- Kernel - mailweb.openeuler.org

[PATCH openEuler-5.10-LTS] atm: idt77252: fix use-after-free bugs caused by tst_timer
by Zheng Zengkai 02 Nov '22

02 Nov '22

From: Duoming Zhou <duoming(a)zju.edu.cn> stable inclusion from stable-v5.10.138 commit a0ae122e9aeccbff75014c4d36d11a9d32e7fb5e category: bugfix bugzilla: 187909, https://gitee.com/src-openeuler/kernel/issues/I5X3ML CVE: CVE-2022-3635 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3f4093e2bf4673f218c0bf17d8362337c400e77b upstream. There are use-after-free bugs caused by tst_timer. The root cause is that there are no functions to stop tst_timer in idt77252_exit(). One of the possible race conditions is shown below: (thread 1) | (thread 2) | idt77252_init_one | init_card | fill_tst | mod_timer(&card->tst_timer, ...) idt77252_exit | (wait a time) | tst_timer | | ... kfree(card) // FREE | | card->soft_tst[e] // USE The idt77252_dev is deallocated in idt77252_exit() and used in timer handler. This patch adds del_timer_sync() in idt77252_exit() in order that the timer handler could be stopped before the idt77252_dev is deallocated. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Link: https://lore.kernel.org/r/20220805070008.18007-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/atm/idt77252.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c index 5f0472c18bcb..82f6f1fbe9e7 100644 --- a/drivers/atm/idt77252.c +++ b/drivers/atm/idt77252.c @@ -3767,6 +3767,7 @@ static void __exit idt77252_exit(void) card = idt77252_chain; dev = card->atmdev; idt77252_chain = card->next; + del_timer_sync(&card->tst_timer); if (dev->phy->stop) dev->phy->stop(dev); -- 2.20.1

1 0

[PATCH openEuler-5.10-LTS 01/43] block: fix null-deref in percpu_ref_put
by Zheng Zengkai 02 Nov '22

02 Nov '22

From: Zhang Wensheng <zhangwensheng5(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5N162 CVE: NA -------------------------------- In the use of q_usage_counter of request_queue, blk_cleanup_queue using "wait_event(q->mq_freeze_wq, percpu_ref_is_zero(&q->q_usage_counter))" to wait q_usage_counter becoming zero. however, if the q_usage_counter becoming zero quickly, and percpu_ref_exit will execute and ref->data will be freed, maybe another process will cause a null-defef problem like below: CPU0 CPU1 blk_cleanup_queue blk_freeze_queue blk_mq_freeze_queue_wait scsi_end_request percpu_ref_get ... percpu_ref_put atomic_long_sub_and_test percpu_ref_exit ref->data -> NULL ref->data->release(ref) -> null-deref Fix it by setting flag(QUEUE_FLAG_USAGE_COUNT_SYNC) to add synchronization mechanism, when ref->data->release is called, the flag will be setted, and the "wait_event" in blk_mq_freeze_queue_wait must wait flag becoming true as well, which will limit percpu_ref_exit to execute ahead of time. Signed-off-by: Zhang Wensheng <zhangwensheng5(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/blk-core.c | 4 +++- block/blk-mq.c | 7 +++++++ include/linux/blk-mq.h | 1 + include/linux/blkdev.h | 2 ++ 4 files changed, 13 insertions(+), 1 deletion(-) diff --git a/block/blk-core.c b/block/blk-core.c index 0b496dabc5ac..448e4d70af7f 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -385,7 +385,8 @@ void blk_cleanup_queue(struct request_queue *q) * prevent that blk_mq_run_hw_queues() accesses the hardware queues * after draining finished. */ - blk_freeze_queue(q); + blk_freeze_queue_start(q); + blk_mq_freeze_queue_wait_sync(q); rq_qos_exit(q); @@ -502,6 +503,7 @@ static void blk_queue_usage_counter_release(struct percpu_ref *ref) struct request_queue *q = container_of(ref, struct request_queue, q_usage_counter); + blk_queue_flag_set(QUEUE_FLAG_USAGE_COUNT_SYNC, q); wake_up_all(&q->mq_freeze_wq); } diff --git a/block/blk-mq.c b/block/blk-mq.c index e1fcdbefcac0..ab1b0bfc64f9 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -193,6 +193,7 @@ void blk_freeze_queue_start(struct request_queue *q) { mutex_lock(&q->mq_freeze_lock); if (++q->mq_freeze_depth == 1) { + blk_queue_flag_clear(QUEUE_FLAG_USAGE_COUNT_SYNC, q); percpu_ref_kill(&q->q_usage_counter); mutex_unlock(&q->mq_freeze_lock); if (queue_is_mq(q)) @@ -203,6 +204,12 @@ void blk_freeze_queue_start(struct request_queue *q) } EXPORT_SYMBOL_GPL(blk_freeze_queue_start); +void blk_mq_freeze_queue_wait_sync(struct request_queue *q) +{ + wait_event(q->mq_freeze_wq, percpu_ref_is_zero(&q->q_usage_counter) && + test_bit(QUEUE_FLAG_USAGE_COUNT_SYNC, &q->queue_flags)); +} + void blk_mq_freeze_queue_wait(struct request_queue *q) { wait_event(q->mq_freeze_wq, percpu_ref_is_zero(&q->q_usage_counter)); diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h index ac83257972a0..e4e46229d0eb 100644 --- a/include/linux/blk-mq.h +++ b/include/linux/blk-mq.h @@ -574,6 +574,7 @@ void blk_mq_freeze_queue(struct request_queue *q); void blk_mq_unfreeze_queue(struct request_queue *q); void blk_freeze_queue_start(struct request_queue *q); void blk_mq_freeze_queue_wait(struct request_queue *q); +void blk_mq_freeze_queue_wait_sync(struct request_queue *q); int blk_mq_freeze_queue_wait_timeout(struct request_queue *q, unsigned long timeout); diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 49540ce9e325..4c046530edb9 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -643,6 +643,8 @@ struct request_queue { #define QUEUE_FLAG_NOWAIT 29 /* device supports NOWAIT */ /*at least one blk-mq hctx can't get driver tag */ #define QUEUE_FLAG_HCTX_WAIT 30 +/* sync for q_usage_counter */ +#define QUEUE_FLAG_USAGE_COUNT_SYNC 31 #define QUEUE_FLAG_MQ_DEFAULT ((1 << QUEUE_FLAG_IO_STAT) | \ (1 << QUEUE_FLAG_SAME_COMP) | \ -- 2.20.1

