- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
by Zeng Heng 15 Jul '24

15 Jul '24

From: Raju Rangoju <Raju.Rangoju(a)amd.com> stable inclusion from stable-v6.6.36 commit 434c6b924e1f4c219aab2d9e05fe79c5364e37d3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD09L CVE: CVE-2024-40984 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a83e1385b780d41307433ddbc86e3c528db031f0 ] Undo the modifications made in commit d410ee5109a1 ("ACPICA: avoid "Info: mapping multiple BARs. Your kernel is fine.""). The initial purpose of this commit was to stop memory mappings for operation regions from overlapping page boundaries, as it can trigger warnings if different page attributes are present. However, it was found that when this situation arises, mapping continues until the boundary's end, but there is still an attempt to read/write the entire length of the map, leading to a NULL pointer deference. For example, if a four-byte mapping request is made but only one byte is mapped because it hits the current page boundary's end, a four-byte read/write attempt is still made, resulting in a NULL pointer deference. Instead, map the entire length, as the ACPI specification does not mandate that it must be within the same page boundary. It is permissible for it to be mapped across different regions. Link: https://github.com/acpica/acpica/pull/954 Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218849 Fixes: d410ee5109a1 ("ACPICA: avoid "Info: mapping multiple BARs. Your kernel is fine."") Co-developed-by: Sanath S <Sanath.S(a)amd.com> Signed-off-by: Sanath S <Sanath.S(a)amd.com> Signed-off-by: Raju Rangoju <Raju.Rangoju(a)amd.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/acpi/acpica/exregion.c | 23 ++--------------------- 1 file changed, 2 insertions(+), 21 deletions(-) diff --git a/drivers/acpi/acpica/exregion.c b/drivers/acpi/acpica/exregion.c index 8907b8bf4267..c49b9f8de723 100644 --- a/drivers/acpi/acpica/exregion.c +++ b/drivers/acpi/acpica/exregion.c @@ -44,7 +44,6 @@ acpi_ex_system_memory_space_handler(u32 function, struct acpi_mem_mapping *mm = mem_info->cur_mm; u32 length; acpi_size map_length; - acpi_size page_boundary_map_length; #ifdef ACPI_MISALIGNMENT_NOT_SUPPORTED u32 remainder; #endif @@ -138,26 +137,8 @@ acpi_ex_system_memory_space_handler(u32 function, map_length = (acpi_size) ((mem_info->address + mem_info->length) - address); - /* - * If mapping the entire remaining portion of the region will cross - * a page boundary, just map up to the page boundary, do not cross. - * On some systems, crossing a page boundary while mapping regions - * can cause warnings if the pages have different attributes - * due to resource management. - * - * This has the added benefit of constraining a single mapping to - * one page, which is similar to the original code that used a 4k - * maximum window. - */ - page_boundary_map_length = (acpi_size) - (ACPI_ROUND_UP(address, ACPI_DEFAULT_PAGE_SIZE) - address); - if (page_boundary_map_length == 0) { - page_boundary_map_length = ACPI_DEFAULT_PAGE_SIZE; - } - - if (map_length > page_boundary_map_length) { - map_length = page_boundary_map_length; - } + if (map_length > ACPI_DEFAULT_PAGE_SIZE) + map_length = ACPI_DEFAULT_PAGE_SIZE; /* Create a new mapping starting at the address given */ -- 2.25.1

