May 2024 - Kernel - mailweb.openeuler.org

[rdma-core v3] libhns: Fix missing flag when creating qp by hnsdv_create_qp()
by Chengchang Tang 11 May '24

11 May '24

From: Juan Zhou <zhoujuan51(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/rdma-core/issues/I9NZME -------------------------------------------------------------------------- This flag will be used when the DCA mode is enabled. Without this flag, the QP fails to be created in DCA mode. Fixes: c7bf0dbf472d ("libhns: Introduce DCA for RC QP") Signed-off-by: Juan Zhou <zhoujuan51(a)h-partners.com> --- providers/hns/hns_roce_u_verbs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/providers/hns/hns_roce_u_verbs.c b/providers/hns/hns_roce_u_verbs.c index a680339..e30880c 100644 --- a/providers/hns/hns_roce_u_verbs.c +++ b/providers/hns/hns_roce_u_verbs.c @@ -1049,7 +1049,8 @@ int hns_roce_u_destroy_srq(struct ibv_srq *ibv_srq) } enum { - HNSDV_QP_SUP_COMP_MASK = HNSDV_QP_INIT_ATTR_MASK_QP_CONGEST_TYPE, + HNSDV_QP_SUP_COMP_MASK = HNSDV_QP_INIT_ATTR_MASK_QP_CREATE_FLAGS | + HNSDV_QP_INIT_ATTR_MASK_QP_CONGEST_TYPE, }; static int check_hnsdv_qp_attr(struct hns_roce_context *ctx, -- 2.33.0

1 0

[PATCH OLK-6.6 00/14] Backport some memory policy feature and bugfix in mm from mainline
by Ze Zuo 11 May '24

11 May '24

Backport feature(mm/mempolicy: weighted interleave mempolicy and sysfs extension) and some mempolicy bugfix and cleanup. Gregory Price (3): mm/mempolicy: refactor a read-once mechanism into a function for re-use mm/mempolicy: introduce MPOL_WEIGHTED_INTERLEAVE for weighted interleaving mm/mempolicy: protect task interleave functions with tsk->mems_allowed_seq Hugh Dickins (10): mempolicy: fix migrate_pages(2) syscall return nr_failed mempolicy trivia: delete those ancient pr_debug()s mempolicy trivia: slightly more consistent naming mempolicy trivia: use pgoff_t in shared mempolicy tree mempolicy: mpol_shared_policy_init() without pseudo-vma mempolicy: remove confusing MPOL_MF_LAZY dead code kernfs: drop shared NUMA mempolicy hooks mempolicy: alloc_pages_mpol() for NUMA policy without vma mempolicy: mmap_lock is not needed while migrating folios mempolicy: migration attempt to match interleave nodes Rakie Kim (1): mm/mempolicy: implement the sysfs-based weighted_interleave interface .../ABI/testing/sysfs-kernel-mm-mempolicy | 4 + ...fs-kernel-mm-mempolicy-weighted-interleave | 25 + .../admin-guide/mm/numa_memory_policy.rst | 9 + fs/kernfs/file.c | 49 - fs/proc/task_mmu.c | 5 +- include/linux/gfp.h | 10 +- include/linux/hugetlb.h | 9 - include/linux/mempolicy.h | 51 +- include/linux/mm.h | 2 +- include/linux/sched.h | 1 + include/uapi/linux/mempolicy.h | 3 +- ipc/shm.c | 21 +- mm/hugetlb.c | 38 +- mm/mempolicy.c | 1449 +++++++++++------ mm/shmem.c | 95 +- mm/swap.h | 9 +- mm/swap_state.c | 86 +- mm/zswap.c | 7 +- 18 files changed, 1137 insertions(+), 736 deletions(-) create mode 100644 Documentation/ABI/testing/sysfs-kernel-mm-mempolicy create mode 100644 Documentation/ABI/testing/sysfs-kernel-mm-mempolicy-weighted-interleave -- 2.25.1

2 15

[PATCH openEuler-1.0-LTS] s390/dasd: fix double module refcount decrement
by Chen Zhongjin 11 May '24