1 42

[PATCH openEuler-5.10-LTS 00/10] Backport 5.10.133 LTS
by Zheng Zengkai 02 Nov '22

02 Nov '22

Backport 5.10.133 LTS patches from upstream. git cherry-pick v5.10.132..v5.10.133~1 -s Already merged(-138, by CVE-2022-29900): tools headers: Remove broken definition of __LITTLE_ENDIAN tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in 'perf bench mem memcpy' - again objtool: Fix elf_create_undef_symbol() endianness kvm: fix objtool relocation warning um: Add missing apply_returns() x86/bugs: Remove apostrophe typo tools headers cpufeatures: Sync with the kernel sources tools arch x86: Sync the msr-index.h copy with the kernel sources x86/kvm: fix FASTOP_SIZE when return thunks are enabled efi/x86: use naked RET on mixed mode call wrapper x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current x86/ftrace: Add UNWIND_HINT_FUNC annotation for ftrace_stub x86/xen: Fix initialisation in hypercall_page after rethunk x86, kvm: use proper ASM macros for kvm_vcpu_is_preempted tools/insn: Restore the relative include paths for cross building x86/static_call: Serialize __static_call_fixup() properly x86/speculation: Disable RRSBA behavior x86/kexec: Disable RET on kexec x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported x86/bugs: Add Cannon lake to RETBleed affected CPU list x86/retbleed: Add fine grained Kconfig knobs x86/cpu/amd: Enumerate BTC_NO x86/common: Stamp out the stepping madness x86/speculation: Fill RSB on vmexit for IBRS KVM: VMX: Fix IBRS handling after vmexit KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS KVM: VMX: Convert launched argument to flags KVM: VMX: Flatten __vmx_vcpu_run() objtool: Re-add UNWIND_HINT_{SAVE_RESTORE} x86/speculation: Remove x86_spec_ctrl_mask x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit x86/speculation: Fix SPEC_CTRL write on SMT state change x86/speculation: Fix firmware entry SPEC_CTRL handling x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n x86/cpu/amd: Add Spectral Chicken objtool: Add entry UNRET validation x86/bugs: Do IBPB fallback check only once x86/bugs: Add retbleed=ibpb x86/xen: Rename SYS* entry points objtool: Update Retpoline validation intel_idle: Disable IBRS during long idle x86/bugs: Report Intel retbleed vulnerability x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS x86/bugs: Optimize SPEC_CTRL MSR writes x86/entry: Add kernel IBRS implementation x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value x86/bugs: Enable STIBP for JMP2RET x86/bugs: Add AMD retbleed= boot parameter x86/bugs: Report AMD retbleed vulnerability x86: Add magic AMD return-thunk objtool: Treat .text.__x86.* as noinstr x86: Use return-thunk in asm code x86/sev: Avoid using __x86_return_thunk x86/vsyscall_emu/64: Don't use RET in vsyscall emulation x86/kvm: Fix SETcc emulation for return thunks x86/bpf: Use alternative RET encoding x86/ftrace: Use alternative RET encoding x86,static_call: Use alternative RET encoding objtool: skip non-text sections when adding return-thunk sites x86,objtool: Create .return_sites x86: Undo return-thunk damage x86/retpoline: Use -mfunction-return Makefile: Set retpoline cflags based on CONFIG_CC_IS_{CLANG,GCC} x86/retpoline: Swizzle retpoline thunk x86/retpoline: Cleanup some #ifdefery x86/cpufeatures: Move RETPOLINE flags to word 11 x86/kvm/vmx: Make noinstr clean x86/realmode: build with -D__DISABLE_EXPORTS x86/entry: Remove skip_r11rcx objtool: Fix SLS validation for kcov tail-call replacement crypto: x86/poly1305 - Fixup SLS objtool: Default ignore INT3 for unreachable kvm/emulate: Fix SETcc emulation function offsets with SLS tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in 'perf bench mem memcpy' x86: Add straight-line-speculation mitigation objtool: Add straight-line-speculation validation x86/alternative: Relax text_poke_bp() constraint x86: Fix objtool build warning x86: Prepare inline-asm for straight-line-speculation x86: Prepare asm files for straight-line-speculation x86/lib/atomic64_386_32: Rename things bpf,x86: Respect X86_FEATURE_RETPOLINE* bpf,x86: Simplify computing label offsets x86/alternative: Implement .retpoline_sites support x86/retpoline: Create a retpoline thunk array x86/retpoline: Move the retpoline thunk declarations to nospec-branch.h x86/asm: Fixup odd GEN-for-each-reg.h usage x86/asm: Fix register order x86/retpoline: Remove unused replacement symbols objtool,x86: Replace alternatives with .retpoline_sites objtool: Explicitly avoid self modifying code in .altinstr_replacement objtool: Classify symbols objtool: Handle __sanitize_cov*() tail calls objtool: Introduce CFI hash objtool: Make .altinstructions section entry size consistent objtool: Remove reloc symbol type checks in get_alt_entry() objtool: print out the symbol type when complaining about it objtool: Teach get_alt_entry() about more relocation types objtool: Don't make .altinstructions writable objtool/x86: Ignore __x86_indirect_alt_* symbols objtool: Only rewrite unconditional retpoline thunk calls objtool: Fix .symtab_shndx handling for elf_create_undef_symbol() x86/alternative: Optimize single-byte NOPs at an arbitrary position objtool: Support asm jump tables objtool/x86: Rewrite retpoline thunk calls objtool: Skip magical retpoline .altinstr_replacement objtool: Cache instruction relocs objtool: Keep track of retpoline call sites objtool: Add elf_create_undef_symbol() objtool: Extract elf_symbol_add() objtool: Extract elf_strtab_concat() objtool: Create reloc sections implicitly objtool: Add elf_create_reloc() helper objtool: Rework the elf_rebuild_reloc_section() logic objtool: Handle per arch retpoline naming objtool: Correctly handle retpoline thunk calls x86/retpoline: Simplify retpolines x86/alternatives: Optimize optimize_nops() x86: Add insn_decode_kernel() x86/alternative: Use insn_decode() x86/insn: Add an insn_decode() API x86/insn: Add a __ignore_sync_check__ marker x86/insn: Rename insn_decode() to insn_decode_from_regs() x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() x86/alternative: Support ALTERNATIVE_TERNARY x86/alternative: Support not-feature x86/alternative: Merge include files x86/xen: Support objtool vmlinux.o validation in xen-head.S x86/xen: Support objtool validation in xen-asm.S objtool: Combine UNWIND_HINT_RET_OFFSET and UNWIND_HINT_FUNC objtool: Assume only ELF functions do sibling calls objtool: Support retpoline jump detection for vmlinux.o objtool: Support stack layout changes in alternatives objtool: Add 'alt_group' struct objtool: Refactor ORC section generation KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw KVM/VMX: Use TEST %REG,%REG instead of CMP $0,%REG in vmenter.S To be merged(10): e6f8dc86a1c1 x86/insn-eval: Handle return values from the decoder b0e2dc950654 x86/alternative: Handle Jcc __x86_indirect_thunk_\reg 3d13ee0d411a x86/alternative: Try inline spectre_v2=retpoline,amd 38a80a3ca2cb x86/alternative: Add debug prints to apply_retpolines() 42ec4d71353f objtool: Fix code relocs vs weak symbols 3e8afd072d09 objtool: Fix type of reloc::addend e1db6c8a69ec objtool: Fix symbol creation 236b959da9d1 objtool: Fix objtool regression on x32 systems ecc0d92a9f6c x86/asm/32: Fix ANNOTATE_UNRET_SAFE use on 32-bit 6849ed81a33a x86: Use -mindirect-branch-cs-prefix for RETPOLINE builds Total patches: 148 - 138 = 10 Borislav Petkov (1): x86/insn-eval: Handle return values from the decoder Jiri Slaby (1): x86/asm/32: Fix ANNOTATE_UNRET_SAFE use on 32-bit Mikulas Patocka (1): objtool: Fix objtool regression on x32 systems Peter Zijlstra (7): x86/alternative: Handle Jcc __x86_indirect_thunk_\reg x86/alternative: Try inline spectre_v2=retpoline,amd x86/alternative: Add debug prints to apply_retpolines() objtool: Fix code relocs vs weak symbols objtool: Fix type of reloc::addend objtool: Fix symbol creation x86: Use -mindirect-branch-cs-prefix for RETPOLINE builds Makefile | 1 + arch/x86/kernel/alternative.c | 60 +++++++- arch/x86/kernel/head_32.S | 1 + arch/x86/lib/insn-eval.c | 34 +++-- tools/objtool/check.c | 9 +- tools/objtool/elf.c | 251 ++++++++++++++++++++++++++++++---- tools/objtool/elf.h | 4 +- 7 files changed, 312 insertions(+), 48 deletions(-) -- 2.20.1

