- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 1484/1484] drivers/md/dm-cache-metadata.c:1729:9: warning: 'strncpy' specified bound 16 equals destination size
by kernel test robot 19 Nov '24

19 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 8a039651010897592567f5751c4e706ab794e9c0 commit: 2363088eba2ecccfb643725e4864af73c4226a04 [1484/1484] LoongArch: Allow building with kcov coverage config: loongarch-randconfig-001-20241119 (https://download.01.org/0day-ci/archive/20241119/202411191039.9EY0Nxk9-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241119/202411191039.9EY0Nxk9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411191039.9EY0Nxk9-lkp@intel.com/ All warnings (new ones prefixed by >>): In function 'write_hints', inlined from 'dm_cache_write_hints' at drivers/md/dm-cache-metadata.c:1753:6: >> drivers/md/dm-cache-metadata.c:1729:9: warning: 'strncpy' specified bound 16 equals destination size [-Wstringop-truncation] 1729 | strncpy(cmd->policy_name, policy_name, sizeof(cmd->policy_name)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/strncpy +1729 drivers/md/dm-cache-metadata.c 4e781b498ee500 Joe Thornber 2016-09-15 1713 4e781b498ee500 Joe Thornber 2016-09-15 1714 /* 4e781b498ee500 Joe Thornber 2016-09-15 1715 * It's quicker to always delete the hint array, and recreate with 4e781b498ee500 Joe Thornber 2016-09-15 1716 * dm_array_new(). 4e781b498ee500 Joe Thornber 2016-09-15 1717 */ 4e781b498ee500 Joe Thornber 2016-09-15 1718 static int write_hints(struct dm_cache_metadata *cmd, struct dm_cache_policy *policy) c6b4fcbad044e6 Joe Thornber 2013-03-01 1719 { c6b4fcbad044e6 Joe Thornber 2013-03-01 1720 int r; c6b4fcbad044e6 Joe Thornber 2013-03-01 1721 size_t hint_size; c6b4fcbad044e6 Joe Thornber 2013-03-01 1722 const char *policy_name = dm_cache_policy_get_name(policy); 86a3238c7b9b75 Heinz Mauelshagen 2023-01-25 1723 const unsigned int *policy_version = dm_cache_policy_get_version(policy); c6b4fcbad044e6 Joe Thornber 2013-03-01 1724 c6b4fcbad044e6 Joe Thornber 2013-03-01 1725 if (!policy_name[0] || c6b4fcbad044e6 Joe Thornber 2013-03-01 1726 (strlen(policy_name) > sizeof(cmd->policy_name) - 1)) c6b4fcbad044e6 Joe Thornber 2013-03-01 1727 return -EINVAL; c6b4fcbad044e6 Joe Thornber 2013-03-01 1728 c6b4fcbad044e6 Joe Thornber 2013-03-01 @1729 strncpy(cmd->policy_name, policy_name, sizeof(cmd->policy_name)); 4e7f506f642963 Mike Snitzer 2013-03-20 1730 memcpy(cmd->policy_version, policy_version, sizeof(cmd->policy_version)); c6b4fcbad044e6 Joe Thornber 2013-03-01 1731 c6b4fcbad044e6 Joe Thornber 2013-03-01 1732 hint_size = dm_cache_policy_get_hint_size(policy); c6b4fcbad044e6 Joe Thornber 2013-03-01 1733 if (!hint_size) c6b4fcbad044e6 Joe Thornber 2013-03-01 1734 return 0; /* short-circuit hints initialization */ c6b4fcbad044e6 Joe Thornber 2013-03-01 1735 cmd->policy_hint_size = hint_size; c6b4fcbad044e6 Joe Thornber 2013-03-01 1736 c6b4fcbad044e6 Joe Thornber 2013-03-01 1737 if (cmd->hint_root) { c6b4fcbad044e6 Joe Thornber 2013-03-01 1738 r = dm_array_del(&cmd->hint_info, cmd->hint_root); c6b4fcbad044e6 Joe Thornber 2013-03-01 1739 if (r) c6b4fcbad044e6 Joe Thornber 2013-03-01 1740 return r; c6b4fcbad044e6 Joe Thornber 2013-03-01 1741 } c6b4fcbad044e6 Joe Thornber 2013-03-01 1742 4e781b498ee500 Joe Thornber 2016-09-15 1743 return dm_array_new(&cmd->hint_info, &cmd->hint_root, c6b4fcbad044e6 Joe Thornber 2013-03-01 1744 from_cblock(cmd->cache_blocks), 4e781b498ee500 Joe Thornber 2016-09-15 1745 get_hint, policy); 0596661f0a16d9 Joe Thornber 2014-04-03 1746 } 0596661f0a16d9 Joe Thornber 2014-04-03 1747 :::::: The code at line 1729 was first introduced by commit :::::: c6b4fcbad044e6fffcc75bba160e720eb8d67d17 dm: add cache target :::::: TO: Joe Thornber <ejt(a)redhat.com> :::::: CC: Alasdair G Kergon <agk(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
by Yi Yang 19 Nov '24

