- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] Remove the automatic loading of the hisi_trng driver
by Weili Qian 26 May '23

26 May '23

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Weili Qian (2): crypto: hisilicon/trng - use %u to print u32 variables crypto/trng: Remove the automatic loading of the hisi_trng driver drivers/crypto/hisilicon/trng/trng.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.30.0

1 2

[PATCH 01/15] fix hikptool rciep rsp filed error problem
by veega 26 May '23

26 May '23

From: veega2022 <zhuweijia(a)huawei.com> union hikp_space_rsp 0xF8h is reserved and 0xFCh is cpl_status Signed-off-by: hesiyuan <hesiyuan4(a)huawei.com> --- libhikptdev/src/rciep/hikpt_rciep.c | 2 +- libhikptdev/src/rciep/hikpt_rciep.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/libhikptdev/src/rciep/hikpt_rciep.c b/libhikptdev/src/rciep/hikpt_rciep.c index 9b7a82a..5c7e82f 100644 --- a/libhikptdev/src/rciep/hikpt_rciep.c +++ b/libhikptdev/src/rciep/hikpt_rciep.c @@ -97,7 +97,7 @@ static uint32_t hikp_wait_for_cpl_status(void) uint32_t status; do { - status = g_hikp_req->field.cpl_status; + status = g_hikp_rsp->field.cpl_status; if (status != HIKP_INIT_STAT) return status; count--; diff --git a/libhikptdev/src/rciep/hikpt_rciep.h b/libhikptdev/src/rciep/hikpt_rciep.h index 093724a..8fbb3c0 100644 --- a/libhikptdev/src/rciep/hikpt_rciep.h +++ b/libhikptdev/src/rciep/hikpt_rciep.h @@ -75,8 +75,8 @@ union hikp_space_rsp { uint32_t version; /* 000h */ uint32_t rsp_para_num; /* 004h */ uint32_t data[HIKP_RSP_DATA_MAX]; /* 008h */ - uint32_t cpl_status; /* 0F8h */ - uint32_t pid_record; /* 0FCh */ + uint32_t rsv; /* 0F8h */ + uint32_t cpl_status; /* 0FCh */ struct iep_doorbell sw_db; /* 100h. Fixed and unmodifiable */ } field; -- 2.36.1.windows.1

1 0

[PATCH OLK-5.10] Net: ethernet: 3snic 3s9xx network driver add "select NET_DEVLINK"
by Jialin Zhang 24 May '23

24 May '23

3snic inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I77U9U CVE: NA --------------------------- Net: ethernet: 3snic 3s9xx network Kconfig add "select NET_DEVLINK" Signed-off-by: Steven Song <steven.song(a)3snic.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/net/ethernet/3snic/Kconfig | 2 +- drivers/net/ethernet/3snic/sssnic/Kconfig | 2 -- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/net/ethernet/3snic/Kconfig b/drivers/net/ethernet/3snic/Kconfig index 2356f6f46a5c..eb71854198d4 100644 --- a/drivers/net/ethernet/3snic/Kconfig +++ b/drivers/net/ethernet/3snic/Kconfig @@ -5,8 +5,8 @@ config NET_VENDOR_3SNIC bool "3SNIC smart NIC devices" - default y depends on PCI + select NET_DEVLINK help If you have a network (Ethernet) card belonging to this class, say Y. diff --git a/drivers/net/ethernet/3snic/sssnic/Kconfig b/drivers/net/ethernet/3snic/sssnic/Kconfig index c636e57ece94..9a89d62ae5fd 100644 --- a/drivers/net/ethernet/3snic/sssnic/Kconfig +++ b/drivers/net/ethernet/3snic/sssnic/Kconfig @@ -8,7 +8,6 @@ config SSSNIC depends on PCI depends on ARM64 || X86_64 select SSSNIC_HW - default m help This driver supports 3SNIC Ethernet Controller SSSNIC device. For more information about this product, go to the product @@ -22,4 +21,3 @@ config SSSNIC config SSSNIC_HW tristate depends on PCI - default n -- 2.25.1