11 May '24

From: Miroslav Franc <mfranc(a)suse.cz> mainline inclusion from mainline-v6.9-rc1 commit c3116e62ddeff79cae342147753ce596f01fcf06 category: bugfix bugzilla: 189916 CVE: CVE-2024-27054 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Once the discipline is associated with the device, deleting the device takes care of decrementing the module's refcount. Doing it manually on this error path causes refcount to artificially decrease on each error while it should just stay the same. Fixes: c020d722b110 ("s390/dasd: fix panic during offline processing") Signed-off-by: Miroslav Franc <mfranc(a)suse.cz> Signed-off-by: Jan Höppner <hoeppner(a)linux.ibm.com> Signed-off-by: Stefan Haberland <sth(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240209124522.3697827-3-sth@linux.ibm.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: drivers/s390/block/dasd.c [fix context conflicts] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/s390/block/dasd.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c index a23e7d394a0ad..433651225fca6 100644 --- a/drivers/s390/block/dasd.c +++ b/drivers/s390/block/dasd.c @@ -3501,12 +3501,11 @@ int dasd_generic_set_online(struct ccw_device *cdev, dasd_delete_device(device); return -EINVAL; } + device->base_discipline = base_discipline; if (!try_module_get(discipline->owner)) { - module_put(base_discipline->owner); dasd_delete_device(device); return -EINVAL; } - device->base_discipline = base_discipline; device->discipline = discipline; /* check_device will allocate block device if necessary */ @@ -3514,8 +3513,6 @@ int dasd_generic_set_online(struct ccw_device *cdev, if (rc) { pr_warn("%s Setting the DASD online with discipline %s failed with rc=%i\n", dev_name(&cdev->dev), discipline->name, rc); - module_put(discipline->owner); - module_put(base_discipline->owner); dasd_delete_device(device); return rc; } -- 2.25.1

2 1

[PATCH OLK-6.6 v3] md: do not delete safemode_timer in mddev_suspend
by Li Nan 11 May '24

11 May '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9JMCR Reference: https://lore.kernel.org/all/20240508092053.1447930-1-linan666@huaweicloud.c… -------------------------------- The deletion of safemode_timer in mddev_suspend() is redundant and potentially harmful now. If timer is about to be woken up but gets deleted, 'in_sync' will remain 0 until the next write, causing array to stay in the 'active' state instead of transitioning to 'clean'. Commit 0d9f4f135eb6 ("MD: Add del_timer_sync to mddev_suspend (fix nasty panic))" introduced this deletion for dm, because if timer fired after dm is destroyed, the resource which the timer depends on might have been freed. However, commit 0dd84b319352 ("md: call __md_stop_writes in md_stop") added __md_stop_writes() to md_stop(), which is called before freeing resource. Timer is deleted in __md_stop_writes(), and the origin issue is resolved. Therefore, delete safemode_timer can be removed safely now. Fixes: 0dd84b319352 ("md: call __md_stop_writes in md_stop") Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/md/md.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 80cb0120394f..dee49543c2ca 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -490,7 +490,6 @@ int mddev_suspend(struct mddev *mddev, bool interruptible) */ WRITE_ONCE(mddev->suspended, mddev->suspended + 1); - del_timer_sync(&mddev->safemode_timer); /* restrict memory reclaim I/O during raid array is suspend */ mddev->noio_flag = memalloc_noio_save(); -- 2.39.2

2 1

[PATCH v2 OLK-6.6 0/3] mm: mglru: reuse some legacy trace
by Zhao Mengmeng 11 May '24

11 May '24

From: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> Backport upstream mglru patch to reuse some trace events, along with trace-vmscan-postprocess parsing and output fixes. Jaewon Kim (1): mm: multi-gen LRU: reuse some legacy trace events Vlastimil Babka (2): trace-vmscan-postprocess: sync with tracepoints updates mm, vmscan: remove ISOLATE_UNMAPPED .../postprocess/trace-vmscan-postprocess.pl | 42 ++++++++----------- include/linux/mmzone.h | 2 - include/trace/events/vmscan.h | 8 +--- mm/vmscan.c | 21 ++++++---- 4 files changed, 34 insertions(+), 39 deletions(-) -- 2.33.0