19 Nov '24

From: Longlong Xia <xialonglong(a)kylinos.cn> mainline inclusion from mainline-v6.12-rc4 commit 9462f4ca56e7d2430fdb6dcc8498244acbfc4489 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB0EQM CVE: CVE-2024-50073 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] Read of size 8 at addr ffff88815fe99c00 by task poc/3379 CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace: <TASK> gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm] __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389 update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500 __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846 __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161 gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107 __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm] ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195 ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79 __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338 __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805 tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818 Allocated by task 65: gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm] gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm] gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm] gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm] tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391 tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39 flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445 process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229 worker_thread+0x3dc/0x950 kernel/workqueue.c:3391 kthread+0x2a3/0x370 kernel/kthread.c:389 ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257 Freed by task 3367: kfree+0x126/0x420 mm/slub.c:4580 gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818 [Analysis] gsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux can be freed by multi threads through ioctl,which leads to the occurrence of uaf. Protect it by gsm tx lock. Signed-off-by: Longlong Xia <xialonglong(a)kylinos.cn> Cc: stable <stable(a)kernel.org> Suggested-by: Jiri Slaby <jirislaby(a)kernel.org> Link: https://lore.kernel.org/r/20240926130213.531959-1-xialonglong@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/n_gsm.c [Commit 54da6a092431("locking: Introduce __cleanup() based infrastructure") not merged, The guard() function is not introduced.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/n_gsm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index a864a93f9cec..18ff23731349 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2164,6 +2164,7 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) int i; struct gsm_dlci *dlci; struct gsm_msg *txq, *ntxq; + unsigned long flags; gsm->dead = true; mutex_lock(&gsm->mutex); @@ -2186,10 +2187,13 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) gsm_dlci_release(gsm->dlci[i]); mutex_unlock(&gsm->mutex); /* Now wipe the queues */ + + spin_lock_irqsave(&gsm->tx_lock, flags); tty_ldisc_flush(gsm->tty); list_for_each_entry_safe(txq, ntxq, &gsm->tx_list, list) kfree(txq); INIT_LIST_HEAD(&gsm->tx_list); + spin_unlock_irqrestore(&gsm->tx_lock, flags); } /** -- 2.25.1

2 1

[openeuler:OLK-6.6 1484/1484] drivers/crypto/montage/tsse/tsse_dev.h:84:13: warning: variable 'cpu' set but not used
by kernel test robot 19 Nov '24