2 1

[PATCH OLK-5.10] Net: ethernet: 3snic 3s9xx network driver add "select NET_DEVLINK"
by Jialin Zhang 24 May '23

24 May '23

3snic inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I77U9U CVE: NA --------------------------- Net: ethernet: 3snic 3s9xx network Kconfig add "select NET_DEVLINK" Signed-off-by: Steven Song <steven.song(a)3snic.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/net/ethernet/3snic/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/3snic/Kconfig b/drivers/net/ethernet/3snic/Kconfig index 2356f6f46a5c..eb71854198d4 100644 --- a/drivers/net/ethernet/3snic/Kconfig +++ b/drivers/net/ethernet/3snic/Kconfig @@ -5,8 +5,8 @@ config NET_VENDOR_3SNIC bool "3SNIC smart NIC devices" - default y depends on PCI + select NET_DEVLINK help If you have a network (Ethernet) card belonging to this class, say Y. -- 2.25.1

2 1

[PATCH OLK-5.10] Revert "riscv: topology: fix default topology reporting"
by Jialin Zhang 24 May '23

24 May '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I73HJ0 -------------------------------- This reverts commit 932afc18ba98772fe428505c76160428f93e7bde. Fix build error in riscv64: build failed: riscv, allmodconfig arch/riscv/kernel/smpboot.o: In function `smp_callin': (.text+0x160): undefined reference to `store_cpu_topology' arch/riscv/kernel/smpboot.o: In function `smp_prepare_cpus': (.init.text+0x212): undefined reference to `store_cpu_topology' make: *** [vmlinux] Error 1 Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- arch/riscv/Kconfig | 2 +- arch/riscv/kernel/smpboot.c | 4 +--- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig index a63d8134a9e5..e52cd2cefe8e 100644 --- a/arch/riscv/Kconfig +++ b/arch/riscv/Kconfig @@ -36,7 +36,7 @@ config RISCV select CLINT_TIMER if !MMU select COMMON_CLK select EDAC_SUPPORT - select GENERIC_ARCH_TOPOLOGY + select GENERIC_ARCH_TOPOLOGY if SMP select GENERIC_ATOMIC64 if !64BIT select GENERIC_CLOCKEVENTS select GENERIC_EARLY_IOREMAP diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c index 0e0aed380e28..0b04e0eae3ab 100644 --- a/arch/riscv/kernel/smpboot.c +++ b/arch/riscv/kernel/smpboot.c @@ -46,8 +46,6 @@ void __init smp_prepare_cpus(unsigned int max_cpus) int cpuid; int ret; - store_cpu_topology(smp_processor_id()); - /* This covers non-smp usecase mandated by "nosmp" option */ if (max_cpus == 0) return; @@ -154,8 +152,8 @@ asmlinkage __visible void smp_callin(void) mmgrab(mm); current->active_mm = mm; - store_cpu_topology(curr_cpuid); notify_cpu_starting(curr_cpuid); + update_siblings_masks(curr_cpuid); set_cpu_online(curr_cpuid, 1); /* -- 2.25.1

2 1

[OLK-5.10 0/8] Add support for HiSilicon UC/H60PA/PAv3 PMU driver
by Junhao He 23 May '23