1 10

[PATCH openEuler-5.10-LTS 0/1] Backport 5.10.131 LTS
by Zheng Zengkai 02 Nov '22

02 Nov '22

Backport 5.10.131 LTS patches from upstream. git cherry-pick v5.10.130..v5.10.131~1 -s cc5ee0e0eed0 Revert "mtd: rawnand: gpmi: Fix setting busy timeout setting" Total patches: 1 Greg Kroah-Hartman (1): Revert "mtd: rawnand: gpmi: Fix setting busy timeout setting" drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.20.1

1 1

[PATCH openEuler-5.10-LTS 000/109] Backport 5.10.132 LTS
by Zheng Zengkai 02 Nov '22

02 Nov '22

Backport 5.10.132 LTS patches from upstream. git cherry-pick v5.10.131..v5.10.132~1 -s Already merged(-1): 136d7987fcfd x86: Clear .brk area at early boot Context conflict: 91530f675e88 fix race between exit_itimers() and /proc/pid/timers 9d883b3f000d Revert "evm: Fix memleak in init_desc" KABI changed(-2): 7657e3958535 cgroup: Use separate src/dst nodes when preloading css_sets for migration 104594de2778 nvme: fix regression when disconnect a recovering ctrl Total patches: 112 - 1 - 2 = 109 Andrea Mayer (3): seg6: fix skb checksum evaluation in SRH encapsulation/insertion seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors seg6: bpf: fix skb checksum in bpf_push_seg6_encap() Ard Biesheuvel (2): ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle Baokun Li (1): ext4: fix race condition between ext4_write and ext4_convert_inline_data Chanho Park (1): tty: serial: samsung_tty: set dma burst_size to 1 Charles Keepax (5): ASoC: wm5110: Fix DRE control ASoC: dapm: Initialise kcontrol data for mux/demux controls ASoC: cs47l15: Fix event generation for low power mux control ASoC: madera: Fix event generation for OUT1 demux ASoC: madera: Fix event generation for rate controls Chia-Lin Kao (AceLan) (2): net: atlantic: remove deep parameter on suspend/resume functions net: atlantic: remove aq_nic_deinit() when resume Chris Wilson (1): drm/i915/gt: Serialize TLB invalidates with GT resets Coiby Xu (1): ima: force signature verification when CONFIG_KEXEC_SIG is configured Cristian Ciocaltea (1): spi: amd: Limit max transfer and message size Dan Carpenter (1): drm/i915/selftests: fix a couple IS_ERR() vs NULL tests Dave Chinner (1): fs/remap: constrain dedupe of EOF blocks Dmitry Osipenko (3): ARM: 9213/1: Print message about disabled Spectre workarounds only once drm/panfrost: Put mapping instead of shmem obj on panfrost_mmu_map_fault_addr() error drm/panfrost: Fix shrinker list corruption by madvise IOCTL Felix Fietkau (1): wifi: mac80211: fix queue selection for mesh/OCB interfaces Filipe Manana (1): btrfs: return -EAGAIN for NOWAIT dio reads/writes on compressed and inline extents Florian Westphal (1): netfilter: br_netfilter: do not skip all hooks with 0 priority Francesco Dolcini (1): ASoC: sgtl5000: Fix noise on shutdown/remove Gabriel Fernandez (1): ARM: dts: stm32: use the correct clock source for CEC on stm32mp151 Gal Pressman (1): net/mlx5e: Fix capability check for updating vnic env counters Geert Uytterhoeven (1): sh: convert nommu io{re,un}map() to static inline functions Gowans, James (1): mm: split huge PUD on wp_huge_pud fallback Hangyu Hua (2): drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector() net: tipc: fix possible refcount leak in tipc_sk_create() Haowen Bai (1): pinctrl: aspeed: Fix potential NULL dereference in aspeed_pinmux_set_mux() Hector Martin (2): ASoC: tas2764: Correct playback volume range ASoC: tas2764: Fix amp gain register offset & default Huaxin Lu (1): ima: Fix a potential integer overflow in ima_appraise_measurement Ilpo Järvinen (3): serial: stm32: Clear prev values before setting RTS delays serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle serial: 8250: Fix PM usage_count for console handover Jianglei Nie (2): ima: Fix potential memory leak in ima_init_crypto() net: sfp: fix memory leak in sfp_probe() John Garry (1): scsi: hisi_sas: Limit max hw sectors for v3 HW Jon