Fixes for 5.10

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-5.10/jffs2-allow-setting-rp_size-to-zero-during-remountin.patch b/queue-5.10/jffs2-allow-setting-rp_size-to-zero-during-remountin.patch
new file mode 100644 (file)
index 0000000..addd7e7
--- /dev/null
+++ b/queue-5.10/jffs2-allow-setting-rp_size-to-zero-during-remountin.patch
@@ -0,0 +1,74 @@
+From 5254cd2947a0f127ba4a4a3d8d6df2f557f9caa5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Oct 2020 14:54:43 +0800
+Subject: jffs2: Allow setting rp_size to zero during remounting
+
+From: lizhe <lizhe67@huawei.com>
+
+[ Upstream commit cd3ed3c73ac671ff6b0230ccb72b8300292d3643 ]
+
+Set rp_size to zero will be ignore during remounting.
+
+The method to identify whether we input a remounting option of
+rp_size is to check if the rp_size input is zero. It can not work
+well if we pass "rp_size=0".
+
+This patch add a bool variable "set_rp_size" to fix this problem.
+
+Reported-by: Jubin Zhong <zhongjubin@huawei.com>
+Signed-off-by: lizhe <lizhe67@huawei.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jffs2/jffs2_fs_sb.h | 1 +
+ fs/jffs2/super.c       | 7 +++++--
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/jffs2/jffs2_fs_sb.h b/fs/jffs2/jffs2_fs_sb.h
+index 778275f48a879..5a7091746f68b 100644
+--- a/fs/jffs2/jffs2_fs_sb.h
++++ b/fs/jffs2/jffs2_fs_sb.h
+@@ -38,6 +38,7 @@ struct jffs2_mount_opts {
+        * users. This is implemented simply by means of not allowing the
+        * latter users to write to the file system if the amount if the
+        * available space is less then 'rp_size'. */
++      bool set_rp_size;
+       unsigned int rp_size;
+ };
+ 
+diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
+index 4fd297bdf0f3f..c523adaca79f3 100644
+--- a/fs/jffs2/super.c
++++ b/fs/jffs2/super.c
+@@ -88,7 +88,7 @@ static int jffs2_show_options(struct seq_file *s, struct dentry *root)
+ 
+       if (opts->override_compr)
+               seq_printf(s, ",compr=%s", jffs2_compr_name(opts->compr));
+-      if (opts->rp_size)
++      if (opts->set_rp_size)
+               seq_printf(s, ",rp_size=%u", opts->rp_size / 1024);
+ 
+       return 0;
+@@ -206,6 +206,7 @@ static int jffs2_parse_param(struct fs_context *fc, struct fs_parameter *param)
+               if (opt > c->mtd->size)
+                       return invalf(fc, "jffs2: Too large reserve pool specified, max is %llu KB",
+                                     c->mtd->size / 1024);
++              c->mount_opts.set_rp_size = true;
+               c->mount_opts.rp_size = opt;
+               break;
+       default:
+@@ -225,8 +226,10 @@ static inline void jffs2_update_mount_opts(struct fs_context *fc)
+               c->mount_opts.override_compr = new_c->mount_opts.override_compr;
+               c->mount_opts.compr = new_c->mount_opts.compr;
+       }
+-      if (new_c->mount_opts.rp_size)
++      if (new_c->mount_opts.set_rp_size) {
++              c->mount_opts.set_rp_size = new_c->mount_opts.set_rp_size;
+               c->mount_opts.rp_size = new_c->mount_opts.rp_size;
++      }
+       mutex_unlock(&c->alloc_sem);
+ }
+ 
+-- 
+2.27.0
+