2 1

[PATCH OLK-6.6 1/1] kvm: add coda feature
by l00500167 15 Jul '24

15 Jul '24

virtCCA feature Signed-off-by: l00500167 <lijunbin4(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ include/linux/iommu.h | 4 +++- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h index 859d21729..0f2acb4ed 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h @@ -625,6 +625,9 @@ struct arm_smmu_strtab_l1_desc { struct arm_smmu_ste *l2ptr; dma_addr_t l2ptr_dma; +#ifdef CONFIG_CVM_HOST + bool is_sync; +#endif }; struct arm_smmu_ctx_desc { @@ -750,6 +753,12 @@ struct arm_smmu_device { struct mutex streams_mutex; bool bypass; +#ifdef CONFIG_CVM_HOST + int s_evtq_irq; + int s_gerr_irq; + resource_size_t ioaddr; + uint64_t id; +#endif }; struct arm_smmu_stream { @@ -802,6 +811,11 @@ struct arm_smmu_domain { spinlock_t devices_lock; struct list_head mmu_notifiers; +#ifdef CONFIG_CVM_HOST + bool secure; + struct list_head node; + struct kvm *kvm; +#endif }; static inline struct arm_smmu_domain *to_smmu_domain(struct iommu_domain *dom) diff --git a/include/linux/iommu.h b/include/linux/iommu.h index 1d70dd0d0..840a3b89f 100644 --- a/include/linux/iommu.h +++ b/include/linux/iommu.h @@ -635,7 +635,9 @@ struct iommu_ops { struct iommu_domain *blocked_domain; struct iommu_domain *default_domain; - KABI_RESERVE(1) +#ifdef CONFIG_CVM_HOST + int (*iommu_enable_secure)(struct iommu_domain *domain); +#endif KABI_RESERVE(2) KABI_RESERVE(3) KABI_RESERVE(4) -- 2.25.1

2 1

[PATCH OLK-6.6 1/1] kvm: add coda feature
by l00500167 15 Jul '24

15 Jul '24

virtcca feature Signed-off-by: l00500167 <lijunbin4(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ include/linux/iommu.h | 4 +++- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h index 859d21729..0f2acb4ed 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h @@ -625,6 +625,9 @@ struct arm_smmu_strtab_l1_desc { struct arm_smmu_ste *l2ptr; dma_addr_t l2ptr_dma; +#ifdef CONFIG_CVM_HOST + bool is_sync; +#endif }; struct arm_smmu_ctx_desc { @@ -750,6 +753,12 @@ struct arm_smmu_device { struct mutex streams_mutex; bool bypass; +#ifdef CONFIG_CVM_HOST + int s_evtq_irq; + int s_gerr_irq; + resource_size_t ioaddr; + uint64_t id; +#endif }; struct arm_smmu_stream { @@ -802,6 +811,11 @@ struct arm_smmu_domain { spinlock_t devices_lock; struct list_head mmu_notifiers; +#ifdef CONFIG_CVM_HOST + bool secure; + struct list_head node; + struct kvm *kvm; +#endif }; static inline struct arm_smmu_domain *to_smmu_domain(struct iommu_domain *dom) diff --git a/include/linux/iommu.h b/include/linux/iommu.h index 1d70dd0d0..840a3b89f 100644 --- a/include/linux/iommu.h +++ b/include/linux/iommu.h @@ -635,7 +635,9 @@ struct iommu_ops { struct iommu_domain *blocked_domain; struct iommu_domain *default_domain; - KABI_RESERVE(1) +#ifdef CONFIG_CVM_HOST + int (*iommu_enable_secure)(struct iommu_domain *domain); +#endif KABI_RESERVE(2) KABI_RESERVE(3) KABI_RESERVE(4) -- 2.25.1

