November 2020 - Kernel - mailweb.openeuler.org

[PATCH 1/3] mm: madvise: fix vma user-after-free
by Yang Yingliang 16 Nov '20

16 Nov '20

From: Yang Shi <shy828301(a)gmail.com> mainline inclusion from mainline-v5.9-rc4 commit 7867fd7cc44e63c6673cd0f8fea155456d34d0de category: bugfix bugzilla: 42216 CVE: NA ------------------------------------------------- The syzbot reported the below use-after-free: BUG: KASAN: use-after-free in madvise_willneed mm/madvise.c:293 [inline] BUG: KASAN: use-after-free in madvise_vma mm/madvise.c:942 [inline] BUG: KASAN: use-after-free in do_madvise.part.0+0x1c8b/0x1cf0 mm/madvise.c:1145 Read of size 8 at addr ffff8880a6163eb0 by task syz-executor.0/9996 CPU: 0 PID: 9996 Comm: syz-executor.0 Not tainted 5.9.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x18f/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 madvise_willneed mm/madvise.c:293 [inline] madvise_vma mm/madvise.c:942 [inline] do_madvise.part.0+0x1c8b/0x1cf0 mm/madvise.c:1145 do_madvise mm/madvise.c:1169 [inline] __do_sys_madvise mm/madvise.c:1171 [inline] __se_sys_madvise mm/madvise.c:1169 [inline] __x64_sys_madvise+0xd9/0x110 mm/madvise.c:1169 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Allocated by task 9992: kmem_cache_alloc+0x138/0x3a0 mm/slab.c:3482 vm_area_alloc+0x1c/0x110 kernel/fork.c:347 mmap_region+0x8e5/0x1780 mm/mmap.c:1743 do_mmap+0xcf9/0x11d0 mm/mmap.c:1545 vm_mmap_pgoff+0x195/0x200 mm/util.c:506 ksys_mmap_pgoff+0x43a/0x560 mm/mmap.c:1596 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 9992: kmem_cache_free.part.0+0x67/0x1f0 mm/slab.c:3693 remove_vma+0x132/0x170 mm/mmap.c:184 remove_vma_list mm/mmap.c:2613 [inline] __do_munmap+0x743/0x1170 mm/mmap.c:2869 do_munmap mm/mmap.c:2877 [inline] mmap_region+0x257/0x1780 mm/mmap.c:1716 do_mmap+0xcf9/0x11d0 mm/mmap.c:1545 vm_mmap_pgoff+0x195/0x200 mm/util.c:506 ksys_mmap_pgoff+0x43a/0x560 mm/mmap.c:1596 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 It is because vma is accessed after releasing mmap_lock, but someone else acquired the mmap_lock and the vma is gone. Releasing mmap_lock after accessing vma should fix the problem. Fixes: 692fe62433d4c ("mm: Handle MADV_WILLNEED through vfs_fadvise()") Reported-by: syzbot+b90df26038d1d5d85c97(a)syzkaller.appspotmail.com Signed-off-by: Yang Shi <shy828301(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org> Reviewed-by: Jan Kara <jack(a)suse.cz> Cc: <stable(a)vger.kernel.org> [5.4+] Link: https://lkml.kernel.org/r/20200816141204.162624-1-shy828301@gmail.com Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/madvise.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/madvise.c b/mm/madvise.c index 464282e24a30..1369e6d062bc 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -308,9 +308,9 @@ static long madvise_willneed(struct vm_area_struct *vma, */ *prev = NULL; /* tell sys_madvise we drop mmap_sem */ get_file(file); - up_read(&current->mm->mmap_sem); offset = (loff_t)(start - vma->vm_start) + ((loff_t)vma->vm_pgoff << PAGE_SHIFT); + up_read(&current->mm->mmap_sem); vfs_fadvise(file, offset, end - start, POSIX_FADV_WILLNEED); fput(file); down_read(&current->mm->mmap_sem); -- 2.25.1