diff --git a/queue-5.10/jffs2-fix-null-pointer-dereference-in-rp_size-fs-opt.patch b/queue-5.10/jffs2-fix-null-pointer-dereference-in-rp_size-fs-opt.patch
new file mode 100644 (file)
index 0000000..217c9c2
--- /dev/null
+++ b/queue-5.10/jffs2-fix-null-pointer-dereference-in-rp_size-fs-opt.patch
@@ -0,0 +1,114 @@
+From 13970e461e8c1e878d1dbf52f018327e3f251f1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Oct 2020 14:12:04 +0100
+Subject: jffs2: Fix NULL pointer dereference in rp_size fs option parsing
+
+From: Jamie Iles <jamie@nuviainc.com>
+
+[ Upstream commit a61df3c413e49b0042f9caf774c58512d1cc71b7 ]
+
+syzkaller found the following JFFS2 splat:
+
+  Unable to handle kernel paging request at virtual address dfffa00000000001
+  Mem abort info:
+    ESR = 0x96000004
+    EC = 0x25: DABT (current EL), IL = 32 bits
+    SET = 0, FnV = 0
+    EA = 0, S1PTW = 0
+  Data abort info:
+    ISV = 0, ISS = 0x00000004
+    CM = 0, WnR = 0
+  [dfffa00000000001] address between user and kernel address ranges
+  Internal error: Oops: 96000004 [#1] SMP
+  Dumping ftrace buffer:
+     (ftrace buffer empty)
+  Modules linked in:
+  CPU: 0 PID: 12745 Comm: syz-executor.5 Tainted: G S                5.9.0-rc8+ #98
+  Hardware name: linux,dummy-virt (DT)
+  pstate: 20400005 (nzCv daif +PAN -UAO BTYPE=--)
+  pc : jffs2_parse_param+0x138/0x308 fs/jffs2/super.c:206
+  lr : jffs2_parse_param+0x108/0x308 fs/jffs2/super.c:205
+  sp : ffff000022a57910
+  x29: ffff000022a57910 x28: 0000000000000000
+  x27: ffff000057634008 x26: 000000000000d800
+  x25: 000000000000d800 x24: ffff0000271a9000
+  x23: ffffa0001adb5dc0 x22: ffff000023fdcf00
+  x21: 1fffe0000454af2c x20: ffff000024cc9400
+  x19: 0000000000000000 x18: 0000000000000000
+  x17: 0000000000000000 x16: ffffa000102dbdd0
+  x15: 0000000000000000 x14: ffffa000109e44bc
+  x13: ffffa00010a3a26c x12: ffff80000476e0b3
+  x11: 1fffe0000476e0b2 x10: ffff80000476e0b2
+  x9 : ffffa00010a3ad60 x8 : ffff000023b70593
+  x7 : 0000000000000003 x6 : 00000000f1f1f1f1
+  x5 : ffff000023fdcf00 x4 : 0000000000000002
+  x3 : ffffa00010000000 x2 : 0000000000000001
+  x1 : dfffa00000000000 x0 : 0000000000000008
+  Call trace:
+   jffs2_parse_param+0x138/0x308 fs/jffs2/super.c:206
+   vfs_parse_fs_param+0x234/0x4e8 fs/fs_context.c:117
+   vfs_parse_fs_string+0xe8/0x148 fs/fs_context.c:161
+   generic_parse_monolithic+0x17c/0x208 fs/fs_context.c:201
+   parse_monolithic_mount_data+0x7c/0xa8 fs/fs_context.c:649
+   do_new_mount fs/namespace.c:2871 [inline]
+   path_mount+0x548/0x1da8 fs/namespace.c:3192
+   do_mount+0x124/0x138 fs/namespace.c:3205
+   __do_sys_mount fs/namespace.c:3413 [inline]
+   __se_sys_mount fs/namespace.c:3390 [inline]
+   __arm64_sys_mount+0x164/0x238 fs/namespace.c:3390
+   __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
+   invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
+   el0_svc_common.constprop.0+0x15c/0x598 arch/arm64/kernel/syscall.c:149
+   do_el0_svc+0x60/0x150 arch/arm64/kernel/syscall.c:195
+   el0_svc+0x34/0xb0 arch/arm64/kernel/entry-common.c:226
+   el0_sync_handler+0xc8/0x5b4 arch/arm64/kernel/entry-common.c:236
+   el0_sync+0x15c/0x180 arch/arm64/kernel/entry.S:663
+  Code: d2d40001 f2fbffe1 91002260 d343fc02 (38e16841)
+  ---[ end trace 4edf690313deda44 ]---
+
+This is because since ec10a24f10c8, the option parsing happens before
+fill_super and so the MTD device isn't associated with the filesystem.
+Defer the size check until there is a valid association.
+
+Fixes: ec10a24f10c8 ("vfs: Convert jffs2 to use the new mount API")
+Cc: <stable@vger.kernel.org>
+Cc: David Howells <dhowells@redhat.com>
+Signed-off-by: Jamie Iles <jamie@nuviainc.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jffs2/super.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
+index c523adaca79f3..81ca58c10b728 100644
+--- a/fs/jffs2/super.c
++++ b/fs/jffs2/super.c
+@@ -202,12 +202,8 @@ static int jffs2_parse_param(struct fs_context *fc, struct fs_parameter *param)
+       case Opt_rp_size:
+               if (result.uint_32 > UINT_MAX / 1024)
+                       return invalf(fc, "jffs2: rp_size unrepresentable");
+-              opt = result.uint_32 * 1024;
+-              if (opt > c->mtd->size)
+-                      return invalf(fc, "jffs2: Too large reserve pool specified, max is %llu KB",
+-                                    c->mtd->size / 1024);
++              c->mount_opts.rp_size = result.uint_32 * 1024;
+               c->mount_opts.set_rp_size = true;
+-              c->mount_opts.rp_size = opt;
+               break;
+       default:
+               return -EINVAL;
+@@ -269,6 +265,10 @@ static int jffs2_fill_super(struct super_block *sb, struct fs_context *fc)
+       c->mtd = sb->s_mtd;
+       c->os_priv = sb;
+ 
++      if (c->mount_opts.rp_size > c->mtd->size)
++              return invalf(fc, "jffs2: Too large reserve pool specified, max is %llu KB",
++                            c->mtd->size / 1024);
++
+       /* Initialize JFFS2 superblock locks, the further initialization will
+        * be done later */
+       mutex_init(&c->alloc_sem);
+-- 
+2.27.0
+

diff --git a/queue-5.10/series b/queue-5.10/series
index ea9301f9d3b134fec4ad5d1dca2d611ddd43b1fa..b8f5948e6d9e36b0f284517dce3ce0104961b7ba 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -5,3 +5,5 @@ ethtool-fix-string-set-id-check.patch
 md-raid10-initialize-r10_bio-read_slot-before-use.patch
 drm-amd-display-add-get_dig_frontend-implementation-for-dcex.patch
 io_uring-close-a-small-race-gap-for-files-cancel.patch
+jffs2-allow-setting-rp_size-to-zero-during-remountin.patch
+jffs2-fix-null-pointer-dereference-in-rp_size-fs-opt.patch