Hunter (1): net: stmmac: dwc-qos: Disable split header for Tegra194 Juergen Gross (2): xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue x86/pat: Fix x86_has_pat_wp() Kai-Heng Feng (1): platform/x86: hp-wmi: Ignore Sanitization Mode event Keith Busch (1): nvme-pci: phison e16 has bogus namespace ids Kris Bahnsen (1): ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count Kuniyuki Iwashima (18): sysctl: Fix data races in proc_dointvec(). sysctl: Fix data races in proc_douintvec(). sysctl: Fix data races in proc_dointvec_minmax(). sysctl: Fix data races in proc_douintvec_minmax(). sysctl: Fix data races in proc_doulongvec_minmax(). sysctl: Fix data races in proc_dointvec_jiffies(). tcp: Fix a data-race around sysctl_tcp_max_orphans. inetpeer: Fix data-races around sysctl. net: Fix data-races around sysctl_mem. cipso: Fix data-races around sysctl. icmp: Fix data-races around sysctl. ipv4: Fix a data-race around sysctl_fib_sync_mem. sysctl: Fix data-races in proc_dointvec_ms_jiffies(). icmp: Fix a data-race around sysctl_icmp_ratelimit. icmp: Fix a data-race around sysctl_icmp_ratemask. raw: Fix a data-race around sysctl_raw_l3mdev_accept. ipv4: Fix data-races around sysctl_ip_dynaddr. nexthop: Fix data-races around nexthop_compat_mode. Liang He (2): net: ftgmac100: Hold reference returned by of_get_child_by_name() cpufreq: pmac32-cpufreq: Fix refcount leak bug Linus Torvalds (1): signal handling: don't use BUG_ON() for debugging Linus Walleij (1): soc: ixp4xx/npe: Fix unused match warning Linyu Yuan (1): usb: typec: add missing uevent when partner support PD Lucien Buchmann (1): USB: serial: ftdi_sio: add Belimo device ids Mark Brown (1): ASoC: ops: Fix off by one in range control validation Martin Povišer (2): ASoC: tas2764: Add post reset delays ASoC: tas2764: Fix and extend FSYNC polarity handling Meng Tang (6): ALSA: hda - Add fixup for Dell Latitidue E5430 ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model ALSA: hda/realtek: Fix headset mic for Acer SF313-51 ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop Michael Walle (1): NFC: nxp-nci: don't print header length mismatch on i2c error Michal Suchanek (1): ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero Muchun Song (1): mm: sysctl: fix missing numa_stat when !CONFIG_HUGETLB_PAGE Nicolas Dichtel (1): ip: fix dflt addr selection for connected nexthop Oleg Nesterov (1): fix race between exit_itimers() and /proc/pid/timers Peter Ujfalusi (3): ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array ASoC: SOF: Intel: hda-loader: Clarify the cl_dsp_init() flow Ryan Wanner (1): ARM: dts: at91: sama5d2: Fix typo in i2s1 node Ryusuke Konishi (1): nilfs2: fix incorrect masking of permission flags for symlinks Sagi Grimberg (1): nvme-tcp: always fail a request when sending it failed Srinivas Neeli (1): Revert "can: xilinx_can: Limit CANFD brp to 2" Stafford Horne (1): irqchip: or1k-pic: Undefine mask_ack for level triggered hardware Stephan Gerhold (2): virtio_mmio: Add missing PM calls to freeze/restore virtio_mmio: Restore guest page size on resume Steven Rostedt (Google) (1): net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale pointer Tariq Toukan (3): net/mlx5e: kTLS, Fix build time constant test in TX net/mlx5e: kTLS, Fix build time constant test in RX net/tls: Check for errors in tls_device_init Thinh Nguyen (1): usb: dwc3: gadget: Fix event pending check Vitaly Kuznetsov (1): KVM: x86: Fully initialize 'struct kvm_lapic_irq' in kvm_pv_kick_cpu_op() Xiu Jianfeng (1): Revert "evm: Fix memleak in init_desc" Yangxi Xiang (1): vt: fix memory overlapping when deleting chars in the buffer Yi Yang (1): serial: 8250: fix return error code in serial8250_request_std_resource() Zhen Lei (1): ARM: 9210/1: Mark the FDT_FIXED sections as shareable Zheng Yejian (1): tracing/histograms: Fix memory leak problem Íñigo Huguet (2): sfc: fix use after free when disabling sriov sfc: fix kernel panic when creating VF Documentation/networking/ip-sysctl.rst | 4 +- arch/arm/boot/dts/imx6qdl-ts7970.dtsi | 2 +- arch/arm/boot/dts/sama5d2.dtsi | 2 +- arch/arm/boot/dts/stm32mp151.dtsi | 2 +- .../boot/dts/sun8i-h2-plus-orangepi-zero.dts | 2 +- arch/arm/include/asm/mach/map.h | 1 + arch/arm/include/asm/ptrace.h | 26 +++++++++ arch/arm/mm/alignment.c | 3 ++ arch/arm/mm/mmu.c | 15 +++++- arch/arm/mm/proc-v7-bugs.c | 9 ++-- arch/arm/probes/decode.h | 26 +-------- arch/sh/include/asm/io.h | 8 ++- arch/x86/kernel/ima_arch.c | 2 + arch/x86/kvm/x86.c | 18 ++++--- arch/x86/mm/init.c | 14 ++++- drivers/cpufreq/pmac32-cpufreq.c | 4 ++ drivers/gpu/drm/i915/display/intel_dp_mst.c | 1 + drivers/gpu/drm/i915/gt/intel_gt.c | 15 +++++- drivers/gpu/drm/i915/gt/selftest_lrc.c | 8 +-- drivers/gpu/drm/panfrost/panfrost_drv.c | 4 +- drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +- drivers/irqchip/irq-or1k-pic.c | 1 - drivers/net/can/xilinx_can.c | 4 +- .../ethernet/aquantia/atlantic/aq_pci_func.c | 23 +++----- drivers/net/ethernet/faraday/ftgmac100.c | 15 +++++- .../mellanox/mlx5/core/en_accel/ktls_rx.c | 3 +- .../mellanox/mlx5/core/en_accel/ktls_tx.c | 3 +- .../ethernet/mellanox/mlx5/core/en_stats.c | 2 +- drivers/net/ethernet/sfc/ef10.c | 3 ++ drivers/net/ethernet/sfc/ef10_sriov.c | 10 ++-- .../stmicro/stmmac/dwmac-dwc-qos-eth.c | 1 + drivers/net/phy/sfp.c | 2 +- drivers/net/xen-netback/rx.c | 1 + drivers/nfc/nxp-nci/i2c.c | 8 ++- drivers/nvme/host/pci.c | 3 +- drivers/nvme/host/tcp.c | 3 +- drivers/pinctrl/aspeed/pinctrl-aspeed.c | 4 +- drivers/platform/x86/hp-wmi.c | 3 ++ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 7 +++ drivers/soc/ixp4xx/ixp4xx-npe.c | 2 +- drivers/spi/spi-amd.c | 8 +++ drivers/tty/serial/8250/8250_core.c | 4 ++ drivers/tty/serial/8250/8250_port.c | 4 +- drivers/tty/serial/amba-pl011.c | 23 +++++++- drivers/tty/serial/samsung_tty.c | 5 +- drivers/tty/serial/serial_core.c | 5 -- drivers/tty/serial/stm32-usart.c | 2 + drivers/tty/vt/vt.c | 2 +- drivers/usb/dwc3/gadget.c | 4 +- drivers/usb/serial/ftdi_sio.c | 3 ++ drivers/usb/serial/ftdi_sio_ids.h | 6 +++ drivers/usb/typec/class.c | 1 + drivers/virtio/virtio_mmio.c | 26 +++++++++ fs/btrfs/inode.c | 14 ++++- fs/exec.c | 2 +- fs/ext4/extents.c | 5 ++ fs/nilfs2/nilfs.h | 3 ++ fs/remap_range.c | 3 +- include/linux/kexec.h | 6 +++ include/linux/sched/task.h | 2 +- include/linux/serial_core.h | 5 ++ include/net/raw.h | 2 +- include/net/sock.h | 2 +- include/net/tls.h | 4 +- include/trace/events/sock.h | 6 ++- kernel/exit.c | 2 +- kernel/kexec_file.c | 11 +++- kernel/signal.c | 8 +-- kernel/sysctl.c | 53 ++++++++++--------- kernel/time/posix-timers.c | 19 +++++-- kernel/trace/trace_events_hist.c | 2 + mm/memory.c | 27 +++++----- net/bridge/br_netfilter_hooks.c | 21 ++++++-- net/core/filter.c | 1 - net/ipv4/af_inet.c | 4 +- net/ipv4/cipso_ipv4.c | 12 +++-- net/ipv4/fib_semantics.c | 4 +- net/ipv4/fib_trie.c | 2 +- net/ipv4/icmp.c | 10 ++-- net/ipv4/inetpeer.c | 12 +++-- net/ipv4/nexthop.c | 5 +- net/ipv4/tcp.c | 3 +- net/ipv6/route.c | 2 +- net/ipv6/seg6_iptunnel.c | 5 +- net/ipv6/seg6_local.c | 2 - net/mac80211/wme.c | 4 +- net/tipc/socket.c | 1 + net/tls/tls_device.c | 4 +- net/tls/tls_main.c | 7 ++- security/integrity/evm/evm_crypto.c | 7 +-- security/integrity/ima/ima_appraise.c | 3 +- security/integrity/ima/ima_crypto.c | 1 + sound/pci/hda/patch_conexant.c | 1 + sound/pci/hda/patch_realtek.c | 16 ++++++ sound/soc/codecs/cs47l15.c | 5 +- sound/soc/codecs/madera.c | 14 +++-- sound/soc/codecs/sgtl5000.c | 9 ++++ sound/soc/codecs/sgtl5000.h | 1 + sound/soc/codecs/tas2764.c | 46 +++++++++------- sound/soc/codecs/tas2764.h | 6 +-- sound/soc/codecs/wm5110.c | 8 ++- sound/soc/intel/skylake/skl-nhlt.c | 40 +++++++++----- sound/soc/soc-dapm.c | 5 ++ sound/soc/soc-ops.c | 4 +- sound/soc/sof/intel/hda-loader.c | 8 +-- 105 files changed, 556 insertions(+), 252 deletions(-) -- 2.20.1