1 2

[PATCH 000/174] backport stable-4.19.155
by Yang Yingliang 16 Nov '20

16 Nov '20

Alain Volmat (1): cpufreq: sti-cpufreq: add stih418 support Aleksandr Nogikh (1): netem: fix zero division in tabledist Alex Hung (1): ACPI: video: use ACPI backlight for HP 635 Notebook Alexander Sverdlin (2): staging: octeon: repair "fixed-link" support staging: octeon: Drop on uncorrectable alignment or FCS error Alok Prasad (1): RDMA/qedr: Fix memory leak in iWARP CM Amit Cohen (1): mlxsw: core: Fix use-after-free in mlxsw_emad_trans_finish() Anand Jain (2): btrfs: fix replace of seed device btrfs: improve device scanning messages Anant Thazhemadam (2): net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid gfs2: add validation checks for size of superblock Andrew Donnellan (1): powerpc/rtas: Restrict RTAS requests from userspace Andrew Gabbasov (1): ravb: Fix bit fields checking in ravb_hwtstamp_get() Andy Shevchenko (2): device property: Keep secondary firmware node secondary by type device property: Don't clear secondary pointer for shared primary firmware node Aneesh Kumar K.V (1): powerpc/drmem: Make lmb_size 64 bit Antonio Borneo (1): drm/bridge/synopsys: dsi: add support for non-continuous HS clock Arjun Roy (1): tcp: Prevent low rmem stalls with SO_RCVLOWAT. Ashish Sangwan (1): NFS: fix nfs_path in case of a rename retry Badhri Jagan Sridharan (1): usb: typec: tcpm: During PR_SWAP, source caps should be sent only after tSwapSourceStart Bartosz Golaszewski (1): rtc: rx8010: don't modify the global rtc ops Ben Hutchings (1): ACPI / extlog: Check for RDMSR failure Chao Leng (1): nvme-rdma: fix crash when connect rejected Chao Yu (2): f2fs: fix uninit-value in f2fs_lookup f2fs: fix to check segment boundary during SIT page readahead Chris Lew (1): rpmsg: glink: Use complete_all for open states Chris Wilson (1): drm/i915: Force VT'd workarounds when running as a guest OS Chuck Lever (1): NFSD: Add missing NFSv2 .pc_func methods Dan Carpenter (1): memory: emif: Remove bogus debugfs error handling Daniel W. S. Almeida (1): media: uvcvideo: Fix dereference of out-of-bound list iterator Darrick J. Wong (2): xfs: fix realtime bitmap/summary file truncation when growing rt volume xfs: don't free rt blocks when we're doing a REMAP bunmapi call Dave Airlie (1): drm/ttm: fix eviction valuable range check. Denis Efremov (1): btrfs: use kvzalloc() to allocate clone_roots in btrfs_ioctl_send() Diana Craciun (1): bus/fsl_mc: Do not rely on caller to provide non NULL mc_io Dinghao Liu (1): ext4: fix error handling code in add_new_gdb Douglas Anderson (2): ARM: 8997/2: hw_breakpoint: Handle inexact watchpoint addresses kgdb: Make "kgdbcon" work properly with "kgdb_earlycon" Douglas Gilbert (1): sgl_alloc_order: fix memory leak Eric Biggers (7): fscrypt: return -EXDEV for incompatible rename or link into encrypted dir fscrypt: clean up and improve dentry revalidation fscrypt: fix race allowing rename() and link() of ciphertext dentries fs, fscrypt: clear DCACHE_ENCRYPTED_NAME when unaliasing directory fscrypt: only set dentry_operations on ciphertext dentries fscrypt: fix race where ->lookup() marks plaintext dentry as ciphertext ext4: fix leaking sysfs kobject after failed mount Fangzhi Zuo (1): drm/amd/display: HDMI remote sink need mode validation for Linux Filipe Manana (3): btrfs: reschedule if necessary when logging directory items btrfs: send, recompute reference path after orphanization of a directory btrfs: fix use-after-free on readahead extent after failure to create it Frank Wunderlich (1): arm: dts: mt7623: add missing pause for switchport Frederic Barrat (1): cxl: Rework error message for incompatible slots Geert Uytterhoeven (1): ata: sata_rcar: Fix DMA boundary mask Greg Kroah-Hartman (2): Revert "block: ratelimit handle_bad_sector() message" Linux 4.19.155 Gustavo A. R. Silva (1): mtd: lpddr: Fix bad logic in print_drs_error Hans Verkuil (2): media: videodev2.h: RGB BT2020 and HSV are always full range media: imx274: fix frame interval handling Hans de Goede (1): media: uvcvideo: Fix uvc_ctrl_fixup_xu_info() not having any effect Heiner Kallweit (1): r8169: fix issue with forced threading in combination with shared interrupts Helge Deller (2): scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove() hil/parisc: Disable HIL driver when it gets stuck Ian Abbott (1): staging: comedi: cb_pcidas: Allow 2-channel commands for AO subdevice Ido Schimmel (1): mlxsw: core: Fix memory leak on module removal Ilya Dryomov (1): libceph: clear con->out_msg on Policy::stateful_server faults Jamie Iles (1): ACPI: debug: don't allow debugging when ACPI is disabled Jan Kara (2): ext4: Detect already used quota file early udf: Fix memory leak when mounting Jason Gerecke (1): HID: wacom: Avoid entering wacom_wac_pen_report for pad / battery Jason Gunthorpe (1): RDMA/addr: Fix race with netevent_callback()/rdma_addr_cancel() Jerome Brunet (1): usb: cdc-acm: fix cooldown mechanism Jia-Ju Bai (1): p54: avoid accessing the data mapped to streaming DMA Jiri Olsa (1): perf python scripting: Fix printable strings in python3 scripts Jiri Slaby (1): x86/unwind/orc: Fix inactive tasks with stack pointer in %sp on GCC 10 compiled kernels Jisheng Zhang (1): arm64: berlin: Select DW_APB_TIMER_OF Joel Stanley (1): powerpc: Warn about use of smt_snooze_delay Johannes Berg (1): um: change sigio_spinlock to a mutex John Ogness (1): printk: reduce LOG_BUF_SHIFT range for H8300 Jonathan Cameron (5): ACPI: Add out of bounds and numa_off protections to pxm_to_node() iio:light:si1145: Fix timestamp alignment and prevent data leak. iio:adc:ti-adc0832 Fix alignment issue with timestamp iio:adc:ti-adc12138 Fix alignment issue with timestamp iio:gyro:itg3200: Fix timestamp alignment and prevent data leak. Josef Bacik (1): btrfs: cleanup cow block on error Josh Poimboeuf (1): objtool: Support Clang non-section symbols in ORC generation Juergen Gross (2): x86/xen: disable Firmware First mode for correctable memory errors xen/events: block rogue events for some time Kim Phillips (3): arch/x86/amd/ibs: Fix re-arming IBS Fetch perf/x86/amd/ibs: Don't include randomized bits in get_ibs_op_count() perf/x86/amd/ibs: Fix raw sample data accumulation Krzysztof Kozlowski (8): power: supply: bq27xxx: report "not charging" on