3 9

[PATCH OLK-6.6 v2] md: do not delete safemode_timer in mddev_suspend
by Li Nan 11 May '24

11 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9JMCR -------------------------------- The deletion of safemode_timer in mddev_suspend() is redundant and potentially harmful now. If timer is about to be woken up but gets deleted, 'in_sync' will remain 0 until the next write, causing array to stay in the 'active' state instead of transitioning to 'clean'. Commit 0d9f4f135eb6 ("MD: Add del_timer_sync to mddev_suspend (fix nasty panic))" introduced this deletion for dm, because if timer fired after dm is destroyed, the resource which the timer depends on might have been freed. However, commit 0dd84b319352 ("md: call __md_stop_writes in md_stop") added __md_stop_writes() to md_stop(), which is called before freeing resource. Timer is deleted in __md_stop_writes(), and the origin issue is resolved. Therefore, delete safemode_timer can be removed safely now. Fixes: 0dd84b319352 ("md: call __md_stop_writes in md_stop") Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/md/md.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 80cb0120394f..dee49543c2ca 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -490,7 +490,6 @@ int mddev_suspend(struct mddev *mddev, bool interruptible) */ WRITE_ONCE(mddev->suspended, mddev->suspended + 1); - del_timer_sync(&mddev->safemode_timer); /* restrict memory reclaim I/O during raid array is suspend */ mddev->noio_flag = memalloc_noio_save(); -- 2.39.2

2 1

[PATCH v3 OLK-6.6 0/3] mm: mglru: reuse some legacy trace
by Zhao Mengmeng 11 May '24

11 May '24

Backport upstream mglru patch to reuse some trace events, along with trace-vmscan-postprocess parsing and output fixes. Jaewon Kim (1): mm: multi-gen LRU: reuse some legacy trace events Vlastimil Babka (2): trace-vmscan-postprocess: sync with tracepoints updates mm, vmscan: remove ISOLATE_UNMAPPED .../postprocess/trace-vmscan-postprocess.pl | 42 ++++++++----------- include/linux/mmzone.h | 2 - include/trace/events/vmscan.h | 8 +--- mm/vmscan.c | 21 ++++++---- 4 files changed, 34 insertions(+), 39 deletions(-) -- 2.33.0

2 4

[openeuler:OLK-6.6 7640/9508] kernel/livepatch/core.c:216:13: warning: no previous prototype for 'arch_klp_skip_resolve'
by kernel test robot 11 May '24

