- Kernel - mailweb.openeuler.org

[PATCH] sock: fix potential memory leak in proto_register()
by Yang Yingliang 16 Jan '20

16 Jan '20

From: zhanglin <zhang.lin16(a)zte.com.cn> mainline inclusion from mainline-v5.3-rc7 commit b45ce32135d1c82a5bf12aa56957c3fd27956057 category: bugfix bugzilla: 20825 CVE: NA ------------------------------------- If protocols registered exceeded PROTO_INUSE_NR, prot will be added to proto_list, but no available bit left for prot in proto_inuse_idx. Changes since v2: * Propagate the error code properly Signed-off-by: zhanglin <zhang.lin16(a)zte.com.cn> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: guodeqing <geffrey.guo(a)huawei.com> Reviewed-by: Wenan Mao <maowenan(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/core/sock.c | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/net/core/sock.c b/net/core/sock.c index f0b4657..910d0e0 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -3216,16 +3216,17 @@ static __init int net_inuse_init(void) core_initcall(net_inuse_init); -static void assign_proto_idx(struct proto *prot) +static int assign_proto_idx(struct proto *prot) { prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR); if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) { pr_err("PROTO_INUSE_NR exhausted\n"); - return; + return -ENOSPC; } set_bit(prot->inuse_idx, proto_inuse_idx); + return 0; } static void release_proto_idx(struct proto *prot) @@ -3234,8 +3235,9 @@ static void release_proto_idx(struct proto *prot) clear_bit(prot->inuse_idx, proto_inuse_idx); } #else -static inline void assign_proto_idx(struct proto *prot) +static inline int assign_proto_idx(struct proto *prot) { + return 0; } static inline void release_proto_idx(struct proto *prot) @@ -3284,6 +3286,8 @@ static int req_prot_init(const struct proto *prot) int proto_register(struct proto *prot, int alloc_slab) { + int ret = -ENOBUFS; + if (alloc_slab) { prot->slab = kmem_cache_create_usercopy(prot->name, prot->obj_size, 0, @@ -3320,20 +3324,27 @@ int proto_register(struct proto *prot, int alloc_slab) } mutex_lock(&proto_list_mutex); + ret = assign_proto_idx(prot); + if (ret) { + mutex_unlock(&proto_list_mutex); + goto out_free_timewait_sock_slab_name; + } list_add(&prot->node, &proto_list); - assign_proto_idx(prot); mutex_unlock(&proto_list_mutex); - return 0; + return ret; out_free_timewait_sock_slab_name: - kfree(prot->twsk_prot->twsk_slab_name); + if (alloc_slab && prot->twsk_prot) + kfree(prot->twsk_prot->twsk_slab_name); out_free_request_sock_slab: - req_prot_cleanup(prot->rsk_prot); + if (alloc_slab) { + req_prot_cleanup(prot->rsk_prot); - kmem_cache_destroy(prot->slab); - prot->slab = NULL; + kmem_cache_destroy(prot->slab); + prot->slab = NULL; + } out: - return -ENOBUFS; + return ret; } EXPORT_SYMBOL(proto_register); -- 1.8.3

1 0

[PATCH] arm64/sve: Fix missing SVE/FPSIMD endianness conversions
by Yang Yingliang 16 Jan '20