all types ARM: dts: s5pv210: remove DMA controller bus node name to fix dtschema warnings ARM: dts: s5pv210: move PMU node out of clock controller ARM: dts: s5pv210: remove dedicated 'audio-subsystem' node ia64: fix build error with !COREDUMP i2c: imx: Fix external abort on interrupt in exit paths ARM: samsung: fix PM debug build with DEBUG_LL but !MMU ARM: s3c24xx: fix missing system reset Lang Dai (1): uio: free uio id after uio file node is freed Li Jun (3): usb: dwc3: core: add phy cleanup for probe error handling usb: dwc3: core: don't trigger runtime pm when remove driver usb: typec: tcpm: reset hard_reset_count for any disconnect Luo Meng (1): ext4: fix invalid inode checksum Madhav Chauhan (1): drm/amdgpu: don't map BO in reserved region Madhuparna Bhowmik (2): mmc: via-sdmmc: Fix data race bug drivers: watchdog: rdc321x_wdt: Fix race condition bugs Mahesh Salgaonkar (1): powerpc/powernv/elog: Fix race while processing OPAL error log event. Marc Zyngier (2): arm64: Run ARCH_WORKAROUND_1 enabling code on all CPUs KVM: arm64: Fix AArch32 handling of DBGD{CCINT, SCRext} and DBGVCR Marek Behún (1): leds: bcm6328, bcm6358: use devres LED registering function Martin Fuzzey (1): w1: mxc_w1: Fix timeout resolution problem leading to bus error Masahiro Fujiwara (1): gtp: fix an use-before-init in gtp_newlink() Masami Hiramatsu (1): ia64: kprobes: Use generic kretprobe trampoline handler Mateusz Nosek (1): futex: Fix incorrect should_fail_futex() handling Matthew Wilcox (Oracle) (3): ceph: promote to unsigned long long before shifting 9P: Cast to loff_t before multiplying cachefiles: Handle readpage error correctly Michael Chan (1): bnxt_en: Log unknown link speed appropriately. Michael Neuling (1): powerpc: Fix undetected data corruption with P9N DD2.1 VSX CI load emulation Michael Schaller (1): efivarfs: Replace invalid slashes with exclamation marks in dentries. Miklos Szeredi (1): fuse: fix page dereference after free Nadezda Lutovinova (1): drm/brige/megachips: Add checking if ge_b850v3_lvds_init() is working correctly Nicholas Piggin (3): mm: fix exec activate_mm vs TLB shootdown and lazy tlb switching race powerpc: select ARCH_WANT_IRQS_OFF_ACTIVATE_MM sparc64: remove mm_cpumask clearing to fix kthread_use_mm race Nick Desaulniers (1): arm64: link with -z norelro regardless of CONFIG_RELOCATABLE Olga Kornievskaia (1): NFSv4.2: support EXCHGID4_FLAG_SUPP_FENCE_OPS 4.2 EXCHANGE_ID flag Oliver Neukum (1): USB: adutux: fix debugging Oliver O'Halloran (1): powerpc/powernv/smp: Fix spurious DBG() warning Paul Cercueil (1): dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status Peter Chen (1): usb: xhci: omit duplicate actions when suspending a runtime suspended host. Peter Zijlstra (1): serial: pl011: Fix lockdep splat when handling magic-sysrq interrupt Qiujun Huang (1): ring-buffer: Return 0 on success from ring_buffer_resize() Qu Wenruo (1): btrfs: qgroup: fix wrong qgroup metadata reserve for delayed inode Quinn Tran (1): scsi: qla2xxx: Fix crash on session cleanup with unload Raju Rangoju (1): cxgb4: set up filter action after rewrites Ran Wang (1): usb: host: fsl-mph-dr-of: check return of dma_set_mask() Randy Dunlap (1): x86/PCI: Fix intel_mid_pci.c build error when ACPI is not enabled Rasmus Villemoes (1): scripts/setlocalversion: make git describe output more reliable Raul E Rangel (1): mmc: sdhci-acpi: AMDI0040: Set SDHCI_QUIRK2_PRESET_VALUE_BROKEN Ronnie Sahlberg (1): cifs: handle -EINTR in cifs_setattr Sandeep Singh (1): usb: xhci: Workaround for S3 issue on AMD SNPS 3.0 xHC Sascha Hauer (1): ata: sata_nv: Fix retrieving of active qcs Sathishkumar Muruganandam (1): ath10k: fix VHT NSS calculation when STBC is enabled Song Liu (2): bpf: Fix comment for helper bpf_current_task_under_cgroup() md/raid5: fix oops during stripe resizing Stefano Garzarella (1): vringh: fix __vringh_iov() when riov and wiov are different Sven Schnelle (1): s390/stp: add locking to sysfs functions Takashi Iwai (1): drm/amd/display: Don't invoke kgdb_breakpoint() unconditionally Tero Kristo (1): clk: ti: clockdomain: fix static checker warning Thinh Nguyen (2): usb: dwc3: ep0: Fix ZLP for OUT ep0 requests usb: dwc3: gadget: Check MPS of the request length Tom Rix (2): video: fbdev: pvr2fb: initialize variables media: tw5864: check status of tw5864_frameinterval_get Tony Lindgren (1): ARM: dts: omap4: Fix sgx clock rate for 4430 Tung Nguyen (1): tipc: fix memory leak caused by tipc_buf_append() Valentin Schneider (1): arm64: topology: Stop using MPIDR for topology information Vinay Kumar Yadav (3): chelsio/chtls: fix deadlock issue chelsio/chtls: fix memory leaks in CPL handlers chelsio/chtls: fix tls record info to user Wei Huang (1): acpi-cpufreq: Honor _PSD table setting on new AMD CPUs Wen Gong (1): ath10k: start recovery process when payload length exceeds max htc length for sdio Xia Jiang (1): media: platform: Improve queue set up flow for bug fixing Xie He (1): drivers/net/wan/hdlc_fr: Correctly handle special skb->protocol values Xiongfeng Wang (1): power: supply: test_power: add missing newlines when printing parameters by sysfs Xiubo Li (1): nbd: make the config put is called before the notifying the waiter Yoshihiro Shimoda (1): arm64: dts: renesas: ulcb: add full-pwr-cycle-in-suspend into eMMC nodes Zhang Qilong (1): f2fs: add trace exit in exception path Zhao Heming (1): md/bitmap: md_bitmap_get_counter returns wrong blocks Zhengyuan Liu (1): arm64/mm: return cpu_all_mask when node is NUMA_NO_NODE Zhihao Cheng (2): ubifs: dent: Fix some potential memory leaks while iterating entries ubi: check kthread_should_stop() after the setting of task state Zong Li (1): riscv: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO dmitry.torokhov(a)gmail.com (1): ACPI: button: fix handling lid state changes when input device closed Documentation/filesystems/fscrypt.rst | 12 +- .../media/uapi/v4l/colorspaces-defs.rst | 9 +- .../media/uapi/v4l/colorspaces-details.rst | 5 +- Makefile | 2 +- arch/Kconfig | 7 + arch/arm/Kconfig | 2 + arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts | 1 + arch/arm/boot/dts/omap4.dtsi | 2 +- arch/arm/boot/dts/omap443x.dtsi | 10 ++ arch/arm/boot/dts/s5pv210.dtsi | 127 +++++++-------- arch/arm/kernel/hw_breakpoint.c | 100 ++++++++---- arch/arm/plat-samsung/Kconfig | 1 + arch/arm64/Kconfig.platforms | 1 + arch/arm64/Makefile | 4 +- arch/arm64/boot/dts/renesas/ulcb.dtsi | 1 + arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/include/asm/numa.h | 3 + arch/arm64/kernel/cpu_errata.c | 8 + arch/arm64/kernel/topology.c | 43 ++--- arch/arm64/kvm/sys_regs.c | 6 +- arch/arm64/mm/numa.c | 6 +- arch/ia64/kernel/Makefile | 2 +- arch/ia64/kernel/kprobes.c | 77 +-------- arch/powerpc/Kconfig | 14 ++ arch/powerpc/include/asm/drmem.h | 4 +- arch/powerpc/include/asm/mmu_context.h | 2 +- arch/powerpc/kernel/rtas.c | 153 ++++++++++++++++++ arch/powerpc/kernel/sysfs.c | 42 ++--- arch/powerpc/kernel/traps.c | 2 +- arch/powerpc/platforms/powernv/opal-elog.c | 33 +++- arch/powerpc/platforms/powernv/smp.c | 2 +- arch/riscv/include/uapi/asm/auxvec.h | 3 + arch/s390/kernel/time.c | 118 ++++++++++---- arch/sparc/kernel/smp_64.c | 65 ++------ arch/um/kernel/sigio.c | 6 +- arch/x86/events/amd/ibs.c | 53 ++++-- arch/x86/include/asm/msr-index.h | 1 + arch/x86/kernel/unwind_orc.c | 9 +- arch/x86/pci/intel_mid_pci.c | 1 + arch/x86/xen/enlighten_pv.c | 9 ++ block/blk-core.c | 9 +- drivers/acpi/acpi_dbg.c | 3 + drivers/acpi/acpi_extlog.c | 6 +- drivers/acpi/button.c | 13 +- drivers/acpi/numa.c | 2 +- drivers/acpi/video_detect.c | 9 ++ drivers/ata/sata_nv.c | 2 +- drivers/ata/sata_rcar.c | 2 +- drivers/base/core.c | 4 +- drivers/block/nbd.c | 2 +- drivers/bus/fsl-mc/mc-io.c | 7 +- drivers/clk/ti/clockdomain.c | 2 + drivers/cpufreq/acpi-cpufreq.c | 3 +- drivers/cpufreq/sti-cpufreq.c | 6 +- drivers/crypto/chelsio/chtls/chtls_cm.c | 29 ++-- drivers/crypto/chelsio/chtls/chtls_io.c | 7 +- drivers/dma/dma-jz4780.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 10 ++ drivers/gpu/drm/amd/display/dc/core/dc_link.c | 2 +- drivers/gpu/drm/amd/display/dc/os_types.h | 2 +- .../bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 12 +- drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c | 9 +- drivers/gpu/drm/i915/i915_drv.h | 6 +- drivers/gpu/drm/ttm/ttm_bo.c | 2 +- drivers/hid/wacom_wac.c | 4 +- drivers/i2c/busses/i2c-imx.c | 24 +-- drivers/iio/adc/ti-adc0832.c | 11 +- drivers/iio/adc/ti-adc12138.c | 13 +- drivers/iio/gyro/itg3200_buffer.c | 15 +- drivers/iio/light/si1145.c | 19 ++- drivers/infiniband/core/addr.c | 11 +- drivers/infiniband/hw/qedr/qedr_iw_cm.c | 1 + drivers/input/serio/hil_mlc.c | 21 ++- drivers/input/serio/hp_sdc_mlc.c | 8 +- drivers/leds/leds-bcm6328.c | 2 +- drivers/leds/leds-bcm6358.c | 2 +- drivers/md/md-bitmap.c | 2 +- drivers/md/raid5.c | 4 +- drivers/media/i2c/imx274.c | 8 +- drivers/media/pci/tw5864/tw5864-video.c | 6 + .../media/platform/mtk-jpeg/mtk_jpeg_core.c | 7 + drivers/media/usb/uvc/uvc_ctrl.c | 27 ++-- drivers/memory/emif.c | 33 +--- drivers/message/fusion/mptscsih.c | 13 +- drivers/misc/cxl/pci.c | 4 +- drivers/mmc/host/sdhci-acpi.c | 37 +++++ drivers/mmc/host/via-sdmmc.c | 3 + drivers/mtd/ubi/wl.c | 13 ++ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 +- .../net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 56 ++++--- drivers/net/ethernet/chelsio/cxgb4/t4_tcb.h | 4 + drivers/net/ethernet/mellanox/mlxsw/core.c | 5 + drivers/net/ethernet/realtek/r8169.c | 4 +- drivers/net/ethernet/renesas/ravb_main.c | 10 +- drivers/net/gtp.c | 16 +- drivers/net/wan/hdlc_fr.c | 98 +++++------ drivers/net/wireless/ath/ath10k/htt_rx.c | 8 +- drivers/net/wireless/ath/ath10k/sdio.c | 4 + drivers/net/wireless/intersil/p54/p54pci.c | 4 +- drivers/nvme/host/rdma.c | 1 - drivers/power/supply/bq27xxx_battery.c | 6 +- drivers/power/supply/test_power.c | 6 + drivers/rpmsg/qcom_glink_native.c | 6 +- drivers/rtc/rtc-rx8010.c | 24 ++- drivers/scsi/qla2xxx/qla_target.c | 13 +- drivers/staging/comedi/drivers/cb_pcidas.c | 1 + drivers/staging/octeon/ethernet-mdio.c | 6 - drivers/staging/octeon/ethernet-rx.c | 34 ++-- drivers/staging/octeon/ethernet.c | 9 ++ drivers/tty/serial/amba-pl011.c | 11 +- drivers/uio/uio.c | 4 +- drivers/usb/class/cdc-acm.c | 12 +- drivers/usb/class/cdc-acm.h | 3 +- drivers/usb/dwc3/core.c | 15 +- drivers/usb/dwc3/ep0.c | 11 +- drivers/usb/dwc3/gadget.c | 4 +- drivers/usb/host/fsl-mph-dr-of.c | 9 +- drivers/usb/host/xhci-pci.c | 17 ++ drivers/usb/host/xhci.c | 7 +- drivers/usb/host/xhci.h | 1 + drivers/usb/misc/adutux.c | 1 + drivers/usb/typec/tcpm.c | 8 +- drivers/vhost/vringh.c | 9 +- drivers/video/fbdev/pvr2fb.c | 2 + drivers/w1/masters/mxc_w1.c | 14 +- drivers/watchdog/rdc321x_wdt.c | 5 +- drivers/xen/events/events_base.c | 27 +++- drivers/xen/events/events_internal.h | 3 +- fs/9p/vfs_file.c | 4 +- fs/btrfs/ctree.c | 6 + fs/btrfs/delayed-inode.c | 3 +- fs/btrfs/dev-replace.c | 2 +- fs/btrfs/reada.c | 2 + fs/btrfs/send.c | 74 ++++++++- fs/btrfs/tree-log.c | 8 + fs/btrfs/volumes.c | 14 +- fs/cachefiles/rdwr.c | 3 +- fs/ceph/addr.c | 2 +- fs/cifs/inode.c | 13 +- fs/crypto/crypto.c | 58 +++---- fs/crypto/fname.c | 1 + fs/crypto/hooks.c | 34 ++-- fs/crypto/policy.c | 3 +- fs/dcache.c | 15 ++ fs/efivarfs/super.c | 3 + fs/exec.c | 15 +- fs/ext4/ext4.h | 62 +++++-- fs/ext4/inode.c | 11 +- fs/ext4/namei.c | 76 ++++++--- fs/ext4/resize.c | 4 +- fs/ext4/super.c | 6 + fs/f2fs/checkpoint.c | 8 +- fs/f2fs/dir.c | 8 +- fs/f2fs/namei.c | 17 +- fs/fuse/dev.c | 28 ++-- fs/gfs2/ops_fstype.c | 18 ++- fs/nfs/namespace.c | 12 +- fs/nfs/nfs4proc.c | 9 +- fs/nfsd/nfsproc.c | 16 ++ fs/ubifs/debug.c | 1 + fs/ubifs/dir.c | 8 +- fs/udf/super.c | 21 ++- fs/xfs/libxfs/xfs_bmap.c | 19 ++- fs/xfs/xfs_rtalloc.c | 10 +- include/linux/dcache.h | 2 +- include/linux/fscrypt.h | 34 ++-- include/linux/fscrypt_notsupp.h | 9 +- include/linux/fscrypt_supp.h | 6 +- include/linux/hil_mlc.h | 2 +- include/linux/mtd/pfow.h | 2 +- include/linux/usb/pd.h | 1 + include/uapi/linux/bpf.h | 4 +- include/uapi/linux/nfs4.h | 3 + include/uapi/linux/videodev2.h | 17 +- init/Kconfig | 3 +- kernel/debug/debug_core.c | 22 ++- kernel/futex.c | 4 +- kernel/trace/ring_buffer.c | 8 +- lib/scatterlist.c | 2 +- net/9p/trans_fd.c | 2 +- net/ceph/messenger.c | 5 + net/ipv4/tcp.c | 2 + net/ipv4/tcp_input.c | 3 +- net/sched/sch_netem.c | 9 +- net/tipc/msg.c | 5 +- scripts/setlocalversion | 21 ++- tools/include/uapi/linux/bpf.h | 4 +- tools/objtool/orc_gen.c | 33 +++- tools/perf/util/print_binary.c | 2 +- 189 files changed, 1746 insertions(+), 928 deletions(-) -- 2.25.1