1 109

[PATCH openEuler-5.10-LTS 00/50] Backport 5.10.130 LTS
by Zheng Zengkai 02 Nov '22

02 Nov '22

Backport 5.10.130 LTS patches from upstream. git cherry-pick v5.10.129..v5.10.130~1 -s Already merged(-5): 6c32496964da mm/slub: add missing TID updates on slab deactivation 0a5e36dbcb44 netfilter: nf_tables: stricter validation of element data b81212828ad1 fbmem: Check virtual screen sizes in fb_set_var() b727561ddc93 fbcon: Disallow setting font bigger than screen size cecb806c766c fbcon: Prevent that screen size is smaller than font size Total patches: 55 - 5 = 50 Andrei Lalaev (1): pinctrl: sunxi: sunxi_pconf_set: use correct offset Claudiu Beznea (2): ARM: at91: pm: use proper compatible for sama5d2's rtc ARM: at91: pm: use proper compatibles for sam9x60's rtc and rtt Dan Williams (1): memregion: Fix memregion_free() fallback definition Daniel Borkmann (2): bpf: Fix incorrect verifier simulation around jmp32's jeq/jne bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals Dmitry Osipenko (1): dmaengine: pl330: Fix lockdep warning about non-static key Duoming Zhou (1): net: rose: fix UAF bug caused by rose_t0timer_expiry Eric Sandeen (1): xfs: remove incorrect ASSERT in xfs_rename Eugen Hristev (2): ARM: dts: at91: sam9x60ek: fix eeprom compatible and size ARM: dts: at91: sama5d2_icp: fix eeprom compatibles Guiling Deng (1): fbdev: fbmem: Fix logo center image dx issue Heiner Kallweit (1): r8169: fix accessing unset transport header Hsin-Yi Wang (1): video: of_display_timing.h: include errno.h Ivan Malov (1): xsk: Clear page contiguity bit when unmapping pool Jason A. Donenfeld (1): powerpc/powernv: delay rng platform device creation until later in boot Jimmy Assarsson (3): can: kvaser_usb: replace run-time checks with struct kvaser_usb_driver_info can: kvaser_usb: kvaser_usb_leaf: fix CAN clock frequency regression can: kvaser_usb: kvaser_usb_leaf: fix bittiming limits Konrad Dybcio (1): arm64: dts: qcom: msm8994: Fix CPU6/7 reg values Liang He (1): can: grcan: grcan_probe(): remove extra of_node_get() Linus Torvalds (1): ida: don't use BUG_ON() for debugging Lukasz Cieplicki (1): i40e: Fix dropped jumbo frames statistics Miaoqian Lin (3): ARM: meson: Fix refcount leak in meson_smp_prepare_cpus dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate Michael Walle (1): dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly Oliver Hartkopp (1): can: bcm: use call_rcu() instead of costly synchronize_rcu() Oliver Neukum (1): usbnet: fix memory leak in error case Pablo Neira Ayuso (1): netfilter: nft_set_pipapo: release elements in clone from abort path Peng Fan (3): arm64: dts: imx8mp-evk: correct mmc pad settings arm64: dts: imx8mp-evk: correct gpio-led pad settings arm64: dts: imx8mp-evk: correct I2C3 pad settings Peter Robinson (1): dmaengine: imx-sdma: Allow imx8m for imx7 FW revs Rafael J. Wysocki (1): PM: runtime: Redefine pm_runtime_release_supplier() Rhett Aultman (1): can: gs_usb: gs_usb_open/close(): fix memory leak Rick Lindsley (1): ibmvnic: Properly dispose of all skbs during a failover. Samuel Holland (2): pinctrl: sunxi: a83t: Fix NAND function name for some pins dt-bindings: dma: allwinner,sun50i-a64-dma: Fix min/max typo Satish Nagireddy (1): i2c: cadence: Unregister the clk notifier in error path Sherry Sun (1): arm64: dts: imx8mp-evk: correct the uart2 pinctl value Shuah Khan (3): misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer misc: rtsx_usb: use separate command and response buffers misc: rtsx_usb: set return value in rsp_buf alloc err path Stephan Gerhold (1): arm64: dts: qcom: msm8992-*: Fix vdd_lvs1_2-supply typo Tim Crawford (1): ALSA: hda/realtek: Add quirk for Clevo L140PU Vladimir Oltean (3): selftests: forwarding: fix flood_unicast_test when h2 supports IFF_UNICAST_FLT selftests: forwarding: fix learning_test when h1 supports IFF_UNICAST_FLT selftests: forwarding: fix error message in learning_test Yian Chen (1): iommu/vt-d: Fix PCI bus rescan device hot add .../dma/allwinner,sun50i-a64-dma.yaml | 2 +- arch/arm/boot/dts/at91-sam9x60ek.dts | 3 +- arch/arm/boot/dts/at91-sama5d2_icp.dts | 6 +- arch/arm/mach-at91/pm.c | 6 +- arch/arm/mach-meson/platsmp.c | 2 + arch/arm64/boot/dts/freescale/imx8mp-evk.dts | 18 +- .../dts/qcom/msm8992-bullhead-rev-101.dts | 2 +- .../boot/dts/qcom/msm8992-xiaomi-libra.dts | 2 +- arch/arm64/boot/dts/qcom/msm8994.dtsi | 4 +- arch/powerpc/platforms/powernv/rng.c | 16 +- drivers/base/core.c | 3 +- drivers/base/power/runtime.c | 20 +- drivers/dma/at_xdmac.c | 5 + drivers/dma/imx-sdma.c | 2 +- drivers/dma/pl330.c | 2 +- drivers/dma/ti/dma-crossbar.c | 5 + drivers/i2c/busses/i2c-cadence.c | 1 + drivers/iommu/intel/dmar.c | 2 +- drivers/misc/cardreader/rtsx_usb.c | 27 +- drivers/net/can/grcan.c | 1 - drivers/net/can/usb/gs_usb.c | 23 +- drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 25 +- .../net/can/usb/kvaser_usb/kvaser_usb_core.c | 255 ++++++++++-------- .../net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 4 +- .../net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 119 ++++---- drivers/net/ethernet/ibm/ibmvnic.c | 9 + drivers/net/ethernet/intel/i40e/i40e.h | 16 ++ drivers/net/ethernet/intel/i40e/i40e_main.c | 73 +++++ .../net/ethernet/intel/i40e/i40e_register.h | 13 + drivers/net/ethernet/intel/i40e/i40e_type.h | 1 + drivers/net/ethernet/realtek/r8169_main.c | 10 +- drivers/net/usb/usbnet.c | 17 +- drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c | 10 +- drivers/pinctrl/sunxi/pinctrl-sunxi.c | 2 + drivers/video/fbdev/core/fbmem.c | 2 +- fs/xfs/xfs_inode.c | 1 - include/linux/memregion.h | 2 +- include/linux/pm_runtime.h | 5 +- include/linux/rtsx_usb.h | 2 - include/video/of_display_timing.h | 2 + kernel/bpf/verifier.c | 113 ++++---- lib/idr.c | 3 +- net/can/bcm.c | 18 +- net/netfilter/nft_set_pipapo.c | 48 ++-- net/rose/rose_route.c | 4 +- net/xdp/xsk_buff_pool.c | 1 + sound/pci/hda/patch_realtek.c | 1 + tools/testing/selftests/net/forwarding/lib.sh | 6 +- 48 files changed, 570 insertions(+), 344 deletions(-) -- 2.20.1

