- Kernel - mailweb.openeuler.org

[PATCH 00/35] Fixes some CVEs and kernel bugs
by Yang Yingliang 20 Feb '20

20 Feb '20

Al Viro (2): do_last(): fetch directory ->i_mode and ->i_uid before it's too late vfs: fix do_last() regression Amir Goldstein (1): debugfs: simplify __debugfs_remove_file() Jan Kara (23): jbd2: Fixup stale comment in commit code jbd2: Completely fill journal descriptor blocks ext4: Move marking of handle as sync to ext4_add_nondir() ext4: Do not iput inode under running transaction ext4: Fix ext4_should_journal_data() for EA inodes ext4: Use ext4_journal_extend() instead of jbd2_journal_extend() ext4: Avoid unnecessary revokes in ext4_alloc_branch() ext4: Provide function to handle transaction restarts ext4, jbd2: Provide accessor function for handle credits ocfs2: Use accessor function for h_buffer_credits jbd2: Reorganize jbd2_journal_stop() jbd2: Drop pointless check from jbd2_journal_stop() jbd2: Drop pointless wakeup from jbd2_journal_stop() jbd2: Factor out common parts of stopping and restarting a handle jbd2: Account descriptor blocks into t_outstanding_credits jbd2: Drop jbd2_space_needed() jbd2: Reserve space for revoke descriptor blocks jbd2: Rename h_buffer_credits to h_total_credits jbd2: Make credit checking more strict ext4: Reserve revoke credits for freed blocks jbd2: Provide trace event for handle restarts jbd2: Fine tune estimate of necessary descriptor blocks jbd2: make jbd2_handle_buffer_credits() handle reserved handles Liu Song (1): jbd2: remove repeated assignments in __jbd2_log_wait_for_space() Shijie Luo (1): ext4: add cond_resched() to ext4_protect_reserved_inode Wen Huang (1): libertas: Fix two buffer overflows at parsing bss descriptor Yufen Yu (2): bdi: fix use-after-free for the bdi device bdi: fix kabi for struct backing_dev_info yangerkun (1): ext4: reserve revoke credits in __ext4_new_inode yu kuai (3): block: rename 'q->debugfs_dir' and 'q->blk_trace->dir' in blk_unregister_queue() simple_recursive_removal(): kernel-side rm -rf for ramfs-style filesystems debugfs: fix kabi for function debugfs_remove_recursive block/blk-cgroup.c | 7 +- block/blk-sysfs.c | 44 +++++ drivers/net/wireless/marvell/libertas/cfg.c | 16 +- fs/debugfs/inode.c | 126 +++----------- fs/ext4/block_validity.c | 1 + fs/ext4/ext4.h | 4 +- fs/ext4/ext4_jbd2.c | 32 +++- fs/ext4/ext4_jbd2.h | 106 ++++++++++-- fs/ext4/extents.c | 89 ++++++---- fs/ext4/ialloc.c | 4 +- fs/ext4/indirect.c | 125 ++++++++------ fs/ext4/inode.c | 31 +--- fs/ext4/migrate.c | 103 +++++------ fs/ext4/namei.c | 39 +++-- fs/ext4/resize.c | 46 ++--- fs/ext4/xattr.c | 94 ++++------ fs/jbd2/checkpoint.c | 3 +- fs/jbd2/commit.c | 9 +- fs/jbd2/journal.c | 35 +++- fs/jbd2/revoke.c | 6 + fs/jbd2/transaction.c | 254 ++++++++++++++++------------ fs/libfs.c | 65 +++++++ fs/namei.c | 17 +- fs/ocfs2/alloc.c | 32 ++-- fs/ocfs2/journal.c | 8 +- fs/tracefs/inode.c | 111 ++---------- include/linux/backing-dev-defs.h | 7 + include/linux/device.h | 5 + include/linux/fs.h | 2 + include/linux/jbd2.h | 87 ++++++---- include/linux/tracefs.h | 1 - include/trace/events/ext4.h | 13 +- include/trace/events/jbd2.h | 16 +- kernel/trace/trace.c | 4 +- kernel/trace/trace_events.c | 6 +- kernel/trace/trace_hwlat.c | 2 +- mm/backing-dev.c | 49 +++++- 37 files changed, 894 insertions(+), 705 deletions(-) -- 1.8.3

1 35

[PATCH] drm/i915/gen9: Clear residual context state on context switch
by Yang Yingliang 07 Feb '20