1 174

[PATCH 1/5] partitions/efi: Fix partition name parsing in GUID partition entry
by Yang Yingliang 16 Nov '20

16 Nov '20

From: Nikolai Merinov <n.merinov(a)inango-systems.com> mainline inclusion from mainline-5.7-rc1 commit d5528d5e91041e68e8eab9792ce627705a0ed273 category: bugfix bugzilla: 32454 CVE: NA --------------------------- GUID partition entry defined to have a partition name as 36 UTF-16LE code units. This means that on big-endian platforms ASCII symbols would be read with 0xXX00 efi_char16_t character code. In order to correctly extract ASCII characters from a partition name field we should be converted from 16LE to CPU architecture. The problem exists on all big endian platforms. [ mingo: Minor edits. ] Fixes: eec7ecfede74 ("genhd, efi: add efi partition metadata to hd_structs") Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Nikolai Merinov <n.merinov(a)inango-systems.com> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20200308080859.21568-29-ardb@kernel.org Link: https://lore.kernel.org/r/797777312.1324734.1582544319435.JavaMail.zimbra@i… Signed-off-by: yangerkun <yangerkun(a)huawei.com> Reviewed-by: Yufen Yu <yuyufen(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/partitions/efi.c | 35 ++++++++++++++++++++++++++--------- block/partitions/efi.h | 2 +- 2 files changed, 27 insertions(+), 10 deletions(-) diff --git a/block/partitions/efi.c b/block/partitions/efi.c index 39f70d968754..b9beaa0a9b36 100644 --- a/block/partitions/efi.c +++ b/block/partitions/efi.c @@ -670,6 +670,31 @@ static int find_valid_gpt(struct parsed_partitions *state, gpt_header **gpt, return 0; } +/** + * utf16_le_to_7bit(): Naively converts a UTF-16LE string to 7-bit ASCII characters + * @in: input UTF-16LE string + * @size: size of the input string + * @out: output string ptr, should be capable to store @size+1 characters + * + * Description: Converts @size UTF16-LE symbols from @in string to 7-bit + * ASCII characters and stores them to @out. Adds trailing zero to @out array. + */ +static void utf16_le_to_7bit(const __le16 *in, unsigned int size, u8 *out) +{ + unsigned int i = 0; + + out[size] = 0; + + while (i < size) { + u8 c = le16_to_cpu(in[i]) & 0xff; + + if (c && !isprint(c)) + c = '!'; + out[i] = c; + i++; + } +} + /** * efi_partition(struct parsed_partitions *state) * @state: disk parsed partitions @@ -706,7 +731,6 @@ int efi_partition(struct parsed_partitions *state) for (i = 0; i < le32_to_cpu(gpt->num_partition_entries) && i < state->limit-1; i++) { struct partition_meta_info *info; - unsigned label_count = 0; unsigned label_max; u64 start = le64_to_cpu(ptes[i].starting_lba); u64 size = le64_to_cpu(ptes[i].ending_lba) - @@ -727,14 +751,7 @@ int efi_partition(struct parsed_partitions *state) /* Naively convert UTF16-LE to 7 bits. */ label_max = min(ARRAY_SIZE(info->volname) - 1, ARRAY_SIZE(ptes[i].partition_name)); - info->volname[label_max] = 0; - while (label_count < label_max) { - u8 c = ptes[i].partition_name[label_count] & 0xff; - if (c && !isprint(c)) - c = '!'; - info->volname[label_count] = c; - label_count++; - } + utf16_le_to_7bit(ptes[i].partition_name, label_max, info->volname); state->parts[i + 1].has_info = true; } kfree(ptes); diff --git a/block/partitions/efi.h b/block/partitions/efi.h index abd0b19288a6..42db2513ecfa 100644 --- a/block/partitions/efi.h +++ b/block/partitions/efi.h @@ -102,7 +102,7 @@ typedef struct _gpt_entry { __le64 starting_lba; __le64 ending_lba; gpt_entry_attributes attributes; - efi_char16_t partition_name[72 / sizeof (efi_char16_t)]; + __le16 partition_name[72/sizeof(__le16)]; } __packed gpt_entry; typedef struct _gpt_mbr_record { -- 2.25.1

1 4

[PATCH 1/2] evm: Reset IMA flags if EVM ignore mode is selected
by Roberto Sassu 14 Nov '20