19 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 8a039651010897592567f5751c4e706ab794e9c0 commit: 811debd4ea52033d7393d4a7de2be11f71c70348 [1484/1484] add support for Mont-TSSE Driver config: x86_64-randconfig-074-20241119 (https://download.01.org/0day-ci/archive/20241119/202411191002.S36p5N3T-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241119/202411191002.S36p5N3T-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411191002.S36p5N3T-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/crypto/montage/tsse/tsse_irq.c:10: drivers/crypto/montage/tsse/tsse_dev.h: In function 'tsse_get_cur_node': >> drivers/crypto/montage/tsse/tsse_dev.h:84:13: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 84 | int cpu, node; | ^~~ -- In file included from drivers/crypto/montage/tsse/tsse_ipc.c:14: drivers/crypto/montage/tsse/tsse_dev.h: In function 'tsse_get_cur_node': >> drivers/crypto/montage/tsse/tsse_dev.h:84:13: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 84 | int cpu, node; | ^~~ drivers/crypto/montage/tsse/tsse_ipc.c: At top level: drivers/crypto/montage/tsse/tsse_ipc.c:17:18: warning: no previous prototype for 'get_msginf' [-Wmissing-prototypes] 17 | struct tsse_msg *get_msginf(void __iomem *d2h) | ^~~~~~~~~~ drivers/crypto/montage/tsse/tsse_ipc.c:41:6: warning: no previous prototype for 'ipc_recieve_msg' [-Wmissing-prototypes] 41 | void ipc_recieve_msg(struct tsse_ipc *tsseipc, struct ipc_msg *msg) | ^~~~~~~~~~~~~~~ drivers/crypto/montage/tsse/tsse_ipc.c:53:5: warning: no previous prototype for 'msg_rout' [-Wmissing-prototypes] 53 | int msg_rout(struct tsse_ipc *tsseipc, struct tsse_msg *tssemsg) | ^~~~~~~~ drivers/crypto/montage/tsse/tsse_ipc.c:103:6: warning: no previous prototype for 'ipc_send_msg' [-Wmissing-prototypes] 103 | void ipc_send_msg(struct tsse_ipc *tsseipc, struct ipc_data *msg) | ^~~~~~~~~~~~ drivers/crypto/montage/tsse/tsse_ipc.c:115:6: warning: no previous prototype for 'ipc_hw_init' [-Wmissing-prototypes] 115 | void ipc_hw_init(struct tsse_ipc *hw_ipc) | ^~~~~~~~~~~ drivers/crypto/montage/tsse/tsse_ipc.c:122:5: warning: no previous prototype for 'ipc_init_msg' [-Wmissing-prototypes] 122 | int ipc_init_msg(struct tsse_ipc *tsseipc) | ^~~~~~~~~~~~ -- In file included from drivers/crypto/montage/tsse/tsse_dev_mgr.c:15: drivers/crypto/montage/tsse/tsse_dev.h: In function 'tsse_get_cur_node': >> drivers/crypto/montage/tsse/tsse_dev.h:84:13: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 84 | int cpu, node; | ^~~ drivers/crypto/montage/tsse/tsse_dev_mgr.c: At top level: drivers/crypto/montage/tsse/tsse_dev_mgr.c:107:5: warning: no previous prototype for 'tsse_stop_dev' [-Wmissing-prototypes] 107 | int tsse_stop_dev(struct tsse_dev *tdev, bool busy_exit) | ^~~~~~~~~~~~~ -- In file included from drivers/crypto/montage/tsse/tsse_vuart.c:25: drivers/crypto/montage/tsse/tsse_dev.h: In function 'tsse_get_cur_node': >> drivers/crypto/montage/tsse/tsse_dev.h:84:13: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 84 | int cpu, node; | ^~~ At top level: drivers/crypto/montage/tsse/tsse_vuart.c:77:13: warning: 'vuart_wait_for_xmitr' defined but not used [-Wunused-function] 77 | static void vuart_wait_for_xmitr(struct uart_port *port) | ^~~~~~~~~~~~~~~~~~~~ -- In file included from drivers/crypto/montage/tsse/tsse_fw_service.c:20: drivers/crypto/montage/tsse/tsse_dev.h: In function 'tsse_get_cur_node': >> drivers/crypto/montage/tsse/tsse_dev.h:84:13: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 84 | int cpu, node; | ^~~ drivers/crypto/montage/tsse/tsse_fw_service.c: At top level: drivers/crypto/montage/tsse/tsse_fw_service.c:26:5: warning: no previous prototype for 'fw_send_msg' [-Wmissing-prototypes] 26 | int fw_send_msg(struct tsse_ipc *tsseipc, struct ipc_msg *msg) | ^~~~~~~~~~~ drivers/crypto/montage/tsse/tsse_fw_service.c:51:6: warning: no previous prototype for 'fw_free' [-Wmissing-prototypes] 51 | void fw_free(void *msg_t) | ^~~~~~~ vim +/cpu +84 drivers/crypto/montage/tsse/tsse_dev.h 81 82 static inline int tsse_get_cur_node(void) 83 { > 84 int cpu, node; 85 86 cpu = get_cpu(); 87 node = topology_physical_package_id(cpu); 88 put_cpu(); 89 90 return node; 91 } 92 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] [Backport] ext4: don't set SB_RDONLY after filesystem errors
by Yongjian Sun 19 Nov '24