1 50

[PATCH] uacce: add the reference counter protection
by Laibin Qiu 02 Nov '22

02 Nov '22

From: Yu'an Wang <wangyuan46(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5VVP6 CVE: NA -------------------------------- The device driver pointer will be set null during hot plugging. So should use the device driver null check to pretect put queue. Otherwise the null pointer may cause the oom ops as doing hot plugging. Signed-off-by: Yu'an Wang <wangyuan46(a)huawei.com> Reviewed-by: Kai Ye <yekai13(a)huawei.com> Reviewed-by: Longfang Liu <liulongfang(a)huawei.com> Reviewed-by: li yongxin <liyongxin1(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- drivers/misc/uacce/uacce.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c index b0cdc244e882..dc3aaae30752 100644 --- a/drivers/misc/uacce/uacce.c +++ b/drivers/misc/uacce/uacce.c @@ -229,10 +229,8 @@ static void uacce_free_dma_buffers(struct uacce_queue *q) return; while (i < qfr->dma_list[0].total_num) { WARN_ON(!qfr->dma_list[i].size || !qfr->dma_list[i].dma); - dev_dbg(uacce->pdev, "free dma qfr %s (kaddr=%lx, dma=%llx)\n", - uacce_qfrt_str(qfr), - (unsigned long)qfr->dma_list[i].kaddr, - qfr->dma_list[i].dma); + dev_dbg(uacce->pdev, "free dma qfr %s (index = %d)\n", + uacce_qfrt_str(qfr), i); dma_free_coherent(uacce->pdev, qfr->dma_list[i].size, qfr->dma_list[i].kaddr, qfr->dma_list[i].dma); @@ -383,8 +381,8 @@ static int uacce_mmap_dma_buffers(struct uacce_queue *q, slice[i].size); if (ret) { dev_err(uacce->pdev, - "mmap dma buf fail(dma=0x%llx,size=0x%x)!\n", - slice[i].dma, slice[i].size); + "mmap dma buf fail(dma index=%d,size=0x%x)!\n", + i, slice[i].size); goto DMA_MMAP_FAIL; } @@ -736,6 +734,12 @@ static void uacce_put_queue(struct uacce_queue *q) q->state = UACCE_Q_ZOMBIE; q->filep->private_data = NULL; uacce_queue_drain(q); + + if (!uacce->pdev->driver) { + dev_warn(uacce->pdev, "the parent device is hot plugged!\n"); + return; + } + if (module_refcount(uacce->pdev->driver->owner) > 0) module_put(uacce->pdev->driver->owner); } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] usb: mon: make mmapped memory read only
by Yongqiang Liu 02 Nov '22

02 Nov '22

From: Tadeusz Struk <tadeusz.struk(a)linaro.org> stable inclusion from stable-v4.19.262 commit bf7e2cee3899ede4c7c6548f28159ee3775fb67f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5XTU4 CVE: CVE-2022-43750 -------------------------------- commit a659daf63d16aa883be42f3f34ff84235c302198 upstream. Syzbot found an issue in usbmon module, where the user space client can corrupt the monitor's internal memory, causing the usbmon module to crash the kernel with segfault, UAF, etc. The reproducer mmaps the /dev/usbmon memory to user space, and overwrites it with arbitrary data, which causes all kinds of issues. Return an -EPERM error from mon_bin_mmap() if the flag VM_WRTIE is set. Also clear VM_MAYWRITE to make it impossible to change it to writable later. Cc: "Dmitry Vyukov" <dvyukov(a)google.com> Cc: stable <stable(a)kernel.org> Fixes: 6f23ee1fefdc ("USB: add binary API to usbmon") Suggested-by: PaX Team <pageexec(a)freemail.hu> # for the VM_MAYRITE portion Link: https://syzkaller.appspot.com/bug?id=2eb1f35d6525fa4a74d75b4244971e5b1411c9… Reported-by: syzbot+23f57c5ae902429285d7(a)syzkaller.appspotmail.com Signed-off-by: Tadeusz Struk <tadeusz.struk(a)linaro.org> Link: https://lore.kernel.org/r/20220919215957.205681-1-tadeusz.struk@linaro.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/usb/mon/mon_bin.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c index f48a23adbc35..094e812e9e69 100644 --- a/drivers/usb/mon/mon_bin.c +++ b/drivers/usb/mon/mon_bin.c @@ -1268,6 +1268,11 @@ static int mon_bin_mmap(struct file *filp, struct vm_area_struct *vma) { /* don't do anything here: "fault" will set up page table entries */ vma->vm_ops = &mon_bin_vm_ops; + + if (vma->vm_flags & VM_WRITE) + return -EPERM; + + vma->vm_flags &= ~VM_MAYWRITE; vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP; vma->vm_private_data = filp->private_data; mon_bin_vma_open(vma); -- 2.25.1