16 Jan '20

From: Dave Martin <Dave.Martin(a)arm.com> mainline inclusion from mainline-5.2-rc5 commit 41040cf7c5f0 category: bugfix bugzilla: 27454 CVE: NA ------------------------------------------------- The in-memory representation of SVE and FPSIMD registers is different: the FPSIMD V-registers are stored as single 128-bit host-endian values, whereas SVE registers are stored in an endianness-invariant byte order. This means that the two representations differ when running on a big-endian host. But we blindly copy data from one representation to another when converting between the two, resulting in the register contents being unintentionally byteswapped in certain situations. Currently this can be triggered by the first SVE instruction after a syscall, for example (though the potential trigger points may vary in future). So, fix the conversion functions fpsimd_to_sve(), sve_to_fpsimd() and sve_sync_from_fpsimd_zeropad() to swab where appropriate. There is no common swahl128() or swab128() that we could use here. Maybe it would be worth making this generic, but for now add a simple local hack. Since the byte order differences are exposed in ABI, also clarify the documentation. Cc: Alex Bennée <alex.bennee(a)linaro.org> Cc: Peter Maydell <peter.maydell(a)linaro.org> Cc: Alan Hayward <alan.hayward(a)arm.com> Cc: Julien Grall <julien.grall(a)arm.com> Fixes: bc0ee4760364 ("arm64/sve: Core task context handling") Fixes: 8cd969d28fd2 ("arm64/sve: Signal handling support") Fixes: 43d4da2c45b2 ("arm64/sve: ptrace and ELF coredump support") Signed-off-by: Dave Martin <Dave.Martin(a)arm.com> [will: Fix typos in comments and docs spotted by Julien] Signed-off-by: Will Deacon <will.deacon(a)arm.com> Confilicts: arch/arm64/include/uapi/asm/kvm.h arch/arm64/include/uapi/asm/ptrace.h arch/arm64/include/uapi/asm/sigcontext.h Signed-off-by: Chen Zhou <chenzhou10(a)huawei.com> Reviewed-by: Xuefeng Wang <wxf.wang(a)hisilicon.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- Documentation/arm64/sve.txt | 16 ++++++++++++ arch/arm64/include/uapi/asm/ptrace.h | 4 +++ arch/arm64/include/uapi/asm/sigcontext.h | 14 +++++++++++ arch/arm64/kernel/fpsimd.c | 42 +++++++++++++++++++++++++------- 4 files changed, 67 insertions(+), 9 deletions(-) diff --git a/Documentation/arm64/sve.txt b/Documentation/arm64/sve.txt index 7169a0e..2001d84 100644 --- a/Documentation/arm64/sve.txt +++ b/Documentation/arm64/sve.txt @@ -39,6 +39,18 @@ model features for SVE is included in Appendix A. is to connect to a target process first and then attempt a ptrace(PTRACE_GETREGSET, pid, NT_ARM_SVE, &iov). +* Whenever SVE scalable register values (Zn, Pn, FFR) are exchanged in memory + between userspace and the kernel, the register value is encoded in memory in + an endianness-invariant layout, with bits [(8 * i + 7) : (8 * i)] encoded at + byte offset i from the start of the memory representation. This affects for + example the signal frame (struct sve_context) and ptrace interface + (struct user_sve_header) and associated data. + + Beware that on big-endian systems this results in a different byte order than + for the FPSIMD V-registers, which are stored as single host-endian 128-bit + values, with bits [(127 - 8 * i) : (120 - 8 * i)] of the register encoded at + byte offset i. (struct fpsimd_context, struct user_fpsimd_state). + 2. Vector length terminology ----------------------------- @@ -107,6 +119,10 @@ the SVE instruction set architecture. size and layout. Macros SVE_SIG_* are defined [1] to facilitate access to the members. +* Each scalable register (Zn, Pn, FFR) is stored in an endianness-invariant + layout, with bits [(8 * i + 7) : (8 * i)] stored at byte offset i from the + start of the register's representation in memory. + * If the SVE context is too big to fit in sigcontext.