23 May '23

1. Compared with the PAv2 PMU, the PAv3 PMU has different event IDs and definitions. The version number in the version register is used to distinguish the event IDs and definitions in the driver. 2. The H60PA PMU and PA are two different devices. The H60PA PMU supports higher bandwidth, and the PA PMU delay is relatively low. Different HIDs are used to distinguish the delay. 3. Each cluster is integrated with a unified cache (UC) PMU, which provides consistency between NUMA and UMA domains. It sits between L2 and the memory system. Chen Jun (1): perf: hisi: Extract hisi_pmu_init Junhao He (7): drivers/perf: hisi: Advertise the PERF_PMU_CAP_NO_EXCLUDE capability drivers/perf: hisi: Simplify the parameters of hisi_pmu_init() drivers/perf: hisi: Extract initialization of "cpa_pmu->pmu" drivers/perf: hisi: Remove redundant initialized of pmu->name drivers/perf: hisi: add NULL check for name drivers/perf: hisi: Add support for HiSilicon H60PA and PAv3 PMU driver drivers/perf: hisi: Add support for HiSilicon UC PMU driver drivers/perf/hisilicon/Makefile | 2 +- drivers/perf/hisilicon/hisi_uncore_cpa_pmu.c | 16 +- drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c | 33 +- drivers/perf/hisilicon/hisi_uncore_hha_pmu.c | 23 +- drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c | 27 +- drivers/perf/hisilicon/hisi_uncore_pa_pmu.c | 156 ++++- drivers/perf/hisilicon/hisi_uncore_pmu.c | 24 +- drivers/perf/hisilicon/hisi_uncore_pmu.h | 43 +- drivers/perf/hisilicon/hisi_uncore_sllc_pmu.c | 15 +- drivers/perf/hisilicon/hisi_uncore_uc_pmu.c | 577 ++++++++++++++++++ 10 files changed, 792 insertions(+), 124 deletions(-) create mode 100644 drivers/perf/hisilicon/hisi_uncore_uc_pmu.c -- 2.30.0

1 8

[PATCH OLK-5.10 0/2] ACC support no-sva feature
by Weili Qian 22 May '23

22 May '23

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Weili Qian (1): crypto: hisilicon/qm - support no-sva feature Kai Ye (1): uacce: add features from kernel not support drivers/crypto/hisilicon/hpre/hpre_main.c | 13 +- drivers/crypto/hisilicon/qm.c | 250 +++++++--- drivers/crypto/hisilicon/sec2/sec.h | 1 - drivers/crypto/hisilicon/sec2/sec_crypto.c | 2 +- drivers/crypto/hisilicon/sec2/sec_main.c | 20 +- drivers/crypto/hisilicon/zip/zip_main.c | 2 +- drivers/misc/uacce/Kconfig | 3 +- drivers/misc/uacce/Makefile | 0 drivers/misc/uacce/uacce.c | 508 ++++++++++++++++++++- include/linux/hisi_acc_qm.h | 7 +- include/linux/uacce.h | 46 +- include/uapi/misc/uacce/hisi_qm.h | 28 +- include/uapi/misc/uacce/uacce.h | 53 ++- 13 files changed, 810 insertions(+), 123 deletions(-) mode change 100644 => 100755 drivers/misc/uacce/Kconfig mode change 100644 => 100755 drivers/misc/uacce/Makefile mode change 100644 => 100755 include/uapi/misc/uacce/hisi_qm.h mode change 100644 => 100755 include/uapi/misc/uacce/uacce.h -- 2.30.0

1 2

[PATCH OLK-5.10 00/11] Patchset related to sendbuf and rmb buffer.
by Litao Jiao 22 May '23