07 Feb '20

From: Akeem G Abodunrin <akeem.g.abodunrin(a)intel.com> commit bc8a76a152c5f9ef3b48104154a65a68a8b76946 upstream. Intel ID: PSIRT-TA-201910-001 CVEID: CVE-2019-14615 Intel GPU Hardware prior to Gen11 does not clear EU state during a context switch. This can result in information leakage between contexts. For Gen8 and Gen9, hardware provides a mechanism for fast cleardown of the EU state, by issuing a PIPE_CONTROL with bit 27 set. We can use this in a context batch buffer to explicitly cleardown the state on every context switch. As this workaround is already in place for gen8, we can borrow the code verbatim for Gen9. Signed-off-by: Mika Kuoppala <mika.kuoppala(a)linux.intel.com> Signed-off-by: Akeem G Abodunrin <akeem.g.abodunrin(a)intel.com> Cc: Kumar Valsan Prathap <prathap.kumar.valsan(a)intel.com> Cc: Chris Wilson <chris.p.wilson(a)intel.com> Cc: Balestrieri Francesco <francesco.balestrieri(a)intel.com> Cc: Bloomfield Jon <jon.bloomfield(a)intel.com> Cc: Dutt Sudeep <sudeep.dutt(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/gpu/drm/i915/intel_lrc.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c index 6937ef0b..13e97fa 100644 --- a/drivers/gpu/drm/i915/intel_lrc.c +++ b/drivers/gpu/drm/i915/intel_lrc.c @@ -1562,6 +1562,15 @@ static u32 *gen9_init_indirectctx_bb(struct intel_engine_cs *engine, u32 *batch) /* WaFlushCoherentL3CacheLinesAtContextSwitch:skl,bxt,glk */ batch = gen8_emit_flush_coherentl3_wa(engine, batch); + /* WaClearSlmSpaceAtContextSwitch:skl,bxt,kbl,glk,cfl */ + batch = gen8_emit_pipe_control(batch, + PIPE_CONTROL_FLUSH_L3 | + PIPE_CONTROL_GLOBAL_GTT_IVB | + PIPE_CONTROL_CS_STALL | + PIPE_CONTROL_QW_WRITE, + i915_ggtt_offset(engine->scratch) + + 2 * CACHELINE_BYTES); + batch = emit_lri(batch, lri, ARRAY_SIZE(lri)); /* WaClearSlmSpaceAtContextSwitch:kbl */ -- 1.8.3

1 0

[PATCH 00/14] Some bug and CVE fixes
by Yang Yingliang 05 Feb '20

05 Feb '20

Cheng Jian (2): membarrier/kabi: fix kabi for membarrier_state selftest/membarrier: fix build error Mathieu Desnoyers (5): sched/membarrier: Remove redundant check sched/membarrier: Fix p->mm->membarrier_state racy load selftests, sched/membarrier: Add multi-threaded test sched/membarrier: Skip IPIs when mm->mm_users == 1 sched/membarrier: Return -ENOMEM to userspace on memory allocation failure Peter Zijlstra (2): sched: Clean up active_mm reference counting membarrier: Fix RCU locking bug caused by faulty merge Tyler Hicks (1): drm/i915: Fix use-after-free when destroying GEM context Xiongfeng Wang (2): PCI: add a member in 'struct pci_bus' to record the original 'pci_ops' PCI: fix kabi change in struct pci_bus Ying Fang (2): KVM: arm/arm64: use esr_ec as trace field of kvm_exit tracepoint KVM: tools/kvm_stat: Fix kvm_exit filter name drivers/gpu/drm/i915/i915_gem_context.c | 13 +- drivers/pci/probe.c | 7 +- fs/exec.c | 2 +- include/linux/mm_types.h | 8 + include/linux/pci.h | 5 +- include/linux/sched/mm.h | 8 +- kernel/sched/core.c | 49 ++-- kernel/sched/membarrier.c | 236 +++++++++------ kernel/sched/sched.h | 37 +++ tools/kvm/kvm_stat/kvm_stat | 8 +- tools/testing/selftests/membarrier/.gitignore | 3 +- tools/testing/selftests/membarrier/Makefile | 4 +- .../testing/selftests/membarrier/membarrier_test.c | 312 -------------------- .../selftests/membarrier/membarrier_test_impl.h | 317 +++++++++++++++++++++ .../membarrier/membarrier_test_multi_thread.c | 72 +++++ .../membarrier/membarrier_test_single_thread.c | 23 ++ virt/kvm/arm/arm.c | 2 +- virt/kvm/arm/trace.h | 14 +- 18 files changed, 678 insertions(+), 442 deletions(-) delete mode 100644 tools/testing/selftests/membarrier/membarrier_test.c create mode 100644 tools/testing/selftests/membarrier/membarrier_test_impl.h create mode 100644 tools/testing/selftests/membarrier/membarrier_test_multi_thread.c create mode 100644 tools/testing/selftests/membarrier/membarrier_test_single_thread.c -- 1.8.3