__reserved[], then extra space is allocated on the stack, an extra_context record is written in __reserved[] referencing this space. sve_context is then written in the diff --git a/arch/arm64/include/uapi/asm/ptrace.h b/arch/arm64/include/uapi/asm/ptrace.h index b0fd1d3..0102234 100644 --- a/arch/arm64/include/uapi/asm/ptrace.h +++ b/arch/arm64/include/uapi/asm/ptrace.h @@ -174,6 +174,10 @@ struct user_sve_header { * FPCR uint32_t FPCR * * Additional data might be appended in the future. + * + * The Z-, P- and FFR registers are represented in memory in an endianness- + * invariant layout which differs from the layout used for the FPSIMD + * V-registers on big-endian systems: see sigcontext.h for more explanation. */ #define SVE_PT_SVE_ZREG_SIZE(vq) SVE_SIG_ZREG_SIZE(vq) diff --git a/arch/arm64/include/uapi/asm/sigcontext.h b/arch/arm64/include/uapi/asm/sigcontext.h index dca8f8b..7498e41 100644 --- a/arch/arm64/include/uapi/asm/sigcontext.h +++ b/arch/arm64/include/uapi/asm/sigcontext.h @@ -77,6 +77,15 @@ struct fpsimd_context { __uint128_t vregs[32]; }; +/* + * Note: similarly to all other integer fields, each V-register is stored in an + * endianness-dependent format, with the byte at offset i from the start of the + * in-memory representation of the register value containing + * + * bits [(7 + 8 * i) : (8 * i)] of the register on little-endian hosts; or + * bits [(127 - 8 * i) : (120 - 8 * i)] on big-endian hosts. + */ + /* ESR_EL1 context */ #define ESR_MAGIC 0x45535201 @@ -203,6 +212,11 @@ struct sve_context { * FFR uint16_t[vq] first-fault status register * * Additional data might be appended in the future. + * + * Unlike vregs[] in fpsimd_context, each SVE scalable register (Z-, P- or FFR) + * is encoded in memory in an endianness-invariant format, with the byte at + * offset i from the start of the in-memory representation containing bits + * [(7 + 8 * i) : (8 * i)] of the register value. */ #define SVE_SIG_ZREG_SIZE(vq) ((__u32)(vq) * SVE_VQ_BYTES) diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c index 58c53bc..ad56eaf 100644 --- a/arch/arm64/kernel/fpsimd.c +++ b/arch/arm64/kernel/fpsimd.c @@ -38,6 +38,7 @@ #include <linux/slab.h> #include <linux/stddef.h> #include <linux/sysctl.h> +#include <linux/swab.h> #include <asm/esr.h> #include <asm/fpsimd.h> @@ -355,6 +356,23 @@ static int __init sve_sysctl_init(void) #define ZREG(sve_state, vq, n) ((char *)(sve_state) + \ (SVE_SIG_ZREG_OFFSET(vq, n) - SVE_SIG_REGS_OFFSET)) +#ifdef CONFIG_CPU_BIG_ENDIAN +static __uint128_t arm64_cpu_to_le128(__uint128_t x) +{ + u64 a = swab64(x); + u64 b = swab64(x >> 64); + + return ((__uint128_t)a << 64) | b; +} +#else +static __uint128_t arm64_cpu_to_le128(__uint128_t x) +{ + return x; +} +#endif + +#define arm64_le128_to_cpu(x) arm64_cpu_to_le128(x) + /* * Transfer the FPSIMD state in task->thread.uw.fpsimd_state to * task->thread.sve_state. @@ -372,14 +390,16 @@ static void fpsimd_to_sve(struct task_struct *task) void *sst = task->thread.sve_state; struct user_fpsimd_state const *fst = &task->thread.uw.fpsimd_state; unsigned int i; + __uint128_t *p; if (!system_supports_sve()) return; vq = sve_vq_from_vl(task->thread.sve_vl); - for (i = 0; i < 32; ++i) - memcpy(ZREG(sst, vq, i), &fst->vregs[i], - sizeof(fst->vregs[i])); + for (i = 0; i < 32; ++i) { + p = (__uint128_t *)ZREG(sst, vq, i); + *p = arm64_cpu_to_le128(fst->vregs[i]); + } } /* @@ -398,14 +418,16 @@ static void sve_to_fpsimd(struct task_struct *task) void const *sst = task->thread.sve_state; struct user_fpsimd_state *fst = &task->thread.uw.fpsimd_state; unsigned int i; + __uint128_t const *p; if (!system_supports_sve()) return; vq = sve_vq_from_vl(task->thread.sve_vl); - for (i = 0; i < 32; ++i) - memcpy(&fst->vregs[i], ZREG(sst, vq, i), - sizeof(fst->vregs[i])); + for (i = 0; i < 32; ++i) { + p = (__uint128_t const *)ZREG(sst, vq, i); + fst->vregs[i] = arm64_le128_to_cpu(*p); + } } #ifdef CONFIG_ARM64_SVE @@ -494,6 +516,7 @@ void sve_sync_from_fpsimd_zeropad(struct task_struct *task) void *sst = task->thread.sve_state; struct user_fpsimd_state const *fst = &task->thread.uw.fpsimd_state; unsigned int i; + __uint128_t *p; if (!test_tsk_thread_flag(task, TIF_SVE)) return; @@ -502,9 +525,10 @@ void sve_sync_from_fpsimd_zeropad(struct task_struct *task) memset(sst, 0, SVE_SIG_REGS_SIZE(vq)); - for (i = 0; i < 32; ++i) - memcpy(ZREG(sst, vq, i), &fst->vregs[i], - sizeof(fst->vregs[i])); + for (i = 0; i < 32; ++i) { + p = (__uint128_t *)ZREG(sst, vq, i); + *p = arm64_cpu_to_le128(fst->vregs[i]); + } } int sve_set_vector_length(struct task_struct *task, -- 1.8.3

