/decompressor.c
@@ -24,7 +24,8 @@ struct z_erofs_decompressor {
*/
int (*prepare_destpages)(struct z_erofs_decompress_req *rq,
struct list_head *pagepool);
- int (*decompress)(struct z_erofs_decompress_req *rq, u8 *out);
+ int (*decompress)(struct z_erofs_decompress_req *rq, u8 *out,
+ u8 *obase);
char *name;
};
@@ -114,10 +115,13 @@ static void *generic_copy_inplace_data(struct z_erofs_decompress_req *rq,
return tmp;
}
-static int z_erofs_lz4_decompress(struct z_erofs_decompress_req *rq, u8 *out)
+static int z_erofs_lz4_decompress(struct z_erofs_decompress_req *rq, u8 *out,
+ u8 *obase)
{
+ const uint nrpages_out = PAGE_ALIGN(rq->pageofs_out +
+ rq->outputsize) >> PAGE_SHIFT;
unsigned int inputmargin, inlen;
- u8 *src;
+ u8 *src, *src2;
bool copied, support_0padding;
int ret;
@@ -125,6 +129,7 @@ static int z_erofs_lz4_decompress(struct z_erofs_decompress_req *rq, u8 *out)
return -EOPNOTSUPP;
src = kmap_atomic(*rq->in);
+ src2 = src;
inputmargin = 0;
support_0padding = false;
@@ -148,16 +153,15 @@ static int z_erofs_lz4_decompress(struct z_erofs_decompress_req *rq, u8 *out)
if (rq->inplace_io) {
const uint oend = (rq->pageofs_out +
rq->outputsize) & ~PAGE_MASK;
- const uint nr = PAGE_ALIGN(rq->pageofs_out +
- rq->outputsize) >> PAGE_SHIFT;
-
if (rq->partial_decoding || !support_0padding ||
- rq->out[nr - 1] != rq->in[0] ||
+ rq->out[nrpages_out - 1] != rq->in[0] ||
rq->inputsize - oend <
LZ4_DECOMPRESS_INPLACE_MARGIN(inlen)) {
src = generic_copy_inplace_data(rq, src, inputmargin);
inputmargin = 0;
copied = true;
+ } else {
+ src = obase + ((nrpages_out - 1) << PAGE_SHIFT);
}
}
@@ -178,7 +182,7 @@ static int z_erofs_lz4_decompress(struct z_erofs_decompress_req *rq, u8 *out)
if (copied)
erofs_put_pcpubuf(src);
else
- kunmap_atomic(src);
+ kunmap_atomic(src2);
return ret;
}
@@ -248,7 +252,7 @@ static int z_erofs_decompress_generic(struct z_erofs_decompress_req *rq,
return PTR_ERR(dst);
rq->inplace_io = false;
- ret = alg->decompress(rq, dst);
+ ret = alg->decompress(rq, dst, NULL);
if (!ret)
copy_from_pcpubuf(rq->out, dst, rq->pageofs_out,
rq->outputsize);
@@ -282,7 +286,7 @@ static int z_erofs_decompress_generic(struct z_erofs_decompress_req *rq,
dst_maptype = 2;
dstmap_out:
- ret = alg->decompress(rq, dst + rq->pageofs_out);
+ ret = alg->decompress(rq, dst + rq->pageofs_out, dst);
if (!dst_maptype)
kunmap_atomic(dst);
--
2.43.5
Greg recently reported 2 patches that could not be applied without
conflicts in v5.10:
- e32d262c89e2 ("mptcp: handle consistently DSS corruption")
- 4dabcdf58121 ("tcp: fix mptcp DSS corruption due to large pmtu xmit")
Conflicts have been resolved, and documented in each patch.
One extra commit has been backported, to support allow_infinite_fallback
which is used by one commit from the list above:
- 0530020a7c8f ("mptcp: track and update contiguous data status")
Geliang Tang (1):
mptcp: track and update contiguous data status
Paolo Abeni (2):
mptcp: handle consistently DSS corruption
tcp: fix mptcp DSS corruption due to large pmtu xmit
net/ipv4/tcp_output.c | 2 +-
net/mptcp/mib.c | 2 ++
net/mptcp/mib.h | 2 ++
net/mptcp/protocol.c | 26 ++++++++++++++++++++++----
net/mptcp/protocol.h | 1 +
net/mptcp/subflow.c | 3 ++-
6 files changed, 30 insertions(+), 6 deletions(-)
--
2.45.2
Greg recently reported 6 patches that could not be applied without
conflicts in v5.15:
- e32d262c89e2 ("mptcp: handle consistently DSS corruption")
- 4dabcdf58121 ("tcp: fix mptcp DSS corruption due to large pmtu xmit")
- 119d51e225fe ("mptcp: fallback when MPTCP opts are dropped after 1st
data")
- 7decd1f5904a ("mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow")
- 3d041393ea8c ("mptcp: prevent MPC handshake on port-based signal
endpoints")
- 5afca7e996c4 ("selftests: mptcp: join: test for prohibited MPC to
port-based endp")
Conflicts have been resolved for the 5 first ones, and documented in
each patch.