1 14

[PATCH] PCI/AER: increments pci bus reference count in aer-inject process
by Yang Yingliang 19 Jan '20

19 Jan '20

From: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> hulk inclusion category: bugfix bugzilla: 28335 CVE: NA ------------------------------------------------- When I test 'aer-inject' with the following procedures: 1. inject a fatal error into a PCI device 2. remove the parent device by sysfs 3. execute command 'rmmod aer-inject' I came across the following use-after-free. [ 297.581524] ================================================================== [ 297.581543] BUG: KASAN: use-after-free in pci_bus_set_ops+0xb4/0xb8 [ 297.581545] Read of size 8 at addr ffff802edbde80e0 by task rmmod/21839 [ 297.581552] CPU: 119 PID: 21839 Comm: rmmod Kdump: loaded Not tainted 4.19.36 #1 [ 297.581554] Hardware name: Huawei TaiShan 2280 V2/BC82AMDD, BIOS 1.05 09/18/2019 [ 297.581556] Call trace: [ 297.581561] dump_backtrace+0x0/0x360 [ 297.581563] show_stack+0x24/0x30 [ 297.581569] dump_stack+0xd8/0x104 [ 297.581576] print_address_description+0x68/0x278 [ 297.581578] kasan_report+0x204/0x330 [ 297.581580] __asan_report_load8_noabort+0x30/0x40 [ 297.581582] pci_bus_set_ops+0xb4/0xb8 [ 297.581591] aer_inject_exit+0x198/0x334 [aer_inject] [ 297.581595] __arm64_sys_delete_module+0x310/0x490 [ 297.581601] el0_svc_common+0xfc/0x278 [ 297.581603] el0_svc_handler+0x50/0xc0 [ 297.581605] el0_svc+0x8/0xc [ 297.581608] Allocated by task 1: [ 297.581611] kasan_kmalloc+0xe0/0x190 [ 297.581614] kmem_cache_alloc_trace+0x104/0x218 [ 297.581616] pci_alloc_bus+0x50/0x2e0 [ 297.581618] pci_add_new_bus+0xa8/0xe08 [ 297.581620] pci_scan_bridge_extend+0x884/0xb28 [ 297.581623] pci_scan_child_bus_extend+0x350/0x628 [ 297.581625] pci_scan_child_bus+0x24/0x30 [ 297.581627] pci_scan_bridge_extend+0x3b8/0xb28 [ 297.581629] pci_scan_child_bus_extend+0x350/0x628 [ 297.581631] pci_scan_child_bus+0x24/0x30 [ 297.581635] acpi_pci_root_create+0x558/0x888 [ 297.581640] pci_acpi_scan_root+0x198/0x330 [ 297.581641] acpi_pci_root_add+0x7bc/0xbb0 [ 297.581646] acpi_bus_attach+0x2f4/0x728 [ 297.581647] acpi_bus_attach+0x1b0/0x728 [ 297.581649] acpi_bus_attach+0x1b0/0x728 [ 297.581651] acpi_bus_scan+0xa0/0x110 [ 297.581657] acpi_scan_init+0x20c/0x500 [ 297.581659] acpi_init+0x54c/0x5d4 [ 297.581661] do_one_initcall+0xbc/0x480 [ 297.581665] kernel_init_freeable+0x5fc/0x6ac [ 297.581670] kernel_init+0x18/0x128 [ 297.581671] ret_from_fork+0x10/0x18 [ 297.581673] Freed by task 19270: [ 297.581675] __kasan_slab_free+0x120/0x228 [ 297.581677] kasan_slab_free+0x10/0x18 [ 297.581678] kfree+0x80/0x1f8 [ 297.581680] release_pcibus_dev+0x54/0x68 [ 297.581686] device_release+0xd4/0x1c0 [ 297.581689] kobject_put+0x12c/0x400 [ 297.581691] device_unregister+0x30/0xc0 [ 297.581693] pci_remove_bus+0xe8/0x1c0 [ 297.581695] pci_remove_bus_device+0xd0/0x2f0 [ 297.581697] pci_stop_and_remove_bus_device_locked+0x2c/0x40 [ 297.581701] remove_store+0x1b8/0x1d0 [ 297.581703] dev_attr_store+0x60/0x80 [ 297.581708] sysfs_kf_write+0x104/0x170 [ 297.581710] kernfs_fop_write+0x23c/0x430 [ 297.581713] __vfs_write+0xec/0x4e0 [ 297.581714] vfs_write+0x12c/0x3d0 [ 297.581715] ksys_write+0xd0/0x190 [ 297.581716] __arm64_sys_write+0x70/0xa0 [ 297.581718] el0_svc_common+0xfc/0x278 [ 297.581720] el0_svc_handler+0x50/0xc0 [ 297.581721] el0_svc+0x8/0xc [ 297.581724] The buggy address belongs to the object at ffff802edbde8000 which belongs to the cache kmalloc-2048 of size 2048 [ 297.581726] The buggy address is located 224 bytes inside of 2048-byte region [ffff802edbde8000, ffff802edbde8800) [ 297.581727] The buggy address belongs to the page: [ 297.581730] page:ffff7e00bb6f7a00 count:1 mapcount:0 mapping:ffff8026de810780 index:0x0 compound_mapcount: 0 [ 297.591520] flags: 0x2ffffe0000008100(slab|head) [ 297.596121] raw: 2ffffe0000008100 ffff7e00bb6f5008 ffff7e00bb6ff608 ffff8026de810780 [ 297.596123] raw: 0000000000000000 00000000000f000f 00000001ffffffff 0000000000000000 [ 297.596124] page dumped because: kasan: bad access detected [ 297.596126] Memory state around the buggy address: [ 297.596128] ffff802edbde7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 297.596129] ffff802edbde8000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.596131] >ffff802edbde8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.596132] ^ [ 297.596133] ffff802edbde8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.596135] ffff802edbde8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.596135] ================================================================== It is because when we unload the module and restore the member 'pci_ops' of 'pci_bus', the 'pci_bus' has been freed. This patch increments the reference count of 'pci_bus' when we modify its member 'pci_ops' and decrements the reference count after we have restored its member. Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/pci/pcie/aer_inject.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/pci/pcie/aer_inject.c b/drivers/pci/pcie/aer_inject.c index 48024a8..03ee265 100644 --- a/drivers/pci/pcie/aer_inject.c +++ b/drivers/pci/pcie/aer_inject.c @@ -304,6 +304,13 @@ static int pci_bus_set_aer_ops(struct pci_bus *bus) spin_lock_irqsave(&inject_lock, flags); if (ops == &aer_inj_pci_ops) goto out; + /* + * increments the reference count of the pci bus. Otherwise, when we + * restore the 'pci_ops' in 'aer_inject_exit', the 'pci_bus' may have + * been freed. + */ + pci_bus_get(bus); + pci_bus_ops_init(bus_ops, bus, ops); list_add(&bus_ops->list, &pci_bus_ops_list); bus_ops = NULL; @@ -543,6 +550,7 @@ static void __exit aer_inject_exit(void) while ((bus_ops = pci_bus_ops_pop())) { pci_bus_set_ops(bus_ops->bus, bus_ops->ops); + pci_bus_put(bus_ops->bus); kfree(bus_ops); } -- 1.8.3