1 0

[PATCH 0/3] Some fixes for SVM
by Yang Yingliang 16 Jan '20

16 Jan '20

Lijun Fang (3): svm: Fix unpin_memory calculate nr_pages error svm: Delete svm_unbind_cores() in svm_notifier_release call svm: Delete ifdef CONFIG_ACPI in svm drivers/char/svm.c | 234 ++++++++++++++++++++++++++--------------------------- 1 file changed, 113 insertions(+), 121 deletions(-) -- 1.8.3

1 3

[all] We should provider more concrete spec files for projects
by Liyongle (Fred) 16 Jan '20

16 Jan '20

Hi all, Please read [1] to get the request that all the PR should detail the changes so that users/developers can understand the context. [1] https://gitee.com/open_euler/dashboard/issues?sort=updated_at%20desc&id=I18… Fred 李永乐

1 0

[PATCH] vrf: Do not attempt to create IPv6 mcast rule if IPv6 is disabled
by Yang Yingliang 16 Jan '20

16 Jan '20

From: David Ahern <dsahern(a)gmail.com> mainline inclusion from mainline-v5.4-rc1 commit dac91170f8e9c73784af5fad6225e954b795601c category: bugfix bugzilla: 23512 CVE: NA ------------------------------------- A user reported that vrf create fails when IPv6 is disabled at boot using 'ipv6.disable=1': https://bugzilla.kernel.org/show_bug.cgi?id=204903 The failure is adding fib rules at create time. Add RTNL_FAMILY_IP6MR to the check in vrf_fib_rule if ipv6_mod_enabled is disabled. Fixes: e4a38c0c4b27 ("ipv6: add vrf table handling code for ipv6 mcast") Signed-off-by: David Ahern <dsahern(a)gmail.com> Cc: Patrick Ruddy <pruddy(a)vyatta.att-mail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: guodeqing <geffrey.guo(a)huawei.com> Reviewed-by: Wenan Mao <maowenan(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/vrf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c index af7b809..f94b4f4 100644 --- a/drivers/net/vrf.c +++ b/drivers/net/vrf.c @@ -1158,7 +1158,8 @@ static int vrf_fib_rule(const struct net_device *dev, __u8 family, bool add_it) struct sk_buff *skb; int err; - if (family == AF_INET6 && !ipv6_mod_enabled()) + if ((family == AF_INET6 || family == RTNL_FAMILY_IP6MR) && + !ipv6_mod_enabled()) return 0; skb = nlmsg_new(vrf_fib_rule_nl_size(), GFP_KERNEL); -- 1.8.3