14 Nov '20

hulk inclusion category: feature feature: digest-lists --------------------------- The EVM ignore mode works similarly to the metadata modification mode. They both allow an operation to be performed even if the operation causes metadata to become invalid. Currently, evm_reset_status() notifies to IMA that an operation modified metadata only when the metadata modification mode was chosen. With this patch, evm_reset_status() does the same also when the EVM ignore mode is selected. Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com> --- security/integrity/evm/evm_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c index 5155ff4c4ef2..2d3c1670d8d3 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -570,7 +570,8 @@ static void evm_reset_status(struct inode *inode, int bit) iint = integrity_iint_find(inode); if (iint) { - if (evm_initialized & EVM_ALLOW_METADATA_WRITES) + if ((evm_initialized & EVM_ALLOW_METADATA_WRITES) || + evm_ignoremode) set_bit(bit, &iint->atomic_flags); iint->evm_status = INTEGRITY_UNKNOWN; -- 2.27.GIT

1 1

openEuler kernel sig meeting
by openEuler conference 13 Nov '20

13 Nov '20

2 3

[PATCH] tty: make FONTX ioctl use the tty pointer they were actually passed
by Yang Yingliang 05 Nov '20

05 Nov '20

From: Linus Torvalds <torvalds(a)linux-foundation.org> mainline inclusion from mainline-v5.10-rc3 commit 90bfdeef83f1d6c696039b6a917190dcbbad3220 category: bugfix bugzilla: NA CVE: CVE-2020-25668 -------------------------------- Some of the font tty ioctl's always used the current foreground VC for their operations. Don't do that then. This fixes a data race on fg_console. Side note: both Michael Ellerman and Jiri Slaby point out that all these ioctls are deprecated, and should probably have been removed long ago, and everything seems to be using the KDFONTOP ioctl instead. In fact, Michael points out that it looks like busybox's loadfont program seems to have switched over to using KDFONTOP exactly _because_ of this bug (ahem.. 12 years ago ;-). Reported-by: Minh Yuan <yuanmingbuaa(a)gmail.com> Acked-by: Michael Ellerman <mpe(a)ellerman.id.au> Acked-by: Jiri Slaby <jirislaby(a)kernel.org> Cc: Greg KH <greg(a)kroah.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Conflicts: drivers/tty/vt/vt_ioctl.c [yyl: There is no vt_io_fontreset(), change the vc_cons to vc in do_fontx_ioctl()] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/tty/vt/vt_ioctl.c | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c index 6a82030cf1ef..2e959563af53 100644 --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -244,7 +244,7 @@ int vt_waitactive(int n) static inline int -do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op) +do_fontx_ioctl(struct vc_data *vc, int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op) { struct consolefontdesc cfdarg; int i; @@ -262,15 +262,16 @@ do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struc op->height = cfdarg.charheight; op->charcount = cfdarg.charcount; op->data = cfdarg.chardata; - return con_font_op(vc_cons[fg_console].d, op); - case GIO_FONTX: { + return con_font_op(vc, op); + + case GIO_FONTX: op->op = KD_FONT_OP_GET; op->flags = KD_FONT_FLAG_OLD; op->width = 8; op->height = cfdarg.charheight; op->charcount = cfdarg.charcount; op->data = cfdarg.chardata; - i = con_font_op(vc_cons[fg_console].d, op); + i = con_font_op(vc, op); if (i) return i; cfdarg.charheight = op->height; @@ -278,7 +279,6 @@ do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struc if (copy_to_user(user_cfd, &cfdarg, sizeof(struct consolefontdesc))) return -EFAULT; return 0; - } } return -EINVAL; } @@ -924,7 +924,7 @@ int vt_ioctl(struct tty_struct *tty, op.height = 0; op.charcount = 256; op.data = up; - ret = con_font_op(vc_cons[fg_console].d, &op); + ret = con_font_op(vc, &op); break; } @@ -935,7 +935,7 @@ int vt_ioctl(struct tty_struct *tty, op.height = 32; op.charcount = 256; op.data = up; - ret = con_font_op(vc_cons[fg_console].d, &op); + ret = con_font_op(vc, &op); break; } @@ -952,7 +952,7 @@ int vt_ioctl(struct tty_struct *tty, case PIO_FONTX: case GIO_FONTX: - ret = do_fontx_ioctl(cmd, up, perm, &op); + ret = do_fontx_ioctl(vc, cmd, up, perm, &op); break; case PIO_FONTRESET: @@ -969,11 +969,11 @@ int vt_ioctl(struct tty_struct *tty, { op.op = KD_FONT_OP_SET_DEFAULT; op.data = NULL; - ret = con_font_op(vc_cons[fg_console].d, &op); + ret = con_font_op(vc, &op); if (ret) break; console_lock(); - con_set_default_unimap(vc_cons[fg_console].d); + con_set_default_unimap(vc); console_unlock(); break; } @@ -1100,8 +1100,9 @@ struct compat_consolefontdesc { }; static inline int -compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd, - int perm, struct console_font_op *op) +compat_fontx_ioctl(struct vc_data *vc, int cmd, + struct compat_consolefontdesc __user *user_cfd, + int perm, struct console_font_op *op) { struct compat_consolefontdesc cfdarg; int i; @@ -1119,7 +1120,8 @@ compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd, op->height = cfdarg.charheight; op->charcount = cfdarg.charcount; op->data = compat_ptr(cfdarg.chardata); - return con_font_op(vc_cons[fg_console].d, op); + return con_font_op(vc, op); + case GIO_FONTX: op->op = KD_FONT_OP_GET; op->flags = KD_FONT_FLAG_OLD; @@ -1127,7 +1129,7 @@ compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd, op->height = cfdarg.charheight; op->charcount = cfdarg.charcount; op->data = compat_ptr(cfdarg.chardata); - i = con_font_op(vc_cons[fg_console].d, op); + i = con_font_op(vc, op); if (i) return i; cfdarg.charheight = op->height; @@ -1218,7 +1220,7 @@ long vt_compat_ioctl(struct tty_struct *tty, */ case PIO_FONTX: case GIO_FONTX: - ret = compat_fontx_ioctl(cmd, up, perm, &op); + ret = compat_fontx_ioctl(vc, cmd, up, perm, &op); break; case KDFONTOP: -- 2.25.1

1 0

openEuler Summit 2020 来了，欢迎申报申报 Summit 议题
by Liyongle (Fred) 05 Nov '20

05 Nov '20

openEuler Summit 是由 openEuler 社区举办的开发者交流会，首届线下 openEuler Summit 将于 12 月24-25日在北京举行。 openEuler Summit 广泛邀请操作系统生态的开发者、用户、社区贡献者、软件爱好者共同解读 openEuler 的最新版，探讨未来的技术路线，让技术、生态、商业在这里产生奇妙的化学反应。开源是一种态度、分享是一种精神。Call for Speaker、Call for Sponsor、Call for SIG、Call for Demo 现已全面开放报名。我们诚挚的邀请您报名演讲、演示 Demo、发表案例、参与社区建设。期待您的到来。 [cid:image001.png@01D6B34F.EDA0B950] [cid:image002.png@01D6B34F.EDA0B950] [cid:image003.png@01D6B34F.EDA0B950] [cid:image004.png@01D6B34F.EDA0B950] Fred 李永乐