2 1

[PATCH OLK-6.6 1/1] kvm: add coda feature
by l00500167 15 Jul '24

15 Jul '24

virtcca coda feature Signed-off-by: l00500167 <lijunbin4(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ include/linux/iommu.h | 4 +++- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h index 859d21729..0f2acb4ed 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h @@ -625,6 +625,9 @@ struct arm_smmu_strtab_l1_desc { struct arm_smmu_ste *l2ptr; dma_addr_t l2ptr_dma; +#ifdef CONFIG_CVM_HOST + bool is_sync; +#endif }; struct arm_smmu_ctx_desc { @@ -750,6 +753,12 @@ struct arm_smmu_device { struct mutex streams_mutex; bool bypass; +#ifdef CONFIG_CVM_HOST + int s_evtq_irq; + int s_gerr_irq; + resource_size_t ioaddr; + uint64_t id; +#endif }; struct arm_smmu_stream { @@ -802,6 +811,11 @@ struct arm_smmu_domain { spinlock_t devices_lock; struct list_head mmu_notifiers; +#ifdef CONFIG_CVM_HOST + bool secure; + struct list_head node; + struct kvm *kvm; +#endif }; static inline struct arm_smmu_domain *to_smmu_domain(struct iommu_domain *dom) diff --git a/include/linux/iommu.h b/include/linux/iommu.h index 1d70dd0d0..840a3b89f 100644 --- a/include/linux/iommu.h +++ b/include/linux/iommu.h @@ -635,7 +635,9 @@ struct iommu_ops { struct iommu_domain *blocked_domain; struct iommu_domain *default_domain; - KABI_RESERVE(1) +#ifdef CONFIG_CVM_HOST + int (*iommu_enable_secure)(struct iommu_domain *domain); +#endif KABI_RESERVE(2) KABI_RESERVE(3) KABI_RESERVE(4) -- 2.25.1

2 1

[PATCH OLK-6.6] kvm: add coda feature
by l00500167 15 Jul '24

15 Jul '24

virtcca feature Signed-off-by: l00500167 <lijunbin4(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ include/linux/iommu.h | 3 +++ 2 files changed, 17 insertions(+) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h index 859d21729..0f2acb4ed 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h @@ -625,6 +625,9 @@ struct arm_smmu_strtab_l1_desc { struct arm_smmu_ste *l2ptr; dma_addr_t l2ptr_dma; +#ifdef CONFIG_CVM_HOST + bool is_sync; +#endif }; struct arm_smmu_ctx_desc { @@ -750,6 +753,12 @@ struct arm_smmu_device { struct mutex streams_mutex; bool bypass; +#ifdef CONFIG_CVM_HOST + int s_evtq_irq; + int s_gerr_irq; + resource_size_t ioaddr; + uint64_t id; +#endif }; struct arm_smmu_stream { @@ -802,6 +811,11 @@ struct arm_smmu_domain { spinlock_t devices_lock; struct list_head mmu_notifiers; +#ifdef CONFIG_CVM_HOST + bool secure; + struct list_head node; + struct kvm *kvm; +#endif }; static inline struct arm_smmu_domain *to_smmu_domain(struct iommu_domain *dom) diff --git a/include/linux/iommu.h b/include/linux/iommu.h index 1d70dd0d0..e3186fbd4 100644 --- a/include/linux/iommu.h +++ b/include/linux/iommu.h @@ -635,6 +635,9 @@ struct iommu_ops { struct iommu_domain *blocked_domain; struct iommu_domain *default_domain; +#ifdef CONFIG_CVM_HOST + int (*iommu_enable_secure)(struct iommu_domain *domain); +#endif - KABI_RESERVE(1) KABI_RESERVE(2) KABI_RESERVE(3) -- 2.25.1

2 2

[PATCH OLK-6.6] f2fs: remove clear SB_INLINECRYPT flag in default_options
by Yifan Qiao 15 Jul '24

15 Jul '24

From: Yunlei He <heyunlei(a)oppo.com> stable inclusion from stable-v6.6.36 commit eddeb8d941d5be11a9da5637dbe81ac37e8449a2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACZZP CVE: CVE-2024-40971 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ac5eecf481c29942eb9a862e758c0c8b68090c33 ] In f2fs_remount, SB_INLINECRYPT flag will be clear and re-set. If create new file or open file during this gap, these files will not use inlinecrypt. Worse case, it may lead to data corruption if wrappedkey_v0 is enable. Thread A: Thread B: -f2fs_remount -f2fs_file_open or f2fs_new_inode -default_options <- clear SB_INLINECRYPT flag -fscrypt_select_encryption_impl -parse_options <- set SB_INLINECRYPT again Signed-off-by: Yunlei He <heyunlei(a)oppo.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/f2fs/super.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index b1a239f3eb66..534d8bb1f26c 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -2186,8 +2186,6 @@ static void default_options(struct f2fs_sb_info *sbi, bool remount) F2FS_OPTION(sbi).memory_mode = MEMORY_MODE_NORMAL; F2FS_OPTION(sbi).errors = MOUNT_ERRORS_CONTINUE; - sbi->sb->s_flags &= ~SB_INLINECRYPT; - set_opt(sbi, INLINE_XATTR); set_opt(sbi, INLINE_DATA); set_opt(sbi, INLINE_DENTRY); -- 2.39.2