1 0

[PATCH] iommu: Add missing new line for dma type
by Yang Yingliang 16 Jan '20

16 Jan '20

From: Lu Baolu <baolu.lu(a)linux.intel.com> mainline inclusion from mainline-5.2-rc5 commit 24f307d8abf7 category: bugfix bugzilla: 16865 CVE: NA ------------------------------------------------- So that all types are printed in the same format. Fixes: c52c72d3dee81 ("iommu: Add sysfs attribyte for domain type") Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Zhen Lei <thunder.leizhen(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/iommu/iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c index c558fda..b7b0105 100644 --- a/drivers/iommu/iommu.c +++ b/drivers/iommu/iommu.c @@ -327,7 +327,7 @@ static ssize_t iommu_group_show_type(struct iommu_group *group, type = "unmanaged\n"; break; case IOMMU_DOMAIN_DMA: - type = "DMA"; + type = "DMA\n"; break; } } -- 1.8.3

1 0

[PATCH 00/45] Backport patches from Linux-4.19.91
by Yang Yingliang 16 Jan '20

16 Jan '20

Merge 45 patches from 4.19.91 stable branch (48 total) beside 3 already merged patches: 248e65f PCI: pciehp: Avoid returning prematurely from sysfs requests 6970c15 dm btree: increase rebalance threshold in __rebalance2() 5dc3f40 scsi: qla2xxx: Change discovery state before PLOGI Aaron Conole (1): openvswitch: support asymmetric conntrack Alex Deucher (1): drm/radeon: fix r1xx/r2xx register checker for POT textures Alexander Lobakin (1): net: dsa: fix flow dissection on Tx path Arun Kumar Neelakantam (2): rpmsg: glink: Fix reuse intents memory leak issue rpmsg: glink: Fix use after free in open_ack TIMEOUT case Bart Van Assche (1): scsi: iscsi: Fix a potential deadlock in the timeout handler Bjorn Andersson (2): rpmsg: glink: Don't send pending rx_done during remove rpmsg: glink: Free pending deferred work on remove Chaotian Jing (2): mmc: block: Make card_busy_detect() a bit more generic mmc: block: Add CMD13 polling for MMC IOCTLS with R1B response Chris Lew (3): rpmsg: glink: Set tail pointer to 0 at end of FIFO rpmsg: glink: Put an extra reference during cleanup rpmsg: glink: Fix rpmsg_register_device err handling Dexuan Cui (1): PCI/PM: Always return devices to D0 when thawing Dmitry Osipenko (1): ARM: tegra: Fix FLOW_CTLR_HALT register clobbering by tegra_resume() Dust Li (1): net: sched: fix dump qlen for sch_mq/sch_mqprio with NOLOCK subqueues Eric Dumazet (2): inet: protect against too small mtu values. tcp: md5: fix potential overestimation of TCP option space George Cherian (1): PCI: Apply Cavium ACS quirk to ThunderX2 and ThunderX3 Greg Kroah-Hartman (2): Revert "arm64: preempt: Fix big-endian when checking preempt count in assembly" Linux 4.19.91 Grygorii Strashko (1): net: ethernet: ti: cpsw: fix extra rx interrupt Guillaume Nault (3): tcp: fix rejected syncookies due to stale timestamps tcp: tighten acceptance of ACKs not matching a child socket tcp: Protect accesses to .ts_recent_stamp with {READ, WRITE}_ONCE() Huy Nguyen (1): net/mlx5e: Query global pause