- Kernel - mailweb.openeuler.org

[PATCH kernel-4.19] sched: Fix sched_fork() access an invalid sched_task_group
by Yang Yingliang 01 Sep '21

01 Sep '21

From: Zhang Qiao <zhangqiao22(a)huawei.com> hulk inclusion category: bugfix bugzilla: 177205, https://gitee.com/openeuler/kernel/issues/I484Y1 CVE: NA -------------------------------- There is a small race between copy_process() and sched_fork() where child->sched_task_group point to an already freed pointer. parent doing fork() | someone moving the parent to another cgroup -------------------------------+------------------------------- copy_process() + dup_task_struct()<1> parent move to another cgroup, and free the old cgroup. <2> + sched_fork() + __set_task_cpu()<3> + task_fork_fair() + sched_slice()<4> In the worst case, this bug can lead to "use-after-free" and cause panic as shown above, (1)parent copy its sched_task_group to child at <1>; (2)someone move the parent to another cgroup and free the old cgroup at <2>; (3)the sched_task_group and cfs_rq that belong to the old cgroup will be accessed at <3> and <4>, which cause a panic: [89249.732198] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 [89249.732701] PGD 8000001fa0a86067 P4D 8000001fa0a86067 PUD 2029955067 PMD 0 [89249.733005] Oops: 0000 [#1] SMP PTI [89249.733288] CPU: 7 PID: 648398 Comm: ebizzy Kdump: loaded Tainted: G OE --------- - - 4.18.0.x86_64+ #1 [89249.734318] RIP: 0010:sched_slice+0x84/0xc0 .... [89249.737910] Call Trace: [89249.738181] task_fork_fair+0x81/0x120 [89249.738457] sched_fork+0x132/0x240 [89249.738732] copy_process.part.5+0x675/0x20e0 [89249.739010] ? __handle_mm_fault+0x63f/0x690 [89249.739286] _do_fork+0xcd/0x3b0 [89249.739558] do_syscall_64+0x5d/0x1d0 [89249.739830] entry_SYSCALL_64_after_hwframe+0x65/0xca [89249.740107] RIP: 0033:0x7f04418cd7e1 When a new process is forked, cgroup_post_fork() associates it with the cgroup of its parent. Therefore this commit move the __set_task_cpu() and task_fork() that access some cgroup-related fields(sched_task_group and cfs_rq) to sched_post_fork() and call sched_post_fork() after cgroup_post_fork(). Fixes: 8323f26ce342 ("sched: Fix race in task_group") Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> Reviewed-by: Chen Hui <judy.chenhui(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/sched/task.h | 1 + kernel/fork.c | 1 + kernel/sched/core.c | 36 ++++++++++++++++++++---------------- 3 files changed, 22 insertions(+), 16 deletions(-) diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h index 44c6f15800ff5..5046980ecb0f8 100644 --- a/include/linux/sched/task.h +++ b/include/linux/sched/task.h @@ -33,6 +33,7 @@ extern asmlinkage void schedule_tail(struct task_struct *prev); extern void init_idle(struct task_struct *idle, int cpu); extern int sched_fork(unsigned long clone_flags, struct task_struct *p); +extern void sched_post_fork(struct task_struct *p); extern void sched_dead(struct task_struct *p); void __noreturn do_task_dead(void); diff --git a/kernel/fork.c b/kernel/fork.c index e306f8925008b..403b8a3315979 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2158,6 +2158,7 @@ static __latent_entropy struct task_struct *copy_process( proc_fork_connector(p); cgroup_post_fork(p); + sched_post_fork(p); cgroup_threadgroup_change_end(current); perf_event_fork(p); diff --git a/kernel/sched/core.c b/kernel/sched/core.c index e362fe5c84b66..d0d6153df7357 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -2348,8 +2348,6 @@ static inline void init_schedstats(void) {} */ int sched_fork(unsigned long clone_flags, struct task_struct *p) { - unsigned long flags; - __sched_fork(clone_flags, p); /* * We mark the process as NEW here. This guarantees that @@ -2393,6 +2391,26 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p) init_entity_runnable_average(&p->se); +#ifdef CONFIG_SCHED_INFO + if (likely(sched_info_on())) + memset(&p->sched_info, 0, sizeof(p->sched_info)); +#endif +#if defined(CONFIG_SMP) + p->on_cpu = 0; +#endif + init_task_preempt_count(p); +#ifdef CONFIG_SMP + plist_node_init(&p->pushable_tasks, MAX_PRIO); + RB_CLEAR_NODE(&p->pushable_dl_tasks); +#endif + + return 0; +} + +void sched_post_fork(struct task_struct *p) +{ + unsigned long flags; + /* * The child is not yet in the pid-hash so no cgroup attach races, * and the cgroup is pinned to this child due to cgroup_fork() @@ -2410,20 +2428,6 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p) if (p->sched_class->task_fork) p->sched_class->task_fork(p); raw_spin_unlock_irqrestore(&p->pi_lock, flags); - -#ifdef CONFIG_SCHED_INFO - if (likely(sched_info_on())) - memset(&p->sched_info, 0, sizeof(p->sched_info)); -#endif -#if defined(CONFIG_SMP) - p->on_cpu = 0; -#endif - init_task_preempt_count(p); -#ifdef CONFIG_SMP - plist_node_init(&p->pushable_tasks, MAX_PRIO); - RB_CLEAR_NODE(&p->pushable_dl_tasks); -#endif - return 0; } unsigned long to_ratio(u64 period, u64 runtime) -- 2.25.1