1 0

[PATCH 0/2] Its support hibernation
by Yang Yingliang 19 Jan '20

19 Jan '20

Currently, if we test hibernation, it will fails at the ITS driver, because its can't resume and suspend successuly during the phase of hibernation. Add its herbinate state to support its resume correctly. Hongbo Yao (2): PM / hibernate: introduce system_in_hibernation irqchip/gic-v3-its: its support herbination drivers/irqchip/irq-gic-v3-its.c | 19 +++++++++++++++++-- include/linux/suspend.h | 2 ++ kernel/power/hibernate.c | 11 +++++++++++ 3 files changed, 30 insertions(+), 2 deletions(-) -- 1.8.3

1 2

[PATCH hulk-4.19-next 0/2] Its support hibernation
by Hongbo Yao 19 Jan '20

19 Jan '20

Currently, if we test hibernation, it will fails at the ITS driver, because its can't resume and suspend successuly during the phase of hibernation. Add its herbinate state to support its resume correctly. Hongbo Yao (2): PM / hibernate: introduce system_in_hibernation irqchip/gic-v3-its: its support herbination drivers/irqchip/irq-gic-v3-its.c | 19 +++++++++++++++++-- include/linux/suspend.h | 2 ++ kernel/power/hibernate.c | 11 +++++++++++ 3 files changed, 30 insertions(+), 2 deletions(-) -- 2.20.1

1 2

[PATCH] config: enable CONFIG_SMMU_BYPASS_DEV by default
by Yang Yingliang 17 Jan '20