state before setting prio2buffer Jian-Hong Pan (1): PCI/MSI: Fix incorrect MSI-X masking on resume Jiang Yi (1): vfio/pci: call irq_bypass_unregister_producer() before freeing irq Lihua Yao (1): ARM: dts: s3c64xx: Fix init order of clock providers Long Li (4): cifs: smbd: Return -EAGAIN when transport is reconnecting cifs: smbd: Add messages on RDMA session destroy and reconnection cifs: smbd: Return -EINVAL when the number of iovs exceeds SMBDIRECT_MAX_SGE cifs: Don't display RDMA transport on reconnect Martin Blumenstingl (1): drm: meson: venc: cvbs: fix CVBS mode matching Mathias Nyman (1): xhci: fix USB3 device initiated resume race with roothub autosuspend Max Filippov (1): xtensa: fix TLB sanity checker Mian Yousaf Kaukab (1): net: thunderx: start phy before starting autonegotiation Mike Snitzer (1): dm mpath: remove harmful bio-based optimization Navid Emamdoost (1): dma-buf: Fix memory leak in sync_file_merge() Nikolay Aleksandrov (1): net: bridge: deny dev_set_mac_address() when unregistering Pavel Shilovsky (2): CIFS: Respect O_SYNC and O_DIRECT flags during reconnect CIFS: Close open handle after interrupted close Steffen Liebergeld (1): PCI: Fix Intel ACS quirk UPDCR register address Taehee Yoo (1): tipc: fix ordering of tipc module init and exit routine Vladyslav Tarasiuk (1): mqprio: Fix out-of-bounds access in mqprio_dump Makefile | 2 +- arch/arm/boot/dts/s3c6410-mini6410.dts | 4 + arch/arm/boot/dts/s3c6410-smdk6410.dts | 4 + arch/arm/mach-tegra/reset-handler.S | 6 +- arch/arm64/include/asm/assembler.h | 8 +- arch/arm64/kernel/entry.S | 8 +- arch/xtensa/mm/tlb.c | 4 +- drivers/dma-buf/sync_file.c | 2 +- drivers/gpu/drm/meson/meson_venc_cvbs.c | 48 ++++--- drivers/gpu/drm/radeon/r100.c | 4 +- drivers/gpu/drm/radeon/r200.c | 4 +- drivers/md/dm-mpath.c | 37 +---- drivers/mmc/core/block.c | 151 ++++++++------------- drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 2 +- .../ethernet/mellanox/mlx5/core/en/port_buffer.c | 27 +++- drivers/net/ethernet/ti/cpsw.c | 2 +- drivers/pci/msi.c | 2 +- drivers/pci/pci-driver.c | 17 ++- drivers/pci/quirks.c | 22 +-- drivers/rpmsg/qcom_glink_native.c | 53 ++++++-- drivers/rpmsg/qcom_glink_smem.c | 2 +- drivers/scsi/libiscsi.c | 4 +- drivers/usb/host/xhci-hub.c | 8 ++ drivers/usb/host/xhci-ring.c | 3 +- drivers/vfio/pci/vfio_pci_intrs.c | 2 +- fs/cifs/cifs_debug.c | 5 + fs/cifs/file.c | 7 + fs/cifs/smb2misc.c | 59 ++++++-- fs/cifs/smb2pdu.c | 16 ++- fs/cifs/smb2proto.h | 3 + fs/cifs/smbdirect.c | 8 +- fs/cifs/transport.c | 7 +- include/linux/netdevice.h | 5 + include/linux/time.h | 13 ++ include/net/ip.h | 5 + include/net/tcp.h | 27 ++-- net/bridge/br_device.c | 6 + net/core/dev.c | 3 +- net/core/flow_dissector.c | 5 +- net/ipv4/devinet.c | 5 - net/ipv4/ip_output.c | 13 +- net/ipv4/tcp_output.c | 5 +- net/openvswitch/conntrack.c | 11 ++ net/sched/sch_mq.c | 1 + net/sched/sch_mqprio.c | 3 +- net/tipc/core.c | 29 ++-- 46 files changed, 400 insertions(+), 262 deletions(-) -- 1.8.3