1 0

[PATCH 1/2] vt: keyboard, simplify vt_kdgkbsent
by Yang Yingliang 04 Nov '20

04 Nov '20

From: Jiri Slaby <jslaby(a)suse.cz> mainline inclusion from mainline-v5.10-rc2 commit 6ca03f90527e499dd5e32d6522909e2ad390896b category: bugfix bugzilla: NA CVE: CVE-2020-25656 -------------------------------- Use 'strlen' of the string, add one for NUL terminator and simply do 'copy_to_user' instead of the explicit 'for' loop. This makes the KDGKBSENT case more compact. The only thing we need to take care about is NULL 'func_table[i]'. Use an empty string in that case. The original check for overflow could never trigger as the func_buf strings are always shorter or equal to 'struct kbsentry's. Cc: <stable(a)vger.kernel.org> Signed-off-by: Jiri Slaby <jslaby(a)suse.cz> Link: https://lore.kernel.org/r/20201019085517.10176-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/tty/vt/keyboard.c | 28 +++++++++------------------- 1 file changed, 9 insertions(+), 19 deletions(-) diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index a7455f8a4235..56315d23f34e 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -1994,9 +1994,7 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) { struct kbsentry *kbs; - char *p; u_char *q; - u_char __user *up; int sz, fnw_sz; int delta; char *first_free, *fj, *fnw; @@ -2022,23 +2020,15 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) i = kbs->kb_func; switch (cmd) { - case KDGKBSENT: - sz = sizeof(kbs->kb_string) - 1; /* sz should have been - a struct member */ - up = user_kdgkb->kb_string; - p = func_table[i]; - if(p) - for ( ; *p && sz; p++, sz--) - if (put_user(*p, up++)) { - ret = -EFAULT; - goto reterr; - } - if (put_user('\0', up)) { - ret = -EFAULT; - goto reterr; - } - kfree(kbs); - return ((p && *p) ? -EOVERFLOW : 0); + case KDGKBSENT: { + /* size should have been a struct member */ + unsigned char *from = func_table[i] ? : ""; + + ret = copy_to_user(user_kdgkb->kb_string, from, + strlen(from) + 1) ? -EFAULT : 0; + + goto reterr; + } case KDSKBSENT: if (!perm) { ret = -EPERM; -- 2.25.1

1 1

[PATCH] binder: fix UAF when releasing todo list
by Yang Yingliang 04 Nov '20

04 Nov '20

From: Todd Kjos <tkjos(a)google.com> stable inclusion from linux-4.19.153 commit 35cc2facc2a5ff52b9aa03f2dc81dcb000d97da3 CVE: CVE-2020-0423 -------------------------------- commit f3277cbfba763cd2826396521b9296de67cf1bbc upstream. When releasing a thread todo list when tearing down a binder_proc, the following race was possible which could result in a use-after-free: 1. Thread 1: enter binder_release_work from binder_thread_release 2. Thread 2: binder_update_ref_for_handle() -> binder_dec_node_ilocked() 3. Thread 2: dec nodeA --> 0 (will free node) 4. Thread 1: ACQ inner_proc_lock 5. Thread 2: block on inner_proc_lock 6. Thread 1: dequeue work (BINDER_WORK_NODE, part of nodeA) 7. Thread 1: REL inner_proc_lock 8. Thread 2: ACQ inner_proc_lock 9. Thread 2: todo list cleanup, but work was already dequeued 10. Thread 2: free node 11. Thread 2: REL inner_proc_lock 12. Thread 1: deref w->type (UAF) The problem was that for a BINDER_WORK_NODE, the binder_work element must not be accessed after releasing the inner_proc_lock while processing the todo list elements since another thread might be handling a deref on the node containing the binder_work element leading to the node being freed. Signed-off-by: Todd Kjos <tkjos(a)google.com> Link: https://lore.kernel.org/r/20201009232455.4054810-1-tkjos@google.com Cc: <stable(a)vger.kernel.org> # 4.14, 4.19, 5.4, 5.8 Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/android/binder.c | 35 ++++++++++------------------------- 1 file changed, 10 insertions(+), 25 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index cf4367135a00..18c32637047f 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -285,7 +285,7 @@ struct binder_device { struct binder_work { struct list_head entry; - enum { + enum binder_work_type { BINDER_WORK_TRANSACTION = 1, BINDER_WORK_TRANSACTION_COMPLETE, BINDER_WORK_RETURN_ERROR, @@ -895,27 +895,6 @@ static struct binder_work *binder_dequeue_work_head_ilocked( return w; } -/** - * binder_dequeue_work_head() - Dequeues the item at head of list - * @proc: binder_proc associated with list - * @list: list to dequeue head - * - * Removes the head of the list if there are items on the list - * - * Return: pointer dequeued binder_work, NULL if list was empty - */ -static struct binder_work *binder_dequeue_work_head( - struct binder_proc *proc, - struct list_head *list) -{ - struct binder_work *w; - - binder_inner_proc_lock(proc); - w = binder_dequeue_work_head_ilocked(list); - binder_inner_proc_unlock(proc); - return w; -} - static void binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer); static void binder_free_thread(struct binder_thread *thread); @@ -4229,13 +4208,17 @@ static void binder_release_work(struct binder_proc *proc, struct list_head *list) { struct binder_work *w; + enum binder_work_type wtype; while (1) { - w = binder_dequeue_work_head(proc, list); + binder_inner_proc_lock(proc); + w = binder_dequeue_work_head_ilocked(list); + wtype = w ? w->type : 0; + binder_inner_proc_unlock(proc); if (!w) return; - switch (w->type) { + switch (wtype) { case BINDER_WORK_TRANSACTION: { struct binder_transaction *t; @@ -4269,9 +4252,11 @@ static void binder_release_work(struct binder_proc *proc, kfree(death); binder_stats_deleted(BINDER_STAT_DEATH); } break; + case BINDER_WORK_NODE: + break; default: pr_err("unexpected work type, %d, not freed\n", - w->type); + wtype); break; } } -- 2.25.1

