5.10-stable patches

added patches:
	floppy-use-a-statically-allocated-error-counter.patch
	io_uring-always-grab-file-table-for-deferred-statx.patch

diff --git a/queue-5.10/floppy-use-a-statically-allocated-error-counter.patch b/queue-5.10/floppy-use-a-statically-allocated-error-counter.patch
new file mode 100644 (file)
index 0000000..50fdacb
--- /dev/null
+++ b/queue-5.10/floppy-use-a-statically-allocated-error-counter.patch
@@ -0,0 +1,115 @@
+From f71f01394f742fc4558b3f9f4c7ef4c4cf3b07c8 Mon Sep 17 00:00:00 2001
+From: Willy Tarreau <w@1wt.eu>
+Date: Sun, 8 May 2022 11:37:07 +0200
+Subject: floppy: use a statically allocated error counter
+
+From: Willy Tarreau <w@1wt.eu>
+
+commit f71f01394f742fc4558b3f9f4c7ef4c4cf3b07c8 upstream.
+
+Interrupt handler bad_flp_intr() may cause a UAF on the recently freed
+request just to increment the error count.  There's no point keeping
+that one in the request anyway, and since the interrupt handler uses a
+static pointer to the error which cannot be kept in sync with the
+pending request, better make it use a static error counter that's reset
+for each new request.  This reset now happens when entering
+redo_fd_request() for a new request via set_next_request().
+
+One initial concern about a single error counter was that errors on one
+floppy drive could be reported on another one, but this problem is not
+real given that the driver uses a single drive at a time, as that
+PC-compatible controllers also have this limitation by using shared
+signals.  As such the error count is always for the "current" drive.
+
+Reported-by: Minh Yuan <yuanmingbuaa@gmail.com>
+Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org>
+Tested-by: Denis Efremov <efremov@linux.com>
+Signed-off-by: Willy Tarreau <w@1wt.eu>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Denis Efremov <efremov@linux.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/block/floppy.c |   20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -509,8 +509,8 @@ static unsigned long fdc_busy;
+ static DECLARE_WAIT_QUEUE_HEAD(fdc_wait);
+ static DECLARE_WAIT_QUEUE_HEAD(command_done);
+ 
+-/* Errors during formatting are counted here. */
+-static int format_errors;
++/* errors encountered on the current (or last) request */
++static int floppy_errors;
+ 
+ /* Format request descriptor. */
+ static struct format_descr format_req;
+@@ -530,7 +530,6 @@ static struct format_descr format_req;
+ static char *floppy_track_buffer;
+ static int max_buffer_sectors;
+ 
+-static int *errors;
+ typedef void (*done_f)(int);
+ static const struct cont_t {
+       void (*interrupt)(void);
+@@ -1455,7 +1454,7 @@ static int interpret_errors(void)
+                       if (drive_params[current_drive].flags & FTD_MSG)
+                               DPRINT("Over/Underrun - retrying\n");
+                       bad = 0;
+-              } else if (*errors >= drive_params[current_drive].max_errors.reporting) {
++              } else if (floppy_errors >= drive_params[current_drive].max_errors.reporting) {
+                       print_errors();
+               }
+               if (reply_buffer[ST2] & ST2_WC || reply_buffer[ST2] & ST2_BC)
+@@ -2095,7 +2094,7 @@ static void bad_flp_intr(void)
+               if (!next_valid_format(current_drive))
+                       return;
+       }
+-      err_count = ++(*errors);
++      err_count = ++floppy_errors;
+       INFBOUND(write_errors[current_drive].badness, err_count);
+       if (err_count > drive_params[current_drive].max_errors.abort)
+               cont->done(0);
+@@ -2240,9 +2239,8 @@ static int do_format(int drive, struct f
+               return -EINVAL;
+       }
+       format_req = *tmp_format_req;
+-      format_errors = 0;
+       cont = &format_cont;
+-      errors = &format_errors;
++      floppy_errors = 0;
+       ret = wait_til_done(redo_format, true);
+       if (ret == -EINTR)
+               return -EINTR;
+@@ -2721,7 +2719,7 @@ static int make_raw_rw_request(void)
+                */
+               if (!direct ||
+                   (indirect * 2 > direct * 3 &&
+-                   *errors < drive_params[current_drive].max_errors.read_track &&
++                   floppy_errors < drive_params[current_drive].max_errors.read_track &&
+                    ((!probing ||
+                      (drive_params[current_drive].read_track & (1 << drive_state[current_drive].probed_format)))))) {
+                       max_size = blk_rq_sectors(current_req);
+@@ -2846,10 +2844,11 @@ static int set_next_request(void)
+       current_req = list_first_entry_or_null(&floppy_reqs, struct request,
+                                              queuelist);
+       if (current_req) {
+-              current_req->error_count = 0;
++              floppy_errors = 0;
+               list_del_init(&current_req->queuelist);
++              return 1;
+       }
+-      return current_req != NULL;
++      return 0;
+ }
+ 
+ /* Starts or continues processing request. Will automatically unlock the
+@@ -2908,7 +2907,6 @@ do_request:
+               _floppy = floppy_type + drive_params[current_drive].autodetect[drive_state[current_drive].probed_format];
+       } else
+               probing = 0;
+-      errors = &(current_req->error_count);
+       tmp = make_raw_rw_request();
+       if (tmp < 2) {
+               request_done(tmp);

diff --git a/queue-5.10/io_uring-always-grab-file-table-for-deferred-statx.patch b/queue-5.10/io_uring-always-grab-file-table-for-deferred-statx.patch
new file mode 100644 (file)
index 0000000..18c3d96
--- /dev/null
+++ b/queue-5.10/io_uring-always-grab-file-table-for-deferred-statx.patch
@@ -0,0 +1,43 @@
+From b1da21187de121e2ed2dc2e0c70d5aabce469691 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Thu, 19 May 2022 06:05:27 -0600
+Subject: io_uring: always grab file table for deferred statx
+
+From: Jens Axboe <axboe@kernel.dk>
+
+Lee reports that there's a use-after-free of the process file table.
+There's an assumption that we don't need the file table for some
+variants of statx invocation, but that turns out to be false and we
+end up with not grabbing a reference for the request even if the
+deferred execution uses it.
+
+Get rid of the REQ_F_NO_FILE_TABLE optimization for statx, and always
+grab that reference.
+
+This issues doesn't exist upstream since the native workers got
+introduced with 5.12.
+
+Link: https://lore.kernel.org/io-uring/YoOJ%2FT4QRKC+fAZE@google.com/
+Reported-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/io_uring.c |    6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -4252,12 +4252,8 @@ static int io_statx(struct io_kiocb *req
+       struct io_statx *ctx = &req->statx;
+       int ret;
+ 
+-      if (force_nonblock) {
+-              /* only need file table for an actual valid fd */
+-              if (ctx->dfd == -1 || ctx->dfd == AT_FDCWD)
+-                      req->flags |= REQ_F_NO_FILE_TABLE;
++      if (force_nonblock)
+               return -EAGAIN;
+-      }
+ 
+       ret = do_statx(ctx->dfd, ctx->filename, ctx->flags, ctx->mask,
+                      ctx->buffer);

diff --git a/queue-5.10/series b/queue-5.10/series
index 7ac09b3bef66e435d89dfb89d22dbde807cfb168..4c9216b6dbe1703cac701790a55cd1d3840522e8 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -1 +1,3 @@
 usb-gadget-fix-race-when-gadget-driver-register-via-ioctl.patch
+io_uring-always-grab-file-table-for-deferred-statx.patch
+floppy-use-a-statically-allocated-error-counter.patch