1 45

[PATCH] ext4: check for directory entries too close to block end
by Yang Yingliang 16 Jan '20

16 Jan '20

From: Jan Kara <jack(a)suse.cz> commit 109ba779d6cca2d519c5dd624a3276d03e21948e upstream. ext4_check_dir_entry() currently does not catch a case when a directory entry ends so close to the block end that the header of the next directory entry would not fit in the remaining space. This can lead to directory iteration code trying to access address beyond end of current buffer head leading to oops. CC: stable(a)vger.kernel.org Signed-off-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20191202170213.4761-3-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/ext4/dir.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c index 46d5c40..d947c5e 100644 --- a/fs/ext4/dir.c +++ b/fs/ext4/dir.c @@ -77,6 +77,11 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, error_msg = "rec_len is too small for name_len"; else if (unlikely(((char *) de - buf) + rlen > size)) error_msg = "directory entry overrun"; + else if (unlikely(((char *) de - buf) + rlen > + size - EXT4_DIR_REC_LEN(1) && + ((char *) de - buf) + rlen != size)) { + error_msg = "directory entry too close to block end"; + } else if (unlikely(le32_to_cpu(de->inode) > le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count))) error_msg = "inode out of bounds"; -- 1.8.3

1 0

[PATCH] ext4: fix ext4_empty_dir() for directories with holes
by Yang Yingliang 16 Jan '20

16 Jan '20

From: Jan Kara <jack(a)suse.cz> commit 64d4ce892383b2ad6d782e080d25502f91bf2a38 upstream. Function ext4_empty_dir() doesn't correctly handle directories with holes and crashes on bh->b_data dereference when bh is NULL. Reorganize the loop to use 'offset' variable all the times instead of comparing pointers to current direntry with bh->b_data pointer. Also add more strict checking of '.' and '..' directory entries to avoid entering loop in possibly invalid state on corrupted filesystems. References: CVE-2019-19037 CC: stable(a)vger.kernel.org Fixes: 4e19d6b65fb4 ("ext4: allow directory holes") Signed-off-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20191202170213.4761-2-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/ext4/namei.c | 32 ++++++++++++++++++-------------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index f56d6f1..43dcb91 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -2693,7 +2693,7 @@ bool ext4_empty_dir(struct inode *inode) { unsigned int offset; struct buffer_head *bh; - struct ext4_dir_entry_2 *de, *de1; + struct ext4_dir_entry_2 *de; struct super_block *sb; if (ext4_has_inline_data(inode)) { @@ -2718,19 +2718,25 @@ bool ext4_empty_dir(struct inode *inode) return true; de = (struct ext4_dir_entry_2 *) bh->b_data; - de1 = ext4_next_entry(de, sb->s_blocksize); - if (le32_to_cpu(de->inode) != inode->i_ino || - le32_to_cpu(de1->inode) == 0 || - strcmp(".", de->name) || strcmp("..", de1->name)) { - ext4_warning_inode(inode, "directory missing '.' and/or '..'"); + if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size, + 0) || + le32_to_cpu(de->inode) != inode->i_ino || strcmp(".", de->name)) { + ext4_warning_inode(inode, "directory missing '.'"); + brelse(bh); + return true; + } + offset = ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); + de = ext4_next_entry(de, sb->s_blocksize); + if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size, + offset) || + le32_to_cpu(de->inode) == 0 || strcmp("..", de->name)) { + ext4_warning_inode(inode, "directory missing '..'"); brelse(bh); return true; } - offset = ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize) + - ext4_rec_len_from_disk(de1->rec_len, sb->s_blocksize); - de = ext4_next_entry(de1, sb->s_blocksize); + offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); while (offset < inode->i_size) { - if ((void *) de >= (void *) (bh->b_data+sb->s_blocksize)) { + if (!(offset & (sb->s_blocksize - 1))) { unsigned int lblock; brelse(bh); lblock = offset >> EXT4_BLOCK_SIZE_BITS(sb); @@ -2741,12 +2747,11 @@ bool ext4_empty_dir(struct inode *inode) } if (IS_ERR(bh)) return true; - de = (struct ext4_dir_entry_2 *) bh->b_data; } + de = (struct ext4_dir_entry_2 *) (bh->b_data + + (offset & (sb->s_blocksize - 1))); if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size, offset)) { - de = (struct ext4_dir_entry_2 *)(bh->b_data + - sb->s_blocksize); offset = (offset | (sb->s_blocksize - 1)) + 1; continue; } @@ -2755,7 +2760,6 @@ bool ext4_empty_dir(struct inode *inode) return false; } offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); - de = ext4_next_entry(de, sb->s_blocksize); } brelse(bh); return true; -- 1.8.3

1 0

[PATCH] KVM: arm/arm64: vgic: Replace spin_is_locked() with lockdep
by Yang Yingliang 14 Jan '20