11 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0238904492b29dfc7715e7783eff8011b916ddac commit: b8f3220637be1736c165c289c634f27841ac4e01 [7640/9508] livepatch: add arch hook before doing klp_resolve_symbols config: x86_64-randconfig-013-20240511 (https://download.01.org/0day-ci/archive/20240511/202405111327.wFY69R0L-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240511/202405111327.wFY69R0L-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405111327.wFY69R0L-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/livepatch/core.c:97:12: warning: no previous prototype for 'arch_klp_init_func' [-Wmissing-prototypes] 97 | int __weak arch_klp_init_func(struct klp_object *obj, struct klp_func *func) | ^~~~~~~~~~~~~~~~~~ >> kernel/livepatch/core.c:216:13: warning: no previous prototype for 'arch_klp_skip_resolve' [-Wmissing-prototypes] 216 | bool __weak arch_klp_skip_resolve(unsigned int type) | ^~~~~~~~~~~~~~~~~~~~~ kernel/livepatch/core.c:1767:12: warning: no previous prototype for 'arch_klp_check_activeness_func' [-Wmissing-prototypes] 1767 | int __weak arch_klp_check_activeness_func(struct klp_func *func, int enable, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/livepatch/core.c:2022:14: warning: no previous prototype for 'arch_klp_mem_alloc' [-Wmissing-prototypes] 2022 | void __weak *arch_klp_mem_alloc(size_t size) | ^~~~~~~~~~~~~~~~~~ kernel/livepatch/core.c:2027:13: warning: no previous prototype for 'arch_klp_mem_free' [-Wmissing-prototypes] 2027 | void __weak arch_klp_mem_free(void *mem) | ^~~~~~~~~~~~~~~~~ kernel/livepatch/core.c:2063:13: warning: no previous prototype for 'arch_klp_set_brk_func' [-Wmissing-prototypes] 2063 | void __weak arch_klp_set_brk_func(struct klp_func_node *func_node, void *new_func) | ^~~~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for DRM_I915_DEBUG_GEM Depends on [n]: HAS_IOMEM [=y] && DRM_I915 [=m] && EXPERT [=y] && DRM_I915_WERROR [=n] Selected by [m]: - DRM_I915_DEBUG [=y] && HAS_IOMEM [=y] && DRM_I915 [=m] && EXPERT [=y] && !COMPILE_TEST [=n] vim +/arch_klp_skip_resolve +216 kernel/livepatch/core.c 96 > 97 int __weak arch_klp_init_func(struct klp_object *obj, struct klp_func *func) 98 { 99 return 0; 100 } 101 #endif /* CONFIG_LIVEPATCH_FTRACE */ 102 103 static bool klp_initialized(void) 104 { 105 return !!klp_root_kobj; 106 } 107 108 #ifdef CONFIG_LIVEPATCH_FTRACE 109 static struct klp_func *klp_find_func(struct klp_object *obj, 110 struct klp_func *old_func) 111 { 112 struct klp_func *func; 113 114 klp_for_each_func(obj, func) { 115 if ((strcmp(old_func->old_name, func->old_name) == 0) && 116 (old_func->old_sympos == func->old_sympos)) { 117 return func; 118 } 119 } 120 121 return NULL; 122 } 123 124 static struct klp_object *klp_find_object(struct klp_patch *patch, 125 struct klp_object *old_obj) 126 { 127 struct klp_object *obj; 128 129 klp_for_each_object(patch, obj) { 130 if (klp_is_module(old_obj)) { 131 if (klp_is_module(obj) && 132 strcmp(old_obj->name, obj->name) == 0) { 133 return obj; 134 } 135 } else if (!klp_is_module(obj)) { 136 return obj; 137 } 138 } 139 140 return NULL; 141 } 142 #endif /* CONFIG_LIVEPATCH_FTRACE */ 143 144 struct klp_find_arg { 145 const char *name; 146 unsigned long addr; 147 unsigned long count; 148 unsigned long pos; 149 }; 150 151 static int klp_match_callback(void *data, unsigned long addr) 152 { 153 struct klp_find_arg *args = data; 154 155 args->addr = addr; 156 args->count++; 157 158 /* 159 * Finish the search when the symbol is found for the desired position 160 * or the position is not defined for a non-unique symbol. 161 */ 162 if ((args->pos && (args->count == args->pos)) || 163 (!args->pos && (args->count > 1))) 164 return 1; 165 166 return 0; 167 } 168 169 static int klp_find_callback(void *data, const char *name, unsigned long addr) 170 { 171 struct klp_find_arg *args = data; 172 173 if (strcmp(args->name, name)) 174 return 0; 175 176 return klp_match_callback(data, addr); 177 } 178 179 static int klp_find_object_symbol(const char *objname, const char *name, 180 unsigned long sympos, unsigned long *addr) 181 { 182 struct klp_find_arg args = { 183 .name = name, 184 .addr = 0, 185 .count = 0, 186 .pos = sympos, 187 }; 188 189 if (objname) 190 module_kallsyms_on_each_symbol(objname, klp_find_callback, &args); 191 else 192 kallsyms_on_each_match_symbol(klp_match_callback, name, &args); 193 194 /* 195 * Ensure an address was found. If sympos is 0, ensure symbol is unique; 196 * otherwise ensure the symbol position count matches sympos. 197 */ 198 if (args.addr == 0) 199 pr_err("symbol '%s' not found in symbol table\n", name); 200 else if (args.count > 1 && sympos == 0) { 201 pr_err("unresolvable ambiguity for symbol '%s' in object '%s'\n", 202 name, objname); 203 } else if (sympos != args.count && sympos > 0) { 204 pr_err("symbol position %lu for symbol '%s' in object '%s' not found\n", 205 sympos, name, objname ? objname : "vmlinux"); 206 } else { 207 *addr = args.addr; 208 return 0; 209 } 210 211 *addr = 0; 212 return -EINVAL; 213 } 214 215 #ifdef CONFIG_LIVEPATCH_WO_FTRACE > 216 bool __weak arch_klp_skip_resolve(unsigned int type) 217 { 218 return false; 219 } 220 #endif 221 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] nfs: fix UAF in direct writes
by Long Li 11 May '24