19 Nov '24

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v6.12-rc1 commit d3476f3dad4ad68ae5f6b008ea6591d1520da5d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWS CVE: CVE-2024-50191 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When the filesystem is mounted with errors=remount-ro, we were setting SB_RDONLY flag to stop all filesystem modifications. We knew this misses proper locking (sb->s_umount) and does not go through proper filesystem remount procedure but it has been the way this worked since early ext2 days and it was good enough for catastrophic situation damage mitigation. Recently, syzbot has found a way (see link) to trigger warnings in filesystem freezing because the code got confused by SB_RDONLY changing under its hands. Since these days we set EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all filesystem modifications, modifying SB_RDONLY shouldn't be needed. So stop doing that. Link: https://lore.kernel.org/all/000000000000b90a8e061e21d12f@google.com Reported-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Christian Brauner <brauner(a)kernel.org> Link: https://patch.msgid.link/20240805201241.27286-1-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/super.c [Context differences.] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/super.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index e1f99fa9a6d0..d721c0e9d382 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -742,11 +742,12 @@ static void ext4_handle_error(struct super_block *sb, bool force_ro, int error, ext4_msg(sb, KERN_CRIT, "Remounting filesystem read-only"); /* - * Make sure updated value of ->s_mount_flags will be visible before - * ->s_flags update + * EXT4_FLAGS_SHUTDOWN was set which stops all filesystem + * modifications. We don't set SB_RDONLY because that requires + * sb->s_umount semaphore and setting it without proper remount + * procedure is confusing code such as freeze_super() leading to + * deadlocks and other problems. */ - smp_wmb(); - sb->s_flags |= SB_RDONLY; out: ext4_netlink_send_info(sb, force_ro ? 2 : 1); } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] [Backport] ext4: don't set SB_RDONLY after filesystem errors
by Yongjian Sun 19 Nov '24

19 Nov '24

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v6.12-rc1 commit d3476f3dad4ad68ae5f6b008ea6591d1520da5d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWS CVE: CVE-2024-50191 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When the filesystem is mounted with errors=remount-ro, we were setting SB_RDONLY flag to stop all filesystem modifications. We knew this misses proper locking (sb->s_umount) and does not go through proper filesystem remount procedure but it has been the way this worked since early ext2 days and it was good enough for catastrophic situation damage mitigation. Recently, syzbot has found a way (see link) to trigger warnings in filesystem freezing because the code got confused by SB_RDONLY changing under its hands. Since these days we set EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all filesystem modifications, modifying SB_RDONLY shouldn't be needed. So stop doing that. Link: https://lore.kernel.org/all/000000000000b90a8e061e21d12f@google.com Reported-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Christian Brauner <brauner(a)kernel.org> Link: https://patch.msgid.link/20240805201241.27286-1-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/super.c [Context differences.] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/super.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index e1f99fa9a6d0..d721c0e9d382 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -742,11 +742,12 @@ static void ext4_handle_error(struct super_block *sb, bool force_ro, int error, ext4_msg(sb, KERN_CRIT, "Remounting filesystem read-only"); /* - * Make sure updated value of ->s_mount_flags will be visible before - * ->s_flags update + * EXT4_FLAGS_SHUTDOWN was set which stops all filesystem + * modifications. We don't set SB_RDONLY because that requires + * sb->s_umount semaphore and setting it without proper remount + * procedure is confusing code such as freeze_super() leading to + * deadlocks and other problems. */ - smp_wmb(); - sb->s_flags |= SB_RDONLY; out: ext4_netlink_send_info(sb, force_ro ? 2 : 1); } -- 2.39.2