22 May '23

*** BLURB HERE *** 48147 (10): net/smc: add sysctl interface for SMC net/smc: fix compile warning for smc_sysctl net/smc: fix -Wmissing-prototypes warning when CONFIG_SYSCTL not set net/smc: fix a memory leak in smc_sysctl_net_exit() net/smc: Introduce a sysctl for setting SMC-R buffer type net/smc: Use sysctl-specified types of buffers in new link group net/smc: Allow SMC-D 1MB DMB allocations net/smc: Allow virtually contiguous sndbufs or RMBs for SMC-R net/smc: Unbind r/w buffer size from clcsock and make them tunable net/smc: Add size match for smc_buf_get_slot Litao Jiao (1): net/smc: Tune the maximum size of virtually contiguous sndbufs or RMBs for SMC-R Documentation/networking/smc-sysctl.rst | 41 ++++ include/net/net_namespace.h | 5 +- include/net/netns/smc.h | 13 ++ net/smc/Makefile | 1 + net/smc/af_smc.c | 78 ++++++- net/smc/smc_clc.c | 8 +- net/smc/smc_clc.h | 2 +- net/smc/smc_core.c | 265 ++++++++++++++++-------- net/smc/smc_core.h | 17 +- net/smc/smc_ib.c | 15 +- net/smc/smc_llc.c | 26 ++- net/smc/smc_rx.c | 90 ++++++-- net/smc/smc_sysctl.c | 93 +++++++++ net/smc/smc_sysctl.h | 32 +++ net/smc/smc_tx.c | 7 +- 15 files changed, 556 insertions(+), 137 deletions(-) create mode 100644 Documentation/networking/smc-sysctl.rst create mode 100644 include/net/netns/smc.h create mode 100644 net/smc/smc_sysctl.c create mode 100644 net/smc/smc_sysctl.h -- 2.33.0

1 11

[PATCH openEuler-22.03-LTS-SP1 1/2] xfs: verify buffer contents when we skip log replay
by Jialin Zhang 22 May '23

22 May '23

From: "Darrick J. Wong" <djwong(a)kernel.org> mainline inclusion from mainline-v6.3-rc6 commit 22ed903eee23a5b174e240f1cdfa9acf393a5210 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6X4UN CVE: CVE-2023-2124 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot detected a crash during log recovery: XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 XFS (loop0): Torn write (CRC failure) detected at log block 0x180. Truncating head block from 0x200. XFS (loop0): Starting recovery (logdev: internal) ================================================================== BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup_get_block+0x15c/0x6d0 fs/xfs/libxfs/xfs_btree.c:1813 Read of size 8 at addr ffff88807e89f258 by task syz-executor132/5074 CPU: 0 PID: 5074 Comm: syz-executor132 Not tainted 6.2.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:306 print_report+0x107/0x1f0 mm/kasan/report.c:417 kasan_report+0xcd/0x100 mm/kasan/report.c:517 xfs_btree_lookup_get_block+0x15c/0x6d0 fs/xfs/libxfs/xfs_btree.c:1813 xfs_btree_lookup+0x346/0x12c0 fs/xfs/libxfs/xfs_btree.c:1913 xfs_btree_simple_query_range+0xde/0x6a0 fs/xfs/libxfs/xfs_btree.c:4713 xfs_btree_query_range+0x2db/0x380 fs/xfs/libxfs/xfs_btree.c:4953 xfs_refcount_recover_cow_leftovers+0x2d1/0xa60 fs/xfs/libxfs/xfs_refcount.c:1946 xfs_reflink_recover_cow+0xab/0x1b0 fs/xfs/xfs_reflink.c:930 xlog_recover_finish+0x824/0x920 fs/xfs/xfs_log_recover.c:3493 xfs_log_mount_finish+0x1ec/0x3d0 