The last patch has not been backported: this is an extra test for the
selftests validating the previous commit, and there are a lot of
conflicts. That's fine not to backport this test, it is still possible
to use the selftests from a newer version and run them on this older
kernel.
One extra commit has been backported, to support allow_infinite_fallback
which is used by two commits from the list above:
- 0530020a7c8f ("mptcp: track and update contiguous data status")
Geliang Tang (1):
mptcp: track and update contiguous data status
Matthieu Baerts (NGI0) (2):
mptcp: fallback when MPTCP opts are dropped after 1st data
mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow
Paolo Abeni (3):
mptcp: handle consistently DSS corruption
tcp: fix mptcp DSS corruption due to large pmtu xmit
mptcp: prevent MPC handshake on port-based signal endpoints
net/ipv4/tcp_output.c | 2 +-
net/mptcp/mib.c | 3 +++
net/mptcp/mib.h | 3 +++
net/mptcp/pm_netlink.c | 3 ++-
net/mptcp/protocol.c | 23 ++++++++++++++++++++---
net/mptcp/protocol.h | 2 ++
net/mptcp/subflow.c | 19 ++++++++++++++++---
7 files changed, 47 insertions(+), 8 deletions(-)
--
2.45.2
Greg recently reported 3 patches that could not be applied without
conflicts in v6.1:
- 4dabcdf58121 ("tcp: fix mptcp DSS corruption due to large pmtu xmit")
- 3d041393ea8c ("mptcp: prevent MPC handshake on port-based signal
endpoints")
- 5afca7e996c4 ("selftests: mptcp: join: test for prohibited MPC to
port-based endp")
Conflicts have been resolved for the two first ones, and documented in
each patch.
The last patch has not been backported: this is an extra test for the
selftests validating the previous commit, and there are a lot of
conflicts. That's fine not to backport this test, it is still possible
to use the selftests from a newer version and run them on this older
kernel.
Paolo Abeni (2):
tcp: fix mptcp DSS corruption due to large pmtu xmit
mptcp: prevent MPC handshake on port-based signal endpoints
net/ipv4/tcp_output.c | 4 +---
net/mptcp/mib.c | 1 +
net/mptcp/mib.h | 1 +
net/mptcp/pm_netlink.c | 1 +
net/mptcp/protocol.h | 1 +
net/mptcp/subflow.c | 11 +++++++++++
6 files changed, 16 insertions(+), 3 deletions(-)
--
2.45.2
Greg recently reported 2 patches that could not be applied without
conflict in v6.6:
- 4dabcdf58121 ("tcp: fix mptcp DSS corruption due to large pmtu xmit")
- 5afca7e996c4 ("selftests: mptcp: join: test for prohibited MPC to
port-based endp")
Conflicts have been resolved, and documented in each patch.
Note that there are two extra patches:
- 8c6f6b4bb53a ("selftests: mptcp: join: change capture/checksum as
bool"): to avoid some conflicts
- "selftests: mptcp: remove duplicated variables": a dedicated patch
for v6.6, to fix some previous backport issues.
Geliang Tang (1):
selftests: mptcp: join: change capture/checksum as bool
Matthieu Baerts (NGI0) (1):
selftests: mptcp: remove duplicated variables
Paolo Abeni (2):
tcp: fix mptcp DSS corruption due to large pmtu xmit
selftests: mptcp: join: test for prohibited MPC to port-based endp
net/ipv4/tcp_output.c | 4 +-
.../testing/selftests/net/mptcp/mptcp_join.sh | 135 ++++++++++++------
.../testing/selftests/net/mptcp/mptcp_lib.sh | 11 --
3 files changed, 96 insertions(+), 54 deletions(-)
--
2.45.2