1 1

[PATCH openEuler-5.10 1/9] RDMA/hns: Fix PBL page MTR find
by Zheng Zengkai 01 Nov '22

01 Nov '22

From: Chengchang Tang <tangchengchang(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5Y79T ------------------------------------------------------------------- Now, The address of the first two pages in the MR will be searched. And an exception will occur when there is only one page in this MR. This patch fix the number of page to search. Fixes: 9b2cf76c9f05 ("RDMA/hns: Optimize PBL buffer allocation process") Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> Reviewed-by: Yangyang Li <liyangyang20(a)huawei.com> Reviewed-by: YueHaibing <yuehaibing(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index 87872c6e1977..c6348e520fb1 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -3266,7 +3266,8 @@ static int set_mtpt_pbl(struct hns_roce_dev *hr_dev, int i, count; count = hns_roce_mtr_find(hr_dev, &mr->pbl_mtr, 0, pages, - ARRAY_SIZE(pages), &pbl_ba); + min_t(int, ARRAY_SIZE(pages), mr->npages), + &pbl_ba); if (count < 1) { ibdev_err(ibdev, "failed to find PBL mtr, count = %d.\n", count); -- 2.20.1

1 8

[PATCH openEuler-1.0-LTS 1/4] ext4: fix bug_on in __es_tree_search caused by bad quota inode
by Yongqiang Liu 01 Nov '22

01 Nov '22

From: Baokun Li <libaokun1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187821,https://gitee.com/openeuler/kernel/issues/I5X9U0 CVE: NA -------------------------------- We got a issue as fllows: Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> ================================================================== kernel BUG at fs/ext4/extents_status.c:202! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 1 PID: 810 Comm: mount Not tainted 6.1.0-rc1-next-g9631525255e3 #352 RIP: 0010:__es_tree_search.isra.0+0xb8/0xe0 RSP: 0018:ffffc90001227900 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000077512a0f RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000002a10 RDI: ffff8881004cd0c8 RBP: ffff888177512ac8 R08: 47ffffffffffffff R09: 0000000000000001 R10: 0000000000000001 R11: 00000000000679af R12: 0000000000002a10 R13: ffff888177512d88 R14: 0000000077512a10 R15: 0000000000000000 FS: 00007f4bd76dbc40(0000)GS:ffff88842fd00000(0000)knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005653bf993cf8 CR3: 000000017bfdf000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ext4_es_cache_extent+0xe2/0x210 ext4_cache_extents+0xd2/0x110 ext4_find_extent+0x5d5/0x8c0 ext4_ext_map_blocks+0x9c/0x1d30 ext4_map_blocks+0x431/0xa50 ext4_getblk+0x82/0x340 ext4_bread+0x14/0x110 ext4_quota_read+0xf0/0x180 v2_read_header+0x24/0x90 v2_check_quota_file+0x2f/0xa0 dquot_load_quota_sb+0x26c/0x760 dquot_load_quota_inode+0xa5/0x190 ext4_enable_quotas+0x14c/0x300 __ext4_fill_super+0x31cc/0x32c0 ext4_fill_super+0x115/0x2d0 get_tree_bdev+0x1d2/0x360 ext4_get_tree+0x19/0x30 vfs_get_tree+0x26/0xe0 path_mount+0x81d/0xfc0 do_mount+0x8d/0xc0 __x64_sys_mount+0xc0/0x160 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> ================================================================== Above issue may happen as follows: ------------------------------------- ext4_fill_super ext4_orphan_cleanup ext4_enable_quotas ext4_quota_enable ext4_iget --> get error inode <5> ext4_ext_check_inode --> Wrong imode makes it escape inspection make_bad_inode(inode) --> EXT4_BOOT_LOADER_INO set imode dquot_load_quota_inode vfs_setup_quota_inode --> check pass dquot_load_quota_sb v2_check_quota_file v2_read_header ext4_quota_read ext4_bread ext4_getblk ext4_map_blocks ext4_ext_map_blocks ext4_find_extent ext4_cache_extents ext4_es_cache_extent __es_tree_search.isra.0 ext4_es_end --> Wrong extents trigger BUG_ON In the above issue, s_usr_quota_inum is set to 5, but inode<5> contains incorrect imode and disordered extents. Because 5 is EXT4_BOOT_LOADER_INO, the ext4_ext_check_inode check in the ext4_iget function can be bypassed, finally, the extents that are not checked trigger the BUG_ON in the __es_tree_search function. To solve this issue, check whether the inode is bad_inode in vfs_setup_quota_inode(). Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/quota/dquot.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index ddb379abd919..316f49cbc032 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -2312,6 +2312,10 @@ static int vfs_load_quota_inode(struct inode *inode, int type, int format_id, if (!fmt) return -ESRCH; + if (is_bad_inode(inode)) { + error = -EUCLEAN; + goto out_fmt; + } if (!S_ISREG(inode->i_mode)) { error = -EACCES; goto out_fmt; -- 2.25.1

1 3