17 Jan '20

hulk inclusion category: feature bugzilla: 28210 CVE: NA ------------------------------------------------- Enable CONFIG_SMMU_BYPASS_DEV by default. Reviewed-By: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/configs/hulk_defconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/configs/hulk_defconfig b/arch/arm64/configs/hulk_defconfig index 5ded386..7859fd4 100644 --- a/arch/arm64/configs/hulk_defconfig +++ b/arch/arm64/configs/hulk_defconfig @@ -4593,6 +4593,7 @@ CONFIG_IOMMU_PAGE_FAULT=y CONFIG_ARM_SMMU=y CONFIG_ARM_SMMU_V3=y # CONFIG_QCOM_IOMMU is not set +CONFIG_SMMU_BYPASS_DEV=y # # Remoteproc drivers -- 1.8.3

1 0

[PATCH 0/7] Fix some bugs and CVEs
by Yang Yingliang 16 Jan '20

16 Jan '20

Dedy Lansky (1): cfg80211/mac80211: make ieee80211_send_layer2_update a public function Jaegeuk Kim (1): f2fs: support swap file w/ DIO Jouni Malinen (1): mac80211: Do not send Layer 2 Update frame before authorization Keith Busch (1): PCI/AER: Refactor error injection fallbacks Peng Wang (1): kernfs: fix potential null pointer dereference Shmulik Ladkani (1): net/sched: act_mirred: Pull mac prior redir to non mac_header_xmit device Wei Li (1): arm64: fix calling nmi_enter() repeatedly when IPI_CPU_CRASH_STOP arch/arm64/kernel/smp.c | 7 ++- drivers/pci/pcie/aer_inject.c | 66 +++++++++++--------- fs/f2fs/data.c | 140 +++++++++++++++++++++++++++++++++++++++--- fs/f2fs/f2fs.h | 2 +- fs/kernfs/dir.c | 3 +- include/net/cfg80211.h | 11 ++++ include/trace/events/f2fs.h | 11 ++-- net/mac80211/cfg.c | 58 ++--------------- net/mac80211/sta_info.c | 4 ++ net/sched/act_mirred.c | 22 ++++--- net/wireless/util.c | 45 ++++++++++++++ 11 files changed, 259 insertions(+), 110 deletions(-) -- 1.8.3

1 7

[PATCH 00/83] Backport lts patches from Linux-4.19.95
by Yang Yingliang 16 Jan '20