fs/xfs/xfs_log.c:829 xfs_mountfs+0x146a/0x1ef0 fs/xfs/xfs_mount.c:933 xfs_fs_fill_super+0xf95/0x11f0 fs/xfs/xfs_super.c:1666 get_tree_bdev+0x400/0x620 fs/super.c:1282 vfs_get_tree+0x88/0x270 fs/super.c:1489 do_new_mount+0x289/0xad0 fs/namespace.c:3145 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f89fa3f4aca Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fffd5fb5ef8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00646975756f6e2c RCX: 00007f89fa3f4aca RDX: 0000000020000100 RSI: 0000000020009640 RDI: 00007fffd5fb5f10 RBP: 00007fffd5fb5f10 R08: 00007fffd5fb5f50 R09: 000000000000970d R10: 0000000000200800 R11: 0000000000000206 R12: 0000000000000004 R13: 0000555556c6b2c0 R14: 0000000000200800 R15: 00007fffd5fb5f50 </TASK> The fuzzed image contains an AGF with an obviously garbage agf_refcount_level value of 32, and a dirty log with a buffer log item for that AGF. The ondisk AGF has a higher LSN than the recovered log item. xlog_recover_buf_commit_pass2 reads the buffer, compares the LSNs, and decides to skip replay because the ondisk buffer appears to be newer. Unfortunately, the ondisk buffer is corrupt, but recovery just read the buffer with no buffer ops specified: error = xfs_buf_read(mp->m_ddev_targp, buf_f->blf_blkno, buf_f->blf_len, buf_flags, &bp, NULL); Skipping the buffer leaves its contents in memory unverified. This sets us up for a kernel crash because xfs_refcount_recover_cow_leftovers reads the buffer (which is still around in XBF_DONE state, so no read verification) and creates a refcountbt cursor of height 32. This is impossible so we run off the end of the cursor object and crash. Fix this by invoking the verifier on all skipped buffers and aborting log recovery if the ondisk buffer is corrupt. It might be smarter to force replay the log item atop the buffer and then see if it'll pass the write verifier (like ext4 does) but for now let's go with the conservative option where we stop immediately. Link: https://syzkaller.appspot.com/bug?extid=7e9494b8b399902e994e Signed-off-by: Darrick J. Wong <djwong(a)kernel.org> Reviewed-by: Dave Chinner <dchinner(a)redhat.com> Signed-off-by: Dave Chinner <david(a)fromorbit.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/xfs/xfs_buf_item_recover.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/fs/xfs/xfs_buf_item_recover.c b/fs/xfs/xfs_buf_item_recover.c index 4b2ad8dce690..d892125eb022 100644 --- a/fs/xfs/xfs_buf_item_recover.c +++ b/fs/xfs/xfs_buf_item_recover.c @@ -943,6 +943,16 @@ xlog_recover_buf_commit_pass2( if (lsn && lsn != -1 && XFS_LSN_CMP(lsn, current_lsn) >= 0) { trace_xfs_log_recover_buf_skip(log, buf_f); xlog_recover_validate_buf_type(mp, bp, buf_f, NULLCOMMITLSN); + + /* + * We're skipping replay of this buffer log item due to the log + * item LSN being behind the ondisk buffer. Verify the buffer + * contents since we aren't going to run the write verifier. + */ + if (bp->b_ops) { + bp->b_ops->verify_read(bp); + error = bp->b_error; + } goto out_release; } -- 2.25.1

