From: Chao Yu <chao(a)kernel.org>
stable inclusion
from stable-v6.6.14
commit d3c0b49aaa12a61d560528f5d605029ab57f0728
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP
CVE: CVE-2023-52444
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ]
As Al reported in link[1]:
f2fs_rename()
...
if (old_dir != new_dir && !whiteout)
f2fs_set_link(old_inode, old_dir_entry,
old_dir_page, new_dir);
else
f2fs_put_page(old_dir_page, 0);
You want correct inumber in the ".." link. And cross-directory
rename does move the source to new parent, even if you'd been asked
to leave a whiteout in the old place.
[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/
With below testcase, it may cause dirent corruption, due to it missed
to call f2fs_set_link() to update ".." link to new directory.
- mkdir -p dir/foo
- renameat2 -w dir/foo bar
[ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3]
[FSCK] other corrupted bugs [Fail]
Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT")
Cc: Jan Kara <jack(a)suse.cz>
Reported-by: Al Viro <viro(a)zeniv.linux.org.uk>
Signed-off-by: Chao Yu <chao(a)kernel.org>
Reviewed-by: Jan Kara <jack(a)suse.cz>
Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com>
---
fs/f2fs/namei.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
index 193b22a2d6bf..02d9c47797be 100644
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c
@@ -1106,7 +1106,7 @@ static int f2fs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
}
if (old_dir_entry) {
- if (old_dir != new_dir && !whiteout)
+ if (old_dir != new_dir)
f2fs_set_link(old_inode, old_dir_entry,
old_dir_page, new_dir);
else
--
2.39.2
From: Chao Yu <chao(a)kernel.org>
stable inclusion
from stable-v5.10.209
commit 6f866885e147d33efc497f1095f35b2ee5ec7310
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP
CVE: CVE-2023-52444
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ]
As Al reported in link[1]:
f2fs_rename()
...
if (old_dir != new_dir && !whiteout)
f2fs_set_link(old_inode, old_dir_entry,
old_dir_page, new_dir);
else
f2fs_put_page(old_dir_page, 0);
You want correct inumber in the ".." link. And cross-directory
rename does move the source to new parent, even if you'd been asked
to leave a whiteout in the old place.
[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/
With below testcase, it may cause dirent corruption, due to it missed
to call f2fs_set_link() to update ".." link to new directory.
- mkdir -p dir/foo
- renameat2 -w dir/foo bar
[ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3]
[FSCK] other corrupted bugs [Fail]
Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT")
Cc: Jan Kara <jack(a)suse.cz>
Reported-by: Al Viro <viro(a)zeniv.linux.org.uk>
Signed-off-by: Chao Yu <chao(a)kernel.org>
Reviewed-by: Jan Kara <jack(a)suse.cz>
Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com>
---
fs/f2fs/namei.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
index 72b109685db4..99e4ec48d2a4 100644
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c
@@ -1066,7 +1066,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
}
if (old_dir_entry) {
- if (old_dir != new_dir && !whiteout)
+ if (old_dir != new_dir)
f2fs_set_link(old_inode, old_dir_entry,
old_dir_page, new_dir);
else
--
2.39.2
From: Chao Yu <chao(a)kernel.org>
stable inclusion
from stable-v4.19.306
commit 02160112e6d45c2610b049df6eb693d7a2e57b46
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP
CVE: CVE-2023-52444
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ]
As Al reported in link[1]:
f2fs_rename()
...
if (old_dir != new_dir && !whiteout)
f2fs_set_link(old_inode, old_dir_entry,
old_dir_page, new_dir);
else
f2fs_put_page(old_dir_page, 0);
You want correct inumber in the ".." link. And cross-directory
rename does move the source to new parent, even if you'd been asked
to leave a whiteout in the old place.
[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/
With below testcase, it may cause dirent corruption, due to it missed
to call f2fs_set_link() to update ".." link to new directory.