11 May '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v5.10.214 commit 4595d90b5d2ea5fa4d318d13f59055aa4bf3e7f5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5GC CVE: CVE-2024-26958 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 17f46b803d4f23c66cacce81db35fef3adb8f2af ] In production we have been hitting the following warning consistently ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0 Workqueue: nfsiod nfs_direct_write_schedule_work [nfs] RIP: 0010:refcount_warn_saturate+0x9c/0xe0 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x9f/0x130 ? refcount_warn_saturate+0x9c/0xe0 ? report_bug+0xcc/0x150 ? handle_bug+0x3d/0x70 ? exc_invalid_op+0x16/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0x9c/0xe0 nfs_direct_write_schedule_work+0x237/0x250 [nfs] process_one_work+0x12f/0x4a0 worker_thread+0x14e/0x3b0 ? ZSTD_getCParams_internal+0x220/0x220 kthread+0xdc/0x120 ? __btf_name_valid+0xa0/0xa0 ret_from_fork+0x1f/0x30 This is because we're completing the nfs_direct_request twice in a row. The source of this is when we have our commit requests to submit, we process them and send them off, and then in the completion path for the commit requests we have if (nfs_commit_end(cinfo.mds)) nfs_direct_write_complete(dreq); However since we're submitting asynchronous requests we sometimes have one that completes before we submit the next one, so we end up calling complete on the nfs_direct_request twice. The only other place we use nfs_generic_commit_list() is in __nfs_commit_inode, which wraps this call in a nfs_commit_begin(); nfs_commit_end(); Which is a common pattern for this style of completion handling, one that is also repeated in the direct code with get_dreq()/put_dreq() calls around where we process events as well as in the completion paths. Fix this by using the same pattern for the commit requests. Before with my 200 node rocksdb stress running this warning would pop every 10ish minutes. With my patch the stress test has been running for several hours without popping. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/nfs/write.c include/linux/nfs_fs.h [make nfs_commit_end() have return value of bool and declared in header file] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/nfs/direct.c | 11 +++++++++-- fs/nfs/write.c | 10 +++++++--- include/linux/nfs_fs.h | 2 ++ 3 files changed, 18 insertions(+), 5 deletions(-) diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c index 6a4083d550c6..c0de56ed8364 100644 --- a/fs/nfs/direct.c +++ b/fs/nfs/direct.c @@ -760,10 +760,17 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq) LIST_HEAD(mds_list); nfs_init_cinfo_from_dreq(&cinfo, dreq); + nfs_commit_begin(cinfo.mds); nfs_scan_commit(dreq->inode, &mds_list, &cinfo); res = nfs_generic_commit_list(dreq->inode, &mds_list, 0, &cinfo); - if (res < 0) /* res == -ENOMEM */ - nfs_direct_write_reschedule(dreq); + if (res < 0) { /* res == -ENOMEM */ + spin_lock(&dreq->lock); + if (dreq->flags == 0) + dreq->flags = NFS_ODIRECT_RESCHED_WRITES; + spin_unlock(&dreq->lock); + } + if (nfs_commit_end(cinfo.mds)) + nfs_direct_write_complete(dreq); } static void nfs_direct_write_schedule_work(struct work_struct *work) diff --git a/fs/nfs/write.c b/fs/nfs/write.c index e383d265e65b..e4b1ce488637 100644 --- a/fs/nfs/write.c +++ b/fs/nfs/write.c @@ -1643,15 +1643,19 @@ static int wait_on_commit(struct nfs_mds_commit_info *cinfo) !atomic_read(&cinfo->rpcs_out)); } -static void nfs_commit_begin(struct nfs_mds_commit_info *cinfo) +void nfs_commit_begin(struct nfs_mds_commit_info *cinfo) { atomic_inc(&cinfo->rpcs_out); } -static void nfs_commit_end(struct nfs_mds_commit_info *cinfo) +bool nfs_commit_end(struct nfs_mds_commit_info *cinfo) { - if (atomic_dec_and_test(&cinfo->rpcs_out)) + + if (atomic_dec_and_test(&cinfo->rpcs_out)) { wake_up_var(&cinfo->rpcs_out); + return true; + } + return false; } void nfs_commitdata_release(struct nfs_commit_data *data) diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h index 22e4ce63917d..beb26241fe57 100644 --- a/include/linux/nfs_fs.h +++ b/include/linux/nfs_fs.h @@ -545,6 +545,8 @@ extern int nfs_wb_page_cancel(struct inode *inode, struct page* page); extern int nfs_commit_inode(struct inode *, int); extern struct nfs_commit_data *nfs_commitdata_alloc(bool never_fail); extern void nfs_commit_free(struct nfs_commit_data *data); +void nfs_commit_begin(struct nfs_mds_commit_info *cinfo); +bool nfs_commit_end(struct nfs_mds_commit_info *cinfo); static inline int nfs_have_writebacks(struct inode *inode) -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
by ZhaoLong Wang 11 May '24