2 3

[PATCH OLK-5.10] [Backport] ext4: don't set SB_RDONLY after filesystem errors
by Yongjian Sun 19 Nov '24

19 Nov '24

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v6.12-rc1 commit d3476f3dad4ad68ae5f6b008ea6591d1520da5d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWS CVE: CVE-2024-50191 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When the filesystem is mounted with errors=remount-ro, we were setting SB_RDONLY flag to stop all filesystem modifications. We knew this misses proper locking (sb->s_umount) and does not go through proper filesystem remount procedure but it has been the way this worked since early ext2 days and it was good enough for catastrophic situation damage mitigation. Recently, syzbot has found a way (see link) to trigger warnings in filesystem freezing because the code got confused by SB_RDONLY changing under its hands. Since these days we set EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all filesystem modifications, modifying SB_RDONLY shouldn't be needed. So stop doing that. Link: https://lore.kernel.org/all/000000000000b90a8e061e21d12f@google.com Reported-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Christian Brauner <brauner(a)kernel.org> Link: https://patch.msgid.link/20240805201241.27286-1-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/super.c [Context differences.] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/super.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 2adee3847415..22d8025668db 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -753,11 +753,12 @@ static void ext4_handle_error(struct super_block *sb, bool force_ro, int error, ext4_msg(sb, KERN_CRIT, "Remounting filesystem read-only"); /* - * Make sure updated value of ->s_mount_flags will be visible before - * ->s_flags update + * EXT4_FLAGS_SHUTDOWN was set which stops all filesystem + * modifications. We don't set SB_RDONLY because that requires + * sb->s_umount semaphore and setting it without proper remount + * procedure is confusing code such as freeze_super() leading to + * deadlocks and other problems. */ - smp_wmb(); - sb->s_flags |= SB_RDONLY; #ifdef CONFIG_EXT4_ERROR_REPORT out: ext4_netlink_send_info(sb, force_ro ? 2 : 1); -- 2.39.2

2 3

[PATCH OLK-6.6] [Backport] ext4: don't set SB_RDONLY after filesystem errors
by Yongjian Sun 19 Nov '24

19 Nov '24

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v6.12-rc1 commit d3476f3dad4ad68ae5f6b008ea6591d1520da5d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWS CVE: CVE-2024-50191 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When the filesystem is mounted with errors=remount-ro, we were setting SB_RDONLY flag to stop all filesystem modifications. We knew this misses proper locking (sb->s_umount) and does not go through proper filesystem remount procedure but it has been the way this worked since early ext2 days and it was good enough for catastrophic situation damage mitigation. Recently, syzbot has found a way (see link) to trigger warnings in filesystem freezing because the code got confused by SB_RDONLY changing under its hands. Since these days we set EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all filesystem modifications, modifying SB_RDONLY shouldn't be needed. So stop doing that. Link: https://lore.kernel.org/all/000000000000b90a8e061e21d12f@google.com Reported-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Christian Brauner <brauner(a)kernel.org> Link: https://patch.msgid.link/20240805201241.27286-1-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/super.c [Context differences.] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/super.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 4b81f9ae3454..367fa50be4d6 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -821,11 +821,12 @@ static void ext4_handle_error(struct super_block *sb, bool force_ro, int error, ext4_msg(sb, KERN_CRIT, "Remounting filesystem read-only"); /* - * Make sure updated value of ->s_mount_flags will be visible before - * ->s_flags update + * EXT4_FLAGS_SHUTDOWN was set which stops all filesystem + * modifications. We don't set SB_RDONLY because that requires + * sb->s_umount semaphore and setting it without proper remount + * procedure is confusing code such as freeze_super() leading to + * deadlocks and other problems. */ - smp_wmb(); - sb->s_flags |= SB_RDONLY; #ifdef CONFIG_EXT4_ERROR_REPORT out: ext4_netlink_send_info(sb, force_ro ? 2 : 1); -- 2.39.2