- mkdir -p dir/foo
- renameat2 -w dir/foo bar
[ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3]
[FSCK] other corrupted bugs [Fail]
Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT")
Cc: Jan Kara <jack(a)suse.cz>
Reported-by: Al Viro <viro(a)zeniv.linux.org.uk>
Signed-off-by: Chao Yu <chao(a)kernel.org>
Reviewed-by: Jan Kara <jack(a)suse.cz>
Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com>
---
fs/f2fs/namei.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
index 0ace2c2e3de9..98afafe633a2 100644
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c
@@ -968,7 +968,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
}
if (old_dir_entry) {
- if (old_dir != new_dir && !whiteout)
+ if (old_dir != new_dir)
f2fs_set_link(old_inode, old_dir_entry,
old_dir_page, new_dir);
else
--
2.39.2
From: Chao Yu <chao(a)kernel.org>
stable inclusion
from stable-v4.19.306
commit 02160112e6d45c2610b049df6eb693d7a2e57b46
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP
CVE: CVE-2023-52444
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ]
As Al reported in link[1]:
f2fs_rename()
...
if (old_dir != new_dir && !whiteout)
f2fs_set_link(old_inode, old_dir_entry,
old_dir_page, new_dir);
else
f2fs_put_page(old_dir_page, 0);
You want correct inumber in the ".." link. And cross-directory
rename does move the source to new parent, even if you'd been asked
to leave a whiteout in the old place.
[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/
With below testcase, it may cause dirent corruption, due to it missed
to call f2fs_set_link() to update ".." link to new directory.
- mkdir -p dir/foo
- renameat2 -w dir/foo bar
[ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3]
[FSCK] other corrupted bugs [Fail]
Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT")
Cc: Jan Kara <jack(a)suse.cz>
Reported-by: Al Viro <viro(a)zeniv.linux.org.uk>
Signed-off-by: Chao Yu <chao(a)kernel.org>
Reviewed-by: Jan Kara <jack(a)suse.cz>
Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com>
---
fs/f2fs/namei.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
index 0ace2c2e3de9..98afafe633a2 100644
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c
@@ -968,7 +968,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
}
if (old_dir_entry) {
- if (old_dir != new_dir && !whiteout)
+ if (old_dir != new_dir)
f2fs_set_link(old_inode, old_dir_entry,
old_dir_page, new_dir);
else
--
2.39.2
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: b97b63500af297c36f80416fd1f1193d227cf51a
commit: 6636f4434a9c5c9c645694db206188ee5a6626dd [13350/21632] ext4: report error to userspace by netlink
config: x86_64-buildonly-randconfig-001-20240224 (https://download.01.org/0day-ci/archive/20240224/202402242133.TAc5acto-lkp@…)
compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402242133.TAc5acto-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202402242133.TAc5acto-lkp@intel.com/
All errors (new ones prefixed by >>):
>> ld.lld: error: undefined symbol: __alloc_skb
>>> referenced by super.c
>>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a
--
>> ld.lld: error: undefined symbol: __nlmsg_put
>>> referenced by super.c
>>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a
--
>> ld.lld: error: undefined symbol: kfree_skb
>>> referenced by super.c
>>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a
--
>> ld.lld: error: undefined symbol: netlink_broadcast
>>> referenced by super.c
>>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a
--
>> ld.lld: error: undefined symbol: init_net
>>> referenced by super.c
>>> fs/ext4/super.o:(ext4_init_fs) in archive built-in.a
--
>> ld.lld: error: undefined symbol: __netlink_kernel_create
>>> referenced by super.c
>>> fs/ext4/super.o:(ext4_init_fs) in archive built-in.a
--
>> ld.lld: error: undefined symbol: netlink_kernel_release
>>> referenced by super.c
>>> fs/ext4/super.o:(ext4_exit_fs) in archive built-in.a
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
tree: https://gitee.com/openeuler/kernel.git OLK-5.10
head: 4fee6fdef7d687d6ce43289fd7e7f96fde039af0
commit: 329bf7f331286ee5d571d374e31ed50d2877b110 [29649/30000] ubcore: fix the bug of tp negotiation concurrency
config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240224/202402242102.SLiva8Ut-lkp@…)
compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402242102.SLiva8Ut-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202402242102.SLiva8Ut-lkp@intel.com/
All warnings (new ones prefixed by >>):
drivers/ub/urma/ubcore/ubcore_device.c:306:6: warning: no previous prototype for function 'ubcore_destroy_upi_list' [-Wmissing-prototypes]
306 | void ubcore_destroy_upi_list(void)
| ^
drivers/ub/urma/ubcore/ubcore_device.c:306:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
306 | void ubcore_destroy_upi_list(void)
| ^
| static
>> drivers/ub/urma/ubcore/ubcore_device.c:393:23: warning: no previous prototype for function 'ubcore_find_tpf_device_legacy' [-Wmissing-prototypes]
393 | struct ubcore_device *ubcore_find_tpf_device_legacy(void)
| ^
drivers/ub/urma/ubcore/ubcore_device.c:393:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
393 | struct ubcore_device *ubcore_find_tpf_device_legacy(void)
| ^
| static
2 warnings generated.
