drop ubifs patch from 3.18

diff --git a/queue-3.18/crypto-vmx-fix-sleep-in-atomic-bugs.patch b/queue-3.18/crypto-vmx-fix-sleep-in-atomic-bugs.patch
deleted file mode 100644 (file)
index a1badf9..0000000
--- a/queue-3.18/crypto-vmx-fix-sleep-in-atomic-bugs.patch
+++ /dev/null
@@ -1,161 +0,0 @@
-From 0522236d4f9c5ab2e79889cb020d1acbe5da416e Mon Sep 17 00:00:00 2001
-From: Ondrej Mosnacek <omosnace@redhat.com>
-Date: Wed, 22 Aug 2018 08:26:31 +0200
-Subject: crypto: vmx - Fix sleep-in-atomic bugs
-
-From: Ondrej Mosnacek <omosnace@redhat.com>
-
-commit 0522236d4f9c5ab2e79889cb020d1acbe5da416e upstream.
-
-This patch fixes sleep-in-atomic bugs in AES-CBC and AES-XTS VMX
-implementations. The problem is that the blkcipher_* functions should
-not be called in atomic context.
-
-The bugs can be reproduced via the AF_ALG interface by trying to
-encrypt/decrypt sufficiently large buffers (at least 64 KiB) using the
-VMX implementations of 'cbc(aes)' or 'xts(aes)'. Such operations then
-trigger BUG in crypto_yield():
-
-[  891.863680] BUG: sleeping function called from invalid context at include/crypto/algapi.h:424
-[  891.864622] in_atomic(): 1, irqs_disabled(): 0, pid: 12347, name: kcapi-enc
-[  891.864739] 1 lock held by kcapi-enc/12347:
-[  891.864811]  #0: 00000000f5d42c46 (sk_lock-AF_ALG){+.+.}, at: skcipher_recvmsg+0x50/0x530
-[  891.865076] CPU: 5 PID: 12347 Comm: kcapi-enc Not tainted 4.19.0-0.rc0.git3.1.fc30.ppc64le #1
-[  891.865251] Call Trace:
-[  891.865340] [c0000003387578c0] [c000000000d67ea4] dump_stack+0xe8/0x164 (unreliable)
-[  891.865511] [c000000338757910] [c000000000172a58] ___might_sleep+0x2f8/0x310
-[  891.865679] [c000000338757990] [c0000000006bff74] blkcipher_walk_done+0x374/0x4a0
-[  891.865825] [c0000003387579e0] [d000000007e73e70] p8_aes_cbc_encrypt+0x1c8/0x260 [vmx_crypto]
-[  891.865993] [c000000338757ad0] [c0000000006c0ee0] skcipher_encrypt_blkcipher+0x60/0x80
-[  891.866128] [c000000338757b10] [c0000000006ec504] skcipher_recvmsg+0x424/0x530
-[  891.866283] [c000000338757bd0] [c000000000b00654] sock_recvmsg+0x74/0xa0
-[  891.866403] [c000000338757c10] [c000000000b00f64] ___sys_recvmsg+0xf4/0x2f0
-[  891.866515] [c000000338757d90] [c000000000b02bb8] __sys_recvmsg+0x68/0xe0
-[  891.866631] [c000000338757e30] [c00000000000bbe4] system_call+0x5c/0x70
-
-Fixes: 8c755ace357c ("crypto: vmx - Adding CBC routines for VMX module")
-Fixes: c07f5d3da643 ("crypto: vmx - Adding support for XTS")
-Cc: stable@vger.kernel.org
-Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
-diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c
-index 5285ece4f33a..b71895871be3 100644
---- a/drivers/crypto/vmx/aes_cbc.c
-+++ b/drivers/crypto/vmx/aes_cbc.c
-@@ -107,24 +107,23 @@ static int p8_aes_cbc_encrypt(struct blkcipher_desc *desc,
-               ret = crypto_skcipher_encrypt(req);
-               skcipher_request_zero(req);
-       } else {
--              preempt_disable();
--              pagefault_disable();
--              enable_kernel_vsx();
--
-               blkcipher_walk_init(&walk, dst, src, nbytes);
-               ret = blkcipher_walk_virt(desc, &walk);
-               while ((nbytes = walk.nbytes)) {
-+                      preempt_disable();
-+                      pagefault_disable();
-+                      enable_kernel_vsx();
-                       aes_p8_cbc_encrypt(walk.src.virt.addr,
-                                          walk.dst.virt.addr,