2 1

[PATCH OLK-5.10] f2fs: remove clear SB_INLINECRYPT flag in default_options
by Yifan Qiao 15 Jul '24

15 Jul '24

From: Yunlei He <heyunlei(a)oppo.com> stable inclusion from stable-v5.10.221 commit 38a82c8d00638bb642bef787eb1d5e0e4d3b7d71 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACZZP CVE: CVE-2024-40971 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ac5eecf481c29942eb9a862e758c0c8b68090c33 ] In f2fs_remount, SB_INLINECRYPT flag will be clear and re-set. If create new file or open file during this gap, these files will not use inlinecrypt. Worse case, it may lead to data corruption if wrappedkey_v0 is enable. Thread A: Thread B: -f2fs_remount -f2fs_file_open or f2fs_new_inode -default_options <- clear SB_INLINECRYPT flag -fscrypt_select_encryption_impl -parse_options <- set SB_INLINECRYPT again Signed-off-by: Yunlei He <heyunlei(a)oppo.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/f2f2/super.c [Context differences] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/f2fs/super.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index 6a214366970c..daa31574acfb 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -1713,8 +1713,6 @@ static void default_options(struct f2fs_sb_info *sbi) F2FS_OPTION(sbi).compress_ext_cnt = 0; F2FS_OPTION(sbi).bggc_mode = BGGC_MODE_ON; - sbi->sb->s_flags &= ~SB_INLINECRYPT; - set_opt(sbi, INLINE_XATTR); set_opt(sbi, INLINE_DATA); set_opt(sbi, INLINE_DENTRY); -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] f2fs: remove clear SB_INLINECRYPT flag in default_options
by Yifan Qiao 15 Jul '24

15 Jul '24

From: Yunlei He <heyunlei(a)oppo.com> stable inclusion from stable-v5.10.221 commit 38a82c8d00638bb642bef787eb1d5e0e4d3b7d71 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACZZP CVE: CVE-2024-40971 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ac5eecf481c29942eb9a862e758c0c8b68090c33 ] In f2fs_remount, SB_INLINECRYPT flag will be clear and re-set. If create new file or open file during this gap, these files will not use inlinecrypt. Worse case, it may lead to data corruption if wrappedkey_v0 is enable. Thread A: Thread B: -f2fs_remount -f2fs_file_open or f2fs_new_inode -default_options <- clear SB_INLINECRYPT flag -fscrypt_select_encryption_impl -parse_options <- set SB_INLINECRYPT again Signed-off-by: Yunlei He <heyunlei(a)oppo.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/f2f2/super.c [Context differences] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/f2fs/super.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index fba413ced982..565289233b3b 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -1714,8 +1714,6 @@ static void default_options(struct f2fs_sb_info *sbi) F2FS_OPTION(sbi).compress_ext_cnt = 0; F2FS_OPTION(sbi).bggc_mode = BGGC_MODE_ON; - sbi->sb->s_flags &= ~SB_INLINECRYPT; - set_opt(sbi, INLINE_XATTR); set_opt(sbi, INLINE_DATA); set_opt(sbi, INLINE_DENTRY); -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] f2fs: remove clear SB_INLINECRYPT flag in default_options
by Yifan Qiao 15 Jul '24

15 Jul '24

From: Yunlei He <heyunlei(a)oppo.com> stable inclusion from stable-v5.10.221 commit 38a82c8d00638bb642bef787eb1d5e0e4d3b7d71 category: bugfix bugzilla: 190178 CVE: CVE-2024-40971 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ac5eecf481c29942eb9a862e758c0c8b68090c33 ] In f2fs_remount, SB_INLINECRYPT flag will be clear and re-set. If create new file or open file during this gap, these files will not use inlinecrypt. Worse case, it may lead to data corruption if wrappedkey_v0 is enable. Thread A: Thread B: -f2fs_remount -f2fs_file_open or f2fs_new_inode -default_options <- clear SB_INLINECRYPT flag -fscrypt_select_encryption_impl -parse_options <- set SB_INLINECRYPT again Signed-off-by: Yunlei He <heyunlei(a)oppo.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/f2f2/super.c [Context differences] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/f2fs/super.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index fba413ced982..565289233b3b 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -1714,8 +1714,6 @@ static void default_options(struct f2fs_sb_info *sbi) F2FS_OPTION(sbi).compress_ext_cnt = 0; F2FS_OPTION(sbi).bggc_mode = BGGC_MODE_ON; - sbi->sb->s_flags &= ~SB_INLINECRYPT; - set_opt(sbi, INLINE_XATTR); set_opt(sbi, INLINE_DATA); set_opt(sbi, INLINE_DENTRY); -- 2.39.2

2 1

[PATCH OLK-6.6] ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists()
by Yifan Qiao 15 Jul '24