--
drivers/ub/urma/ubcore/ubcore_tp.c:66:17: warning: no previous prototype for function 'ubcore_get_mtu' [-Wmissing-prototypes]
66 | enum ubcore_mtu ubcore_get_mtu(int mtu)
| ^
drivers/ub/urma/ubcore/ubcore_tp.c:66:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
66 | enum ubcore_mtu ubcore_get_mtu(int mtu)
| ^
| static
>> drivers/ub/urma/ubcore/ubcore_tp.c:392:5: warning: no previous prototype for function 'ubcore_modify_tp_state' [-Wmissing-prototypes]
392 | int ubcore_modify_tp_state(struct ubcore_device *dev, struct ubcore_tp *tp,
| ^
drivers/ub/urma/ubcore/ubcore_tp.c:392:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
392 | int ubcore_modify_tp_state(struct ubcore_device *dev, struct ubcore_tp *tp,
| ^
| static
drivers/ub/urma/ubcore/ubcore_tp.c:894:19: warning: no previous prototype for function 'ubcore_create_vtp' [-Wmissing-prototypes]
894 | struct ubcore_tp *ubcore_create_vtp(struct ubcore_device *dev, union ubcore_eid *remote_eid,
| ^
drivers/ub/urma/ubcore/ubcore_tp.c:894:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
894 | struct ubcore_tp *ubcore_create_vtp(struct ubcore_device *dev, union ubcore_eid *remote_eid,
| ^
| static
drivers/ub/urma/ubcore/ubcore_tp.c:920:5: warning: no previous prototype for function 'ubcore_destroy_vtp' [-Wmissing-prototypes]
920 | int ubcore_destroy_vtp(struct ubcore_tp *vtp)
| ^
drivers/ub/urma/ubcore/ubcore_tp.c:920:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
920 | int ubcore_destroy_vtp(struct ubcore_tp *vtp)
| ^
| static
4 warnings generated.
--
>> drivers/ub/urma/uburma/uburma_main.c:640:6: warning: no previous prototype for function 'uburma_dev_accessible_by_ns' [-Wmissing-prototypes]
640 | bool uburma_dev_accessible_by_ns(struct uburma_device *ubu_dev, struct net *net)
| ^
drivers/ub/urma/uburma/uburma_main.c:640:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
640 | bool uburma_dev_accessible_by_ns(struct uburma_device *ubu_dev, struct net *net)
| ^
| static
>> drivers/ub/urma/uburma/uburma_main.c:665:5: warning: no previous prototype for function 'uburma_set_dev_ns' [-Wmissing-prototypes]
665 | int uburma_set_dev_ns(char *device_name, int ns_fd)
| ^
drivers/ub/urma/uburma/uburma_main.c:665:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
665 | int uburma_set_dev_ns(char *device_name, int ns_fd)
| ^
| static
>> drivers/ub/urma/uburma/uburma_main.c:723:5: warning: no previous prototype for function 'uburma_set_ns_mode' [-Wmissing-prototypes]
723 | int uburma_set_ns_mode(bool shared)
| ^
drivers/ub/urma/uburma/uburma_main.c:723:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
723 | int uburma_set_ns_mode(bool shared)
| ^
| static
3 warnings generated.
vim +/ubcore_find_tpf_device_legacy +393 drivers/ub/urma/ubcore/ubcore_device.c
392
> 393 struct ubcore_device *ubcore_find_tpf_device_legacy(void)
394 {
395 if (g_tpf == NULL)
396 ubcore_log_err("tpf is not registered yet");
397
398 ubcore_get_device(g_tpf);
399 return g_tpf;
400 }
401
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki