- Kernel - mailweb.openeuler.org

[PATCH master] staging: r8188eu: fix a memory leak in rtw_mp_QueryDrv()
by Jianglei Nie 12 Dec '21

12 Dec '21

stable inclusion category: bugfix bugzilla: NA CVE: NA Line 6191 (#1) allocates a memory chunk for input by kmalloc(). Line 6213 (#3) frees the input before the function returns while line 6199 (#2) forget to free it, which will lead to a memory leak. This bug influences all stable versions from 5.15.1 to 5.15.7. We should kfree() input in line 6199 (#2). 6186 static int rtw_mp_QueryDrv(struct net_device *dev, 6187 struct iw_request_info *info, 6188 union iwreq_data *wrqu, char *extra) 6189 { 6191 char *input = kmalloc(wrqu->data.length, GFP_KERNEL); // #1: kmalloc space 6195 if (!input) 6196 return -ENOMEM; 6198 if (copy_from_user(input, wrqu->data.pointer, wrqu->data.length)) 6199 return -EFAULT; // #2: missing kfree 6213 kfree(input); // #3: kfree space 6214 return 0; 6215 } Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> --- drivers/staging/r8188eu/os_dep/ioctl_linux.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c index 906a57eae1af..edc660f15436 100644 --- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c +++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c @@ -6195,8 +6195,11 @@ static int rtw_mp_QueryDrv(struct net_device *dev, if (!input) return -ENOMEM; - if (copy_from_user(input, wrqu->data.pointer, wrqu->data.length)) - return -EFAULT; + if (copy_from_user(input, wrqu->data.pointer, wrqu->data.length)) { + kfree(input); + return -EFAULT; + } + DBG_88E("%s:iwpriv in =%s\n", __func__, input); qAutoLoad = strncmp(input, "autoload", 8); /* strncmp true is 0 */ -- 2.25.1

1 0

[PATCH master] staging: r8188eu: fix a memory leak in rtw_mp_pwrtrk()
by Jianglei Nie 12 Dec '21

12 Dec '21

stable inclusion category: bugfix bugzilla: NA CVE: NA Line 5968 (#1) allocates a memory chunk for input by kmalloc(). Line 5973 (#2), line 5989 (#4) and line 5994 (#5) free the input before the function returns while line 5986 (#3) forget to free it, which will lead to a memory leak. This bug influences all stable versions from 5.15 to 5.15.7. We should kfree() input in line 5986 (#3). 5960 static int rtw_mp_pwrtrk(struct net_device *dev, 5961 struct iw_request_info *info, 5962 struct iw_point *wrqu, char *extra) 5963 { 5968 char *input = kmalloc(wrqu->length, GFP_KERNEL); // #1: kmalloc space 5970 if (!input) 5971 return -ENOMEM; 5972 if (copy_from_user(input, wrqu->pointer, wrqu->length)) { 5973 kfree(input); // #2: kfree space 5974 return -EFAULT; 5975 } 5980 if (strncmp(input, "stop", 4) == 0) { 5981 enable = 0; 5982 sprintf(extra, "mp tx power tracking stop"); 5983 } else if (sscanf(input, "ther =%d", &thermal)) { 5984 ret = Hal_SetThermalMeter(padapter, (u8)thermal); 5985 if (ret == _FAIL) 5986 return -EPERM; // #3: missing kfree 5987 sprintf(extra, "mp tx power tracking start, target value =%d ok ", thermal); 5988 } else { 5989 kfree(input); // #4: kfree space 5990 return -EINVAL; 5991 } 5994 kfree(input); // #5: kfree space 6000 return 0; 6001 } Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> --- drivers/staging/r8188eu/os_dep/ioctl_linux.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c index 0eccce57c63a..906a57eae1af 100644 --- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c +++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c @@ -5982,8 +5982,10 @@ static int rtw_mp_pwrtrk(struct net_device *dev, sprintf(extra, "mp tx power tracking stop"); } else if (sscanf(input, "ther =%d", &thermal)) { ret = Hal_SetThermalMeter(padapter, (u8)thermal); - if (ret == _FAIL) + if (ret == _FAIL) { + kfree(input); return -EPERM; + } sprintf(extra, "mp tx power tracking start, target value =%d ok ", thermal); } else { kfree(input); -- 2.25.1

1 0

[PATCH master] powercap: DTPM: Fix reference leak in cpuhp_dtpm_cpu_offline()
by Jianglei Nie 12 Dec '21

12 Dec '21

stable inclusion category: bugfix bugzilla: NA CVE: NA In line 153 (#1), cpufreq_cpu_get() increments the kobject reference counter of the policy it returned on success. According to the document, the policy returned by cpufreq_cpu_get() has to be released with the help of cpufreq_cpu_put() to balance its kobject reference counter properly. Forgetting the cpufreq_cpu_put() operation will result in reference leak.This bug influences all stable versions from v5.15 to v5.15.7. We can fix it by calling cpufreq_cpu_put() before the function returns (#2, #3 and #4). 147 static int cpuhp_dtpm_cpu_offline(unsigned int cpu) 148 { 153 policy = cpufreq_cpu_get(cpu); // #1: reference increment 155 if (!policy) 156 return 0; 158 pd = em_cpu_get(cpu); 159 if (!pd) 160 return -EINVAL; // #2: missing reference decrement 166 if (cpumask_weight(policy->cpus) != 1) 167 return 0; // #3: missing reference decrement 174 return 0; // #4: missing reference decrement 175 } Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> --- drivers/powercap/dtpm_cpu.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/powercap/dtpm_cpu.c b/drivers/powercap/dtpm_cpu.c index 51c366938acd..6c94515b21ef 100644 --- a/drivers/powercap/dtpm_cpu.c +++ b/drivers/powercap/dtpm_cpu.c @@ -156,21 +156,25 @@ static int cpuhp_dtpm_cpu_offline(unsigned int cpu) return 0; pd = em_cpu_get(cpu); - if (!pd) + if (!pd) { + cpufreq_cpu_put(policy); return -EINVAL; + } dtpm = per_cpu(dtpm_per_cpu, cpu); power_sub(dtpm, pd); - if (cpumask_weight(policy->cpus) != 1) + if (cpumask_weight(policy->cpus) != 1) { + cpufreq_cpu_put(policy); return 0; + } for_each_cpu(cpu, policy->related_cpus) per_cpu(dtpm_per_cpu, cpu) = NULL; dtpm_unregister(dtpm); - + cpufreq_cpu_put(policy); return 0; } -- 2.25.1

1 0

[PATCH master] security:trusted_tpm2: Fix memory leak in tpm2_key_encode()
by Jianglei Nie 12 Dec '21

12 Dec '21

openEuler inclusion category: bugfix bugzilla: NA CVE: NA Line 36 (#1) allocates a memory chunk for scratch by kmalloc(), but it is never freed through the function, which will lead to a memory leak. We should kfree() scratch before the function returns (#2, #3 and #4). 31 static int tpm2_key_encode(struct trusted_key_payload *payload, 32 struct trusted_key_options *options, 33 u8 *src, u32 len) 34 { 36 u8 *scratch = kmalloc(SCRATCH_SIZE, GFP_KERNEL); // #1: kmalloc space 37 u8 *work = scratch, *work1; 50 if (!scratch) 51 return -ENOMEM; 56 if (options->blobauth_len == 0) { 60 if (WARN(IS_ERR(w), "BUG: Boolean failed to encode")) 61 return PTR_ERR(w); // #2: missing kfree 63 } 71 if (WARN(work - scratch + pub_len + priv_len + 14 > SCRATCH_SIZE, 72 "BUG: scratch buffer is too small")) 73 return -EINVAL; // #3: missing kfree // #4: missing kfree: scratch is never used afterwards. 82 if (WARN(IS_ERR(work1), "BUG: ASN.1 encoder failed")) 83 return PTR_ERR(work1); 85 return work1 - payload->blob; 86 } Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> --- security/keys/trusted-keys/trusted_tpm2.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c index 0165da386289..3408a74c855f 100644 --- a/security/keys/trusted-keys/trusted_tpm2.c +++ b/security/keys/trusted-keys/trusted_tpm2.c @@ -57,8 +57,10 @@ static int tpm2_key_encode(struct trusted_key_payload *payload, unsigned char bool[3], *w = bool; /* tag 0 is emptyAuth */ w = asn1_encode_boolean(w, w + sizeof(bool), true); - if (WARN(IS_ERR(w), "BUG: Boolean failed to encode")) + if (WARN(IS_ERR(w), "BUG: Boolean failed to encode")) { + kfree(scratch); return PTR_ERR(w); + } work = asn1_encode_tag(work, end_work, 0, bool, w - bool); } @@ -69,9 +71,12 @@ static int tpm2_key_encode(struct trusted_key_payload *payload, * trigger, so if it does there's something nefarious going on */ if (WARN(work - scratch + pub_len + priv_len + 14 > SCRATCH_SIZE, - "BUG: scratch buffer is too small")) + "BUG: scratch buffer is too small")) { + kfree(scratch); return -EINVAL; + } + kfree(scratch); work = asn1_encode_integer(work, end_work, options->keyhandle); work = asn1_encode_octet_string(work, end_work, pub, pub_len); work = asn1_encode_octet_string(work, end_work, priv, priv_len); -- 2.25.1

1 0

[PATCH master] btrfs: Fix memory leak in __add_inode_ref()
by Jianglei Nie 12 Dec '21

12 Dec '21

openEuler inclusion category: bugfix bugzilla: NA CVE: NA Line 1169 (#3) allocates a memory chunk for victim_name by kmalloc(), but when the function returns in line 1184 (#4) victim_name allcoated by line 1169 (#3) is not freed, which will lead to a memory leak. There is a similar snippet of code in this function as allocating a memory chunk for victim_name in line 1104 (#1) as well as releasing the memory in line 1116 (#2). We should kfree() victim_name when the return value of backref_in_log() is less than zero and before the function returns in line 1184 (#4). 1057 static inline int __add_inode_ref(struct btrfs_trans_handle *trans, 1058 struct btrfs_root *root, 1059 struct btrfs_path *path, 1060 struct btrfs_root *log_root, 1061 struct btrfs_inode *dir, 1062 struct btrfs_inode *inode, 1063 u64 inode_objectid, u64 parent_objectid, 1064 u64 ref_index, char *name, int namelen, 1065 int *search_done) 1066 { 1104 victim_name = kmalloc(victim_name_len, GFP_NOFS); // #1: kmalloc (victim_name-1) 1105 if (!victim_name) 1106 return -ENOMEM; 1112 ret = backref_in_log(log_root, &search_key, 1113 parent_objectid, victim_name, 1114 victim_name_len); 1115 if (ret < 0) { 1116 kfree(victim_name); // #2: kfree (victim_name-1) 1117 return ret; 1118 } else if (!ret) { 1169 victim_name = kmalloc(victim_name_len, GFP_NOFS); // #3: kmalloc (victim_name-2) 1170 if (!victim_name) 1171 return -ENOMEM; 1180 ret = backref_in_log(log_root, &search_key, 1181 parent_objectid, victim_name, 1182 victim_name_len); 1183 if (ret < 0) { 1184 return ret; // #4: missing kfree (victim_name-2) 1185 } else if (!ret) { 1241 return 0; 1242 } Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> --- fs/btrfs/tree-log.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c index 8ab33caf016f..d373fec55521 100644 --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -1181,6 +1181,7 @@ static inline int __add_inode_ref(struct btrfs_trans_handle *trans, parent_objectid, victim_name, victim_name_len); if (ret < 0) { + kfree(victim_name); return ret; } else if (!ret) { ret = -ENOENT; -- 2.25.1

1 0

[PATCH master] scsi: csiostor: Fix memory leak in csio_wr_eq_destroy()
by Jianglei Nie 12 Dec '21

12 Dec '21

openEuler inclusion category: bugfix bugzilla: NA CVE: NA Line 715 (#1) calls mempool_alloc() to allocate an element from a specific memory pool. When some errors occur, line 727 (#2) frees this memory pool but line 731 (#3) does not free it, which will lead to a memory leak. We can fix it by calling mempool_free() when the cbfn is not equal to NULL and before the function returns 0 in line 732 (#3). 705 static int 706 csio_wr_eq_destroy(struct csio_hw *hw, void *priv, int eq_idx, 707 void (*cbfn) (struct csio_hw *, struct csio_mb *)) 708 { 710 struct csio_mb *mbp; 715 mbp = mempool_alloc(hw->mb_mempool, GFP_ATOMIC); // #1: allocate memory pool 716 if (!mbp) 717 return -ENOMEM; 725 rv = csio_mb_issue(hw, mbp); 726 if (rv != 0) { 727 mempool_free(mbp, hw->mb_mempool); // #2: free memory pool 728 return rv; 729 } 731 if (cbfn != NULL) 732 return 0; // #3: missing free 734 return csio_wr_eq_destroy_rsp(hw, mbp, eq_idx); 735 } Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> --- drivers/scsi/csiostor/csio_wr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/csiostor/csio_wr.c b/drivers/scsi/csiostor/csio_wr.c index fe0355c964bc..7dcc4fda0483 100644 --- a/drivers/scsi/csiostor/csio_wr.c +++ b/drivers/scsi/csiostor/csio_wr.c @@ -728,8 +728,10 @@ csio_wr_eq_destroy(struct csio_hw *hw, void *priv, int eq_idx, return rv; } - if (cbfn != NULL) + if (cbfn != NULL) { + mempool_free(mbp, hw->mb_mempool); return 0; + } return csio_wr_eq_destroy_rsp(hw, mbp, eq_idx); } -- 2.25.1

1 0

[PATCH master] drm/amdgpu: Fix reference leak in psp_xgmi_reflect_topology_info()
by Jianglei Nie 12 Dec '21

12 Dec '21

openEuler inclusion category: bugfix bugzilla: NA CVE: NA In line 1138 (#1), amdgpu_get_xgmi_hive() increases the kobject reference counter of the hive it returned. The hive returned by amdgpu_get_xgmi_hive() should be released with the help of amdgpu_put_xgmi_hive() to balance its kobject reference counter properly. Forgetting the amdgpu_put_xgmi_hive() operation will result in reference leak. We can fix it by calling amdgpu_put_xgmi_hive() before the end of the function (#2). 1128 static void psp_xgmi_reflect_topology_info(struct psp_context *psp, 1129 struct psp_xgmi_node_info node_info) 1130 { 1138 hive = amdgpu_get_xgmi_hive(psp->adev); // #1: kzalloc space reference increment 1139 list_for_each_entry(mirror_adev, &hive->device_list, gmc.xgmi.head) { 1140 struct psp_xgmi_topology_info *mirror_top_info; 1141 int j; 1143 if (mirror_adev->gmc.xgmi.node_id != dst_node_id) 1144 continue; 1146 mirror_top_info = &mirror_adev->psp.xgmi_context.top_info; 1147 for (j = 0; j < mirror_top_info->num_nodes; j++) { 1148 if (mirror_top_info->nodes[j].node_id != src_node_id) 1149 continue; 1151 mirror_top_info->nodes[j].num_hops = dst_num_hops; 1157 if (dst_num_links) 1158 mirror_top_info->nodes[j].num_links = dst_num_links; 1160 break; 1161 } 1163 break; 1164 } // #2: missing reference decrement 1165 } Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c index c641f84649d6..f6362047ed71 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c @@ -1162,6 +1162,7 @@ static void psp_xgmi_reflect_topology_info(struct psp_context *psp, break; } + amdgpu_put_xgmi_hive(hive); } int psp_xgmi_get_topology_info(struct psp_context *psp, -- 2.25.1

1 0

[PATCH master] nfp: Fix memory leak in nfp_cpp_area_cache_add()
by Jianglei Nie 12 Dec '21

12 Dec '21

mainline inclusion from mainline-v5.16-rc7 category: bugfix commit: c56c96303e9289cc34716b1179597b6f470833de bugzilla: NA CVE: NA ------------------------ In line 800 (#1), nfp_cpp_area_alloc() allocates and initializes a CPP area structure. But in line 807 (#2), when the cache is allocated failed, this CPP area structure is not freed, which will result in memory leak. We can fix it by freeing the CPP area when the cache is allocated failed (#2). 792 int nfp_cpp_area_cache_add(struct nfp_cpp *cpp, size_t size) 793 { 794 struct nfp_cpp_area_cache *cache; 795 struct nfp_cpp_area *area; 800 area = nfp_cpp_area_alloc(cpp, NFP_CPP_ID(7, NFP_CPP_ACTION_RW, 0), 801 0, size); // #1: allocates and initializes 802 if (!area) 803 return -ENOMEM; 805 cache = kzalloc(sizeof(*cache), GFP_KERNEL); 806 if (!cache) 807 return -ENOMEM; // #2: missing free 817 return 0; 818 } Fixes: 4cb584e0ee7d ("nfp: add CPP access core") Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> Acked-by: Simon Horman <simon.horman(a)corigine.com> Link: https://lore.kernel.org/r/20211209061511.122535-1-niejianglei2021@163.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> --- drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c index d7ac0307797f..34c0d2ddf9ef 100644 --- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c +++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c @@ -803,8 +803,10 @@ int nfp_cpp_area_cache_add(struct nfp_cpp *cpp, size_t size) return -ENOMEM; cache = kzalloc(sizeof(*cache), GFP_KERNEL); - if (!cache) + if (!cache) { + nfp_cpp_area_free(area); return -ENOMEM; + } cache->id = 0; cache->addr = 0; -- 2.25.1

1 0

Re: [PATCH] btrfs: Fix memory leak in __add_inode_ref()
by Xie XiuQi 10 Dec '21

10 Dec '21

Hi, Thanks for your patchset. Please subscribe the kernel(a)openeuler.org and kernel-discuss(a)openeuler.org mailing list before sending patchs, or your patchs would be blocked. Welcome to start a topic at openEuler kernel sig meeting via seeding mail to kernel-discuss(a)openeuler.org. --- 可以通过openEuler kernel 小助手，参加openEuler kernel SIG 微信群。 https://openeuler.gitee.io/kernel-portal/img/wechat/openEuler_kernel_helper… On 2021/12/10 16:09, Jianglei Nie wrote: > Line 1169 (#3) allocates a memory chunk for victim_name by kmalloc(), > but when the function returns in line 1184 (#4) victim_name allcoated > by line 1169 (#3) is not freed, which will lead to a memory leak. > There is a similar snippet of code in this function as allocating a memory > chunk for victim_name in line 1104 (#1) as well as releasing the memory > in line 1116 (#2). > > We should kfree() victim_name when the return value of backref_in_log() > is less than zero and before the function returns in line 1184 (#4). > > 1057 static inline int __add_inode_ref(struct btrfs_trans_handle *trans, > 1058 struct btrfs_root *root, > 1059 struct btrfs_path *path, > 1060 struct btrfs_root *log_root, > 1061 struct btrfs_inode *dir, > 1062 struct btrfs_inode *inode, > 1063 u64 inode_objectid, u64 parent_objectid, > 1064 u64 ref_index, char *name, int namelen, > 1065 int *search_done) > 1066 { > > 1104 victim_name = kmalloc(victim_name_len, GFP_NOFS); > // #1: kmalloc (victim_name-1) > 1105 if (!victim_name) > 1106 return -ENOMEM; > > 1112 ret = backref_in_log(log_root, &search_key, > 1113 parent_objectid, victim_name, > 1114 victim_name_len); > 1115 if (ret < 0) { > 1116 kfree(victim_name); // #2: kfree (victim_name-1) > 1117 return ret; > 1118 } else if (!ret) { > > 1169 victim_name = kmalloc(victim_name_len, GFP_NOFS); > // #3: kmalloc (victim_name-2) > 1170 if (!victim_name) > 1171 return -ENOMEM; > > 1180 ret = backref_in_log(log_root, &search_key, > 1181 parent_objectid, victim_name, > 1182 victim_name_len); > 1183 if (ret < 0) { > 1184 return ret; // #4: missing kfree (victim_name-2) > 1185 } else if (!ret) { > > 1241 return 0; > 1242 } > > Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> > --- > fs/btrfs/tree-log.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c > index 8ab33caf016f..d373fec55521 100644 > --- a/fs/btrfs/tree-log.c > +++ b/fs/btrfs/tree-log.c > @@ -1181,6 +1181,7 @@ static inline int __add_inode_ref(struct btrfs_trans_handle *trans, > parent_objectid, victim_name, > victim_name_len); > if (ret < 0) { > + kfree(victim_name); > return ret; > } else if (!ret) { > ret = -ENOENT; >

1 0

[PATCH openEuler-5.10 1/7] bfq: Remove merged request already in bfq_requests_merged()
by Zheng Zengkai 10 Dec '21

10 Dec '21

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v5.14-rc1 commit a921c655f2033dd1ce1379128efe881dda23ea37 category: bugfix bugzilla: 185777 https://gitee.com/openeuler/kernel/issues/I4LM14 CVE: NA --------------------------- Currently, bfq does very little in bfq_requests_merged() and handles all the request cleanup in bfq_finish_requeue_request() called from blk_mq_free_request(). That is currently safe only because blk_mq_free_request() is called shortly after bfq_requests_merged() while bfqd->lock is still held. However to fix a lock inversion between bfqd->lock and ioc->lock, we need to call blk_mq_free_request() after dropping bfqd->lock. That would mean that already merged request could be seen by other processes inside bfq queues and possibly dispatched to the device which is wrong. So move cleanup of the request from bfq_finish_requeue_request() to bfq_requests_merged(). Acked-by: Paolo Valente <paolo.valente(a)linaro.org> Signed-off-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20210623093634.27879-2-jack@suse.cz Signed-off-by: Jens Axboe <axboe(a)kernel.dk> conflict: in bfq_finish_requeue_request, code in hulk have the line atomic_dec(&rq->mq_hctx->elevator_queued); that is conflicted; Signed-off-by: zhangwensheng <zhangwensheng5(a)huawei.com> Reviewed-by: qiulaibin <qiulaibin(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/bfq-iosched.c | 41 +++++++++++++---------------------------- 1 file changed, 13 insertions(+), 28 deletions(-) diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c index fd3c23d516b8..27e01b4cd528 100644 --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -2326,7 +2326,7 @@ static void bfq_requests_merged(struct request_queue *q, struct request *rq, *next_bfqq = bfq_init_rq(next); if (!bfqq) - return; + goto remove; /* * If next and rq belong to the same bfq_queue and next is older @@ -2349,6 +2349,14 @@ static void bfq_requests_merged(struct request_queue *q, struct request *rq, bfqq->next_rq = rq; bfqg_stats_update_io_merged(bfqq_group(bfqq), next->cmd_flags); +remove: + /* Merged request may be in the IO scheduler. Remove it. */ + if (!RB_EMPTY_NODE(&next->rb_node)) { + bfq_remove_request(next->q, next); + if (next_bfqq) + bfqg_stats_update_io_remove(bfqq_group(next_bfqq), + next->cmd_flags); + } } /* Must be called with bfqq != NULL */ @@ -5901,6 +5909,7 @@ static void bfq_finish_requeue_request(struct request *rq) { struct bfq_queue *bfqq = RQ_BFQQ(rq); struct bfq_data *bfqd; + unsigned long flags; /* * rq either is not associated with any icq, or is an already @@ -5918,40 +5927,16 @@ static void bfq_finish_requeue_request(struct request *rq) rq->io_start_time_ns, rq->cmd_flags); + spin_lock_irqsave(&bfqd->lock, flags); if (likely(rq->rq_flags & RQF_STARTED)) { - unsigned long flags; - - spin_lock_irqsave(&bfqd->lock, flags); - if (rq == bfqd->waited_rq) bfq_update_inject_limit(bfqd, bfqq); bfq_completed_request(bfqq, bfqd); - bfq_finish_requeue_request_body(bfqq); atomic_dec(&rq->mq_hctx->elevator_queued); - - spin_unlock_irqrestore(&bfqd->lock, flags); - } else { - /* - * Request rq may be still/already in the scheduler, - * in which case we need to remove it (this should - * never happen in case of requeue). And we cannot - * defer such a check and removal, to avoid - * inconsistencies in the time interval from the end - * of this function to the start of the deferred work. - * This situation seems to occur only in process - * context, as a consequence of a merge. In the - * current version of the code, this implies that the - * lock is held. - */ - - if (!RB_EMPTY_NODE(&rq->rb_node)) { - bfq_remove_request(rq->q, rq); - bfqg_stats_update_io_remove(bfqq_group(bfqq), - rq->cmd_flags); - } - bfq_finish_requeue_request_body(bfqq); } + bfq_finish_requeue_request_body(bfqq); + spin_unlock_irqrestore(&bfqd->lock, flags); /* * Reset private fields. In case of a requeue, this allows -- 2.20.1

1 6

[PATCH openEuler-1.0-LTS v2 0/6] Add the no_hash_pointers startup parameter
by He Jinjin 10 Dec '21

10 Dec '21

The address printed by %p in the kernel will expose the kernel address information, which is extremely unsafe. So Linux v4.15 limited the information printed by %p which will print a hashed value. This patchset add no_hash_pointers startup parameter which can disable the restriction that %P only prints hashed values, so that %P can print the actual address in the kernel. I patched this function and the test modules associated with this and passed these tests after recompiling. Tobin C. Harding (3): lib/test_printf: Add empty module_exit function kselftest: Add test module framework header lib: Use new kselftest header Timur Tabi(3): kselftest: add support for skipped tests lib/vsprintf: no_hash_pointers prints all addresses as unhashed lib: use KSTM_MODULE_GLOBALS macro in kselftest drivers .../admin-guide/kernel-parameters.txt | 15 +++ Documentation/dev-tools/kselftest.rst | 94 +++++++++++++++++- lib/test_bitmap.c | 23 +---- lib/test_printf.c | 29 +++--- lib/vsprintf.c | 36 ++++++- tools/testing/selftests/kselftest_module.h | 54 ++++++++++ 6 files changed, 215 insertions(+), 36 deletions(-) create mode 100644 tools/testing/selftests/kselftest_module.h -- 2.30.0

1 6

[PATCH openEuler-1.0-LTS] block, bfq: move bfqq to root_group if parent group is offlined
by Yang Yingliang 10 Dec '21

10 Dec '21

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 185863 CVE: NA --------------------------- Our test report a uaf problem: [ 154.237639] ================================================================== [ 154.239896] BUG: KASAN: use-after-free in __bfq_deactivate_entity+0x25/0x290 [ 154.241910] Read of size 1 at addr ffff88824501f7b8 by task rmmod/2447 [ 154.244248] CPU: 7 PID: 2447 Comm: rmmod Not tainted 4.19.90+ #1 [ 154.245962] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 154.248184] Call Trace: [ 154.248532] dump_stack+0x7a/0xac [ 154.248995] print_address_description+0x6c/0x237 [ 154.249649] ? __bfq_deactivate_entity+0x25/0x290 [ 154.250297] kasan_report.cold+0x88/0x29c [ 154.250853] __bfq_deactivate_entity+0x25/0x290 [ 154.251483] bfq_pd_offline+0x13e/0x790 [ 154.252017] ? blk_mq_freeze_queue_wait+0x165/0x180 [ 154.252687] ? bfq_reparent_leaf_entity+0xa0/0xa0 [ 154.253333] ? bfq_put_queue+0x12c/0x1e0 [ 154.253877] ? kmem_cache_free+0x8e/0x1e0 [ 154.254433] ? hrtimer_active+0x53/0xa0 [ 154.254966] ? hrtimer_try_to_cancel+0x6d/0x1c0 [ 154.255576] ? __hrtimer_get_remaining+0xf0/0xf0 [ 154.256197] ? __bfq_deactivate_entity+0x11b/0x290 [ 154.256843] blkcg_deactivate_policy+0x106/0x1f0 [ 154.257464] bfq_exit_queue+0xf1/0x110 [ 154.257975] blk_mq_exit_sched+0x114/0x140 [ 154.258530] elevator_exit+0x9a/0xa0 [ 154.259023] blk_exit_queue+0x3d/0x70 [ 154.259523] blk_cleanup_queue+0x160/0x1e0 [ 154.260099] null_del_dev+0xda/0x1f0 [null_blk] [ 154.260723] null_exit+0x5f/0xab [null_blk] [ 154.261298] __x64_sys_delete_module+0x20e/0x2f0 [ 154.261931] ? __ia32_sys_delete_module+0x2f0/0x2f0 [ 154.262597] ? exit_to_usermode_loop+0x45/0xe0 [ 154.263219] do_syscall_64+0x73/0x280 [ 154.263731] ? page_fault+0x8/0x30 [ 154.264197] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 154.264882] RIP: 0033:0x7f033bf63acb [ 154.265370] Code: 73 01 c3 48 8b 0d bd 33 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8d 33 0c 00 f7 d8 64 89 01 48 [ 154.267880] RSP: 002b:00007ffc7fe52548 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 154.268900] RAX: ffffffffffffffda RBX: 00005583e2b8e530 RCX: 00007f033bf63acb [ 154.269865] RDX: 000000000000000a RSI: 0000000000000800 RDI: 00005583e2b8e598 [ 154.270837] RBP: 00007ffc7fe525a8 R08: 0000000000000000 R09: 0000000000000000 [ 154.271802] R10: 00007f033bfd7ac0 R11: 0000000000000206 R12: 00007ffc7fe52770 [ 154.272763] R13: 00007ffc7fe536f8 R14: 00005583e2b8d2a0 R15: 00005583e2b8e530 [ 154.273939] Allocated by task 2350: [ 154.274419] kasan_kmalloc+0xc6/0xe0 [ 154.274916] kmem_cache_alloc_node_trace+0x119/0x240 [ 154.275594] bfq_pd_alloc+0x50/0x510 [ 154.276081] blkg_alloc+0x237/0x310 [ 154.276557] blkg_create+0x48a/0x5e0 [ 154.277044] blkg_lookup_create+0x144/0x1c0 [ 154.277614] generic_make_request_checks+0x5cf/0xad0 [ 154.278290] generic_make_request+0xdd/0x6c0 [ 154.278877] submit_bio+0xaa/0x250 [ 154.279342] mpage_readpages+0x2a2/0x3b0 [ 154.279878] read_pages+0xdf/0x3a0 [ 154.280343] __do_page_cache_readahead+0x27c/0x2a0 [ 154.280989] ondemand_readahead+0x275/0x460 [ 154.281556] generic_file_read_iter+0xc4e/0x1790 [ 154.282182] aio_read+0x174/0x260 [ 154.282635] io_submit_one+0x7d4/0x14b0 [ 154.283164] __x64_sys_io_submit+0x102/0x230 [ 154.283749] do_syscall_64+0x73/0x280 [ 154.284250] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 154.285159] Freed by task 2315: [ 154.285588] __kasan_slab_free+0x12f/0x180 [ 154.286150] kfree+0xab/0x1d0 [ 154.286561] blkg_free.part.0+0x4a/0xe0 [ 154.287089] rcu_process_callbacks+0x424/0x6d0 [ 154.287689] __do_softirq+0x10d/0x370 [ 154.288395] The buggy address belongs to the object at ffff88824501f700 which belongs to the cache kmalloc-2048 of size 2048 [ 154.290083] The buggy address is located 184 bytes inside of 2048-byte region [ffff88824501f700, ffff88824501ff00) [ 154.291661] The buggy address belongs to the page: [ 154.292306] page:ffffea0009140600 count:1 mapcount:0 mapping:ffff88824bc0e800 index:0x0 compound_mapcount: 0 [ 154.293610] flags: 0x17ffffc0008100(slab|head) [ 154.294211] raw: 0017ffffc0008100 ffffea000896da00 0000000200000002 ffff88824bc0e800 [ 154.295247] raw: 0000000000000000 00000000800f000f 00000001ffffffff 0000000000000000 [ 154.296294] page dumped because: kasan: bad access detected [ 154.297261] Memory state around the buggy address: [ 154.297913] ffff88824501f680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 154.298884] ffff88824501f700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 154.299858] >ffff88824501f780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 154.300824] ^ [ 154.301505] ffff88824501f800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 154.302479] ffff88824501f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 154.303459] ================================================================== This is because when bfq_group is offlined, if the bfq_queues are not in active tree, their parents(bfqq->entity.partent) are still point to the offlined bfq_group. And after some ios are issued to such bfq_queues, the offlined bfq_group is reinserted to service tree. Fix the problem by move bfq_queue to root_group if we found it's parent is offlined. Fixes: e21b7a0b9887 ("block, bfq: add full hierarchical scheduling and cgroups support") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/bfq-cgroup.c | 14 ++++++++++---- block/bfq-wf2q.c | 9 +++++++++ 2 files changed, 19 insertions(+), 4 deletions(-) diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c index 78cfd008b89d7..73b82a5c03717 100644 --- a/block/bfq-cgroup.c +++ b/block/bfq-cgroup.c @@ -556,6 +556,7 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq, struct bfq_group *bfqg) { struct bfq_entity *entity = &bfqq->entity; + struct bfq_group *old_parent = bfqq_group(bfqq); /* * Get extra reference to prevent bfqq from being freed in @@ -577,17 +578,21 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq, bfq_deactivate_bfqq(bfqd, bfqq, false, false); else if (entity->on_st) bfq_put_idle_entity(bfq_entity_service_tree(entity), entity); - bfqg_and_blkg_put(bfqq_group(bfqq)); entity->parent = bfqg->my_entity; entity->sched_data = &bfqg->sched_data; /* pin down bfqg and its associated blkg */ bfqg_and_blkg_get(bfqg); - if (bfq_bfqq_busy(bfqq)) { - bfq_pos_tree_add_move(bfqd, bfqq); + /* + * Don't leave the bfqq->pos_root to old bfqg, since the ref to old + * bfqg will be released and the bfqg might be freed. + */ + bfq_pos_tree_add_move(bfqd, bfqq); + bfqg_and_blkg_put(old_parent); + + if (bfq_bfqq_busy(bfqq)) bfq_activate_bfqq(bfqd, bfqq); - } if (!bfqd->in_service_queue && !bfqd->rq_in_driver) bfq_schedule_dispatch(bfqd); @@ -860,6 +865,7 @@ static void bfq_pd_offline(struct blkg_policy_data *pd) put_async_queues: bfq_put_async_queues(bfqd, bfqg); + pd->plid = BLKCG_MAX_POLS; spin_unlock_irqrestore(&bfqd->lock, flags); /* diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c index 316a1c2d1b610..e830715fe15d6 100644 --- a/block/bfq-wf2q.c +++ b/block/bfq-wf2q.c @@ -1684,6 +1684,15 @@ void bfq_del_bfqq_busy(struct bfq_data *bfqd, struct bfq_queue *bfqq, */ void bfq_add_bfqq_busy(struct bfq_data *bfqd, struct bfq_queue *bfqq) { +#ifdef CONFIG_BFQ_GROUP_IOSCHED + /* If parent group is offlined, move the bfqq to root group */ + if (bfqq->entity.parent) { + struct bfq_group *bfqg = bfq_bfqq_to_bfqg(bfqq); + + if (bfqg->pd.plid >= BLKCG_MAX_POLS) + bfq_bfqq_move(bfqd, bfqq, bfqd->root_group); + } +#endif bfq_log_bfqq(bfqd, bfqq, "add to busy"); bfq_activate_bfqq(bfqd, bfqq); -- 2.25.1

1 0

openEuler kernel技术分享第十六期 & 双周例会
by openEuler conference 10 Dec '21

10 Dec '21

您好！ Kernel SIG 邀请您参加 2021-12-17 14:00 召开的ZOOM会议(自动录制) 会议主题：openEuler kernel技术分享第十六期 & 双周例会会议内容： 14:10-15:30 openEuler kernel 技术分享第16期-openEuler内核热补丁介绍会议链接：https://us06web.zoom.us/j/88618073121?pwd=V3JyZG5IOWRVWENieDJhNndpV2x5UT09 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the ZOOM conference(auto recording) will be held at 2021-12-17 14:00, The subject of the conference is openEuler kernel技术分享第十六期 & 双周例会, Summary: 14:10-15:30 openEuler kernel 技术分享第16期-openEuler内核热补丁介绍 You can join the meeting at https://us06web.zoom.us/j/88618073121?pwd=V3JyZG5IOWRVWENieDJhNndpV2x5UT09. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS 1/2] io_uring: fix soft lockup when call __io_remove_buffers
by Yang Yingliang 09 Dec '21

09 Dec '21

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v5.16-rc3 commit 1d0254e6b47e73222fd3d6ae95cccbaafe5b3ecf category: bugfix bugzilla: 185746 CVE: NA ----------------------------------------------- I got issue as follows: [ 567.094140] __io_remove_buffers: [1]start ctx=0xffff8881067bf000 bgid=65533 buf=0xffff8881fefe1680 [ 594.360799] watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [kworker/u32:5:108] [ 594.364987] Modules linked in: [ 594.365405] irq event stamp: 604180238 [ 594.365906] hardirqs last enabled at (604180237): [<ffffffff93fec9bd>] _raw_spin_unlock_irqrestore+0x2d/0x50 [ 594.367181] hardirqs last disabled at (604180238): [<ffffffff93fbbadb>] sysvec_apic_timer_interrupt+0xb/0xc0 [ 594.368420] softirqs last enabled at (569080666): [<ffffffff94200654>] __do_softirq+0x654/0xa9e [ 594.369551] softirqs last disabled at (569080575): [<ffffffff913e1d6a>] irq_exit_rcu+0x1ca/0x250 [ 594.370692] CPU: 2 PID: 108 Comm: kworker/u32:5 Tainted: G L 5.15.0-next-20211112+ #88 [ 594.371891] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 [ 594.373604] Workqueue: events_unbound io_ring_exit_work [ 594.374303] RIP: 0010:_raw_spin_unlock_irqrestore+0x33/0x50 [ 594.375037] Code: 48 83 c7 18 53 48 89 f3 48 8b 74 24 10 e8 55 f5 55 fd 48 89 ef e8 ed a7 56 fd 80 e7 02 74 06 e8 43 13 7b fd fb bf 01 00 00 00 <e8> f8 78 474 [ 594.377433] RSP: 0018:ffff888101587a70 EFLAGS: 00000202 [ 594.378120] RAX: 0000000024030f0d RBX: 0000000000000246 RCX: 1ffffffff2f09106 [ 594.379053] RDX: 0000000000000000 RSI: ffffffff9449f0e0 RDI: 0000000000000001 [ 594.379991] RBP: ffffffff9586cdc0 R08: 0000000000000001 R09: fffffbfff2effcab [ 594.380923] R10: ffffffff977fe557 R11: fffffbfff2effcaa R12: ffff8881b8f3def0 [ 594.381858] R13: 0000000000000246 R14: ffff888153a8b070 R15: 0000000000000000 [ 594.382787] FS: 0000000000000000(0000) GS:ffff888399c00000(0000) knlGS:0000000000000000 [ 594.383851] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 594.384602] CR2: 00007fcbe71d2000 CR3: 00000000b4216000 CR4: 00000000000006e0 [ 594.385540] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 594.386474] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 594.387403] Call Trace: [ 594.387738] <TASK> [ 594.388042] find_and_remove_object+0x118/0x160 [ 594.389321] delete_object_full+0xc/0x20 [ 594.389852] kfree+0x193/0x470 [ 594.390275] __io_remove_buffers.part.0+0xed/0x147 [ 594.390931] io_ring_ctx_free+0x342/0x6a2 [ 594.392159] io_ring_exit_work+0x41e/0x486 [ 594.396419] process_one_work+0x906/0x15a0 [ 594.399185] worker_thread+0x8b/0xd80 [ 594.400259] kthread+0x3bf/0x4a0 [ 594.401847] ret_from_fork+0x22/0x30 [ 594.402343] </TASK> Message from syslogd@localhost at Nov 13 09:09:54 ... kernel:watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [kworker/u32:5:108] [ 596.793660] __io_remove_buffers: [2099199]start ctx=0xffff8881067bf000 bgid=65533 buf=0xffff8881fefe1680 We can reproduce this issue by follow syzkaller log: r0 = syz_io_uring_setup(0x401, &(0x7f0000000300), &(0x7f0000003000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000280)=<r1=>0x0, &(0x7f0000000380)=<r2=>0x0) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000003080)={0x0, 0x0, &(0x7f0000003040)={&(0x7f0000000040)=ANY=[], 0x18}}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x5, 0x0, 0x401, 0x1, 0x0, 0x100, 0x0, 0x1, {0xfffd}}, 0x0) io_uring_enter(r0, 0x3a2d, 0x0, 0x0, 0x0, 0x0) The reason above issue is 'buf->list' has 2,100,000 nodes, occupied cpu lead to soft lockup. To solve this issue, we need add schedule point when do while loop in '__io_remove_buffers'. After add schedule point we do regression, get follow data. [ 240.141864] __io_remove_buffers: [1]start ctx=0xffff888170603000 bgid=65533 buf=0xffff8881116fcb00 [ 268.408260] __io_remove_buffers: [1]start ctx=0xffff8881b92d2000 bgid=65533 buf=0xffff888130c83180 [ 275.899234] __io_remove_buffers: [2099199]start ctx=0xffff888170603000 bgid=65533 buf=0xffff8881116fcb00 [ 296.741404] __io_remove_buffers: [1]start ctx=0xffff8881b659c000 bgid=65533 buf=0xffff8881010fe380 [ 305.090059] __io_remove_buffers: [2099199]start ctx=0xffff8881b92d2000 bgid=65533 buf=0xffff888130c83180 [ 325.415746] __io_remove_buffers: [1]start ctx=0xffff8881b92d1000 bgid=65533 buf=0xffff8881a17d8f00 [ 333.160318] __io_remove_buffers: [2099199]start ctx=0xffff8881b659c000 bgid=65533 buf=0xffff8881010fe380 ... Fixes:8bab4c09f24e("io_uring: allow conditional reschedule for intensive iterators") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Link: https://lore.kernel.org/r/20211122024737.2198530-1-yebin10@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> conflicts: fs/io_uring.c Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/io_uring.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/io_uring.c b/fs/io_uring.c index d07388600bbed..f3b5f9d670df3 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -3462,6 +3462,7 @@ static int __io_remove_buffers(struct io_ring_ctx *ctx, struct io_buffer *buf, kfree(nxt); if (++i == nbufs) return i; + cond_resched(); } i++; kfree(buf); -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] block: Fix fsync always failed if once failed
by Yang Yingliang 09 Dec '21

09 Dec '21

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v5.17 commit 8a7518931baa8ea023700987f3db31cb0a80610b category: bugfix bugzilla: 185819 CVE: NA ----------------------------------------------- We do test with inject error fault base on v4.19, after test some time we found sync /dev/sda always failed. [root@localhost] sync /dev/sda sync: error syncing '/dev/sda': Input/output error scsi log as follows: [19069.812296] sd 0:0:0:0: [sda] tag#64 Send: scmd 0x00000000d03a0b6b [19069.812302] sd 0:0:0:0: [sda] tag#64 CDB: Synchronize Cache(10) 35 00 00 00 00 00 00 00 00 00 [19069.812533] sd 0:0:0:0: [sda] tag#64 Done: SUCCESS Result: hostbyte=DID_OK driverbyte=DRIVER_OK [19069.812536] sd 0:0:0:0: [sda] tag#64 CDB: Synchronize Cache(10) 35 00 00 00 00 00 00 00 00 00 [19069.812539] sd 0:0:0:0: [sda] tag#64 scsi host busy 1 failed 0 [19069.812542] sd 0:0:0:0: Notifying upper driver of completion (result 0) [19069.812546] sd 0:0:0:0: [sda] tag#64 sd_done: completed 0 of 0 bytes [19069.812549] sd 0:0:0:0: [sda] tag#64 0 sectors total, 0 bytes done. [19069.812564] print_req_error: I/O error, dev sda, sector 0 ftrace log as follows: rep-306069 [007] .... 19654.923315: block_bio_queue: 8,0 FWS 0 + 0 [rep] rep-306069 [007] .... 19654.923333: block_getrq: 8,0 FWS 0 + 0 [rep] kworker/7:1H-250 [007] .... 19654.923352: block_rq_issue: 8,0 FF 0 () 0 + 0 [kworker/7:1H] <idle>-0 [007] ..s. 19654.923562: block_rq_complete: 8,0 FF () 18446744073709551615 + 0 [0] <idle>-0 [007] d.s. 19654.923576: block_rq_complete: 8,0 WS () 0 + 0 [-5] As 8d6996630c03 introduce 'fq->rq_status', this data only update when 'flush_rq' reference count isn't zero. If flush request once failed and record error code in 'fq->rq_status'. If there is no chance to update 'fq->rq_status',then do fsync will always failed. To address this issue reset 'fq->rq_status' after return error code to upper layer. Fixes: 8d6996630c03("block: fix null pointer dereference in blk_mq_rq_timed_out()") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20211129012659.1553733-1-yebin10@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> conflicts: block/blk-flush.c Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-flush.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/block/blk-flush.c b/block/blk-flush.c index 022a2bbb012d7..c1bfcde165af5 100644 --- a/block/blk-flush.c +++ b/block/blk-flush.c @@ -245,8 +245,10 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error) * avoiding use-after-free. */ WRITE_ONCE(flush_rq->state, MQ_RQ_IDLE); - if (fq->rq_status != BLK_STS_OK) + if (fq->rq_status != BLK_STS_OK) { error = fq->rq_status; + fq->rq_status = BLK_STS_OK; + } hctx = blk_mq_map_queue(q, flush_rq->mq_ctx->cpu); if (!q->elevator) { -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/3] blk-mq: factor out some helps to quiesce/unquiesce queue
by Yang Yingliang 09 Dec '21

09 Dec '21

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 173974 CVE: NA --------------------------- Prepare to support concurrent quiesce queue between drivers and block layer, no functional changes. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-mq.c | 58 ++++++++++++++++++++++++++++++++++---------------- 1 file changed, 40 insertions(+), 18 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index ef62a83314a5d..f9b4b73a2f38d 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -211,32 +211,29 @@ void blk_mq_unfreeze_queue(struct request_queue *q) } EXPORT_SYMBOL_GPL(blk_mq_unfreeze_queue); +static void __blk_mq_quiesce_queue_nowait(struct request_queue *q, + unsigned int flag) +{ + blk_queue_flag_set(flag, q); +} + /* * FIXME: replace the scsi_internal_device_*block_nowait() calls in the * mpt3sas driver such that this function can be removed. */ void blk_mq_quiesce_queue_nowait(struct request_queue *q) { - blk_queue_flag_set(QUEUE_FLAG_QUIESCED, q); + __blk_mq_quiesce_queue_nowait(q, QUEUE_FLAG_QUIESCED); } EXPORT_SYMBOL_GPL(blk_mq_quiesce_queue_nowait); -/** - * blk_mq_quiesce_queue() - wait until all ongoing dispatches have finished - * @q: request queue. - * - * Note: this function does not prevent that the struct request end_io() - * callback function is invoked. Once this function is returned, we make - * sure no dispatch can happen until the queue is unquiesced via - * blk_mq_unquiesce_queue(). - */ -void blk_mq_quiesce_queue(struct request_queue *q) +static void __blk_mq_quiesce_queue(struct request_queue *q, unsigned int flag) { struct blk_mq_hw_ctx *hctx; unsigned int i; bool rcu = false; - blk_mq_quiesce_queue_nowait(q); + __blk_mq_quiesce_queue_nowait(q, flag); queue_for_each_hw_ctx(q, hctx, i) { if (hctx->flags & BLK_MQ_F_BLOCKING) @@ -247,15 +244,30 @@ void blk_mq_quiesce_queue(struct request_queue *q) if (rcu) synchronize_rcu(); } + +/** + * blk_mq_quiesce_queue() - wait until all ongoing dispatches have finished + * @q: request queue. + * + * Note: this function does not prevent that the struct request end_io() + * callback function is invoked. Once this function is returned, we make + * sure no dispatch can happen until the queue is unquiesced via + * blk_mq_unquiesce_queue(). + */ +void blk_mq_quiesce_queue(struct request_queue *q) +{ + __blk_mq_quiesce_queue(q, QUEUE_FLAG_QUIESCED); +} EXPORT_SYMBOL_GPL(blk_mq_quiesce_queue); -bool blk_mq_quiesce_queue_without_rcu(struct request_queue *q) +static bool __blk_mq_quiesce_queue_without_rcu(struct request_queue *q, + unsigned int flag) { struct blk_mq_hw_ctx *hctx; unsigned int i; bool rcu = false; - blk_mq_quiesce_queue_nowait(q); + __blk_mq_quiesce_queue_nowait(q, flag); queue_for_each_hw_ctx(q, hctx, i) { if (hctx->flags & BLK_MQ_F_BLOCKING) @@ -265,8 +277,21 @@ bool blk_mq_quiesce_queue_without_rcu(struct request_queue *q) } return rcu; } + +bool blk_mq_quiesce_queue_without_rcu(struct request_queue *q) +{ + return __blk_mq_quiesce_queue_without_rcu(q, QUEUE_FLAG_QUIESCED); +} EXPORT_SYMBOL_GPL(blk_mq_quiesce_queue_without_rcu); +static void __blk_mq_unquiesce_queue(struct request_queue *q, unsigned int flag) +{ + blk_queue_flag_clear(flag, q); + + /* dispatch requests which are inserted during quiescing */ + blk_mq_run_hw_queues(q, true); +} + /* * blk_mq_unquiesce_queue() - counterpart of blk_mq_quiesce_queue() * @q: request queue. @@ -276,10 +301,7 @@ EXPORT_SYMBOL_GPL(blk_mq_quiesce_queue_without_rcu); */ void blk_mq_unquiesce_queue(struct request_queue *q) { - blk_queue_flag_clear(QUEUE_FLAG_QUIESCED, q); - - /* dispatch requests which are inserted during quiescing */ - blk_mq_run_hw_queues(q, true); + __blk_mq_unquiesce_queue(q, QUEUE_FLAG_QUIESCED); } EXPORT_SYMBOL_GPL(blk_mq_unquiesce_queue); -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS 0/6] Add the no_hash_pointers startup parameter
by He Jinjin 09 Dec '21

09 Dec '21

The address printed by %p in the kernel will expose the kernel address information, which is extremely unsafe. So Linux v4.15 limited the information printed by %p which will print a hashed value. This patchset add no_hash_pointers startup parameter which can disable the restriction that %P only prints hashed values, so that %P can print the actual address in the kernel. I patched this function and the test modules associated with this and passed these tests after recompiling. Tobin C. Harding (3): lib/test_printf: Add empty module_exit function kselftest: Add test module framework header lib: Use new kselftest header Timur Tabi(3): kselftest: add support for skipped tests lib: use KSTM_MODULE_GLOBALS macro in kselftest drivers lib/vsprintf: no_hash_pointers prints all addresses as unhashed .../admin-guide/kernel-parameters.txt | 15 +++ Documentation/dev-tools/kselftest.rst | 94 +++++++++++++++++- lib/test_bitmap.c | 23 +---- lib/test_printf.c | 29 +++--- lib/vsprintf.c | 36 ++++++- tools/testing/selftests/kselftest_module.h | 54 ++++++++++ 6 files changed, 215 insertions(+), 36 deletions(-) create mode 100644 tools/testing/selftests/kselftest_module.h -- 2.30.0

1 6

[PATCH openEuler-1.0-LTS 0/6] Add the no_hash_pointers startup parameter
by He Jinjin 09 Dec '21

09 Dec '21

The address printed by %p in the kernel will expose the kernel address information, which is extremely unsafe. So Linux v4.15 limited the information printed by %p which will print a hashed value. This patchset add no_hash_pointers startup parameter which can disable the restriction that %P only prints hashed values, so that %P can print the actual address in the kernel. I patched this function and the test modules associated with this and passed these tests after recompiling. Tobin C. Harding (3): lib/test_printf: Add empty module_exit function kselftest: Add test module framework header lib: Use new kselftest header Timur Tabi(3): kselftest: add support for skipped tests lib: use KSTM_MODULE_GLOBALS macro in kselftest drivers lib/vsprintf: no_hash_pointers prints all addresses as unhashed .../admin-guide/kernel-parameters.txt | 15 +++ Documentation/dev-tools/kselftest.rst | 94 +++++++++++++++++- lib/test_bitmap.c | 23 +---- lib/test_printf.c | 29 +++--- lib/vsprintf.c | 36 ++++++- tools/testing/selftests/kselftest_module.h | 54 ++++++++++ 6 files changed, 215 insertions(+), 36 deletions(-) create mode 100644 tools/testing/selftests/kselftest_module.h -- 2.30.0

1 6

[PATCH OLK-5.10 0/2] Add the function to modify the reboot mode
by Hongyu Li 09 Dec '21

09 Dec '21

The current kernel needs to provide the reboot mode in the boot parameter. However, we can not know this in advance. The kernel should have a method to set the reboot options when the system is booted. This patchset add handles in the <sysfs>/kernel/reboot to read reboot configuration and rewrite it. Therefore users can change the reboot mode as they want. Matteo Croce (1): reboot: allow to specify reboot mode via sysfs Nathan Chancellor (1): reboot: Fix variable assignments in type_store Documentation/ABI/testing/sysfs-kernel-reboot | 32 +++ kernel/reboot.c | 206 ++++++++++++++++++ 2 files changed, 238 insertions(+) create mode 100644 Documentation/ABI/testing/sysfs-kernel-reboot -- 2.17.1

1 0

[PATCH OLK-5.10 0/2] Add the function to modify the reboot mode
by Hongyu Li 09 Dec '21

09 Dec '21

The current kernel needs to provide the reboot mode in the boot parameter. However, we can not know this in advance. The kernel should have a method to set the reboot options when the system is booted. This patchset add handles in the <sysfs>/kernel/reboot to read reboot configuration and rewrite it. Therefore users can change the reboot mode as they want. Matteo Croce (1): reboot: allow to specify reboot mode via sysfs Nathan Chancellor (1): reboot: Fix variable assignments in type_store Documentation/ABI/testing/sysfs-kernel-reboot | 32 +++ kernel/reboot.c | 206 ++++++++++++++++++ 2 files changed, 238 insertions(+) create mode 100644 Documentation/ABI/testing/sysfs-kernel-reboot -- 2.17.1

1 0

[PATCH openEuler-1.0-LTS 1/2] bfq: Remove merged request already in bfq_requests_merged()
by Yang Yingliang 09 Dec '21

09 Dec '21

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v5.14-rc1 commit a921c655f2033dd1ce1379128efe881dda23ea37 category: bugfix bugzilla: 185777, 185811 CVE: NA Currently, bfq does very little in bfq_requests_merged() and handles all the request cleanup in bfq_finish_requeue_request() called from blk_mq_free_request(). That is currently safe only because blk_mq_free_request() is called shortly after bfq_requests_merged() while bfqd->lock is still held. However to fix a lock inversion between bfqd->lock and ioc->lock, we need to call blk_mq_free_request() after dropping bfqd->lock. That would mean that already merged request could be seen by other processes inside bfq queues and possibly dispatched to the device which is wrong. So move cleanup of the request from bfq_finish_requeue_request() to bfq_requests_merged(). Acked-by: Paolo Valente <paolo.valente(a)linaro.org> Signed-off-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20210623093634.27879-2-jack@suse.cz Signed-off-by: Jens Axboe <axboe(a)kernel.dk> conflict: in bfq_finish_requeue_request, 4.19 not have bfq_update_inject_limit branch; Signed-off-by: zhangwensheng <zhangwensheng5(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/bfq-iosched.c | 41 +++++++++++++---------------------------- 1 file changed, 13 insertions(+), 28 deletions(-) diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c index 7d77de9a0f5c0..5452d892480ba 100644 --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -1937,7 +1937,7 @@ static void bfq_requests_merged(struct request_queue *q, struct request *rq, *next_bfqq = bfq_init_rq(next); if (!bfqq) - return; + goto remove; /* * If next and rq belong to the same bfq_queue and next is older @@ -1960,6 +1960,14 @@ static void bfq_requests_merged(struct request_queue *q, struct request *rq, bfqq->next_rq = rq; bfqg_stats_update_io_merged(bfqq_group(bfqq), next->cmd_flags); +remove: + /* Merged request may be in the IO scheduler. Remove it. */ + if (!RB_EMPTY_NODE(&next->rb_node)) { + bfq_remove_request(next->q, next); + if (next_bfqq) + bfqg_stats_update_io_remove(bfqq_group(next_bfqq), + next->cmd_flags); + } } /* Must be called with bfqq != NULL */ @@ -4876,6 +4884,7 @@ static void bfq_finish_requeue_request(struct request *rq) { struct bfq_queue *bfqq = RQ_BFQQ(rq); struct bfq_data *bfqd; + unsigned long flags; /* * rq either is not associated with any icq, or is an already @@ -4893,36 +4902,12 @@ static void bfq_finish_requeue_request(struct request *rq) rq->io_start_time_ns, rq->cmd_flags); + spin_lock_irqsave(&bfqd->lock, flags); if (likely(rq->rq_flags & RQF_STARTED)) { - unsigned long flags; - - spin_lock_irqsave(&bfqd->lock, flags); - bfq_completed_request(bfqq, bfqd); - bfq_finish_requeue_request_body(bfqq); - - spin_unlock_irqrestore(&bfqd->lock, flags); - } else { - /* - * Request rq may be still/already in the scheduler, - * in which case we need to remove it (this should - * never happen in case of requeue). And we cannot - * defer such a check and removal, to avoid - * inconsistencies in the time interval from the end - * of this function to the start of the deferred work. - * This situation seems to occur only in process - * context, as a consequence of a merge. In the - * current version of the code, this implies that the - * lock is held. - */ - - if (!RB_EMPTY_NODE(&rq->rb_node)) { - bfq_remove_request(rq->q, rq); - bfqg_stats_update_io_remove(bfqq_group(bfqq), - rq->cmd_flags); - } - bfq_finish_requeue_request_body(bfqq); } + bfq_finish_requeue_request_body(bfqq); + spin_unlock_irqrestore(&bfqd->lock, flags); /* * Reset private fields. In case of a requeue, this allows -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] md: fix a warning caused by a race between concurrent md_ioctl()s
by Yang Yingliang 09 Dec '21

09 Dec '21

From: "Dae R. Jeong" <dae.r.jeong(a)kaist.ac.kr> mainline inclusion from mainline-v5.11-rc1 commit c731b84b51bf7fe83448bea8f56a6d55006b0615 category: bugfix bugzilla: 185833 CVE: NA ----------------------------------------------- Syzkaller reports a warning as belows. WARNING: CPU: 0 PID: 9647 at drivers/md/md.c:7169 ... Call Trace: ... RIP: 0010:md_ioctl+0x4017/0x5980 drivers/md/md.c:7169 RSP: 0018:ffff888096027950 EFLAGS: 00010293 RAX: ffff88809322c380 RBX: 0000000000000932 RCX: ffffffff84e266f2 RDX: 0000000000000000 RSI: ffffffff84e299f7 RDI: 0000000000000007 RBP: ffff888096027bc0 R08: ffff88809322c380 R09: ffffed101341a482 R10: ffff888096027940 R11: ffff88809a0d240f R12: 0000000000000932 R13: ffff8880a2c14100 R14: ffff88809a0d2268 R15: ffff88809a0d2408 __blkdev_driver_ioctl block/ioctl.c:304 [inline] blkdev_ioctl+0xece/0x1c10 block/ioctl.c:606 block_ioctl+0xee/0x130 fs/block_dev.c:1930 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:696 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x49/0xbe This is caused by a race between two concurrenct md_ioctl()s closing the array. CPU1 (md_ioctl()) CPU2 (md_ioctl()) ------ ------ set_bit(MD_CLOSING, &mddev->flags); did_set_md_closing = true; WARN_ON_ONCE(test_bit(MD_CLOSING, &mddev->flags)); if(did_set_md_closing) clear_bit(MD_CLOSING, &mddev->flags); Fix the warning by returning immediately if the MD_CLOSING bit is set in &mddev->flags which indicates that the array is being closed. Fixes: 065e519e71b2 ("md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop") Reported-by: syzbot+1e46a0864c1a6e9bd3d8(a)syzkaller.appspotmail.com Cc: stable(a)vger.kernel.org Signed-off-by: Dae R. Jeong <dae.r.jeong(a)kaist.ac.kr> Signed-off-by: Song Liu <songliubraving(a)fb.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/md/md.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 8a2656cf7127d..409ec5ffd28d3 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -7306,8 +7306,11 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode, err = -EBUSY; goto out; } - WARN_ON_ONCE(test_bit(MD_CLOSING, &mddev->flags)); - set_bit(MD_CLOSING, &mddev->flags); + if (test_and_set_bit(MD_CLOSING, &mddev->flags)) { + mutex_unlock(&mddev->open_mutex); + err = -EBUSY; + goto out; + } did_set_md_closing = true; mutex_unlock(&mddev->open_mutex); sync_blockdev(bdev); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] net: hns3: fix race condition in debugfs
by Yang Yingliang 09 Dec '21

09 Dec '21

From: Yonglong Liu <liuyonglong(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4LD5U CVE: NA ---------------------------- When multiple users access debugfs at the same time, the process of alloc and release memory becomes disordered, causing the kernel crash like this: [763845.759089] PC is at kfree+0x19c/0x1a0 [763845.759100] LR is at kvfree+0x3c/0x58 [763845.759103] pc : [<ffff00000828878c>] lr : [<ffff00000823432c>] pstate: 60400009 [763845.759105] sp : ffff00003744fc90 [763845.759108] x29: ffff00003744fc90 x28: ffff8027dc87b800 [763845.759115] x27: ffff0000088a1000 x26: ffff000002970f48 [763845.759121] x25: ffff802502600000 x24: 00000000000000af [763845.759127] x23: 0000000000010000 x22: 0000000013dc0000 [763845.759133] x21: ffff00000823432c x20: ffff802502600000 [763845.759139] x19: ffff802502600000 x18: 0000ffffdaa06b10 [763845.759145] x17: 00000000004201c8 x16: ffff0000082b2b10 [763845.759151] x15: 000000000003013f x14: 0000ffffa462ffe0 [763845.759157] x13: ffffffffffffffff x12: 0433526ae61f3300 [763845.759163] x11: ffff000009694b30 x10: 0000000000000001 [763845.759169] x9 : 000000000007b224 x8 : ffff000009719edc [763845.759175] x7 : ffff7fe009409800 x6 : 00000045757af8cf [763845.759181] x5 : ffff8027fced69f0 x4 : 0000000000000000 [763845.759187] x3 : 0000000000000000 x2 : 0433526ae61f3300 [763845.759192] x1 : 0000000000000000 x0 : dead000000000100 [763845.759200] Process cat (pid: 57988, stack limit = 0xffff000037440000) [763845.759203] Call trace: [763845.759207] Exception stack(0xffff00003744fb50 to 0xffff00003744fc90) [763845.759211] fb40: dead000000000100 0000000000000000 [768745.759215] fb60: 0433526ae61f3300 0000000000000000 0000000000000000 ffff8027fced69f0 [763845.759219] fb80: 00000045757af8cf ffff7fe009409800 ffff000009719edc 000000000007b224 [763845.759222] fba0: 0000000000000001 ffff000009694b30 0433526ae61f3300 ffffffffffffffff [763845.759226] fbc0: 0000ffffa462ffe0 000000000003013f ffff0000082b2b10 00000000004201c8 [763845.759231] fbe0: 0000ffffdaa06b10 ffff802502600000 ffff802502600000 ffff00000823432c [763845.759235] fc00: 0000000013dc0000 0000000000010000 00000000000000af ffff802502600000 [763845.759238] fc20: ffff000002970f48 ffff0000088a1000 ffff8027dc87b800 ffff00003744fc90 [763845.759243] fc40: ffff00000823432c ffff00003744fc90 ffff00000828878c 0000000060400009 [763845.759247] fc60: ffff00003744feb0 0000000013dc0000 0000ffffffffffff 0000000000000023 [763845.759250] fc80: ffff00003744fc90 ffff00000828878c [763845.759259] [<ffff00000828878c>] kfree+0x19c/0x1a0 [763845.759263] [<ffff00000823432c>] kvfree+0x3c/0x58 [763845.759306] [<ffff00000295ab94>] hns3_dbg_read+0x94/0x240 [hns3] [763845.759318] [<ffff000008359550>] full_proxy_read+0x60/0x90 [763845.759324] [<ffff0000082b22a4>] __vfs_read+0x58/0x178 [763845.759327] [<ffff0000082b2454>] vfs_read+0x90/0x14c [763845.759332] [<ffff0000082b2b70>] SyS_read+0x60/0xc0 This patch adds a mutex lock to fix the race condition, and need to call hns3_dbg_read_cmd() function when buffer is NULL to avoid reading empty data. Fixes: c91910efc03a ("net: hns3: refactor the debugfs process") Signed-off-by: Yonglong Liu <liuyonglong(a)huawei.com> Reviewed-by: li yongxin <liyongxin1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 + .../ethernet/hisilicon/hns3/hns3_debugfs.c | 19 +++++++++++++------ 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h index c9ac1e7cf4492..048de5b367c19 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h +++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h @@ -764,6 +764,7 @@ struct hnae3_handle { u8 netdev_flags; struct dentry *hnae3_dbgfs; + struct mutex dbgfs_lock; /* Network interface message level enabled bits */ u32 msg_enable; diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c index 7f3b7084e382f..c68e5f3d0ba52 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c @@ -807,6 +807,7 @@ static ssize_t hns3_dbg_read(struct file *filp, char __user *buffer, if (ret) return ret; + mutex_lock(&handle->dbgfs_lock); save_buf = &hns3_dbg_cmd[index].buf; if (!test_bit(HNS3_NIC_STATE_INITED, &priv->state) || @@ -819,15 +820,15 @@ static ssize_t hns3_dbg_read(struct file *filp, char __user *buffer, read_buf = *save_buf; } else { read_buf = kvzalloc(hns3_dbg_cmd[index].buf_len, GFP_KERNEL); - if (!read_buf) - return -ENOMEM; + if (!read_buf) { + ret = -ENOMEM; + goto out; + } /* save the buffer addr until the last read operation */ *save_buf = read_buf; - } - /* get data ready for the first time to read */ - if (!*ppos) { + /* get data ready for the first time to read */ ret = hns3_dbg_read_cmd(dbg_data, hns3_dbg_cmd[index].cmd, read_buf, hns3_dbg_cmd[index].buf_len); if (ret) @@ -836,8 +837,10 @@ static ssize_t hns3_dbg_read(struct file *filp, char __user *buffer, size = simple_read_from_buffer(buffer, count, ppos, read_buf, strlen(read_buf)); - if (size > 0) + if (size > 0) { + mutex_unlock(&handle->dbgfs_lock); return size; + } out: /* free the buffer for the last read operation */ @@ -846,6 +849,7 @@ static ssize_t hns3_dbg_read(struct file *filp, char __user *buffer, *save_buf = NULL; } + mutex_unlock(&handle->dbgfs_lock); return ret; } @@ -916,6 +920,7 @@ int hns3_dbg_init(struct hnae3_handle *handle) debugfs_create_dir(hns3_dbg_dentry[i].name, handle->hnae3_dbgfs); + mutex_init(&handle->dbgfs_lock); for (i = 0; i < ARRAY_SIZE(hns3_dbg_cmd); i++) { if (!hns3_dbg_cmd[i].init) { dev_err(&handle->pdev->dev, @@ -936,6 +941,7 @@ int hns3_dbg_init(struct hnae3_handle *handle) return 0; out: + mutex_destroy(&handle->dbgfs_lock); debugfs_remove_recursive(handle->hnae3_dbgfs); handle->hnae3_dbgfs = NULL; return ret; @@ -951,6 +957,7 @@ void hns3_dbg_uninit(struct hnae3_handle *handle) hns3_dbg_cmd[i].buf = NULL; } + mutex_destroy(&handle->dbgfs_lock); debugfs_remove_recursive(handle->hnae3_dbgfs); handle->hnae3_dbgfs = NULL; } -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] kabi: fix kabi broken in struct sock
by Yang Yingliang 09 Dec '21

09 Dec '21

hulk inclusion category: bugfix bugzilla: NA CVE: NA --------------------------- If config DEBUG_SPINLOCK or DEBUG_LOCK_ALLOC is enabled, don't need fix the kabi broken. It's introduced by 93c5c1d15abcd ("af_unix: fix races in sk_peer_pid and sk_peer_cred accesses"). Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/net/sock.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/include/net/sock.h b/include/net/sock.h index b90b92882b3b8..803464e66e02c 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -472,7 +472,9 @@ struct sock { u32 sk_ack_backlog; u32 sk_max_ack_backlog; kuid_t sk_uid; +#if defined(CONFIG_DEBUG_SPINLOCK) || defined(CONFIG_DEBUG_LOCK_ALLOC) spinlock_t sk_peer_lock; +#endif struct pid *sk_peer_pid; const struct cred *sk_peer_cred; @@ -513,7 +515,18 @@ struct sock { struct sock_reuseport __rcu *sk_reuseport_cb; struct rcu_head sk_rcu; +#if !defined(CONFIG_DEBUG_SPINLOCK) && !defined(CONFIG_DEBUG_LOCK_ALLOC) +#ifndef __GENKSYMS__ + union { + spinlock_t sk_peer_lock; + unsigned long kabi_reserve1; + }; +#else KABI_RESERVE(1) +#endif +#else + KABI_RESERVE(1) +#endif KABI_RESERVE(2) KABI_RESERVE(3) KABI_RESERVE(4) -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 01/31] cifs: fix incorrect check for null pointer in header_assemble
by Yang Yingliang 08 Dec '21

08 Dec '21

From: Steve French <stfrench(a)microsoft.com> stable inclusion from linux-4.19.209 commit 43d2e0fbc67f8bcfb069130f4028a04887ae76b6 -------------------------------- commit 9ed38fd4a15417cac83967360cf20b853bfab9b6 upstream. Although very unlikely that the tlink pointer would be null in this case, get_next_mid function can in theory return null (but not an error) so need to check for null (not for IS_ERR, which can not be returned here). Address warning: fs/smbfs_client/connect.c:2392 cifs_match_super() warn: 'tlink' isn't an ERR_PTR Pointed out by Dan Carpenter via smatch code analysis tool CC: stable(a)vger.kernel.org Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com> Acked-by: Ronnie Sahlberg <lsahlber(a)redhat.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Acked-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/cifs/connect.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 907be252c5d47..36104dd8eb4dd 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -3373,9 +3373,10 @@ cifs_match_super(struct super_block *sb, void *data) spin_lock(&cifs_tcp_ses_lock); cifs_sb = CIFS_SB(sb); tlink = cifs_get_tlink(cifs_sb_master_tlink(cifs_sb)); - if (IS_ERR(tlink)) { + if (tlink == NULL) { + /* can not match superblock if tlink were ever null */ spin_unlock(&cifs_tcp_ses_lock); - return rc; + return 0; } tcon = tlink_tcon(tlink); ses = tcon->ses; -- 2.25.1

1 30

[PATCH OLK-5.10 107/107] fs/ntfs3: Add ntfs3 module in openeuler_defconfig
by Yin Xiujiang 08 Dec '21

08 Dec '21

kylin inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ------------------------------------------------- This adds ntfs3 module in openeuler_defconfig Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- arch/arm64/configs/openeuler_defconfig | 4 ++++ arch/x86/configs/openeuler_defconfig | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 76d6a118330d..b1e8524eb5e6 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6163,6 +6163,10 @@ CONFIG_EXFAT_DEFAULT_IOCHARSET="utf8" CONFIG_NTFS_FS=m # CONFIG_NTFS_DEBUG is not set # CONFIG_NTFS_RW is not set +CONFIG_NTFS3_FS=m +CONFIG_NTFS3_64BIT_CLUSTER=y +CONFIG_NTFS3_LZX_XPRESS=y +CONFIG_NTFS3_FS_POSIX_ACL=y # end of DOS/FAT/EXFAT/NT Filesystems # diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index b25d908dc7a1..83e143d139fa 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -7515,6 +7515,10 @@ CONFIG_EXFAT_DEFAULT_IOCHARSET="utf8" CONFIG_NTFS_FS=m # CONFIG_NTFS_DEBUG is not set # CONFIG_NTFS_RW is not set +CONFIG_NTFS3_FS=m +CONFIG_NTFS3_64BIT_CLUSTER=y +CONFIG_NTFS3_LZX_XPRESS=y +CONFIG_NTFS3_FS_POSIX_ACL=y # end of DOS/FAT/EXFAT/NT Filesystems # -- 2.30.0

1 0

[PATCH OLK-5.10 081/107] fs/ntfs3: Remove a useless shadowing variable
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> mainline inclusion from mainline-v5.15 commit 808bc0a82bcd2cbe32a139613325b1a3e03f35f1 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- There is already a 'u8 mask' defined at the top of the function. There is no need to define a new one here. Remove the useless and shadowing new 'mask' variable. Signed-off-by: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/bitfunc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/ntfs3/bitfunc.c b/fs/ntfs3/bitfunc.c index bf10e2da5c6e..50d838093790 100644 --- a/fs/ntfs3/bitfunc.c +++ b/fs/ntfs3/bitfunc.c @@ -119,8 +119,7 @@ bool are_bits_set(const ulong *lmap, size_t bit, size_t nbits) pos = nbits & 7; if (pos) { - u8 mask = fill_mask[pos]; - + mask = fill_mask[pos]; if ((*map & mask) != mask) return false; } -- 2.30.0

1 0

[PATCH OLK-5.10 080/107] fs/ntfs3: Remove a useless test in 'indx_find()'
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> mainline inclusion from mainline-v5.15 commit d2846bf33c1423ff872c7a7c2afde292ad502c04 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- 'fnd' has been dereferenced several time before, so testing it here is pointless. Moreover, all callers of 'indx_find()' already have some error handling code that makes sure that no NULL 'fnd' is passed. So, remove the useless test. Signed-off-by: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/index.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c index 4f71a91f07d9..6f81e3a49abf 100644 --- a/fs/ntfs3/index.c +++ b/fs/ntfs3/index.c @@ -1072,9 +1072,7 @@ int indx_find(struct ntfs_index *indx, struct ntfs_inode *ni, if (!e) return -EINVAL; - if (fnd) - fnd->root_de = e; - + fnd->root_de = e; err = 0; for (;;) { -- 2.30.0

1 0

[PATCH OLK-5.10 078/107] fs/ntfs3: Change max hardlinks limit to 4000
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> mainline inclusion from mainline-v5.15 commit 56eaeb10e2619081cc383febf6740a4c3e806777 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- xfstest generic/041 works with 3003 hardlinks. Because of this we raise hardlinks limit to 4000. There are no drawbacks or regressions. Theoretically we can raise all the way up to ffff, but there is no practical use for this. Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/ntfs.h | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h index 303a162c3158..9cc396b117bf 100644 --- a/fs/ntfs3/ntfs.h +++ b/fs/ntfs3/ntfs.h @@ -26,9 +26,11 @@ #define NTFS_NAME_LEN 255 -/* ntfs.sys used 500 maximum links on-disk struct allows up to 0xffff. */ -#define NTFS_LINK_MAX 0x400 -//#define NTFS_LINK_MAX 0xffff +/* + * ntfs.sys used 500 maximum links on-disk struct allows up to 0xffff. + * xfstest generic/041 creates 3003 hardlinks. + */ +#define NTFS_LINK_MAX 4000 /* * Activate to use 64 bit clusters instead of 32 bits in ntfs.sys. -- 2.30.0

1 0

[PATCH OLK-5.10 076/107] fs/ntfs3: Fix a memory leak on object opts
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Colin Ian King <colin.king(a)canonical.com> mainline inclusion from mainline-v5.15 commit 880301bb313295a65523e79bc5666f5cf49eb3ed category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Currently a failed allocation on sbi->upcase will cause an exit via the label free_sbi causing a memory leak on object opts. Fix this by re-ordering the exit paths free_opts and free_sbi so that kfree's occur in the reverse allocation order. Addresses-Coverity: ("Resource leak") Fixes: 27fac77707a1 ("fs/ntfs3: Init spi more in init_fs_context than fill_super") Signed-off-by: Colin Ian King <colin.king(a)canonical.com> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c index cefb9ddaf4db..6a535b144ff9 100644 --- a/fs/ntfs3/super.c +++ b/fs/ntfs3/super.c @@ -1393,10 +1393,10 @@ static int ntfs_init_fs_context(struct fs_context *fc) fc->ops = &ntfs_context_ops; return 0; -free_opts: - kfree(opts); free_sbi: kfree(sbi); +free_opts: + kfree(opts); return -ENOMEM; } -- 2.30.0

1 0

[PATCH OLK-5.10 048/107] fs/ntfs3: Add missing header and guards to lib/ headers
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Kari Argillander <kari.argillander(a)gmail.com> mainline inclusion from mainline-v5.15 commit b6ba81034b1b74cf426abcece4becda2611504a4 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- size_t needs header. Add missing header guards so that compiler will only include these ones. Signed-off-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/lib/decompress_common.h | 5 +++++ fs/ntfs3/lib/lib.h | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/fs/ntfs3/lib/decompress_common.h b/fs/ntfs3/lib/decompress_common.h index 2d70ae42f1b5..dd7ced000d0e 100644 --- a/fs/ntfs3/lib/decompress_common.h +++ b/fs/ntfs3/lib/decompress_common.h @@ -5,6 +5,9 @@ * Copyright (C) 2015 Eric Biggers */ +#ifndef _LINUX_NTFS3_LIB_DECOMPRESS_COMMON_H +#define _LINUX_NTFS3_LIB_DECOMPRESS_COMMON_H + #include <linux/string.h> #include <linux/compiler.h> #include <linux/types.h> @@ -336,3 +339,5 @@ static forceinline u8 *lz_copy(u8 *dst, u32 length, u32 offset, const u8 *bufend return dst; } + +#endif /* _LINUX_NTFS3_LIB_DECOMPRESS_COMMON_H */ diff --git a/fs/ntfs3/lib/lib.h b/fs/ntfs3/lib/lib.h index f508fbad2e71..90309a5ae59c 100644 --- a/fs/ntfs3/lib/lib.h +++ b/fs/ntfs3/lib/lib.h @@ -7,6 +7,10 @@ * - linux kernel code style */ +#ifndef _LINUX_NTFS3_LIB_LIB_H +#define _LINUX_NTFS3_LIB_LIB_H + +#include <linux/types.h> /* globals from xpress_decompress.c */ struct xpress_decompressor *xpress_allocate_decompressor(void); @@ -24,3 +28,5 @@ int lzx_decompress(struct lzx_decompressor *__restrict d, const void *__restrict compressed_data, size_t compressed_size, void *__restrict uncompressed_data, size_t uncompressed_size); + +#endif /* _LINUX_NTFS3_LIB_LIB_H */ -- 2.30.0

1 0

[PATCH OLK-5.10 047/107] fs/ntfs3: Add missing headers and forward declarations to ntfs_fs.h
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Kari Argillander <kari.argillander(a)gmail.com> mainline inclusion from mainline-v5.15 commit f239b3a95dd4f7daba26ea17f339a5b19a7d40a1 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- We do not have headers at all in this file. We should have them so that not every .c file needs to include all of the stuff which this file need for building. This way we can remove some headers from other files and get better picture what is needed. This can save some compilation time. And this can help if we sometimes want to separate this one big header. Also use forward declarations for structs and enums when it not included straight with include and it is used in function declarations input. This will prevent possible compiler warning: xxx declared inside parameter list will not be visible outside of this definition or declaration Here is list which I made when parsing this. There is not necessarily all example from this header file, but this just proofs we need it. <linux/blkdev.h> SECTOR_SHIFT <linux/buffer_head.h> sb_bread(), put_bh <linux/cleancache.h> put_page() <linux/fs.h> struct inode (Just struct ntfs_inode need it) <linux/highmem.h> kunmap(), kmap() <linux/kernel.h> cpu_to_leXX() ALIGN <linux/mm.h> kvfree() <linux/mutex.h> struct mutex, mutex_(un/try)lock() <linux/page-flags.h> PageError() <linux/pagemap.h> read_mapping_page() <linux/rbtree.h> struct rb_root <linux/rwsem.h> struct rw_semaphore <linux/slab.h> krfree(), kzalloc() <linux/string.h> memset() <linux/time64.h> struct timespec64 <linux/types.h> uXX, __leXX <linux/uidgid.h> kuid_t, kgid_t <asm/div64.h> do_div() <asm/page.h> PAGE_SIZE "debug.h" ntfs_err() (Just one entry. Maybe we can drop this) "ntfs.h" Do you even ask? Signed-off-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/ntfs_fs.h | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h index 372cda697dd4..dae6dd4ac619 100644 --- a/fs/ntfs3/ntfs_fs.h +++ b/fs/ntfs3/ntfs_fs.h @@ -9,6 +9,37 @@ #ifndef _LINUX_NTFS3_NTFS_FS_H #define _LINUX_NTFS3_NTFS_FS_H +#include <linux/blkdev.h> +#include <linux/buffer_head.h> +#include <linux/cleancache.h> +#include <linux/fs.h> +#include <linux/highmem.h> +#include <linux/kernel.h> +#include <linux/mm.h> +#include <linux/mutex.h> +#include <linux/page-flags.h> +#include <linux/pagemap.h> +#include <linux/rbtree.h> +#include <linux/rwsem.h> +#include <linux/slab.h> +#include <linux/string.h> +#include <linux/time64.h> +#include <linux/types.h> +#include <linux/uidgid.h> +#include <asm/div64.h> +#include <asm/page.h> + +#include "debug.h" +#include "ntfs.h" + +struct dentry; +struct fiemap_extent_info; +struct user_namespace; +struct page; +struct writeback_control; +enum utf16_endian; + + #define MINUS_ONE_T ((size_t)(-1)) /* Biggest MFT / smallest cluster */ #define MAXIMUM_BYTES_PER_MFT 4096 -- 2.30.0

1 0

[PATCH OLK-5.10 046/107] fs/ntfs3: Add missing header files to ntfs.h
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Kari Argillander <kari.argillander(a)gmail.com> mainline inclusion from mainline-v5.15 commit 4dfe83320e1e9665b986840b426742ea764e08d7 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- We do not have header files at all in this file. Add following headers and there is also explanation which for it was added. Note that explanation might not be complete, but it just proofs it is needed. <linux/blkdev.h> // SECTOR_SHIFT <linux/build_bug.h> // static_assert() <linux/kernel.h> // cpu_to_le64, cpu_to_le32, ALIGN <linux/stddef.h> // offsetof() <linux/string.h> // memcmp() <linux/types.h> //__le32, __le16 "debug.h" // PtrOffset(), Add2Ptr() Signed-off-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/ntfs.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h index 6bb3e595263b..695b684bce20 100644 --- a/fs/ntfs3/ntfs.h +++ b/fs/ntfs3/ntfs.h @@ -10,6 +10,15 @@ #ifndef _LINUX_NTFS3_NTFS_H #define _LINUX_NTFS3_NTFS_H +#include <linux/blkdev.h> +#include <linux/build_bug.h> +#include <linux/kernel.h> +#include <linux/stddef.h> +#include <linux/string.h> +#include <linux/types.h> + +#include "debug.h" + /* TODO: Check 4K MFT record and 512 bytes cluster. */ /* Activate this define to use binary search in indexes. */ -- 2.30.0

1 0

[PATCH OLK-5.10 044/107] fs/ntfs3: Remove redundant initialization of variable err
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Colin Ian King <colin.king(a)canonical.com> mainline inclusion from mainline-v5.15 commit 0327c6d01a97a3242cf10717819994aa6e095a1d category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- The variable err is being initialized with a value that is never read, it is being updated later on. The assignment is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King <colin.king(a)canonical.com> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/index.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c index 0daca9adc54c..b1175542d854 100644 --- a/fs/ntfs3/index.c +++ b/fs/ntfs3/index.c @@ -1401,7 +1401,7 @@ int indx_find_raw(struct ntfs_index *indx, struct ntfs_inode *ni, static int indx_create_allocate(struct ntfs_index *indx, struct ntfs_inode *ni, CLST *vbn) { - int err = -ENOMEM; + int err; struct ntfs_sb_info *sbi = ni->mi.sbi; struct ATTRIB *bitmap; struct ATTRIB *alloc; -- 2.30.0

1 0

[PATCH OLK-5.10 042/107] fs/ntfs3: Rename mount option no_acs_rules > (no)acsrules
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Kari Argillander <kari.argillander(a)gmail.com> mainline inclusion from mainline-v5.15 commit 28a941ffc1404b66d67228cbe8392bbadb94af0d category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Rename mount option no_acs_rules to (no)acsrules. This allow us to use possibility to mount with options noaclrules or aclrules. Acked-by: Christian Brauner <christian.brauner(a)ubuntu.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- Documentation/filesystems/ntfs3.rst | 2 +- fs/ntfs3/file.c | 2 +- fs/ntfs3/ntfs_fs.h | 2 +- fs/ntfs3/super.c | 12 ++++++------ fs/ntfs3/xattr.c | 2 +- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/Documentation/filesystems/ntfs3.rst b/Documentation/filesystems/ntfs3.rst index ded706474825..7b6afe452197 100644 --- a/Documentation/filesystems/ntfs3.rst +++ b/Documentation/filesystems/ntfs3.rst @@ -73,7 +73,7 @@ prealloc Preallocate space for files excessively when file size is increasing on writes. Decreases fragmentation in case of parallel write operations to different files. -no_acs_rules "No access rules" mount option sets access rights for +noacsrules "No access rules" mount option sets access rights for files/folders to 777 and owner/group to root. This mount option absorbs all other permissions: - permissions change for files/folders will be reported diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c index fef57141b161..0743d806c567 100644 --- a/fs/ntfs3/file.c +++ b/fs/ntfs3/file.c @@ -737,7 +737,7 @@ int ntfs3_setattr(struct user_namespace *mnt_userns, struct dentry *dentry, umode_t mode = inode->i_mode; int err; - if (sbi->options->no_acs_rules) { + if (sbi->options->noacsrules) { /* "No access rules" - Force any changes of time etc. */ attr->ia_valid |= ATTR_FORCE; /* and disable for editing some attributes. */ diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h index aa18f12b7096..15bab48bc1ad 100644 --- a/fs/ntfs3/ntfs_fs.h +++ b/fs/ntfs3/ntfs_fs.h @@ -70,7 +70,7 @@ struct ntfs_mount_options { showmeta : 1, /* Show meta files. */ nohidden : 1, /* Do not show hidden files. */ force : 1, /* Rw mount dirty volume. */ - no_acs_rules : 1, /*Exclude acs rules. */ + noacsrules : 1, /*Exclude acs rules. */ prealloc : 1 /* Preallocate space when file is growing. */ ; }; diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c index 503e2e23f711..0690e7e4f00d 100644 --- a/fs/ntfs3/super.c +++ b/fs/ntfs3/super.c @@ -228,7 +228,7 @@ enum Opt { Opt_acl, Opt_iocharset, Opt_prealloc, - Opt_no_acs_rules, + Opt_noacsrules, Opt_err, }; @@ -246,7 +246,7 @@ static const struct fs_parameter_spec ntfs_fs_parameters[] = { fsparam_flag_no("acl", Opt_acl), fsparam_flag_no("showmeta", Opt_showmeta), fsparam_flag_no("prealloc", Opt_prealloc), - fsparam_flag("no_acs_rules", Opt_no_acs_rules), + fsparam_flag_no("acsrules", Opt_noacsrules), fsparam_string("iocharset", Opt_iocharset), __fsparam(fs_param_is_string, @@ -358,8 +358,8 @@ static int ntfs_fs_parse_param(struct fs_context *fc, case Opt_prealloc: opts->prealloc = result.negated ? 0 : 1; break; - case Opt_no_acs_rules: - opts->no_acs_rules = 1; + case Opt_noacsrules: + opts->noacsrules = result.negated ? 1 : 0; break; default: /* Should not be here unless we forget add case. */ @@ -547,8 +547,8 @@ static int ntfs_show_options(struct seq_file *m, struct dentry *root) seq_puts(m, ",nohidden"); if (opts->force) seq_puts(m, ",force"); - if (opts->no_acs_rules) - seq_puts(m, ",no_acs_rules"); + if (opts->noacsrules) + seq_puts(m, ",noacsrules"); if (opts->prealloc) seq_puts(m, ",prealloc"); if (sb->s_flags & SB_POSIXACL) diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c index ac4b37bf8832..6f88cb77a17f 100644 --- a/fs/ntfs3/xattr.c +++ b/fs/ntfs3/xattr.c @@ -769,7 +769,7 @@ int ntfs_acl_chmod(struct user_namespace *mnt_userns, struct inode *inode) int ntfs_permission(struct user_namespace *mnt_userns, struct inode *inode, int mask) { - if (ntfs_sb(inode->i_sb)->options->no_acs_rules) { + if (ntfs_sb(inode->i_sb)->options->noacsrules) { /* "No access rules" mode - Allow all changes. */ return 0; } -- 2.30.0

1 0

[PATCH OLK-5.10 041/107] fs/ntfs3: Add iocharset= mount option as alias for nls=
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Kari Argillander <kari.argillander(a)gmail.com> mainline inclusion from mainline-v5.15 commit e274cde8c7550cac46eb7aba3a77aff44ae0b301 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Other fs drivers are using iocharset= mount option for specifying charset. So add it also for ntfs3 and mark old nls= mount option as deprecated. Reviewed-by: Pali Rohár <pali(a)kernel.org> Signed-off-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- Documentation/filesystems/ntfs3.rst | 4 ++-- fs/ntfs3/super.c | 18 +++++++++++------- 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/Documentation/filesystems/ntfs3.rst b/Documentation/filesystems/ntfs3.rst index af7158de6fde..ded706474825 100644 --- a/Documentation/filesystems/ntfs3.rst +++ b/Documentation/filesystems/ntfs3.rst @@ -32,12 +32,12 @@ generic ones. =============================================================================== -nls=name This option informs the driver how to interpret path +iocharset=name This option informs the driver how to interpret path strings and translate them to Unicode and back. If this option is not set, the default codepage will be used (CONFIG_NLS_DEFAULT). Examples: - 'nls=utf8' + 'iocharset=utf8' uid= gid= diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c index 729ead6f2fac..503e2e23f711 100644 --- a/fs/ntfs3/super.c +++ b/fs/ntfs3/super.c @@ -226,7 +226,7 @@ enum Opt { Opt_nohidden, Opt_showmeta, Opt_acl, - Opt_nls, + Opt_iocharset, Opt_prealloc, Opt_no_acs_rules, Opt_err, @@ -245,9 +245,13 @@ static const struct fs_parameter_spec ntfs_fs_parameters[] = { fsparam_flag_no("hidden", Opt_nohidden), fsparam_flag_no("acl", Opt_acl), fsparam_flag_no("showmeta", Opt_showmeta), - fsparam_string("nls", Opt_nls), fsparam_flag_no("prealloc", Opt_prealloc), fsparam_flag("no_acs_rules", Opt_no_acs_rules), + fsparam_string("iocharset", Opt_iocharset), + + __fsparam(fs_param_is_string, + "nls", Opt_iocharset, + fs_param_deprecated, NULL), {} }; @@ -346,7 +350,7 @@ static int ntfs_fs_parse_param(struct fs_context *fc, case Opt_showmeta: opts->showmeta = result.negated ? 0 : 1; break; - case Opt_nls: + case Opt_iocharset: kfree(opts->nls_name); opts->nls_name = param->string; param->string = NULL; @@ -380,11 +384,11 @@ static int ntfs_fs_reconfigure(struct fs_context *fc) new_opts->nls = ntfs_load_nls(new_opts->nls_name); if (IS_ERR(new_opts->nls)) { new_opts->nls = NULL; - errorf(fc, "ntfs3: Cannot load nls %s", new_opts->nls_name); + errorf(fc, "ntfs3: Cannot load iocharset %s", new_opts->nls_name); return -EINVAL; } if (new_opts->nls != sbi->options->nls) - return invalf(fc, "ntfs3: Cannot use different nls when remounting!"); + return invalf(fc, "ntfs3: Cannot use different iocharset when remounting!"); sync_filesystem(sb); @@ -528,9 +532,9 @@ static int ntfs_show_options(struct seq_file *m, struct dentry *root) if (opts->dmask) seq_printf(m, ",dmask=%04o", ~opts->fs_dmask_inv); if (opts->nls) - seq_printf(m, ",nls=%s", opts->nls->charset); + seq_printf(m, ",iocharset=%s", opts->nls->charset); else - seq_puts(m, ",nls=utf8"); + seq_puts(m, ",iocharset=utf8"); if (opts->sys_immutable) seq_puts(m, ",sys_immutable"); if (opts->discard) -- 2.30.0

1 0

[PATCH OLK-5.10 040/107] fs/ntfs3: Make mount option nohidden more universal
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Kari Argillander <kari.argillander(a)gmail.com> mainline inclusion from mainline-v5.15 commit 9d1939f4575f3fda70dd94542dbd4d775e104132 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- If we call Opt_nohidden with just keyword hidden, then we can use hidden/nohidden when mounting. We already use this method for almoust all other parameters so it is just logical that this will use same method. Acked-by: Christian Brauner <christian.brauner(a)ubuntu.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Pali Rohár <pali(a)kernel.org> Signed-off-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c index 420cd1409170..729ead6f2fac 100644 --- a/fs/ntfs3/super.c +++ b/fs/ntfs3/super.c @@ -242,7 +242,7 @@ static const struct fs_parameter_spec ntfs_fs_parameters[] = { fsparam_flag_no("discard", Opt_discard), fsparam_flag_no("force", Opt_force), fsparam_flag_no("sparse", Opt_sparse), - fsparam_flag("nohidden", Opt_nohidden), + fsparam_flag_no("hidden", Opt_nohidden), fsparam_flag_no("acl", Opt_acl), fsparam_flag_no("showmeta", Opt_showmeta), fsparam_string("nls", Opt_nls), @@ -331,7 +331,7 @@ static int ntfs_fs_parse_param(struct fs_context *fc, opts->sparse = result.negated ? 0 : 1; break; case Opt_nohidden: - opts->nohidden = 1; + opts->nohidden = result.negated ? 1 : 0; break; case Opt_acl: if (!result.negated) -- 2.30.0

1 0

[PATCH OLK-5.10 035/107] fs/ntfs3: Remove unnecesarry mount option noatime
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Kari Argillander <kari.argillander(a)gmail.com> mainline inclusion from mainline-v5.15 commit b8a30b4171b9a3c22ef0605ed74a21544d00c680 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Remove unnecesarry mount option noatime because this will be handled by VFS. Our option parser will never get opt like this. Acked-by: Christian Brauner <christian.brauner(a)ubuntu.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Pali Rohár <pali(a)kernel.org> Signed-off-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- Documentation/filesystems/ntfs3.rst | 4 ---- fs/ntfs3/super.c | 7 ------- 2 files changed, 11 deletions(-) diff --git a/Documentation/filesystems/ntfs3.rst b/Documentation/filesystems/ntfs3.rst index ffe9ea0c1499..af7158de6fde 100644 --- a/Documentation/filesystems/ntfs3.rst +++ b/Documentation/filesystems/ntfs3.rst @@ -85,10 +85,6 @@ acl Support POSIX ACLs (Access Control Lists). Effective if supported by Kernel. Not to be confused with NTFS ACLs. The option specified as acl enables support for POSIX ACLs. -noatime All files and directories will not update their last access - time attribute if a partition is mounted with this parameter. - This option can speed up file system operation. - =============================================================================== ToDo list diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c index 55bbc9200a10..a18b99a3e3b5 100644 --- a/fs/ntfs3/super.c +++ b/fs/ntfs3/super.c @@ -223,7 +223,6 @@ enum Opt { Opt_nohidden, Opt_showmeta, Opt_acl, - Opt_noatime, Opt_nls, Opt_prealloc, Opt_no_acs_rules, @@ -242,7 +241,6 @@ static const match_table_t ntfs_tokens = { { Opt_sparse, "sparse" }, { Opt_nohidden, "nohidden" }, { Opt_acl, "acl" }, - { Opt_noatime, "noatime" }, { Opt_showmeta, "showmeta" }, { Opt_nls, "nls=%s" }, { Opt_prealloc, "prealloc" }, @@ -333,9 +331,6 @@ static noinline int ntfs_parse_options(struct super_block *sb, char *options, ntfs_err(sb, "support for ACL not compiled in!"); return -EINVAL; #endif - case Opt_noatime: - sb->s_flags |= SB_NOATIME; - break; case Opt_showmeta: opts->showmeta = 1; break; @@ -587,8 +582,6 @@ static int ntfs_show_options(struct seq_file *m, struct dentry *root) seq_puts(m, ",prealloc"); if (sb->s_flags & SB_POSIXACL) seq_puts(m, ",acl"); - if (sb->s_flags & SB_NOATIME) - seq_puts(m, ",noatime"); return 0; } -- 2.30.0

1 0

[PATCH OLK-5.10 031/107] fs/ntfs3: Fix integer overflow in ni_fiemap with fiemap_prep()
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Kari Argillander <kari.argillander(a)gmail.com> mainline inclusion from mainline-v5.15 commit d4e8e135a9af7d8d939bba1874ab314322fc2dc2 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Use fiemap_prep() to check valid flags. It also shrink request scope (@len) to what the fs can actually handle. This address following Smatch static checker warning: fs/ntfs3/frecord.c:1894 ni_fiemap() warn: potential integer overflow from user 'vbo + len' Because fiemap_prep() shrinks @len this cannot happened anymore. Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com> Link: lore.kernel.org/ntfs3/20210825080440.GA17407@kili/ Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") Signed-off-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/file.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c index 89557d60a9b0..f9c9a8c91b46 100644 --- a/fs/ntfs3/file.c +++ b/fs/ntfs3/file.c @@ -1212,8 +1212,9 @@ int ntfs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, int err; struct ntfs_inode *ni = ntfs_i(inode); - if (fieinfo->fi_flags & FIEMAP_FLAG_XATTR) - return -EOPNOTSUPP; + err = fiemap_prep(inode, fieinfo, start, &len, ~FIEMAP_FLAG_XATTR); + if (err) + return err; ni_lock(ni); -- 2.30.0

1 0

[PATCH OLK-5.10 030/107] fs/ntfs3: Restyle comments to better align with kernel-doc
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> mainline inclusion from mainline-v5.15 commit d3624466b56dd5b1886c1dff500525b544c19c83 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/attrib.c | 18 +++++++++++------- fs/ntfs3/bitmap.c | 5 ++--- fs/ntfs3/file.c | 18 +++++++++--------- fs/ntfs3/frecord.c | 27 +++++++++++++-------------- fs/ntfs3/fslog.c | 11 +++++++---- fs/ntfs3/fsntfs.c | 8 ++++---- fs/ntfs3/index.c | 8 +++++--- fs/ntfs3/inode.c | 20 ++++++++++---------- fs/ntfs3/lznt.c | 5 +++-- fs/ntfs3/ntfs.h | 2 +- fs/ntfs3/ntfs_fs.h | 24 ++++++++++++------------ fs/ntfs3/record.c | 2 +- fs/ntfs3/super.c | 2 +- fs/ntfs3/upcase.c | 2 +- fs/ntfs3/xattr.c | 7 ++++--- 15 files changed, 84 insertions(+), 75 deletions(-) diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c index ffc323bacc9f..34c4cbf7e29b 100644 --- a/fs/ntfs3/attrib.c +++ b/fs/ntfs3/attrib.c @@ -199,6 +199,7 @@ int attr_allocate_clusters(struct ntfs_sb_info *sbi, struct runs_tree *run, /* Add new fragment into run storage. */ if (!run_add_entry(run, vcn, lcn, flen, opt == ALLOCATE_MFT)) { + /* Undo last 'ntfs_look_for_free_space' */ down_write_nested(&wnd->rw_lock, BITMAP_MUTEX_CLUSTERS); wnd_set_free(wnd, lcn, flen); up_write(&wnd->rw_lock); @@ -351,7 +352,6 @@ int attr_make_nonresident(struct ntfs_inode *ni, struct ATTRIB *attr, run_close(run); out1: kfree(attr_s); - /* Reinsert le. */ out: return err; } @@ -1153,14 +1153,18 @@ int attr_load_runs_vcn(struct ntfs_inode *ni, enum ATTR_TYPE type, u16 ro; attr = ni_find_attr(ni, NULL, NULL, type, name, name_len, &vcn, NULL); - if (!attr) + if (!attr) { + /* Is record corrupted? */ return -ENOENT; + } svcn = le64_to_cpu(attr->nres.svcn); evcn = le64_to_cpu(attr->nres.evcn); - if (evcn < vcn || vcn < svcn) + if (evcn < vcn || vcn < svcn) { + /* Is record corrupted? */ return -EINVAL; + } ro = le16_to_cpu(attr->nres.run_off); err = run_unpack_ex(run, ni->mi.sbi, ni->mi.rno, svcn, evcn, svcn, @@ -1171,7 +1175,7 @@ int attr_load_runs_vcn(struct ntfs_inode *ni, enum ATTR_TYPE type, } /* - * attr_wof_load_runs_range - Load runs for given range [from to). + * attr_load_runs_range - Load runs for given range [from to). */ int attr_load_runs_range(struct ntfs_inode *ni, enum ATTR_TYPE type, const __le16 *name, u8 name_len, struct runs_tree *run, @@ -1974,7 +1978,7 @@ int attr_punch_hole(struct ntfs_inode *ni, u64 vbo, u64 bytes, u32 *frame_size) total_size = le64_to_cpu(attr_b->nres.total_size); if (vbo >= alloc_size) { - // NOTE: It is allowed. + /* NOTE: It is allowed. */ return 0; } @@ -1986,9 +1990,9 @@ int attr_punch_hole(struct ntfs_inode *ni, u64 vbo, u64 bytes, u32 *frame_size) bytes -= vbo; if ((vbo & mask) || (bytes & mask)) { - /* We have to zero a range(s)*/ + /* We have to zero a range(s). */ if (frame_size == NULL) { - /* Caller insists range is aligned */ + /* Caller insists range is aligned. */ return -EINVAL; } *frame_size = mask + 1; diff --git a/fs/ntfs3/bitmap.c b/fs/ntfs3/bitmap.c index 06ae38adb8ad..831501555009 100644 --- a/fs/ntfs3/bitmap.c +++ b/fs/ntfs3/bitmap.c @@ -29,7 +29,6 @@ struct rb_node_key { size_t key; }; -/* Tree is sorted by start (key). */ struct e_node { struct rb_node_key start; /* Tree sorted by start. */ struct rb_node_key count; /* Tree sorted by len. */ @@ -1117,7 +1116,7 @@ size_t wnd_find(struct wnd_bitmap *wnd, size_t to_alloc, size_t hint, sb = wnd->sb; log2_bits = sb->s_blocksize_bits + 3; - /* At most two ranges [hint, max_alloc) + [0, hint) */ + /* At most two ranges [hint, max_alloc) + [0, hint). */ Again: /* TODO: Optimize request for case nbits > wbits. */ @@ -1241,7 +1240,7 @@ size_t wnd_find(struct wnd_bitmap *wnd, size_t to_alloc, size_t hint, continue; } - /* Read window */ + /* Read window. */ bh = wnd_map(wnd, iw); if (IS_ERR(bh)) { // TODO: Error. diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c index 62ebfa324bff..89557d60a9b0 100644 --- a/fs/ntfs3/file.c +++ b/fs/ntfs3/file.c @@ -190,7 +190,8 @@ static int ntfs_extend_initialized_size(struct file *file, /* * ntfs_zero_range - Helper function for punch_hole. - * It zeroes a range [vbo, vbo_to) + * + * It zeroes a range [vbo, vbo_to). */ static int ntfs_zero_range(struct inode *inode, u64 vbo, u64 vbo_to) { @@ -231,12 +232,12 @@ static int ntfs_zero_range(struct inode *inode, u64 vbo, u64 vbo_to) if (!buffer_mapped(bh)) { ntfs_get_block(inode, iblock, bh, 0); - /* unmapped? It's a hole - nothing to do */ + /* Unmapped? It's a hole - nothing to do. */ if (!buffer_mapped(bh)) continue; } - /* Ok, it's mapped. Make sure it's up-to-date */ + /* Ok, it's mapped. Make sure it's up-to-date. */ if (PageUptodate(page)) set_buffer_uptodate(bh); @@ -272,9 +273,8 @@ static int ntfs_zero_range(struct inode *inode, u64 vbo, u64 vbo_to) } /* - * ntfs_sparse_cluster + * ntfs_sparse_cluster - Helper function to zero a new allocated clusters. * - * Helper function to zero a new allocated clusters * NOTE: 512 <= cluster size <= 2M */ void ntfs_sparse_cluster(struct inode *inode, struct page *page0, CLST vcn, @@ -588,7 +588,7 @@ static long ntfs_fallocate(struct file *file, int mode, loff_t vbo, loff_t len) truncate_pagecache(inode, vbo_down); if (!is_sparsed(ni) && !is_compressed(ni)) { - /* normal file */ + /* Normal file. */ err = ntfs_zero_range(inode, vbo, end); goto out; } @@ -599,7 +599,7 @@ static long ntfs_fallocate(struct file *file, int mode, loff_t vbo, loff_t len) if (err != E_NTFS_NOTALIGNED) goto out; - /* process not aligned punch */ + /* Process not aligned punch. */ mask = frame_size - 1; vbo_a = (vbo + mask) & ~mask; end_a = end & ~mask; @@ -647,7 +647,7 @@ static long ntfs_fallocate(struct file *file, int mode, loff_t vbo, loff_t len) if (err) goto out; - /* Wait for existing dio to complete */ + /* Wait for existing dio to complete. */ inode_dio_wait(inode); truncate_pagecache(inode, vbo_down); @@ -1127,7 +1127,7 @@ static ssize_t ntfs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) goto out; if (WARN_ON(ni->ni_flags & NI_FLAG_COMPRESSED_MASK)) { - /* Should never be here, see ntfs_file_open() */ + /* Should never be here, see ntfs_file_open(). */ ret = -EOPNOTSUPP; goto out; } diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c index 3f48b612ec96..938b12d56ca6 100644 --- a/fs/ntfs3/frecord.c +++ b/fs/ntfs3/frecord.c @@ -56,7 +56,7 @@ static struct mft_inode *ni_find_mi(struct ntfs_inode *ni, CLST rno) /* * ni_add_mi - Add new mft_inode into ntfs_inode. -*/ + */ static void ni_add_mi(struct ntfs_inode *ni, struct mft_inode *mi) { ni_ins_mi(ni, &ni->mi_tree, mi->rno, &mi->node); @@ -70,9 +70,8 @@ void ni_remove_mi(struct ntfs_inode *ni, struct mft_inode *mi) rb_erase(&mi->node, &ni->mi_tree); } -/* ni_std - * - * Return: Pointer into std_info from primary record. +/* + * ni_std - Return: Pointer into std_info from primary record. */ struct ATTR_STD_INFO *ni_std(struct ntfs_inode *ni) { @@ -385,7 +384,7 @@ bool ni_add_subrecord(struct ntfs_inode *ni, CLST rno, struct mft_inode **mi) /* * ni_remove_attr - Remove all attributes for the given type/name/id. -*/ + */ int ni_remove_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, const __le16 *name, size_t name_len, bool base_only, const __le16 *id) @@ -740,7 +739,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni) /* * ni_create_attr_list - Generates an attribute list for this primary record. -*/ + */ int ni_create_attr_list(struct ntfs_inode *ni) { struct ntfs_sb_info *sbi = ni->mi.sbi; @@ -939,7 +938,7 @@ static int ni_ins_attr_ext(struct ntfs_inode *ni, struct ATTR_LIST_ENTRY *le, if (is_mft_data && (mi_enum_attr(mi, NULL) || vbo <= ((u64)mi->rno << sbi->record_bits))) { - /* We can't accept this record 'case MFT's bootstrapping. */ + /* We can't accept this record 'cause MFT's bootstrapping. */ continue; } if (is_mft && @@ -1078,7 +1077,7 @@ static int ni_insert_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, */ max_free = free; - /* Estimate the result of moving all possible attributes away.*/ + /* Estimate the result of moving all possible attributes away. */ attr = NULL; while ((attr = mi_enum_attr(&ni->mi, attr))) { @@ -1095,7 +1094,7 @@ static int ni_insert_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, goto out; } - /* Start real attribute moving */ + /* Start real attribute moving. */ attr = NULL; for (;;) { @@ -1542,7 +1541,7 @@ int ni_delete_all(struct ntfs_inode *ni) node = next; } - /* Free base record */ + /* Free base record. */ clear_rec_inuse(ni->mi.mrec); ni->mi.dirty = true; err = mi_write(&ni->mi, 0); @@ -2243,7 +2242,7 @@ int ni_decompress_file(struct ntfs_inode *ni) } if (attr->non_res && is_attr_sparsed(attr)) { - /* Sarsed attribute header is 8 bytes bigger than normal. */ + /* Sparsed attribute header is 8 bytes bigger than normal. */ struct MFT_REC *rec = mi->mrec; u32 used = le32_to_cpu(rec->used); u32 asize = le32_to_cpu(attr->size); @@ -2324,7 +2323,7 @@ static int decompress_lzx_xpress(struct ntfs_sb_info *sbi, const char *cmpr, mutex_lock(&sbi->compress.mtx_xpress); ctx = sbi->compress.xpress; if (!ctx) { - /* Lazy initialize Xpress decompress context */ + /* Lazy initialize Xpress decompress context. */ ctx = xpress_allocate_decompressor(); if (!ctx) { err = -ENOMEM; @@ -2348,7 +2347,7 @@ static int decompress_lzx_xpress(struct ntfs_sb_info *sbi, const char *cmpr, /* * ni_read_frame * - * Pages - array of locked pages. + * Pages - Array of locked pages. */ int ni_read_frame(struct ntfs_inode *ni, u64 frame_vbo, struct page **pages, u32 pages_per_frame) @@ -2740,7 +2739,7 @@ int ni_write_frame(struct ntfs_inode *ni, struct page **pages, lznt = NULL; } - /* Compress: frame_mem -> frame_ondisk. */ + /* Compress: frame_mem -> frame_ondisk */ compr_size = compress_lznt(frame_mem, frame_size, frame_ondisk, frame_size, sbi->compress.lznt); mutex_unlock(&sbi->compress.mtx_lznt); diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c index 6f6057129fdd..b5853aed0e25 100644 --- a/fs/ntfs3/fslog.c +++ b/fs/ntfs3/fslog.c @@ -1362,7 +1362,8 @@ static void log_create(struct ntfs_log *log, u32 l_size, const u64 last_lsn, /* Compute the log page values. */ log->data_off = ALIGN( offsetof(struct RECORD_PAGE_HDR, fixups) + - sizeof(short) * ((log->page_size >> SECTOR_SHIFT) + 1), 8); + sizeof(short) * ((log->page_size >> SECTOR_SHIFT) + 1), + 8); log->data_size = log->page_size - log->data_off; log->record_header_len = sizeof(struct LFS_RECORD_HDR); @@ -1372,7 +1373,9 @@ static void log_create(struct ntfs_log *log, u32 l_size, const u64 last_lsn, /* Compute the restart page values. */ log->ra_off = ALIGN( offsetof(struct RESTART_HDR, fixups) + - sizeof(short) * ((log->sys_page_size >> SECTOR_SHIFT) + 1), 8); + sizeof(short) * + ((log->sys_page_size >> SECTOR_SHIFT) + 1), + 8); log->restart_size = log->sys_page_size - log->ra_off; log->ra_size = struct_size(log->ra, clients, 1); log->current_openlog_count = open_log_count; @@ -5132,8 +5135,8 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) rh->sys_page_size = cpu_to_le32(log->page_size); rh->page_size = cpu_to_le32(log->page_size); - t16 = ALIGN(offsetof(struct RESTART_HDR, fixups) + - sizeof(short) * t16, 8); + t16 = ALIGN(offsetof(struct RESTART_HDR, fixups) + sizeof(short) * t16, + 8); rh->ra_off = cpu_to_le16(t16); rh->minor_ver = cpu_to_le16(1); // 0x1A: rh->major_ver = cpu_to_le16(1); // 0x1C: diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c index 669249439217..91e3743e1442 100644 --- a/fs/ntfs3/fsntfs.c +++ b/fs/ntfs3/fsntfs.c @@ -312,7 +312,7 @@ int ntfs_loadlog_and_replay(struct ntfs_inode *ni, struct ntfs_sb_info *sbi) if (sb_rdonly(sb) || !initialized) goto out; - /* Fill LogFile by '-1' if it is initialized.ssss */ + /* Fill LogFile by '-1' if it is initialized. */ err = ntfs_bio_fill_1(sbi, &ni->file.run); out: @@ -960,10 +960,10 @@ int ntfs_set_state(struct ntfs_sb_info *sbi, enum NTFS_DIRTY_FLAGS dirty) /* verify(!ntfs_update_mftmirr()); */ /* - * if we used wait=1, sync_inode_metadata waits for the io for the + * If we used wait=1, sync_inode_metadata waits for the io for the * inode to finish. It hangs when media is removed. * So wait=0 is sent down to sync_inode_metadata - * and filemap_fdatawrite is used for the data blocks + * and filemap_fdatawrite is used for the data blocks. */ err = sync_inode_metadata(&ni->vfs_inode, 0); if (!err) @@ -1917,7 +1917,7 @@ int ntfs_security_init(struct ntfs_sb_info *sbi) sbi->security.next_id = SECURITY_ID_FIRST; /* Always write new security at the end of bucket. */ sbi->security.next_off = - ALIGN(sds_size - SecurityDescriptorsBlockSize, 16); + ALIGN(sds_size - SecurityDescriptorsBlockSize, 16); off = 0; ne = NULL; diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c index 1224b8e42b3e..0daca9adc54c 100644 --- a/fs/ntfs3/index.c +++ b/fs/ntfs3/index.c @@ -2624,17 +2624,19 @@ int indx_update_dup(struct ntfs_inode *ni, struct ntfs_sb_info *sbi, e_fname = (struct ATTR_FILE_NAME *)(e + 1); if (!memcmp(&e_fname->dup, dup, sizeof(*dup))) { - /* Nothing to update in index! Try to avoid this call. */ + /* + * Nothing to update in index! Try to avoid this call. + */ goto out; } memcpy(&e_fname->dup, dup, sizeof(*dup)); if (fnd->level) { - /* directory entry in index */ + /* Directory entry in index. */ err = indx_write(indx, ni, fnd->nodes[fnd->level - 1], sync); } else { - /* directory entry in directory MFT record */ + /* Directory entry in directory MFT record. */ mi->dirty = true; if (sync) err = mi_write(mi, 1); diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c index 8f72066b3229..db2a5a4c38e4 100644 --- a/fs/ntfs3/inode.c +++ b/fs/ntfs3/inode.c @@ -89,7 +89,7 @@ static struct inode *ntfs_read_mft(struct inode *inode, } if (le32_to_cpu(rec->total) != sbi->record_size) { - // Bad inode? + /* Bad inode? */ err = -EINVAL; goto out; } @@ -605,7 +605,7 @@ static noinline int ntfs_get_block_vbo(struct inode *inode, u64 vbo, if (vbo >= valid) set_buffer_new(bh); } else if (create) { - /*normal write*/ + /* Normal write. */ if (bytes > bh->b_size) bytes = bh->b_size; @@ -1091,7 +1091,7 @@ int inode_write_data(struct inode *inode, const void *data, size_t bytes) /* * ntfs_reparse_bytes * - * Number of bytes to for REPARSE_DATA_BUFFER(IO_REPARSE_TAG_SYMLINK) + * Number of bytes for REPARSE_DATA_BUFFER(IO_REPARSE_TAG_SYMLINK) * for unicode string of @uni_len length. */ static inline u32 ntfs_reparse_bytes(u32 uni_len) @@ -1205,13 +1205,13 @@ struct inode *ntfs_create_inode(struct user_namespace *mnt_userns, return ERR_PTR(-EINVAL); if (S_ISDIR(mode)) { - /* use parent's directory attributes */ + /* Use parent's directory attributes. */ fa = dir_ni->std_fa | FILE_ATTRIBUTE_DIRECTORY | FILE_ATTRIBUTE_ARCHIVE; /* - * By default child directory inherits parent attributes - * root directory is hidden + system - * Make an exception for children in root + * By default child directory inherits parent attributes. + * Root directory is hidden + system. + * Make an exception for children in root. */ if (dir->i_ino == MFT_REC_ROOT) fa &= ~(FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM); @@ -1220,8 +1220,8 @@ struct inode *ntfs_create_inode(struct user_namespace *mnt_userns, fa = FILE_ATTRIBUTE_REPARSE_POINT; /* - * linux: there are dir/file/symlink and so on. - * NTFS: symlinks are "dir + reparse" or "file + reparse". + * Linux: there are dir/file/symlink and so on. + * NTFS: symlinks are "dir + reparse" or "file + reparse" * It is good idea to create: * dir + reparse if 'symname' points to directory * or @@ -1860,7 +1860,7 @@ static noinline int ntfs_readlink_hlp(struct inode *inode, char *buffer, default: if (IsReparseTagMicrosoft(rp->ReparseTag)) { - /* unknown Microsoft Tag */ + /* Unknown Microsoft Tag. */ goto out; } if (!IsReparseTagNameSurrogate(rp->ReparseTag) || diff --git a/fs/ntfs3/lznt.c b/fs/ntfs3/lznt.c index 3acf0d9f0b15..f1f691a67cc4 100644 --- a/fs/ntfs3/lznt.c +++ b/fs/ntfs3/lznt.c @@ -296,8 +296,9 @@ static inline ssize_t decompress_chunk(u8 *unc, u8 *unc_end, const u8 *cmpr, */ struct lznt *get_lznt_ctx(int level) { - struct lznt *r = kzalloc(level ? offsetof(struct lznt, hash) : - sizeof(struct lznt), GFP_NOFS); + struct lznt *r = kzalloc(level ? offsetof(struct lznt, hash) + : sizeof(struct lznt), + GFP_NOFS); if (r) r->std = !level; diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h index 0fd7bffb98d4..6bb3e595263b 100644 --- a/fs/ntfs3/ntfs.h +++ b/fs/ntfs3/ntfs.h @@ -262,7 +262,7 @@ enum RECORD_FLAG { RECORD_FLAG_UNKNOWN = cpu_to_le16(0x0008), }; -/* MFT Record structure, */ +/* MFT Record structure. */ struct MFT_REC { struct NTFS_RECORD_HEADER rhdr; // 'FILE' diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h index f9436cbbc347..97e682ebcfb9 100644 --- a/fs/ntfs3/ntfs_fs.h +++ b/fs/ntfs3/ntfs_fs.h @@ -59,18 +59,18 @@ struct ntfs_mount_options { u16 fs_fmask_inv; u16 fs_dmask_inv; - unsigned uid : 1, /* uid was set. */ - gid : 1, /* gid was set. */ - fmask : 1, /* fmask was set. */ - dmask : 1, /* dmask was set. */ - sys_immutable : 1,/* Immutable system files. */ - discard : 1, /* Issue discard requests on deletions. */ - sparse : 1, /* Create sparse files. */ - showmeta : 1, /* Show meta files. */ - nohidden : 1, /* Do not show hidden files. */ - force : 1, /* Rw mount dirty volume. */ - no_acs_rules : 1,/*Exclude acs rules. */ - prealloc : 1 /* Preallocate space when file is growing. */ + unsigned uid : 1, /* uid was set. */ + gid : 1, /* gid was set. */ + fmask : 1, /* fmask was set. */ + dmask : 1, /* dmask was set. */ + sys_immutable : 1, /* Immutable system files. */ + discard : 1, /* Issue discard requests on deletions. */ + sparse : 1, /* Create sparse files. */ + showmeta : 1, /* Show meta files. */ + nohidden : 1, /* Do not show hidden files. */ + force : 1, /* Rw mount dirty volume. */ + no_acs_rules : 1, /*Exclude acs rules. */ + prealloc : 1 /* Preallocate space when file is growing. */ ; }; diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c index 61e3f2fb619f..103705c86772 100644 --- a/fs/ntfs3/record.c +++ b/fs/ntfs3/record.c @@ -219,7 +219,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) asize = le32_to_cpu(attr->size); if (asize < SIZEOF_RESIDENT) { - /* Impossible 'cause we should not return such attribute */ + /* Impossible 'cause we should not return such attribute. */ return NULL; } diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c index 2fbab8a931ee..dbecf095da59 100644 --- a/fs/ntfs3/super.c +++ b/fs/ntfs3/super.c @@ -1053,7 +1053,7 @@ static int ntfs_fill_super(struct super_block *sb, void *data, int silent) iput(inode); - /* Load $LogFile to replay. */ + /* Load LogFile to replay. */ ref.low = cpu_to_le32(MFT_REC_LOG); ref.seq = cpu_to_le16(MFT_REC_LOG); inode = ntfs_iget5(sb, &ref, &NAME_LOGFILE); diff --git a/fs/ntfs3/upcase.c b/fs/ntfs3/upcase.c index eb65bbd939e8..bbeba778237e 100644 --- a/fs/ntfs3/upcase.c +++ b/fs/ntfs3/upcase.c @@ -34,7 +34,7 @@ static inline u16 upcase_unicode_char(const u16 *upcase, u16 chr) * - Case insensitive * - If name equals and 'bothcases' then * - Case sensitive - * 'Straigth way' code scans input names twice in worst case. + * 'Straight way' code scans input names twice in worst case. * Optimized code scans input names only once. */ int ntfs_cmp_names(const __le16 *s1, size_t l1, const __le16 *s2, size_t l2, diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c index 22fd5eb32c5b..b15d532e4a17 100644 --- a/fs/ntfs3/xattr.c +++ b/fs/ntfs3/xattr.c @@ -26,9 +26,10 @@ static inline size_t unpacked_ea_size(const struct EA_FULL *ea) { return ea->size ? le32_to_cpu(ea->size) - : ALIGN(struct_size( - ea, name, - 1 + ea->name_len + le16_to_cpu(ea->elength)), 4); + : ALIGN(struct_size(ea, name, + 1 + ea->name_len + + le16_to_cpu(ea->elength)), + 4); } static inline size_t packed_ea_size(const struct EA_FULL *ea) -- 2.30.0