1 1

[PATCH openEuler-22.03-LTS 1/2] xfs: verify buffer contents when we skip log replay
by Jialin Zhang 22 May '23

22 May '23

From: "Darrick J. Wong" <djwong(a)kernel.org> mainline inclusion from mainline-v6.3-rc6 commit 22ed903eee23a5b174e240f1cdfa9acf393a5210 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6X4UN CVE: CVE-2023-2124 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot detected a crash during log recovery: XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 XFS (loop0): Torn write (CRC failure) detected at log block 0x180. Truncating head block from 0x200. XFS (loop0): Starting recovery (logdev: internal) ================================================================== BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup_get_block+0x15c/0x6d0 fs/xfs/libxfs/xfs_btree.c:1813 Read of size 8 at addr ffff88807e89f258 by task syz-executor132/5074 CPU: 0 PID: 5074 Comm: syz-executor132 Not tainted 6.2.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:306 print_report+0x107/0x1f0 mm/kasan/report.c:417 kasan_report+0xcd/0x100 mm/kasan/report.c:517 xfs_btree_lookup_get_block+0x15c/0x6d0 fs/xfs/libxfs/xfs_btree.c:1813 xfs_btree_lookup+0x346/0x12c0 fs/xfs/libxfs/xfs_btree.c:1913 xfs_btree_simple_query_range+0xde/0x6a0 fs/xfs/libxfs/xfs_btree.c:4713 xfs_btree_query_range+0x2db/0x380 fs/xfs/libxfs/xfs_btree.c:4953 xfs_refcount_recover_cow_leftovers+0x2d1/0xa60 fs/xfs/libxfs/xfs_refcount.c:1946 xfs_reflink_recover_cow+0xab/0x1b0 fs/xfs/xfs_reflink.c:930 xlog_recover_finish+0x824/0x920 fs/xfs/xfs_log_recover.c:3493 xfs_log_mount_finish+0x1ec/0x3d0 fs/xfs/xfs_log.c:829 xfs_mountfs+0x146a/0x1ef0 fs/xfs/xfs_mount.c:933 xfs_fs_fill_super+0xf95/0x11f0 fs/xfs/xfs_super.c:1666 get_tree_bdev+0x400/0x620 fs/super.c:1282 vfs_get_tree+0x88/0x270 fs/super.c:1489 do_new_mount+0x289/0xad0 fs/namespace.c:3145 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f89fa3f4aca Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fffd5fb5ef8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00646975756f6e2c RCX: 00007f89fa3f4aca RDX: 0000000020000100 RSI: 0000000020009640 RDI: 00007fffd5fb5f10 RBP: 00007fffd5fb5f10 R08: 00007fffd5fb5f50 R09: 000000000000970d R10: 0000000000200800 R11: 0000000000000206 R12: 0000000000000004 R13: 0000555556c6b2c0 R14: 0000000000200800 R15: 00007fffd5fb5f50 </TASK> The fuzzed image contains an AGF with an obviously garbage agf_refcount_level value of 32, and a dirty log with a buffer log item for that AGF. The ondisk AGF has a higher LSN than the recovered log item. xlog_recover_buf_commit_pass2 reads the buffer, compares the LSNs, and decides to skip replay because the ondisk buffer appears to be newer. Unfortunately, the ondisk buffer is corrupt, but recovery just read the buffer with no buffer ops specified: error = xfs_buf_read(mp->m_ddev_targp, buf_f->blf_blkno, buf_f->blf_len, buf_flags, &bp, NULL); Skipping the buffer leaves its contents in memory unverified. This sets us up for a kernel crash because xfs_refcount_recover_cow_leftovers reads the buffer (which is still around in XBF_DONE state, so no read verification) and creates a refcountbt cursor of height 32. This is impossible so we run off the end of the cursor object and crash. Fix this by invoking the verifier on all skipped buffers and aborting log recovery if the ondisk buffer is corrupt. It might be smarter to force replay the log item atop the buffer and then see if it'll pass the write verifier (like ext4 does) but for now let's go with the conservative option where we stop immediately. Link: https://syzkaller.appspot.com/bug?extid=7e9494b8b399902e994e Signed-off-by: Darrick J. Wong <djwong(a)kernel.org> Reviewed-by: Dave Chinner <dchinner(a)redhat.com> Signed-off-by: Dave Chinner <david(a)fromorbit.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- fs/xfs/xfs_buf_item_recover.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/fs/xfs/xfs_buf_item_recover.c b/fs/xfs/xfs_buf_item_recover.c index 4b2ad8dce690..d892125eb022 100644 --- a/fs/xfs/xfs_buf_item_recover.c +++ b/fs/xfs/xfs_buf_item_recover.c @@ -943,6 +943,16 @@ xlog_recover_buf_commit_pass2( if (lsn && lsn != -1 && XFS_LSN_CMP(lsn, current_lsn) >= 0) { trace_xfs_log_recover_buf_skip(log, buf_f); xlog_recover_validate_buf_type(mp, bp, buf_f, NULLCOMMITLSN); + + /* + * We're skipping replay of this buffer log item due to the log + * item LSN being behind the ondisk buffer. Verify the buffer + * contents since we aren't going to run the write verifier. + */ + if (bp->b_ops) { + bp->b_ops->verify_read(bp); + error = bp->b_error; + } goto out_release; } -- 2.25.1

1 1