-                                          nbytes & AES_BLOCK_MASK,
-                                          &ctx->enc_key, walk.iv, 1);
-+                      disable_kernel_vsx();
-+                      pagefault_enable();
-+                      preempt_enable();
-+
-                       nbytes &= AES_BLOCK_SIZE - 1;
-                       ret = blkcipher_walk_done(desc, &walk, nbytes);
-               }
--
--              disable_kernel_vsx();
--              pagefault_enable();
--              preempt_enable();
-       }
- 
-       return ret;
-@@ -147,24 +146,23 @@ static int p8_aes_cbc_decrypt(struct blkcipher_desc *desc,
-               ret = crypto_skcipher_decrypt(req);
-               skcipher_request_zero(req);
-       } else {
--              preempt_disable();
--              pagefault_disable();
--              enable_kernel_vsx();
--
-               blkcipher_walk_init(&walk, dst, src, nbytes);
-               ret = blkcipher_walk_virt(desc, &walk);
-               while ((nbytes = walk.nbytes)) {
-+                      preempt_disable();
-+                      pagefault_disable();
-+                      enable_kernel_vsx();
-                       aes_p8_cbc_encrypt(walk.src.virt.addr,
-                                          walk.dst.virt.addr,
-                                          nbytes & AES_BLOCK_MASK,
-                                          &ctx->dec_key, walk.iv, 0);
-+                      disable_kernel_vsx();
-+                      pagefault_enable();
-+                      preempt_enable();
-+
-                       nbytes &= AES_BLOCK_SIZE - 1;
-                       ret = blkcipher_walk_done(desc, &walk, nbytes);
-               }
--
--              disable_kernel_vsx();
--              pagefault_enable();
--              preempt_enable();
-       }
- 
-       return ret;
-diff --git a/drivers/crypto/vmx/aes_xts.c b/drivers/crypto/vmx/aes_xts.c
-index 8bd9aff0f55f..e9954a7d4694 100644
---- a/drivers/crypto/vmx/aes_xts.c
-+++ b/drivers/crypto/vmx/aes_xts.c
-@@ -116,32 +116,39 @@ static int p8_aes_xts_crypt(struct blkcipher_desc *desc,
-               ret = enc? crypto_skcipher_encrypt(req) : crypto_skcipher_decrypt(req);
-               skcipher_request_zero(req);
-       } else {
-+              blkcipher_walk_init(&walk, dst, src, nbytes);
-+
-+              ret = blkcipher_walk_virt(desc, &walk);
-+
-               preempt_disable();
-               pagefault_disable();
-               enable_kernel_vsx();
- 
--              blkcipher_walk_init(&walk, dst, src, nbytes);
--
--              ret = blkcipher_walk_virt(desc, &walk);
-               iv = walk.iv;
-               memset(tweak, 0, AES_BLOCK_SIZE);
-               aes_p8_encrypt(iv, tweak, &ctx->tweak_key);
- 
-+              disable_kernel_vsx();
-+              pagefault_enable();
-+              preempt_enable();
-+
-               while ((nbytes = walk.nbytes)) {
-+                      preempt_disable();
-+                      pagefault_disable();
-+                      enable_kernel_vsx();
-                       if (enc)
-                               aes_p8_xts_encrypt(walk.src.virt.addr, walk.dst.virt.addr,
-                                               nbytes & AES_BLOCK_MASK, &ctx->enc_key, NULL, tweak);
-                       else
-                               aes_p8_xts_decrypt(walk.src.virt.addr, walk.dst.virt.addr,
-                                               nbytes & AES_BLOCK_MASK, &ctx->dec_key, NULL, tweak);