15 Jul '24

From: Baokun Li <libaokun1(a)huawei.com> stable inclusion from stable-v6.6.36 commit 677ff4589f1501578fa903a25bb14831d0607992 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD018 CVE: CVE-2024-40955 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 13df4d44a3aaabe61cd01d277b6ee23ead2a5206 upstream. We can trigger a slab-out-of-bounds with the following commands: mkfs.ext4 -F /dev/$disk 10G mount /dev/$disk /tmp/test echo 2147483647 > /sys/fs/ext4/$disk/mb_group_prealloc echo test > /tmp/test/file && sync ================================================================== BUG: KASAN: slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4] Read of size 8 at addr ffff888121b9d0f0 by task kworker/u2:0/11 CPU: 0 PID: 11 Comm: kworker/u2:0 Tainted: GL 6.7.0-next-20240118 #521 Call Trace: dump_stack_lvl+0x2c/0x50 kasan_report+0xb6/0xf0 ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4] ext4_mb_regular_allocator+0x19e9/0x2370 [ext4] ext4_mb_new_blocks+0x88a/0x1370 [ext4] ext4_ext_map_blocks+0x14f7/0x2390 [ext4] ext4_map_blocks+0x569/0xea0 [ext4] ext4_do_writepages+0x10f6/0x1bc0 [ext4] [...] ================================================================== The flow of issue triggering is as follows: // Set s_mb_group_prealloc to 2147483647 via sysfs ext4_mb_new_blocks ext4_mb_normalize_request ext4_mb_normalize_group_request ac->ac_g_ex.fe_len = EXT4_SB(sb)->s_mb_group_prealloc ext4_mb_regular_allocator ext4_mb_choose_next_group ext4_mb_choose_next_group_best_avail mb_avg_fragment_size_order order = fls(len) - 2 = 29 ext4_mb_find_good_group_avg_frag_lists frag_list = &sbi->s_mb_avg_fragment_size[order] if (list_empty(frag_list)) // Trigger SOOB! At 4k block size, the length of the s_mb_avg_fragment_size list is 14, but an oversized s_mb_group_prealloc is set, causing slab-out-of-bounds to be triggered by an attempt to access an element at index 29. Add a new attr_id attr_clusters_in_group with values in the range [0, sbi->s_clusters_per_group] and declare mb_group_prealloc as that type to fix the issue. In addition avoid returning an order from mb_avg_fragment_size_order() greater than MB_NUM_ORDERS(sb) and reduce some useless loops. Fixes: 7e170922f06b ("ext4: Add allocation criteria 1.5 (CR1_5)") CC: stable(a)vger.kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240319113325.3110393-5-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ext4/mballoc.c | 4 ++++ fs/ext4/sysfs.c | 13 ++++++++++++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index f6e02978d0e6..9a65cdcc6417 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -834,6 +834,8 @@ static int mb_avg_fragment_size_order(struct super_block *sb, ext4_grpblk_t len) return 0; if (order == MB_NUM_ORDERS(sb)) order--; + if (WARN_ON_ONCE(order > MB_NUM_ORDERS(sb))) + order = MB_NUM_ORDERS(sb) - 1; return order; } @@ -1011,6 +1013,8 @@ static void ext4_mb_choose_next_group_best_avail(struct ext4_allocation_context * goal length. */ order = fls(ac->ac_g_ex.fe_len) - 1; + if (WARN_ON_ONCE(order - 1 > MB_NUM_ORDERS(ac->ac_sb))) + order = MB_NUM_ORDERS(ac->ac_sb); min_order = order - sbi->s_mb_best_avail_max_trim_order; if (min_order < 0) min_order = 0; diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c index 6d332dff79dd..5f3df2931643 100644 --- a/fs/ext4/sysfs.c +++ b/fs/ext4/sysfs.c @@ -29,6 +29,7 @@ typedef enum { attr_trigger_test_error, attr_first_error_time, attr_last_error_time, + attr_clusters_in_group, attr_feature, attr_pointer_ui, attr_pointer_ul, @@ -207,13 +208,14 @@ EXT4_ATTR_FUNC(sra_exceeded_retry_limit, 0444); EXT4_ATTR_OFFSET(inode_readahead_blks, 0644, inode_readahead, ext4_sb_info, s_inode_readahead_blks); +EXT4_ATTR_OFFSET(mb_group_prealloc, 0644, clusters_in_group, + ext4_sb_info, s_mb_group_prealloc); EXT4_RW_ATTR_SBI_UI(inode_goal, s_inode_goal); EXT4_RW_ATTR_SBI_UI(mb_stats, s_mb_stats); EXT4_RW_ATTR_SBI_UI(mb_max_to_scan, s_mb_max_to_scan); EXT4_RW_ATTR_SBI_UI(mb_min_to_scan, s_mb_min_to_scan); EXT4_RW_ATTR_SBI_UI(mb_order2_req, s_mb_order2_reqs); EXT4_RW_ATTR_SBI_UI(mb_stream_req, s_mb_stream_request); -EXT4_RW_ATTR_SBI_UI(mb_group_prealloc, s_mb_group_prealloc); EXT4_RW_ATTR_SBI_UI(mb_max_linear_groups, s_mb_max_linear_groups); EXT4_RW_ATTR_SBI_UI(extent_max_zeroout_kb, s_extent_max_zeroout_kb); EXT4_ATTR(trigger_fs_error, 0200, trigger_test_error); @@ -392,6 +394,7 @@ static ssize_t ext4_attr_show(struct kobject *kobj, (unsigned long long) percpu_counter_sum(&sbi->s_sra_exceeded_retry_limit)); case attr_inode_readahead: + case attr_clusters_in_group: case attr_pointer_ui: if (!ptr) return 0; @@ -468,6 +471,14 @@ static ssize_t ext4_attr_store(struct kobject *kobj, else *((unsigned int *) ptr) = t; return len; + case attr_clusters_in_group: + ret = kstrtouint(skip_spaces(buf), 0, &t); + if (ret) + return ret; + if (t > sbi->s_clusters_per_group) + return -EINVAL; + *((unsigned int *) ptr) = t; + return len; case attr_pointer_ul: if (!ptr) return 0; -- 2.39.2

2 1