1 0

【Meeting Notice】openEuler kernel 技术分享第十一期 & 双周例会 Time: 2021-09-03 14:00-17:00
by Meeting Book 31 Aug '21

31 Aug '21

1 0

[PATCH openEuler-1.0-LTS 1/2] KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656)
by Yang Yingliang 31 Aug '21

31 Aug '21

From: Maxim Levitsky <mlevitsk(a)redhat.com> stable inclusion from linux-4.19.205 commit 119d547cbf7c055ba8100309ad71910478092f24 CVE: CVE-2021-3656 -------------------------------- [ upstream commit c7dfa4009965a9b2d7b329ee970eb8da0d32f0bc ] If L1 disables VMLOAD/VMSAVE intercepts, and doesn't enable Virtual VMLOAD/VMSAVE (currently not supported for the nested hypervisor), then VMLOAD/VMSAVE must operate on the L1 physical memory, which is only possible by making L0 intercept these instructions. Failure to do so allowed the nested guest to run VMLOAD/VMSAVE unintercepted, and thus read/write portions of the host physical memory. Fixes: 89c8a4984fc9 ("KVM: SVM: Enable Virtual VMLOAD VMSAVE feature") Suggested-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Maxim Levitsky <mlevitsk(a)redhat.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/x86/kvm/svm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index 464e271dc354d..1076dc1bd92ae 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -513,6 +513,9 @@ static void recalc_intercepts(struct vcpu_svm *svm) c->intercept_dr = h->intercept_dr | g->intercept_dr; c->intercept_exceptions = h->intercept_exceptions | g->intercept_exceptions; c->intercept = h->intercept | g->intercept; + + c->intercept |= (1ULL << INTERCEPT_VMLOAD); + c->intercept |= (1ULL << INTERCEPT_VMSAVE); } static inline struct vmcb *get_host_vmcb(struct vcpu_svm *svm) -- 2.25.1