1 0

[PATCH 001/110] mm: fix double page fault on arm64 if PTE_AF is cleared
by Yang Yingliang 04 Nov '20

04 Nov '20

From: Jia He <justin.he(a)arm.com> stable inclusion from linux-4.19.149 commit 8579a0440381353e0a71dd6a4d4371be8457eac4 -------------------------------- [ Upstream commit 83d116c53058d505ddef051e90ab27f57015b025 ] When we tested pmdk unit test [1] vmmalloc_fork TEST3 on arm64 guest, there will be a double page fault in __copy_from_user_inatomic of cow_user_page. To reproduce the bug, the cmd is as follows after you deployed everything: make -C src/test/vmmalloc_fork/ TEST_TIME=60m check Below call trace is from arm64 do_page_fault for debugging purpose: [ 110.016195] Call trace: [ 110.016826] do_page_fault+0x5a4/0x690 [ 110.017812] do_mem_abort+0x50/0xb0 [ 110.018726] el1_da+0x20/0xc4 [ 110.019492] __arch_copy_from_user+0x180/0x280 [ 110.020646] do_wp_page+0xb0/0x860 [ 110.021517] __handle_mm_fault+0x994/0x1338 [ 110.022606] handle_mm_fault+0xe8/0x180 [ 110.023584] do_page_fault+0x240/0x690 [ 110.024535] do_mem_abort+0x50/0xb0 [ 110.025423] el0_da+0x20/0x24 The pte info before __copy_from_user_inatomic is (PTE_AF is cleared): [ffff9b007000] pgd=000000023d4f8003, pud=000000023da9b003, pmd=000000023d4b3003, pte=360000298607bd3 As told by Catalin: "On arm64 without hardware Access Flag, copying from user will fail because the pte is old and cannot be marked young. So we always end up with zeroed page after fork() + CoW for pfn mappings. we don't always have a hardware-managed access flag on arm64." This patch fixes it by calling pte_mkyoung. Also, the parameter is changed because vmf should be passed to cow_user_page() Add a WARN_ON_ONCE when __copy_from_user_inatomic() returns error in case there can be some obscure use-case (by Kirill). [1] https://github.com/pmem/pmdk/tree/master/src/test/vmmalloc_fork Signed-off-by: Jia He <justin.he(a)arm.com> Reported-by: Yibo Cai <Yibo.Cai(a)arm.com> Reviewed-by: Catalin Marinas <catalin.marinas(a)arm.com> Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/memory.c | 104 ++++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 89 insertions(+), 15 deletions(-) diff --git a/mm/memory.c b/mm/memory.c index c65d3993ac63..c4c667c0b89d 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -117,6 +117,18 @@ int randomize_va_space __read_mostly = 2; #endif +#ifndef arch_faults_on_old_pte +static inline bool arch_faults_on_old_pte(void) +{ + /* + * Those arches which don't have hw access flag feature need to + * implement their own helper. By default, "true" means pagefault + * will be hit on old pte. + */ + return true; +} +#endif + static int __init disable_randmaps(char *s) { randomize_va_space = 0; @@ -2089,32 +2101,82 @@ static inline int pte_unmap_same(struct mm_struct *mm, pmd_t *pmd, return same; } -static inline void cow_user_page(struct page *dst, struct page *src, unsigned long va, struct vm_area_struct *vma) +static inline bool cow_user_page(struct page *dst, struct page *src, + struct vm_fault *vmf) { + bool ret; + void *kaddr; + void __user *uaddr; + bool force_mkyoung; + struct vm_area_struct *vma = vmf->vma; + struct mm_struct *mm = vma->vm_mm; + unsigned long addr = vmf->address; + debug_dma_assert_idle(src); + if (likely(src)) { + copy_user_highpage(dst, src, addr, vma); + return true; + } + /* * If the source page was a PFN mapping, we don't have * a "struct page" for it. We do a best-effort copy by * just copying from the original user address. If that * fails, we just zero-fill it. Live with it. */ - if (unlikely(!src)) { - void *kaddr = kmap_atomic(dst); - void __user *uaddr = (void __user *)(va & PAGE_MASK); + kaddr = kmap_atomic(dst); + uaddr = (void __user *)(addr & PAGE_MASK); + + /* + * On architectures with software "accessed" bits, we would + * take a double page fault, so mark it accessed here. + */ + force_mkyoung = arch_faults_on_old_pte() && !pte_young(vmf->orig_pte); + if (force_mkyoung) { + pte_t entry; + + vmf->pte = pte_offset_map_lock(mm, vmf->pmd, addr, &vmf->ptl); + if (!likely(pte_same(*vmf->pte, vmf->orig_pte))) { + /* + * Other thread has already handled the fault + * and we don't need to do anything. If it's + * not the case, the fault will be triggered + * again on the same address. + */ + ret = false; + goto pte_unlock; + } + entry = pte_mkyoung(vmf->orig_pte); + if (ptep_set_access_flags(vma, addr, vmf->pte, entry, 0)) + update_mmu_cache(vma, addr, vmf->pte); + } + + /* + * This really shouldn't fail, because the page is there + * in the page tables. But it might just be unreadable, + * in which case we just give up and fill the result with + * zeroes. + */ + if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE)) { /* - * This really shouldn't fail, because the page is there - * in the page tables. But it might just be unreadable, - * in which case we just give up and fill the result with - * zeroes. + * Give a warn in case there can be some obscure + * use-case */ - if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE)) - clear_page(kaddr); - kunmap_atomic(kaddr); - flush_dcache_page(dst); - } else - copy_user_highpage(dst, src, va, vma); + WARN_ON_ONCE(1); + clear_page(kaddr); + } + + ret = true; + +pte_unlock: + if (force_mkyoung) + pte_unmap_unlock(vmf->pte, vmf->ptl); + kunmap_atomic(kaddr); + flush_dcache_page(dst); + + return ret; } static gfp_t __get_fault_gfp_mask(struct vm_area_struct *vma) @@ -2268,7 +2330,19 @@ static vm_fault_t wp_page_copy(struct vm_fault *vmf) vmf->address); if (!new_page) goto oom; - cow_user_page(new_page, old_page, vmf->address, vma); + + if (!cow_user_page(new_page, old_page, vmf)) { + /* + * COW failed, if the fault was solved by other, + * it's fine. If not, userspace would re-fault on + * the same address and we will handle the fault + * from the second attempt. + */ + put_page(new_page); + if (old_page) + put_page(old_page); + return 0; + } } if (mem_cgroup_try_charge_delay(new_page, mm, GFP_KERNEL, &memcg, false)) -- 2.25.1

1 109