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2024-50225
by Long Li 19 Nov '24

19 Nov '24

This patch set fix CVE-2024-50225. Naohiro Aota (1): btrfs: fix error propagation of split bios Qu Wenruo (1): btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() fs/btrfs/bio.c | 62 ++++++++++++++++++-------------------------------- fs/btrfs/bio.h | 3 +++ 2 files changed, 25 insertions(+), 40 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6] xfs: fix finding a last resort AG in xfs_filestream_pick_ag
by Long Li 19 Nov '24

19 Nov '24

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.10-rc2 commit dc60992ce76fbc2f71c2674f435ff6bde2108028 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AZ CVE: CVE-2024-50216 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When the main loop in xfs_filestream_pick_ag fails to find a suitable AG it tries to just pick the online AG. But the loop for that uses args->pag as loop iterator while the later code expects pag to be set. Fix this by reusing the max_pag case for this last resort, and also add a check for impossible case of no AG just to make sure that the uninitialized pag doesn't even escape in theory. Reported-by: syzbot+4125a3c514e3436a02e6(a)syzkaller.appspotmail.com Signed-off-by: Christoph Hellwig <hch(a)lst.de> Tested-by: syzbot+4125a3c514e3436a02e6(a)syzkaller.appspotmail.com Fixes: f8f1ed1ab3baba ("xfs: return a referenced perag from filestreams allocator") Cc: <stable(a)vger.kernel.org> # v6.3 Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Carlos Maiolino <cem(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/xfs_filestream.c | 23 ++++++++++++----------- fs/xfs/xfs_trace.h | 15 +++++---------- 2 files changed, 17 insertions(+), 21 deletions(-) diff --git a/fs/xfs/xfs_filestream.c b/fs/xfs/xfs_filestream.c index 2fc98d313708..f62b023f274e 100644 --- a/fs/xfs/xfs_filestream.c +++ b/fs/xfs/xfs_filestream.c @@ -64,7 +64,7 @@ xfs_filestream_pick_ag( struct xfs_perag *pag; struct xfs_perag *max_pag = NULL; xfs_extlen_t minlen = *longest; - xfs_extlen_t free = 0, minfree, maxfree = 0; + xfs_extlen_t minfree, maxfree = 0; xfs_agnumber_t agno; bool first_pass = true; int err; @@ -107,7 +107,6 @@ xfs_filestream_pick_ag( !(flags & XFS_PICK_USERDATA) || (flags & XFS_PICK_LOWSPACE))) { /* Break out, retaining the reference on the AG. */ - free = pag->pagf_freeblks; break; } } @@ -150,23 +149,25 @@ xfs_filestream_pick_ag( * grab. */ if (!max_pag) { - for_each_perag_wrap(args->mp, 0, start_agno, args->pag) + for_each_perag_wrap(args->mp, 0, start_agno, pag) { + max_pag = pag; break; - atomic_inc(&args->pag->pagf_fstrms); - *longest = 0; - } else { - pag = max_pag; - free = maxfree; - atomic_inc(&pag->pagf_fstrms); + } + + /* Bail if there are no AGs at all to select from. */ + if (!max_pag) + return -ENOSPC; } + + pag = max_pag; + atomic_inc(&pag->pagf_fstrms); } else if (max_pag) { xfs_perag_rele(max_pag); } - trace_xfs_filestream_pick(pag, pino, free); + trace_xfs_filestream_pick(pag, pino); args->pag = pag; return 0; - } static struct xfs_inode * diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h index 3926cf7f2a6e..d562028281f5 100644 --- a/fs/xfs/xfs_trace.h +++ b/fs/xfs/xfs_trace.h @@ -672,8 +672,8 @@ DEFINE_FILESTREAM_EVENT(xfs_filestream_lookup); DEFINE_FILESTREAM_EVENT(xfs_filestream_scan); TRACE_EVENT(xfs_filestream_pick, - TP_PROTO(struct xfs_perag *pag, xfs_ino_t ino, xfs_extlen_t free), - TP_ARGS(pag, ino, free), + TP_PROTO(struct xfs_perag *pag, xfs_ino_t ino), + TP_ARGS(pag, ino), TP_STRUCT__entry( __field(dev_t, dev) __field(xfs_ino_t, ino) @@ -684,14 +684,9 @@ TRACE_EVENT(xfs_filestream_pick, TP_fast_assign( __entry->dev = pag->pag_mount->m_super->s_dev; __entry->ino = ino; - if (pag) { - __entry->agno = pag->pag_agno; - __entry->streams = atomic_read(&pag->pagf_fstrms); - } else { - __entry->agno = NULLAGNUMBER; - __entry->streams = 0; - } - __entry->free = free; + __entry->agno = pag->pag_agno; + __entry->streams = atomic_read(&pag->pagf_fstrms); + __entry->free = pag->pagf_freeblks; ), TP_printk("dev %d:%d ino 0x%llx agno 0x%x streams %d free %d", MAJOR(__entry->dev), MINOR(__entry->dev), -- 2.39.2