1 1

转发: 转发: 请教一下，想提交一个内核的补丁，怎么操作，谢谢。（补丁内容见内）
by 徐力群 31 Aug '21

31 Aug '21

kernel@openeuler.org邮件已经订阅成功了（华为汪少博帮忙后台处理了一下），我现在重新发一下邮件。谢谢。请帮忙审阅补丁。发件人: 徐力群发送时间: 2021年8月30日 9:13 收件人: Xie XiuQi <xiexiuqi(a)huawei.com>; kernel(a)openeuler.org 抄送: Cheng Jian <cj.chengjian(a)huawei.com>; 曲维杰 <quweijie(a)huayun.com> 主题: 回复: 转发: 请教一下，想提交一个内核的补丁，怎么操作，谢谢。（补丁内容见内）这个是增加了bugzilla链接地址的补丁，之前可能重复发了几次（一直以为发送失败了）。谢谢。附件包括补丁合入后的测试方法和结果。 https://gitee.com/openeuler/kernel/issues/I47ITN 【标题描述】guest OS内删除文件，从host角度看guest的磁盘文件没有变小发件人: Xie XiuQi <xiexiuqi(a)huawei.com<mailto:xiexiuqi@huawei.com>> 发送时间: 2021年8月27日 22:32 收件人: 徐力群 <xuliqun(a)huayun.com<mailto:xuliqun@huayun.com>>; kernel(a)openeuler.org<mailto:kernel@openeuler.org> 抄送: Cheng Jian <cj.chengjian(a)huawei.com<mailto:cj.chengjian@huawei.com>> 主题: Re: 转发: 请教一下，想提交一个内核的补丁，怎么操作，谢谢。（补丁内容见内）你好，非常欢迎参与 openEuler kernel 开发。首先在这里提交 issue，描述下要解决什么问题。 https://gitee.com/openeuler/kernel/issues 补丁的 Commit Message 中附上对应的 issue 链接，如在bugzila 行添加： bugzilla: https://gitee.com/openeuler/kernel/issues/I3DJ83 然后将适配之后的补丁发往 kernel(a)openeuler.org<mailto:kernel@openeuler.org>, 有问题可以联系我或 Cheng Jian. --- Xie XiuQi On 2021/8/27 14:18, 徐力群 wrote: 发件人: 徐力群发送时间: 2021年8月27日 14:18 收件人: kernel-owner(a)openeuler.org<mailto:kernel-owner@openeuler.org>； <kernel-owner(a)openeuler.org;><mailto:kernel-owner@openeuler.org;>; kernel(a)openeuler.org<mailto:kernel@openeuler.org> 主题: 请教一下，想提交一个内核的补丁，怎么操作，谢谢。（补丁内容见内）该补丁打上之后，guest如果删除了磁盘的文件，那么从host上看磁盘文件会变小。 virtio_blk: add discard and write zeroes support mainline inclusion from mainline-5.14-rc7 commit 1f23816b8eb8fdc39990abe166c10a18c16f6b21、af822aa68fbdf0a480a17462ed70232998127453 category: bugfix bugzilla: NA CVE: NA ------------------------------------------------- from： https://github.com/torvalds/linux/commit/1f23816b8eb8fdc39990abe166c10a18c1… https://github.com/torvalds/linux/commit/af822aa68fbdf0a480a17462ed70232998… In commit 88c85538, "virtio-blk: add discard and write zeroes features to specification" (https://github.com/oasis-tcs/virtio-spec) the virtio block specification has been extended to add VIRTIO_BLK_T_DISCARD and VIRTIO_BLK_T_WRITE_ZEROES commands. This patch enables support for discard and write zeroes in the virtio-blk driver when the device advertises the corresponding features, VIRTIO_BLK_F_DISCARD and VIRTIO_BLK_F_WRITE_ZEROES.

2 3

Re: 转发: 转发: 请教一下，想提交一个内核的补丁，怎么操作，谢谢。（补丁内容见内）
by Xie XiuQi 31 Aug '21

31 Aug '21

On 2021/8/31 9:58, 仇大玉 wrote: > @Xie XiuQi 请问是不是遵循kernel社区的发送方式，使用git send-email的方式参与OpenEuler的kernel提交是的，发到 kernel(a)openeuler.org 即可。发送前，先订阅一下邮件列表。 > > -----Original Message----- > From: 徐力群 <xuliqun(a)huayun.com> > Sent: 2021年8月31日 9:49 > To: chengjian (D) <cj.chengjian(a)huawei.com>; kernel(a)openeuler.org; Xie XiuQi <xiexiuqi(a)huawei.com> > Cc: 曲维杰 <quweijie(a)huayun.com>; 仇大玉 <qiudayu(a)huayun.com> > Subject: 回复: 转发: 转发: 请教一下，想提交一个内核的补丁，怎么操作，谢谢。（补丁内容见内） > > 请看附件，是这个吗？ > 我是收到这个邮件之后再次转发的。 > 难道还需要等待一段时间才能彻底激活？ > > > -----邮件原件----- > 发件人: chengjian (D) <cj.chengjian(a)huawei.com> > 发送时间: 2021年8月30日 20:38 > 收件人: 徐力群 <xuliqun(a)huayun.com>; kernel(a)openeuler.org; Xie XiuQi <xiexiuqi(a)huawei.com> > 抄送: 曲维杰 <quweijie(a)huayun.com>; 仇大玉 <qiudayu(a)huayun.com>; chengjian (D) <cj.chengjian(a)huawei.com> > 主题: Re: 转发: 转发: 请教一下，想提交一个内核的补丁，怎么操作，谢谢。（补丁内容见内） > > > On 2021/8/30 11:10, 徐力群 wrote: >> kernel@openeuler.org邮件已经订阅成功了（华为汪少博帮忙后台处理了一下）， >> >> 我现在重新发一下邮件。谢谢。请帮忙审阅补丁。 >> > 您好，冒昧打扰。 > > > 我这边以及邮件列表仍然没有您那边发送的邮件(PATCH)。 > > 请问您邮件已经发送了么。 > > 如果您发送了，请确认下邮件列表是否订阅成功，以及邮件是否发送成功。（一般来说，邮件被邮件列表墙掉会有一封提醒邮件的）。 > > 谢谢 > > ---- 成坚 > > >> On 2021/8/27 14:18, 徐力群wrote: >> >> *发件人:*徐力群 >> *发送时间:*2021年8月27日14:18 >> *收件人:*kernel-owner@openeuler.org； <kernel-owner(a)openeuler.org;> >> <mailto:kernel-owner@openeuler.org;>; kernel(a)openeuler.org >> *主题:*请教一下，想提交一个内核的补丁，怎么操作，谢谢。（补丁内容见内） >> >> 该补丁打上之后，guest如果删除了磁盘的文件，那么从host上看磁盘文件会变小。 >> >> virtio_blk: add discard and write zeroes support >> >> mainline inclusion >> >> from mainline-5.14-rc7 >> >> commit >> 1f23816b8eb8fdc39990abe166c10a18c16f6b21、af822aa68fbdf0a480a17462ed70232998127453 >> >> category: bugfix >> >> bugzilla: NA >> >> CVE: NA >> >> ------------------------------------------------- >> >> from： >> >> https://github.com/torvalds/linux/commit/1f23816b8eb8fdc39990abe166c10a18c1… >> >> https://github.com/torvalds/linux/commit/af822aa68fbdf0a480a17462ed70232998… >> >> In commit 88c85538, "virtio-blk: add discard and write zeroes features >> >> to specification" (https://github.com/oasis-tcs/virtio-spec) the >> virtio >> >> block specification has been extended to add VIRTIO_BLK_T_DISCARD and >> >> VIRTIO_BLK_T_WRITE_ZEROES commands. This patch enables support for >> >> discard and write zeroes in the virtio-blk driver when the device >> >> advertises the corresponding features, VIRTIO_BLK_F_DISCARD and >> >> VIRTIO_BLK_F_WRITE_ZEROES. >>