11 May '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v5.10.210 commit d132010e6d5c0cb2e28ce9e91ab3ad0ad4cd1063 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5M6 CVE: CVE-2024-26972 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e022216dcd248326a5bb95609d12a6815bca4e2 upstream. For error handling path in ubifs_symlink(), inode will be marked as bad first, then iput() is invoked. If inode->i_link is initialized by fscrypt_encrypt_symlink() in encryption scenario, inode->i_link won't be freed by callchain ubifs_free_inode -> fscrypt_free_inode in error handling path, because make_bad_inode() has changed 'inode->i_mode' as 'S_IFREG'. Following kmemleak is easy to be reproduced by injecting error in ubifs_jnl_update() when doing symlink in encryption scenario: unreferenced object 0xffff888103da3d98 (size 8): comm "ln", pid 1692, jiffies 4294914701 (age 12.045s) backtrace: kmemdup+0x32/0x70 __fscrypt_encrypt_symlink+0xed/0x1c0 ubifs_symlink+0x210/0x300 [ubifs] vfs_symlink+0x216/0x360 do_symlinkat+0x11a/0x190 do_syscall_64+0x3b/0xe0 There are two ways fixing it: 1. Remove make_bad_inode() in error handling path. We can do that because ubifs_evict_inode() will do same processes for good symlink inode and bad symlink inode, for inode->i_nlink checking is before is_bad_inode(). 2. Free inode->i_link before marking inode bad. Method 2 is picked, it has less influence, personally, I think. Cc: stable(a)vger.kernel.org Fixes: 2c58d548f570 ("fscrypt: cache decrypted symlink target in ->i_link") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Suggested-by: Eric Biggers <ebiggers(a)kernel.org> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ubifs/dir.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index 33f2da805c97..6e87964c5c0a 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -1223,6 +1223,8 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry, dir_ui->ui_size = dir->i_size; mutex_unlock(&dir_ui->ui_mutex); out_inode: + /* Free inode->i_link before inode is marked as bad. */ + fscrypt_free_inode(inode); make_bad_inode(inode); iput(inode); out_fname: -- 2.34.3

2 1