16 Jan '20

Merge 83 patches from 4.19.95 stable branch (84 total) beside 1 already merged patches: 21f0802 mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() Aditya Pakki (1): rfkill: Fix incorrect check to avoid NULL pointer dereference Alexander Shishkin (1): perf/x86/intel: Fix PT PMI handling Andreas Kemnade (1): regulator: rn5t618: fix module aliases Andrew Lunn (1): net: dsa: mv88e6xxx: Preserve priority when setting CPU port. Andrey Konovalov (2): USB: dummy-hcd: use usb_urb_dir_in instead of usb_pipein USB: dummy-hcd: increase max number of devices to 32 Anson Huang (2): cpufreq: imx6q: read OCOTP through nvmem for imx6ul/imx6ull ARM: dts: imx6ul: use nvmem-cells for cpu speed grading Arvind Sankar (3): efi/gop: Return EFI_NOT_FOUND if there are no usable GOPs efi/gop: Return EFI_SUCCESS if a usable GOP was found efi/gop: Fix memory leak in __gop_query32/64() Chan Shu Tak, Alex (1): llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c) Chen-Yu Tsai (2): net: stmmac: dwmac-sun8i: Allow all RGMII modes net: stmmac: dwmac-sunxi: Allow all RGMII modes Christian Borntraeger (1): s390/purgatory: do not build purgatory with kcov, kasan and friends Chuhong Yuan (2): spi: spi-cavium-thunderx: Add missing pci_release_regions() drm/exynos: gsc: add missed component_del Cristian Birsan (1): net: usb: lan78xx: Fix error message format specifier Daniel Borkmann (1): bpf: Fix passing modified ctx to ld/abs/ind instruction Daniel T. Lee (2): samples: bpf: Replace symbol compare of trace_event samples: bpf: fix syscall_tp due to unused syscall Daniele Palmas (1): USB: serial: option: add Telit ME910G1 0x110a composition Dave Young (1): x86/efi: Update e820 with reserved EFI boot services data to fix kexec breakage Dragos Tarcatu (1): ASoC: topology: Check return value for soc_tplg_pcm_create() Eric Dumazet (6): gtp: fix bad unlock balance in gtp_encap_enable_socket macvlan: do not assume mac_header is set in macvlan_broadcast() net: usb: lan78xx: fix possible skb leak pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM vlan: fix memory leak in vlan_dev_set_egress_priority vlan: vlan_changelink() should propagate errors Eric Sandeen (1): fs: avoid softlockups in s_inodes iterators Florian Fainelli (2): ARM: dts: BCM5301X: Fix MDIO node address/size cells ARM: dts: Cygnus: Fix MDIO node address/size cells Florian Westphal (1): netfilter: ctnetlink: netns exit must wait for callbacks Greg Kroah-Hartman (1): Linux 4.19.95 Haiyang Zhang (1): hv_netvsc: Fix unwanted rx_table reset Hangbin Liu (1): vxlan: fix tos value before xmit Hans de Goede (1): ASoC: Intel: bytcr_rt5640: Update quirk for Teclast X89 Helge Deller (1): parisc: Fix compiler warnings in debug_core.c Jan Höppner (1): s390/dasd/cio: Interpret ccw_device_get_mdc return value correctly Jason A. Donenfeld (1): powerpc/spinlocks: Include correct header for static key Johan Hovold (1): USB: core: fix check for duplicate endpoints Jose Abreu (4): net: stmmac: Do not accept invalid MTU values net: stmmac: xgmac: Clear previous RX buffer size net: stmmac: RX buffer size must be 16 byte aligned net: stmmac: Always arm TX Timer at end of transmission start Logan Gunthorpe (1): PCI/switchtec: Read all 64 bits of part_event_bitmap Lorenz Bauer (1): bpf: Clear skb->tstamp in bpf_redirect when necessary Manish Chopra (2): bnx2x: Do not handle requests from VFs after parity bnx2x: Fix logic to get total no. of PFs per engine Marco Elver (1): locking/spinlock/debug: Fix various data races Masami Hiramatsu (1): selftests/ftrace: Fix multiple kprobe testcase Mike Rapoport (1): powerpc: Ensure that swiotlb buffer is allocated from low memory Nikolay Borisov (1): btrfs: Fix error messages in qgroup_rescan_init Pablo Neira Ayuso (3): netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in named sets netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init() Paul Chaignon (1): bpf, mips: Limit to 33 tail calls Pengcheng Yang (1): tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK Petr Machata (2): mlxsw: spectrum_qdisc: Ignore grafting of invisible FIFO net: sch_prio: When ungrafting, replace with FIFO Phil Sutter (1): netfilter: uapi: Avoid undefined left-shift in xt_sctp.h Qi Zhou (1): usb: missing parentheses in USE_NEW_SCHEME Shengjiu Wang (1): ASoC: wm8962: fix lambda value Srikar Dronamraju (1): powerpc/vcpu: Assume dedicated processors as non-preempt Stefan Haberland (1): s390/dasd: fix memleak in path handling error case Stefan Roese (1): ARM: dts: imx6ul: imx6ul-14x14-evk.dtsi: Fix SPI NOR probing Stefan Wahren (1): ARM: dts: bcm283x: Fix critical trip point Sudeep Holla (1): ARM: vexpress: Set-up shared OPP table instead of individual for each CPU Sudip Mukherjee (1): libtraceevent: Fix lib installation with O= Sven Schnelle (1): parisc: add missing __init annotation Thinh Nguyen (1): usb: dwc3: gadget: Fix request complete check Thomas Hebb (1): kconfig: don't crash on NULL expressions in expr_eq() Tomi Valkeinen (1): ARM: dts: am437x-gp/epos-evm: fix panel compatible Tzung-Bi Shih (1): ASoC: max98090: fix possible race conditions Vasundhara Volam (1): bnxt_en: Return error if FW returns more data than dump length Vignesh Raghavendra (1): spi: spi-ti-qspi: Fix a bug when accessing non default CS Vishal Kulkarni (1): cxgb4: Fix kernel panic while accessing sge_info Wen Yang (2): regulator: fix use after free issue sch_cake: avoid possible divide by zero in cake_enqueue() Xiaotao Yin (1): iommu/iova: Init the struct iova to fix the possible memleak Xin Long (1): sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY Yang Yingliang (1): block: fix memleak when __blk_rq_map_user_iov() is failed Makefile | 2 +- arch/arm/boot/dts/am437x-gp-evm.dts | 2 +- arch/arm/boot/dts/am43x-epos-evm.dts | 2 +- arch/arm/boot/dts/bcm-cygnus.dtsi | 4 +- arch/arm/boot/dts/bcm283x.dtsi | 2 +- arch/arm/boot/dts/bcm5301x.dtsi | 4 +- arch/arm/boot/dts/imx6ul-14x14-evk.dtsi | 2 +- arch/arm/boot/dts/imx6ul.dtsi | 6 ++ arch/arm/mach-vexpress/spc.c | 12 +++- arch/mips/net/ebpf_jit.c | 9 +-- arch/parisc/include/asm/cmpxchg.h | 10 ++- arch/parisc/kernel/drivers.c | 2 +- arch/powerpc/include/asm/spinlock.h | 5 +- arch/powerpc/mm/mem.c | 8 +++ arch/powerpc/platforms/pseries/setup.c | 7 ++ arch/s390/purgatory/Makefile | 6 +- arch/s390/purgatory/string.c | 3 + arch/x86/events/core.c | 9 ++- arch/x86/platform/efi/quirks.c | 6 +- block/blk-map.c | 2 +- drivers/cpufreq/imx6q-cpufreq.c | 52 +++++++++----- drivers/firmware/efi/libstub/gop.c | 80 +++++----------------- drivers/gpu/drm/exynos/exynos_drm_gsc.c | 1 + drivers/iommu/iova.c | 2 +- drivers/net/dsa/mv88e6xxx/global1.c | 5 ++ drivers/net/dsa/mv88e6xxx/global1.h | 1 + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 12 +++- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h | 1 + drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c | 12 ++++ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 38 +++++++--- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.h | 4 ++ drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 4 ++ .../net/ethernet/mellanox/mlxsw/spectrum_qdisc.c | 7 ++ drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 3 + drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c | 2 +- drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h | 2 + drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 3 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 16 ++++- drivers/net/gtp.c | 5 +- drivers/net/hyperv/hyperv_net.h | 3 +- drivers/net/hyperv/netvsc_drv.c | 4 +- drivers/net/hyperv/rndis_filter.c | 10 ++- drivers/net/macvlan.c | 2 +- drivers/net/usb/lan78xx.c | 11 ++- drivers/net/vxlan.c | 4 +- drivers/pci/switch/switchtec.c | 4 +- drivers/regulator/core.c | 4 +- drivers/regulator/rn5t618-regulator.c | 1 + drivers/s390/block/dasd_eckd.c | 28 ++------ drivers/s390/cio/device_ops.c | 2 +- drivers/spi/spi-cavium-thunderx.c | 2 + drivers/spi/spi-ti-qspi.c | 6 +- drivers/usb/core/config.c | 70 +++++++++++++++---- drivers/usb/core/hub.c | 2 +- drivers/usb/dwc3/gadget.c | 7 ++ drivers/usb/gadget/udc/dummy_hcd.c | 10 +-- drivers/usb/serial/option.c | 2 + fs/btrfs/qgroup.c | 4 +- fs/drop_caches.c | 2 +- fs/inode.c | 7 ++ fs/notify/fsnotify.c | 1 + fs/quota/dquot.c | 1 + include/linux/if_ether.h | 8 +++ include/uapi/linux/netfilter/xt_sctp.h | 6 +- kernel/bpf/verifier.c | 9 ++- kernel/locking/spinlock_debug.c | 32 ++++----- net/8021q/vlan.h | 1 + net/8021q/vlan_dev.c | 3 +- net/8021q/vlan_netlink.c | 19 +++-- net/core/filter.c | 1 + net/ipv4/tcp_input.c | 5 +- net/llc/llc_station.c | 4 +- net/netfilter/nf_conntrack_netlink.c | 3 + net/netfilter/nf_tables_api.c | 16 +++-- net/netfilter/nft_bitwise.c | 4 +- net/netfilter/nft_cmp.c | 6 ++ net/netfilter/nft_range.c | 10 +++ net/netfilter/nft_set_rbtree.c | 21 ++++-- net/rfkill/core.c | 7 +- net/sched/sch_cake.c | 2 +- net/sched/sch_fq.c | 6 +- net/sched/sch_prio.c | 10 ++- net/sctp/sm_sideeffect.c | 28 +++++--- samples/bpf/syscall_tp_kern.c | 18 ++++- samples/bpf/trace_event_user.c | 4 +- scripts/kconfig/expr.c | 7 ++ sound/soc/codecs/max98090.c | 8 +-- sound/soc/codecs/max98090.h | 1 - sound/soc/codecs/wm8962.c | 4 +- sound/soc/intel/boards/bytcr_rt5640.c | 8 ++- sound/soc/soc-topology.c | 8 ++- tools/lib/traceevent/Makefile | 1 + .../ftrace/test.d/kprobe/multiple_kprobes.tc | 6 +- 94 files changed, 543 insertions(+), 265 deletions(-) create mode 100644 arch/s390/purgatory/string.c -- 1.8.3

1 83

[PATCH] block: fix use-after-free on cached last_lookup partition
by Yang Yingliang 16 Jan '20

16 Jan '20

From: Yufen Yu <yuyufen(a)huawei.com> hulk inclusion category: bugfix bugzilla: 27962 CVE: NA --------------------------- delete_partition() clears the cached last_lookup partition. However the .last_lookup cache may be overwritten by one IO path after it is cleared from delete_partition(). Then another IO path may use the cached deleting partition after __delete_partition() is called, then use-after-free is triggered on the cached partition. Fixes the issue by the following approach: 1) always get the partition's refcount via hd_struct_try_get() before setting .last_lookup 2) move clearing .last_lookup from delete_partition() to __delete_partition() which is release handle of the partition's percpu-refcount, so that no IO path can overwrite .last_lookup after it is cleared in __delete_partition(). It is one candidate approach of Yufen's patch[1] which adds overhead in fast path by indirect lookup which may introduce one extra cacheline in IO path. Also this patch relies on percpu-refcount's protection, and it is easier to understand and verify. [1] https://lore.kernel.org/linux-block/20200109013551.GB9655@ming.t460p/T/#t Reported-by: Yufen Yu <yuyufen(a)huawei.com> Cc: Christoph Hellwig <hch(a)infradead.org> Cc: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Conflict: include/linux/genhd.h block/blk-core.c Signed-off-by: Yufen Yu <yuyufen(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-core.c | 12 ------------ block/genhd.c | 6 +++++- block/partition-generic.c | 10 +++++++++- include/linux/genhd.h | 1 + 4 files changed, 15 insertions(+), 14 deletions(-) diff --git a/block/blk-core.c b/block/blk-core.c index dcf1ab0..a52a2f5 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -2788,18 +2788,6 @@ void blk_account_io_start(struct request *rq, bool new_io) part_stat_inc(cpu, part, merges[rw]); } else { part = disk_map_sector_rcu(rq->rq_disk, blk_rq_pos(rq)); - if (!hd_struct_try_get(part)) { - /* - * The partition is already being removed, - * the request will be accounted on the disk only - * - * We take a reference on disk->part0 although that - * partition will never be deleted, so we can treat - * it as any other partition. - */ - part = &rq->rq_disk->part0; - hd_struct_get(part); - } part_round_stats(rq->q, cpu, part); part_inc_in_flight(rq->q, part, rw); rq->part = part; diff --git a/block/genhd.c b/block/genhd.c index 6e8543c..ff9d46d 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -272,17 +272,21 @@ struct hd_struct *disk_map_sector_rcu(struct gendisk *disk, sector_t sector) ptbl = rcu_dereference(disk->part_tbl); part = rcu_dereference(ptbl->last_lookup); - if (part && sector_in_part(part, sector)) + if (part && sector_in_part(part, sector) && hd_struct_try_get(part)) return part; for (i = 1; i < ptbl->len; i++) { part = rcu_dereference(ptbl->part[i]); if (part && sector_in_part(part, sector)) { + if (!hd_struct_try_get(part)) + goto exit; rcu_assign_pointer(ptbl->last_lookup, part); return part; } } + exit: + hd_struct_get(&disk->part0); return &disk->part0; } EXPORT_SYMBOL_GPL(disk_map_sector_rcu); diff --git a/block/partition-generic.c b/block/partition-generic.c index 98d60a5..8ad6dca 100644 --- a/block/partition-generic.c +++ b/block/partition-generic.c @@ -263,6 +263,12 @@ static void delete_partition_work_fn(struct work_struct *work) void __delete_partition(struct percpu_ref *ref) { struct hd_struct *part = container_of(ref, struct hd_struct, ref); + struct disk_part_tbl *ptbl = + rcu_dereference_protected(part->disk->part_tbl, 1); + + rcu_assign_pointer(ptbl->last_lookup, NULL); + put_device(disk_to_dev(part->disk)); + INIT_RCU_WORK(&part->rcu_work, delete_partition_work_fn); queue_rcu_work(system_wq, &part->rcu_work); } @@ -284,8 +290,9 @@ void delete_partition(struct gendisk *disk, int partno) if (!part) return; + get_device(disk_to_dev(disk)); rcu_assign_pointer(ptbl->part[partno], NULL); - rcu_assign_pointer(ptbl->last_lookup, NULL); + kobject_put(part->holder_dir); device_del(part_to_dev(part)); @@ -350,6 +357,7 @@ struct hd_struct *add_partition(struct gendisk *disk, int partno, p->nr_sects = len; p->partno = partno; p->policy = get_disk_ro(disk); + p->disk = disk; if (info) { struct partition_meta_info *pinfo = alloc_part_info(disk); diff --git a/include/linux/genhd.h b/include/linux/genhd.h index be6fe1e..df0d01d 100644 --- a/include/linux/genhd.h +++ b/include/linux/genhd.h @@ -129,6 +129,7 @@ struct hd_struct { struct disk_stats dkstats; #endif struct percpu_ref ref; + struct gendisk *disk; struct rcu_work rcu_work; KABI_RESERVE(1) -- 1.8.3

1 0