1 0

[PATCH kernel-4.19] tcp_comp: Fix comp_read_size return value
by Yang Yingliang 30 Aug '21

30 Aug '21

From: Wang Yufen <wangyufen(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I47SV5?from=project-issue CVE: NA ------------------------------------------------- In comp_read_size rxm->offset should be subtracted from skb->len. And use strp_done to release resoureces when destroy sock. Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/ipv4/tcp_comp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp_comp.c b/net/ipv4/tcp_comp.c index f6ebe52f3f7f7..bd5274091225b 100644 --- a/net/ipv4/tcp_comp.c +++ b/net/ipv4/tcp_comp.c @@ -789,7 +789,7 @@ static int comp_read_size(struct strparser *strp, struct sk_buff *skb) if (rxm->offset > skb->len) return 0; - return skb->len; + return skb->len - rxm->offset; } void comp_setup_strp(struct sock *sk, struct tcp_comp_context *ctx) @@ -903,6 +903,7 @@ static void tcp_comp_context_free(struct rcu_head *head) tcp_comp_context_tx_free(ctx); tcp_comp_context_rx_free(ctx); + strp_done(&ctx->rx.strp); kfree(ctx); } @@ -923,6 +924,7 @@ void tcp_cleanup_compression(struct sock *sk) kfree_skb(ctx->rx.pkt); ctx->rx.pkt = NULL; } + strp_stop(&ctx->rx.strp); rcu_assign_pointer(icsk->icsk_ulp_data, NULL); call_rcu(&ctx->rcu, tcp_comp_context_free); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] virtio-blk: Add validation for block size in config space
by Yang Yingliang 30 Aug '21