14 Jan '20

From: Lance Roy <ldr709(a)gmail.com> mainline inclusion from mainline-v5.0-rc1 commit d4d592a6eeda1e381f38f398e7a0474a599c11ed category: feature feature: convert assertions of spin_is_locked() into lockdep_assert_held() ------------------------------------------------- lockdep_assert_held() is better suited to checking locking requirements, since it only checks if the current thread holds the lock regardless of whether someone else does. This is also a step towards possibly removing spin_is_locked(). Signed-off-by: Lance Roy <ldr709(a)gmail.com> Cc: Marc Zyngier <marc.zyngier(a)arm.com> Cc: Eric Auger <eric.auger(a)redhat.com> Cc: linux-arm-kernel(a)lists.infradead.org Cc: <kvmarm(a)lists.cs.columbia.edu> Signed-off-by: Paul E. McKenney <paulmck(a)linux.ibm.com> Acked-by: Christoffer Dall <christoffer.dall(a)arm.com> Signed-off-by: Zenghui Yu <yuzenghui(a)huawei.com> Reviewed-by: Hailiang Zhang <zhang.zhanghailiang(a)huawei.com> Signed-off-by: Lance Roy <ldr709(a)gmail.com> Signed-off-by: Paul E. McKenney <paulmck(a)linux.ibm.com> Acked-by: Christoffer Dall <christoffer.dall(a)arm.com> Signed-off-by: Zenghui Yu <yuzenghui(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- virt/kvm/arm/vgic/vgic.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c index 4040a33..d3ce29f 100644 --- a/virt/kvm/arm/vgic/vgic.c +++ b/virt/kvm/arm/vgic/vgic.c @@ -196,7 +196,7 @@ void vgic_irq_set_phys_active(struct vgic_irq *irq, bool active) */ static struct kvm_vcpu *vgic_target_oracle(struct vgic_irq *irq) { - DEBUG_SPINLOCK_BUG_ON(!spin_is_locked(&irq->irq_lock)); + lockdep_assert_held(&irq->irq_lock); /* If the interrupt is active, it must stay on the current vcpu */ if (irq->active) @@ -280,7 +280,7 @@ static void vgic_sort_ap_list(struct kvm_vcpu *vcpu) { struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu; - DEBUG_SPINLOCK_BUG_ON(!spin_is_locked(&vgic_cpu->ap_list_lock)); + lockdep_assert_held(&vgic_cpu->ap_list_lock); list_sort(NULL, &vgic_cpu->ap_list_head, vgic_irq_cmp); } @@ -318,7 +318,7 @@ bool vgic_queue_irq_unlock(struct kvm *kvm, struct vgic_irq *irq, { struct kvm_vcpu *vcpu; - DEBUG_SPINLOCK_BUG_ON(!spin_is_locked(&irq->irq_lock)); + lockdep_assert_held(&irq->irq_lock); retry: vcpu = vgic_target_oracle(irq); @@ -709,7 +709,7 @@ static inline void vgic_fold_lr_state(struct kvm_vcpu *vcpu) static inline void vgic_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr) { - DEBUG_SPINLOCK_BUG_ON(!spin_is_locked(&irq->irq_lock)); + lockdep_assert_held(&irq->irq_lock); if (kvm_vgic_global_state.type == VGIC_V2) vgic_v2_populate_lr(vcpu, irq, lr); @@ -743,7 +743,7 @@ static int compute_ap_list_depth(struct kvm_vcpu *vcpu, *multi_sgi = false; - DEBUG_SPINLOCK_BUG_ON(!spin_is_locked(&vgic_cpu->ap_list_lock)); + lockdep_assert_held(&vgic_cpu->ap_list_lock); list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) { int w; @@ -768,7 +768,7 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu) bool multi_sgi; u8 prio = 0xff; - DEBUG_SPINLOCK_BUG_ON(!spin_is_locked(&vgic_cpu->ap_list_lock)); + lockdep_assert_held(&vgic_cpu->ap_list_lock); count = compute_ap_list_depth(vcpu, &multi_sgi); if (count > kvm_vgic_global_state.nr_lr || multi_sgi) -- 1.8.3

1 0