-+                      disable_kernel_vsx();
-+                      pagefault_enable();
-+                      preempt_enable();
- 
-                       nbytes &= AES_BLOCK_SIZE - 1;
-                       ret = blkcipher_walk_done(desc, &walk, nbytes);
-               }
--
--              disable_kernel_vsx();
--              pagefault_enable();
--              preempt_enable();
-       }
-       return ret;
- }

diff --git a/queue-3.18/series b/queue-3.18/series
index 5b04d2d2b3864ead4b91ea7b915db9728dc910ca..ed029ff052364bb7cd261a77f00f83c98e6d59ea 100644 (file)
--- a/queue-3.18/series
+++ b/queue-3.18/series
@@ -21,11 +21,9 @@ userns-correct-the-comment-in-map_write.patch
 userns-move-user-access-out-of-the-mutex.patch
 ubifs-fix-memory-leak-in-lprobs-self-check.patch
 revert-ubifs-fix-potential-integer-overflow-in-allocation.patch
-ubifs-check-data-node-size-before-truncate.patch
 ubifs-fix-synced_i_size-calculation-for-xattr-inodes.patch
 pwm-tiehrpwm-fix-disabling-of-output-of-pwms.patch
 fb-fix-lost-console-when-the-user-unplugs-a-usb-adapter.patch
 udlfb-set-optimal-write-delay.patch
 getxattr-use-correct-xattr-length.patch
 bcache-release-dc-writeback_lock-properly-in-bch_writeback_thread.patch
-crypto-vmx-fix-sleep-in-atomic-bugs.patch

diff --git a/queue-3.18/ubifs-check-data-node-size-before-truncate.patch b/queue-3.18/ubifs-check-data-node-size-before-truncate.patch
deleted file mode 100644 (file)
index 5f54666..0000000
--- a/queue-3.18/ubifs-check-data-node-size-before-truncate.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 95a22d2084d72ea067d8323cc85677dba5d97cae Mon Sep 17 00:00:00 2001
-From: Richard Weinberger <richard@nod.at>
-Date: Sun, 1 Jul 2018 23:20:51 +0200
-Subject: ubifs: Check data node size before truncate
-
-From: Richard Weinberger <richard@nod.at>
-
-commit 95a22d2084d72ea067d8323cc85677dba5d97cae upstream.
-
-Check whether the size is within bounds before using it.
-If the size is not correct, abort and dump the bad data node.
-
-Cc: Kees Cook <keescook@chromium.org>
-Cc: Silvio Cesare <silvio.cesare@gmail.com>
-Cc: stable@vger.kernel.org
-Fixes: 1e51764a3c2ac ("UBIFS: add new flash file system")
-Reported-by: Silvio Cesare <silvio.cesare@gmail.com>
-Signed-off-by: Richard Weinberger <richard@nod.at>
-Reviewed-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Richard Weinberger <richard@nod.at>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- fs/ubifs/journal.c |   11 ++++++++++-
- 1 file changed, 10 insertions(+), 1 deletion(-)
-
---- a/fs/ubifs/journal.c
-+++ b/fs/ubifs/journal.c
-@@ -1180,7 +1180,16 @@ int ubifs_jnl_truncate(struct ubifs_info
-               else if (err)
-                       goto out_free;
-               else {
--                      if (le32_to_cpu(dn->size) <= dlen)
-+                      int dn_len = le32_to_cpu(dn->size);
-+
-+                      if (dn_len <= 0 || dn_len > UBIFS_BLOCK_SIZE) {
-+                              ubifs_err(c, "bad data node (block %u, inode %lu)",
-+                                        blk, inode->i_ino);
-+                              ubifs_dump_node(c, dn);
-+                              goto out_free;
-+                      }
-+
-+                      if (dn_len <= dlen)
-                               dlen = 0; /* Nothing to do */
-                       else {
-                               int compr_type = le16_to_cpu(dn->compr_type);