30 Aug '21

From: Xie Yongji <xieyongji(a)bytedance.com> mainline inclusion from mainline-v5.14-rc7 commit 82e89ea077b93b3c131fa175b0df3acb5b1d5cdf category: bufgix bugzilla: NA CVE: NA -------------------------------- An untrusted device might presents an invalid block size in configuration space. This tries to add validation for it in the validate callback and clear the VIRTIO_BLK_F_BLK_SIZE feature bit if the value is out of the supported range. And we also double check the value in virtblk_probe() in case that it's changed after the validation. Signed-off-by: Xie Yongji <xieyongji(a)bytedance.com> Link: https://lore.kernel.org/r/20210809101609.148-1-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Jason Wang <jasowang(a)redhat.com> Conflict: drivers/block/virtio_blk.c a. commit d1e9aa9c34a7 ("virtio-blk: support per-device queue depth") is not backported, 'unsigned int queue_depth' do not exist. b. commit e982c4d0a29b ("virtio-blk: modernize sysfs attribute creation") is not backported, 'virtblk_attr_groups' do not exist. c. commit f525464a8000 ("block: add blk_alloc_disk and blk_cleanup_disk APIs") and commit 89a5f065653b ("virtio-blk: use blk_mq_alloc_disk") is not backported, 'blk_cleanup_disk' is needed to repleace with 'blk_cleanup_queue', 'out_free_vq' is needed to replace with 'out_put_disk'. Signed-off-by: Li Jinlin <lijinlin3(a)huawei.com> Reviewed-by: louhongxiang <louhongxiang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/block/virtio_blk.c | 39 ++++++++++++++++++++++++++++++++------ 1 file changed, 33 insertions(+), 6 deletions(-) diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c index 7fe0f8f75d550..4423366a99790 100644 --- a/drivers/block/virtio_blk.c +++ b/drivers/block/virtio_blk.c @@ -718,6 +718,28 @@ static const struct blk_mq_ops virtio_mq_ops = { static unsigned int virtblk_queue_depth; module_param_named(queue_depth, virtblk_queue_depth, uint, 0444); +static int virtblk_validate(struct virtio_device *vdev) +{ + u32 blk_size; + + if (!vdev->config->get) { + dev_err(&vdev->dev, "%s failure: config access disabled\n", + __func__); + return -EINVAL; + } + + if (!virtio_has_feature(vdev, VIRTIO_BLK_F_BLK_SIZE)) + return 0; + + blk_size = virtio_cread32(vdev, + offsetof(struct virtio_blk_config, blk_size)); + + if (blk_size < SECTOR_SIZE || blk_size > PAGE_SIZE) + __virtio_clear_bit(vdev, VIRTIO_BLK_F_BLK_SIZE); + + return 0; +} + static int virtblk_probe(struct virtio_device *vdev) { struct virtio_blk *vblk; @@ -728,12 +750,6 @@ static int virtblk_probe(struct virtio_device *vdev) u16 min_io_size; u8 physical_block_exp, alignment_offset; - if (!vdev->config->get) { - dev_err(&vdev->dev, "%s failure: config access disabled\n", - __func__); - return -EINVAL; - } - err = ida_simple_get(&vd_index_ida, 0, minor_to_index(1 << MINORBITS), GFP_KERNEL); if (err < 0) @@ -849,6 +865,14 @@ static int virtblk_probe(struct virtio_device *vdev) else blk_size = queue_logical_block_size(q); + if (unlikely(blk_size < SECTOR_SIZE || blk_size > PAGE_SIZE)) { + dev_err(&vdev->dev, + "block size is changed unexpectedly, now is %u\n", + blk_size); + err = -EINVAL; + goto err_cleanup_disk; + } + /* Use topology information if available */ err = virtio_cread_feature(vdev, VIRTIO_BLK_F_TOPOLOGY, struct virtio_blk_config, physical_block_exp, @@ -882,6 +906,8 @@ static int virtblk_probe(struct virtio_device *vdev) device_add_disk(&vdev->dev, vblk->disk); return 0; +err_cleanup_disk: + blk_cleanup_queue(vblk->disk->queue); out_free_tags: blk_mq_free_tag_set(&vblk->tag_set); out_put_disk: @@ -991,6 +1017,7 @@ static struct virtio_driver virtio_blk = { .driver.name = KBUILD_MODNAME, .driver.owner = THIS_MODULE, .id_table = id_table, + .validate = virtblk_validate, .probe = virtblk_probe, .remove = virtblk_remove, .config_changed = virtblk_config_changed, -- 2.25.1

1 0

[PATCH kernel-4.19] virtio-blk: Add validation for block size in config space
by Yang Yingliang 30 Aug '21

30 Aug '21

From: Xie Yongji <xieyongji(a)bytedance.com> mainline inclusion from mainline-v5.14-rc7 commit 82e89ea077b93b3c131fa175b0df3acb5b1d5cdf category: bufgix bugzilla: NA CVE: NA -------------------------------- An untrusted device might presents an invalid block size in configuration space. This tries to add validation for it in the validate callback and clear the VIRTIO_BLK_F_BLK_SIZE feature bit if the value is out of the supported range. And we also double check the value in virtblk_probe() in case that it's changed after the validation. Signed-off-by: Xie Yongji <xieyongji(a)bytedance.com> Link: https://lore.kernel.org/r/20210809101609.148-1-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Jason Wang <jasowang(a)redhat.com> Conflict: drivers/block/virtio_blk.c a. commit d1e9aa9c34a7 ("virtio-blk: support per-device queue depth") is not backported, 'unsigned int queue_depth' do not exist. b. commit f525464a8000 ("block: add blk_alloc_disk and blk_cleanup_disk APIs") and commit 89a5f065653b ("virtio-blk: use blk_mq_alloc_disk") is not backported, 'blk_cleanup_disk' is needed to repleace with 'blk_cleanup_queue', 'out_free_vq' is needed to replace with 'out_put_disk'. Signed-off-by: Li Jinlin <lijinlin3(a)huawei.com> Reviewed-by: louhongxiang <louhongxiang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/block/virtio_blk.c | 39 ++++++++++++++++++++++++++++++++------ 1 file changed, 33 insertions(+), 6 deletions(-) diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c index dac1769146d7f..c7b92a9902a5d 100644 --- a/drivers/block/virtio_blk.c +++ b/drivers/block/virtio_blk.c @@ -723,6 +723,28 @@ static const struct blk_mq_ops virtio_mq_ops = { static unsigned int virtblk_queue_depth; module_param_named(queue_depth, virtblk_queue_depth, uint, 0444); +static int virtblk_validate(struct virtio_device *vdev) +{ + u32 blk_size; + + if (!vdev->config->get) { + dev_err(&vdev->dev, "%s failure: config access disabled\n", + __func__); + return -EINVAL; + } + + if (!virtio_has_feature(vdev, VIRTIO_BLK_F_BLK_SIZE)) + return 0; + + blk_size = virtio_cread32(vdev, + offsetof(struct virtio_blk_config, blk_size)); + + if (blk_size < SECTOR_SIZE || blk_size > PAGE_SIZE) + __virtio_clear_bit(vdev, VIRTIO_BLK_F_BLK_SIZE); + + return 0; +} + static int virtblk_probe(struct virtio_device *vdev) { struct virtio_blk *vblk; @@ -733,12 +755,6 @@ static int virtblk_probe(struct virtio_device *vdev) u16 min_io_size; u8 physical_block_exp, alignment_offset; - if (!vdev->config->get) { - dev_err(&vdev->dev, "%s failure: config access disabled\n", - __func__); - return -EINVAL; - } - err = ida_simple_get(&vd_index_ida, 0, minor_to_index(1 << MINORBITS), GFP_KERNEL); if (err < 0) @@ -854,6 +870,14 @@ static int virtblk_probe(struct virtio_device *vdev) else blk_size = queue_logical_block_size(q); + if (unlikely(blk_size < SECTOR_SIZE || blk_size > PAGE_SIZE)) { + dev_err(&vdev->dev, + "block size is changed unexpectedly, now is %u\n", + blk_size); + err = -EINVAL; + goto err_cleanup_disk; + } + /* Use topology information if available */ err = virtio_cread_feature(vdev, VIRTIO_BLK_F_TOPOLOGY, struct virtio_blk_config, physical_block_exp, @@ -886,6 +910,8 @@ static int virtblk_probe(struct virtio_device *vdev) device_add_disk(&vdev->dev, vblk->disk, virtblk_attr_groups); return 0; +err_cleanup_disk: + blk_cleanup_queue(vblk->disk->queue); out_free_tags: blk_mq_free_tag_set(&vblk->tag_set); out_put_disk: @@ -995,6 +1021,7 @@ static struct virtio_driver virtio_blk = { .driver.name = KBUILD_MODNAME, .driver.owner = THIS_MODULE, .id_table = id_table, + .validate = virtblk_validate, .probe = virtblk_probe, .remove = virtblk_remove, .config_changed = virtblk_config_changed, -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] blk-mq: fix divide by zero crash in tg_may_dispatch()
by Yang Yingliang 30 Aug '21

30 Aug '21

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 177149, https://gitee.com/openeuler/kernel/issues/I47R8R CVE: NA ----------------------------------------------- If blk-throttle is enabled and io is issued before blk_throtl_register_queue() is done. Divide by zero crash will be triggered in tg_may_dispatch() because 'throtl_slice' is uninitialized. Thus introduce a new falg QUEUE_FLAG_THROTL_INIT_DONE. It will be set after blk_throtl_register_queue() is done, and will be checked before apply any config. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-sysfs.c | 2 ++ block/blk-throttle.c | 41 +++++++++++++++++++++++++++++++++++++++-- include/linux/blkdev.h | 1 + 3 files changed, 42 insertions(+), 2 deletions(-) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index a05b2844f01cf..9687bff0244fb 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -940,6 +940,7 @@ int blk_register_queue(struct gendisk *disk) wbt_enable_default(q); blk_throtl_register_queue(q); + blk_queue_flag_set(QUEUE_FLAG_THROTL_INIT_DONE, q); if (q->request_fn || (q->mq_ops && q->elevator)) { ret = elv_register_queue(q); @@ -977,6 +978,7 @@ void blk_unregister_queue(struct gendisk *disk) if (!test_bit(QUEUE_FLAG_REGISTERED, &q->queue_flags)) return; + blk_queue_flag_clear(QUEUE_FLAG_THROTL_INIT_DONE, q); /* * Since sysfs_remove_dir() prevents adding new directory entries * before removal of existing entries starts, protect against diff --git a/block/blk-throttle.c b/block/blk-throttle.c index c7b4f905feb58..cfd14e95c79e1 100644 --- a/block/blk-throttle.c +++ b/block/blk-throttle.c @@ -11,6 +11,8 @@ #include <linux/bio.h> #include <linux/blktrace_api.h> #include <linux/blk-cgroup.h> +#include <linux/sched/signal.h> +#include <linux/delay.h> #include "blk.h" /* Max dispatch from a group in 1 round */ @@ -1434,6 +1436,31 @@ static void tg_conf_updated(struct throtl_grp *tg, bool global) } } +static inline int throtl_check_init_done(struct request_queue *q) +{ + if (test_bit(QUEUE_FLAG_THROTL_INIT_DONE, &q->queue_flags)) + return 0; + + return blk_queue_dying(q) ? -ENODEV : -EBUSY; +} + +/* + * If throtl_check_init_done() return -EBUSY, we should retry after a short + * msleep(), since that throttle init will be completed in blk_register_queue() + * soon. + */ +static inline int throtl_restart_syscall_when_busy(int errno) +{ + int ret = errno; + + if (ret == -EBUSY) { + msleep(10); + ret = restart_syscall(); + } + + return ret; +} + static ssize_t tg_set_conf(struct kernfs_open_file *of, char *buf, size_t nbytes, loff_t off, bool is_u64) { @@ -1447,6 +1474,10 @@ static ssize_t tg_set_conf(struct kernfs_open_file *of, if (ret) return ret; + ret = throtl_check_init_done(ctx.disk->queue); + if (ret) + goto out_finish; + ret = -EINVAL; if (sscanf(ctx.body, "%llu", &v) != 1) goto out_finish; @@ -1454,7 +1485,6 @@ static ssize_t tg_set_conf(struct kernfs_open_file *of, v = U64_MAX; tg = blkg_to_tg(ctx.blkg); - if (is_u64) *(u64 *)((void *)tg + of_cft(of)->private) = v; else @@ -1464,6 +1494,8 @@ static ssize_t tg_set_conf(struct kernfs_open_file *of, ret = 0; out_finish: blkg_conf_finish(&ctx); + ret = throtl_restart_syscall_when_busy(ret); + return ret ?: nbytes; } @@ -1613,8 +1645,11 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of, if (ret) return ret; - tg = blkg_to_tg(ctx.blkg); + ret = throtl_check_init_done(ctx.disk->queue); + if (ret) + goto out_finish; + tg = blkg_to_tg(ctx.blkg); v[0] = tg->bps_conf[READ][index]; v[1] = tg->bps_conf[WRITE][index]; v[2] = tg->iops_conf[READ][index]; @@ -1710,6 +1745,8 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of, ret = 0; out_finish: blkg_conf_finish(&ctx); + ret = throtl_restart_syscall_when_busy(ret); + return ret ?: nbytes; } diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index d60280e47a2ca..50f3b1eaa021f 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -704,6 +704,7 @@ struct request_queue { #define QUEUE_FLAG_NOMERGES 5 /* disable merge attempts */ #define QUEUE_FLAG_SAME_COMP 6 /* complete on same CPU-group */ #define QUEUE_FLAG_FAIL_IO 7 /* fake timeout */ +#define QUEUE_FLAG_THROTL_INIT_DONE 8 /* io throttle can be online */ #define QUEUE_FLAG_NONROT 9 /* non-rotational device (SSD) */ #define QUEUE_FLAG_VIRT QUEUE_FLAG_NONROT /* paravirt device */ #define QUEUE_FLAG_IO_STAT 10 /* do IO stats */ -- 2.25.1

1 0

[PATCH kernel-4.19] blk-mq: fix divide by zero crash in tg_may_dispatch()
by Yang Yingliang 30 Aug '21

30 Aug '21

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 177149, https://gitee.com/openeuler/kernel/issues/I47R8R CVE: NA ----------------------------------------------- If blk-throttle is enabled and io is issued before blk_throtl_register_queue() is done. Divide by zero crash will be triggered in tg_may_dispatch() because 'throtl_slice' is uninitialized. Thus introduce a new falg QUEUE_FLAG_THROTL_INIT_DONE. It will be set after blk_throtl_register_queue() is done, and will be checked before apply any config. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-sysfs.c | 2 ++ block/blk-throttle.c | 41 +++++++++++++++++++++++++++++++++++++++-- include/linux/blkdev.h | 1 + 3 files changed, 42 insertions(+), 2 deletions(-) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index 15ad67c3c56b8..1f958bace71fc 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -951,6 +951,7 @@ int blk_register_queue(struct gendisk *disk) blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q); wbt_enable_default(q); blk_throtl_register_queue(q); + blk_queue_flag_set(QUEUE_FLAG_THROTL_INIT_DONE, q); /* Now everything is ready and send out KOBJ_ADD uevent */ kobject_uevent(&q->kobj, KOBJ_ADD); @@ -983,6 +984,7 @@ void blk_unregister_queue(struct gendisk *disk) if (!blk_queue_registered(q)) return; + blk_queue_flag_clear(QUEUE_FLAG_THROTL_INIT_DONE, q); /* * Since sysfs_remove_dir() prevents adding new directory entries * before removal of existing entries starts, protect against diff --git a/block/blk-throttle.c b/block/blk-throttle.c index 18b8e868995f9..9426330d99dda 100644 --- a/block/blk-throttle.c +++ b/block/blk-throttle.c @@ -11,6 +11,8 @@ #include <linux/bio.h> #include <linux/blktrace_api.h> #include <linux/blk-cgroup.h> +#include <linux/sched/signal.h> +#include <linux/delay.h> #include "blk.h" /* Max dispatch from a group in 1 round */ @@ -1436,6 +1438,31 @@ static void tg_conf_updated(struct throtl_grp *tg, bool global) } } +static inline int throtl_check_init_done(struct request_queue *q) +{ + if (test_bit(QUEUE_FLAG_THROTL_INIT_DONE, &q->queue_flags)) + return 0; + + return blk_queue_dying(q) ? -ENODEV : -EBUSY; +} + +/* + * If throtl_check_init_done() return -EBUSY, we should retry after a short + * msleep(), since that throttle init will be completed in blk_register_queue() + * soon. + */ +static inline int throtl_restart_syscall_when_busy(int errno) +{ + int ret = errno; + + if (ret == -EBUSY) { + msleep(10); + ret = restart_syscall(); + } + + return ret; +} + static ssize_t tg_set_conf(struct kernfs_open_file *of, char *buf, size_t nbytes, loff_t off, bool is_u64) { @@ -1449,6 +1476,10 @@ static ssize_t tg_set_conf(struct kernfs_open_file *of, if (ret) return ret; + ret = throtl_check_init_done(ctx.disk->queue); + if (ret) + goto out_finish; + ret = -EINVAL; if (sscanf(ctx.body, "%llu", &v) != 1) goto out_finish; @@ -1456,7 +1487,6 @@ static ssize_t tg_set_conf(struct kernfs_open_file *of, v = U64_MAX; tg = blkg_to_tg(ctx.blkg); - if (is_u64) *(u64 *)((void *)tg + of_cft(of)->private) = v; else @@ -1466,6 +1496,8 @@ static ssize_t tg_set_conf(struct kernfs_open_file *of, ret = 0; out_finish: blkg_conf_finish(&ctx); + ret = throtl_restart_syscall_when_busy(ret); + return ret ?: nbytes; } @@ -1615,8 +1647,11 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of, if (ret) return ret; - tg = blkg_to_tg(ctx.blkg); + ret = throtl_check_init_done(ctx.disk->queue); + if (ret) + goto out_finish; + tg = blkg_to_tg(ctx.blkg); v[0] = tg->bps_conf[READ][index]; v[1] = tg->bps_conf[WRITE][index]; v[2] = tg->iops_conf[READ][index]; @@ -1712,6 +1747,8 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of, ret = 0; out_finish: blkg_conf_finish(&ctx); + ret = throtl_restart_syscall_when_busy(ret); + return ret ?: nbytes; } diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 376f5dee46fce..7ed2b137c3324 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -709,6 +709,7 @@ struct request_queue { #define QUEUE_FLAG_NOMERGES 5 /* disable merge attempts */ #define QUEUE_FLAG_SAME_COMP 6 /* complete on same CPU-group */ #define QUEUE_FLAG_FAIL_IO 7 /* fake timeout */ +#define QUEUE_FLAG_THROTL_INIT_DONE 8 /* io throttle can be online */ #define QUEUE_FLAG_NONROT 9 /* non-rotational device (SSD) */ #define QUEUE_FLAG_VIRT QUEUE_FLAG_NONROT /* paravirt device */ #define QUEUE_FLAG_IO_STAT 10 /* do IO stats */ -- 2.25.1

1 0