1 0

[PATCH OLK-5.10 026/107] fs/ntfs3: Fix error handling in indx_insert_into_root()
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Dan Carpenter <dan.carpenter(a)oracle.com> mainline inclusion from mainline-v5.15 commit b8155e95de38b25a69dfb03e4731fd6c5a28531e category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- There are three bugs in this code: 1) If indx_get_root() fails, then return -EINVAL instead of success. 2) On the "/* make root external */" -EOPNOTSUPP; error path it should free "re" but it has a memory leak. 3) If indx_new() fails then it will lead to an error pointer dereference when we call put_indx_node(). I've re-written the error handling to be more clear. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/index.c | 36 ++++++++++++++++-------------------- 1 file changed, 16 insertions(+), 20 deletions(-) diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c index f4729aa50671..69c6c4e0b4d9 100644 --- a/fs/ntfs3/index.c +++ b/fs/ntfs3/index.c @@ -1555,12 +1555,12 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni, u32 root_size, new_root_size; struct ntfs_sb_info *sbi; int ds_root; - struct INDEX_ROOT *root, *a_root = NULL; + struct INDEX_ROOT *root, *a_root; /* Get the record this root placed in */ root = indx_get_root(indx, ni, &attr, &mi); if (!root) - goto out; + return -EINVAL; /* * Try easy case: @@ -1592,10 +1592,8 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni, /* Make a copy of root attribute to restore if error */ a_root = kmemdup(attr, asize, GFP_NOFS); - if (!a_root) { - err = -ENOMEM; - goto out; - } + if (!a_root) + return -ENOMEM; /* copy all the non-end entries from the index root to the new buffer.*/ to_move = 0; @@ -1605,7 +1603,7 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni, for (e = e0;; e = hdr_next_de(hdr, e)) { if (!e) { err = -EINVAL; - goto out; + goto out_free_root; } if (de_is_last(e)) @@ -1613,14 +1611,13 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni, to_move += le16_to_cpu(e->size); } - n = NULL; if (!to_move) { re = NULL; } else { re = kmemdup(e0, to_move, GFP_NOFS); if (!re) { err = -ENOMEM; - goto out; + goto out_free_root; } } @@ -1637,7 +1634,7 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni, if (ds_root > 0 && used + ds_root > sbi->max_bytes_per_attr) { /* make root external */ err = -EOPNOTSUPP; - goto out; + goto out_free_re; } if (ds_root) @@ -1667,7 +1664,7 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni, /* bug? */ ntfs_set_state(sbi, NTFS_DIRTY_ERROR); err = -EINVAL; - goto out1; + goto out_free_re; } if (err) { @@ -1678,7 +1675,7 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni, /* bug? */ ntfs_set_state(sbi, NTFS_DIRTY_ERROR); } - goto out1; + goto out_free_re; } e = (struct NTFS_DE *)(root + 1); @@ -1689,7 +1686,7 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni, n = indx_new(indx, ni, new_vbn, sub_vbn); if (IS_ERR(n)) { err = PTR_ERR(n); - goto out1; + goto out_free_re; } hdr = &n->index->ihdr; @@ -1716,7 +1713,7 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni, put_indx_node(n); fnd_clear(fnd); err = indx_insert_entry(indx, ni, new_de, ctx, fnd); - goto out; + goto out_free_root; } /* @@ -1726,7 +1723,7 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni, e = hdr_insert_de(indx, hdr, new_de, NULL, ctx); if (!e) { err = -EINVAL; - goto out1; + goto out_put_n; } fnd_push(fnd, n, e); @@ -1735,12 +1732,11 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni, n = NULL; -out1: +out_put_n: + put_indx_node(n); +out_free_re: kfree(re); - if (n) - put_indx_node(n); - -out: +out_free_root: kfree(a_root); return err; } -- 2.30.0

1 0

[PATCH OLK-5.10 025/107] fs/ntfs3: Potential NULL dereference in hdr_find_split()
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Dan Carpenter <dan.carpenter(a)oracle.com> mainline inclusion from mainline-v5.15 commit 8c83a4851da1c7eda83098ade238665b15774da3 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- The "e" pointer is dereferenced before it has been checked for NULL. Move the dereference after the NULL check to prevent an Oops. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/index.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c index 5fb41c9c8910..f4729aa50671 100644 --- a/fs/ntfs3/index.c +++ b/fs/ntfs3/index.c @@ -557,11 +557,12 @@ static const struct NTFS_DE *hdr_find_split(const struct INDEX_HDR *hdr) size_t o; const struct NTFS_DE *e = hdr_first_de(hdr); u32 used_2 = le32_to_cpu(hdr->used) >> 1; - u16 esize = le16_to_cpu(e->size); + u16 esize; if (!e || de_is_last(e)) return NULL; + esize = le16_to_cpu(e->size); for (o = le32_to_cpu(hdr->de_off) + esize; o < used_2; o += esize) { const struct NTFS_DE *p = e; -- 2.30.0

1 0

[PATCH OLK-5.10 024/107] fs/ntfs3: Fix error code in indx_add_allocate()
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Dan Carpenter <dan.carpenter(a)oracle.com> mainline inclusion from mainline-v5.15 commit 04810f000afdbdd37825ca7f563f036119422cb7 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Return -EINVAL if ni_find_attr() fails. Don't return success. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/index.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c index 334a3cef714b..5fb41c9c8910 100644 --- a/fs/ntfs3/index.c +++ b/fs/ntfs3/index.c @@ -1500,6 +1500,7 @@ static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni, alloc = ni_find_attr(ni, NULL, NULL, ATTR_ALLOC, in->name, in->name_len, NULL, &mi); if (!alloc) { + err = -EINVAL; if (bmp) goto out2; goto out1; -- 2.30.0

1 0

[PATCH OLK-5.10 023/107] fs/ntfs3: fix an error code in ntfs_get_acl_ex()
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Dan Carpenter <dan.carpenter(a)oracle.com> mainline inclusion from mainline-v5.15 commit 2926e4297053c735ab65450192dfba32a4f47fa9 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- The ntfs_get_ea() function returns negative error codes or on success it returns the length. In the original code a zero length return was treated as -ENODATA and results in a NULL return. But it should be treated as an invalid length and result in an PTR_ERR(-EINVAL) return. Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c index af89e50f7b9f..d3d5b9d331d1 100644 --- a/fs/ntfs3/xattr.c +++ b/fs/ntfs3/xattr.c @@ -521,7 +521,7 @@ static struct posix_acl *ntfs_get_acl_ex(struct user_namespace *mnt_userns, ni_unlock(ni); /* Translate extended attribute to acl */ - if (err > 0) { + if (err >= 0) { acl = posix_acl_from_xattr(mnt_userns, buf, err); if (!IS_ERR(acl)) set_cached_acl(inode, type, acl); -- 2.30.0

1 0

[PATCH OLK-5.10 022/107] fs/ntfs3: add checks for allocation failure
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Dan Carpenter <dan.carpenter(a)oracle.com> mainline inclusion from mainline-v5.15 commit a1b04d380ab64790a7b4a8eb52e14679e47065ab category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Add a check for when the kzalloc() in init_rsttbl() fails. Some of the callers checked for NULL and some did not. I went down the call tree and added NULL checks where ever they were missing. Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/fslog.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c index 2c213b55979e..7144ea8a9ab8 100644 --- a/fs/ntfs3/fslog.c +++ b/fs/ntfs3/fslog.c @@ -809,6 +809,9 @@ static inline struct RESTART_TABLE *init_rsttbl(u16 esize, u16 used) u32 lf = sizeof(struct RESTART_TABLE) + (used - 1) * esize; struct RESTART_TABLE *t = kzalloc(bytes, GFP_NOFS); + if (!t) + return NULL; + t->size = cpu_to_le16(esize); t->used = cpu_to_le16(used); t->free_goal = cpu_to_le32(~0u); @@ -831,7 +834,11 @@ static inline struct RESTART_TABLE *extend_rsttbl(struct RESTART_TABLE *tbl, u16 esize = le16_to_cpu(tbl->size); __le32 osize = cpu_to_le32(bytes_per_rt(tbl)); u32 used = le16_to_cpu(tbl->used); - struct RESTART_TABLE *rt = init_rsttbl(esize, used + add); + struct RESTART_TABLE *rt; + + rt = init_rsttbl(esize, used + add); + if (!rt) + return NULL; memcpy(rt + 1, tbl + 1, esize * used); @@ -864,8 +871,11 @@ static inline void *alloc_rsttbl_idx(struct RESTART_TABLE **tbl) __le32 *e; struct RESTART_TABLE *t = *tbl; - if (!t->first_free) + if (!t->first_free) { *tbl = t = extend_rsttbl(t, 16, ~0u); + if (!t) + return NULL; + } off = le32_to_cpu(t->first_free); @@ -4482,6 +4492,10 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) } dp = alloc_rsttbl_idx(&dptbl); + if (!dp) { + err = -ENOMEM; + goto out; + } dp->target_attr = cpu_to_le32(t16); dp->transfer_len = cpu_to_le32(t32 << sbi->cluster_bits); dp->lcns_follow = cpu_to_le32(t32); -- 2.30.0

1 0

[PATCH OLK-5.10 021/107] fs/ntfs3: Use kcalloc/kmalloc_array over kzalloc/kmalloc
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Kari Argillander <kari.argillander(a)gmail.com> mainline inclusion from mainline-v5.15 commit 345482bc431f6492beb464696341626057f67771 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Use kcalloc/kmalloc_array over kzalloc/kmalloc when we allocate array. Checkpatch found these after we did not use our own defined allocation wrappers. Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/bitmap.c | 2 +- fs/ntfs3/file.c | 2 +- fs/ntfs3/frecord.c | 7 +++---- 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/fs/ntfs3/bitmap.c b/fs/ntfs3/bitmap.c index d502bba323d0..2de05062c78b 100644 --- a/fs/ntfs3/bitmap.c +++ b/fs/ntfs3/bitmap.c @@ -683,7 +683,7 @@ int wnd_init(struct wnd_bitmap *wnd, struct super_block *sb, size_t nbits) if (!wnd->bits_last) wnd->bits_last = wbits; - wnd->free_bits = kzalloc(wnd->nwnd * sizeof(u16), GFP_NOFS); + wnd->free_bits = kcalloc(wnd->nwnd, sizeof(u16), GFP_NOFS); if (!wnd->free_bits) return -ENOMEM; diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c index 8d27c520bec5..a959f6197c99 100644 --- a/fs/ntfs3/file.c +++ b/fs/ntfs3/file.c @@ -900,7 +900,7 @@ static ssize_t ntfs_compress_write(struct kiocb *iocb, struct iov_iter *from) return -EOPNOTSUPP; } - pages = kmalloc(pages_per_frame * sizeof(struct page *), GFP_NOFS); + pages = kmalloc_array(pages_per_frame, sizeof(struct page *), GFP_NOFS); if (!pages) return -ENOMEM; diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c index 2f7d16543530..329bc76dfb09 100644 --- a/fs/ntfs3/frecord.c +++ b/fs/ntfs3/frecord.c @@ -2054,7 +2054,7 @@ int ni_readpage_cmpr(struct ntfs_inode *ni, struct page *page) idx = (vbo - frame_vbo) >> PAGE_SHIFT; pages_per_frame = frame_size >> PAGE_SHIFT; - pages = kzalloc(pages_per_frame * sizeof(struct page *), GFP_NOFS); + pages = kcalloc(pages_per_frame, sizeof(struct page *), GFP_NOFS); if (!pages) { err = -ENOMEM; goto out; @@ -2137,7 +2137,7 @@ int ni_decompress_file(struct ntfs_inode *ni) frame_bits = ni_ext_compress_bits(ni); frame_size = 1u << frame_bits; pages_per_frame = frame_size >> PAGE_SHIFT; - pages = kzalloc(pages_per_frame * sizeof(struct page *), GFP_NOFS); + pages = kcalloc(pages_per_frame, sizeof(struct page *), GFP_NOFS); if (!pages) { err = -ENOMEM; goto out; @@ -2709,8 +2709,7 @@ int ni_write_frame(struct ntfs_inode *ni, struct page **pages, goto out; } - pages_disk = kzalloc(pages_per_frame * sizeof(struct page *), - GFP_NOFS); + pages_disk = kcalloc(pages_per_frame, sizeof(struct page *), GFP_NOFS); if (!pages_disk) { err = -ENOMEM; goto out; -- 2.30.0

1 0

[PATCH OLK-5.10 017/107] fs/ntfs3: Remove unused including <linux/version.h>
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Jiapeng Chong <jiapeng.chong(a)linux.alibaba.com> mainline inclusion from mainline-v5.15 commit 1263eddfea9988125a4b9608efecc8aff2c721f9 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Eliminate the follow versioncheck warning: ./fs/ntfs3/inode.c: 16 linux/version.h not needed. Reported-by: Abaci Robot <abaci(a)linux.alibaba.com> Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Jiapeng Chong <jiapeng.chong(a)linux.alibaba.com> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/inode.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c index a573c6e98cb8..ed64489edf73 100644 --- a/fs/ntfs3/inode.c +++ b/fs/ntfs3/inode.c @@ -13,7 +13,6 @@ #include <linux/namei.h> #include <linux/nls.h> #include <linux/uio.h> -#include <linux/version.h> #include <linux/writeback.h> #include "debug.h" -- 2.30.0

1 0

[PATCH OLK-5.10 016/107] fs/ntfs3: Fix fall-through warnings for Clang
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: "Gustavo A. R. Silva" <gustavoars(a)kernel.org> mainline inclusion from mainline-v5.15 commit abfeb2ee2103f07dd93b9d7b32317e26d1c8ef79 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Fix the following fallthrough warnings: fs/ntfs3/inode.c:1792:2: warning: unannotated fall-through between switch labels [-Wimplicit-fallthrough] fs/ntfs3/index.c:178:2: warning: unannotated fall-through between switch labels [-Wimplicit-fallthrough] This helps with the ongoing efforts to globally enable -Wimplicit-fallthrough for Clang. Link: https://github.com/KSPP/linux/issues/115 Signed-off-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Reviewed-by: Nathan Chancellor <nathan(a)kernel.org> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/index.c | 1 + fs/ntfs3/inode.c | 1 + 2 files changed, 2 insertions(+) diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c index 9386c551e208..189d46e2c38d 100644 --- a/fs/ntfs3/index.c +++ b/fs/ntfs3/index.c @@ -175,6 +175,7 @@ static inline NTFS_CMP_FUNC get_cmp_func(const struct INDEX_ROOT *root) default: break; } + break; default: break; } diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c index bf51e294432e..a573c6e98cb8 100644 --- a/fs/ntfs3/inode.c +++ b/fs/ntfs3/inode.c @@ -1789,6 +1789,7 @@ int ntfs_unlink_inode(struct inode *dir, const struct dentry *dentry) switch (err) { case 0: drop_nlink(inode); + break; case -ENOTEMPTY: case -ENOSPC: case -EROFS: -- 2.30.0

1 0

[PATCH OLK-5.10 015/107] fs/ntfs3: Fix one none utf8 char in source file
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Kari Argillander <kari.argillander(a)gmail.com> mainline inclusion from mainline-v5.15 commit be87e821fdb5ec8c6d404f29e118130c7879ce5b category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- In one source file there is for some reason non utf8 char. But hey this is fs development so this kind of thing might happen. Signed-off-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/frecord.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c index c3121bf9c62f..e377d72477df 100644 --- a/fs/ntfs3/frecord.c +++ b/fs/ntfs3/frecord.c @@ -1784,7 +1784,7 @@ enum REPARSE_SIGN ni_parse_reparse(struct ntfs_inode *ni, struct ATTRIB *attr, /* * WOF - Windows Overlay Filter - used to compress files with lzx/xpress * Unlike native NTFS file compression, the Windows Overlay Filter supports - * only read operations. This means that it doesn�t need to sector-align each + * only read operations. This means that it doesn't need to sector-align each * compressed chunk, so the compressed data can be packed more tightly together. * If you open the file for writing, the Windows Overlay Filter just decompresses * the entire file, turning it back into a plain file. -- 2.30.0

1 0

[PATCH OLK-5.10 014/107] fs/ntfs3: Remove unused variable cnt in ntfs_security_init()
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Nathan Chancellor <nathan(a)kernel.org> mainline inclusion from mainline-v5.15 commit 8c01308b6d6b2bc8e9163c6a3400856fb782dee6 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Clang warns: fs/ntfs3/fsntfs.c:1874:9: warning: variable 'cnt' set but not used [-Wunused-but-set-variable] size_t cnt, off; ^ 1 warning generated. It is indeed unused so remove it. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Nathan Chancellor <nathan(a)kernel.org> Reviewed-by: Nick Desaulniers <ndesaulniers(a)google.com> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/fsntfs.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c index 92140050fb6c..c6599c514acf 100644 --- a/fs/ntfs3/fsntfs.c +++ b/fs/ntfs3/fsntfs.c @@ -1871,7 +1871,7 @@ int ntfs_security_init(struct ntfs_sb_info *sbi) struct ATTRIB *attr; struct ATTR_LIST_ENTRY *le; u64 sds_size; - size_t cnt, off; + size_t off; struct NTFS_DE *ne; struct NTFS_DE_SII *sii_e; struct ntfs_fnd *fnd_sii = NULL; @@ -1946,7 +1946,6 @@ int ntfs_security_init(struct ntfs_sb_info *sbi) sbi->security.next_off = Quad2Align(sds_size - SecurityDescriptorsBlockSize); - cnt = 0; off = 0; ne = NULL; @@ -1964,8 +1963,6 @@ int ntfs_security_init(struct ntfs_sb_info *sbi) next_id = le32_to_cpu(sii_e->sec_id) + 1; if (next_id >= sbi->security.next_id) sbi->security.next_id = next_id; - - cnt += 1; } sbi->security.ni = ni; -- 2.30.0

1 0