2 1

[PATCH OLK-6.6] btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()
by Long Li 19 Nov '24

19 Nov '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> mainline inclusion from mainline-v6.10-rc2 commit aec8e6bf839101784f3ef037dcdb9432c3f32343 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37A4 CVE: CVE-2024-50217 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Mounting btrfs from two images (which have the same one fsid and two different dev_uuids) in certain executing order may trigger an UAF for variable 'device->bdev_file' in __btrfs_free_extra_devids(). And following are the details: 1. Attach image_1 to loop0, attach image_2 to loop1, and scan btrfs devices by ioctl(BTRFS_IOC_SCAN_DEV): / btrfs_device_1 → loop0 fs_device \ btrfs_device_2 → loop1 2. mount /dev/loop0 /mnt btrfs_open_devices btrfs_device_1->bdev_file = btrfs_get_bdev_and_sb(loop0) btrfs_device_2->bdev_file = btrfs_get_bdev_and_sb(loop1) btrfs_fill_super open_ctree fail: btrfs_close_devices // -ENOMEM btrfs_close_bdev(btrfs_device_1) fput(btrfs_device_1->bdev_file) // btrfs_device_1->bdev_file is freed btrfs_close_bdev(btrfs_device_2) fput(btrfs_device_2->bdev_file) 3. mount /dev/loop1 /mnt btrfs_open_devices btrfs_get_bdev_and_sb(&bdev_file) // EIO, btrfs_device_1->bdev_file is not assigned, // which points to a freed memory area btrfs_device_2->bdev_file = btrfs_get_bdev_and_sb(loop1) btrfs_fill_super open_ctree btrfs_free_extra_devids if (btrfs_device_1->bdev_file) fput(btrfs_device_1->bdev_file) // UAF ! Fix it by setting 'device->bdev_file' as 'NULL' after closing the btrfs_device in btrfs_close_one_device(). Fixes: 142388194191 ("btrfs: do not background blkdev_put()") CC: stable(a)vger.kernel.org # 4.19+ Link: https://bugzilla.kernel.org/show_bug.cgi?id=219408 Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/volumes.c [Not merge mainline commit 9ae061cf2a46 ("btrfs: port device access to file")] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/volumes.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c index c6810b74f9b1..093c5a3ef079 100644 --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -1143,6 +1143,7 @@ static void btrfs_close_one_device(struct btrfs_device *device) if (device->bdev) { fs_devices->open_devices--; device->bdev = NULL; + device->bdev_handle = NULL; } clear_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state); btrfs_destroy_dev_zone_info(device); -- 2.39.2

2 1