4.19-stable patches

added patches:
	nilfs2-replace-warn_ons-for-invalid-dat-metadata-block-requests.patch
	userfaultfd-fix-mmap_changing-checking-in-mfill_atomic_hugetlb.patch

diff --git a/queue-4.19/nilfs2-replace-warn_ons-for-invalid-dat-metadata-block-requests.patch b/queue-4.19/nilfs2-replace-warn_ons-for-invalid-dat-metadata-block-requests.patch
new file mode 100644 (file)
index 0000000..08024dc
--- /dev/null
+++ b/queue-4.19/nilfs2-replace-warn_ons-for-invalid-dat-metadata-block-requests.patch
@@ -0,0 +1,82 @@
+From 5124a0a549857c4b87173280e192eea24dea72ad Mon Sep 17 00:00:00 2001
+From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Date: Fri, 27 Jan 2023 01:41:14 +0900
+Subject: nilfs2: replace WARN_ONs for invalid DAT metadata block requests
+
+From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+
+commit 5124a0a549857c4b87173280e192eea24dea72ad upstream.
+
+If DAT metadata file block access fails due to corruption of the DAT file
+or abnormal virtual block numbers held by b-trees or inodes, a kernel
+warning is generated.
+
+This replaces the WARN_ONs by error output, so that a kernel, booted with
+panic_on_warn, does not panic.  This patch also replaces the detected
+return code -ENOENT with another internal code -EINVAL to notify the bmap
+layer of metadata corruption.  When the bmap layer sees -EINVAL, it
+handles the abnormal situation with nilfs_bmap_convert_error() and finally
+returns code -EIO as it should.
+
+Link: https://lkml.kernel.org/r/0000000000005cc3d205ea23ddcf@google.com
+Link: https://lkml.kernel.org/r/20230126164114.6911-1-konishi.ryusuke@gmail.com
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Reported-by: <syzbot+5d5d25f90f195a3cfcb4@syzkaller.appspotmail.com>
+Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nilfs2/dat.c |   27 +++++++++++++++++----------
+ 1 file changed, 17 insertions(+), 10 deletions(-)
+
+--- a/fs/nilfs2/dat.c
++++ b/fs/nilfs2/dat.c
+@@ -40,8 +40,21 @@ static inline struct nilfs_dat_info *NIL
+ static int nilfs_dat_prepare_entry(struct inode *dat,
+                                  struct nilfs_palloc_req *req, int create)
+ {
+-      return nilfs_palloc_get_entry_block(dat, req->pr_entry_nr,
+-                                          create, &req->pr_entry_bh);
++      int ret;
++
++      ret = nilfs_palloc_get_entry_block(dat, req->pr_entry_nr,
++                                         create, &req->pr_entry_bh);
++      if (unlikely(ret == -ENOENT)) {
++              nilfs_msg(dat->i_sb, KERN_ERR,
++                        "DAT doesn't have a block to manage vblocknr = %llu",
++                        (unsigned long long)req->pr_entry_nr);
++              /*
++               * Return internal code -EINVAL to notify bmap layer of
++               * metadata corruption.
++               */
++              ret = -EINVAL;
++      }
++      return ret;
+ }
+ 
+ static void nilfs_dat_commit_entry(struct inode *dat,
+@@ -123,11 +136,7 @@ static void nilfs_dat_commit_free(struct
+ 
+ int nilfs_dat_prepare_start(struct inode *dat, struct nilfs_palloc_req *req)
+ {
+-      int ret;
+-
+-      ret = nilfs_dat_prepare_entry(dat, req, 0);
+-      WARN_ON(ret == -ENOENT);
+-      return ret;
++      return nilfs_dat_prepare_entry(dat, req, 0);
+ }
+ 
+ void nilfs_dat_commit_start(struct inode *dat, struct nilfs_palloc_req *req,
+@@ -154,10 +163,8 @@ int nilfs_dat_prepare_end(struct inode *
+       int ret;
+ 
+       ret = nilfs_dat_prepare_entry(dat, req, 0);
+-      if (ret < 0) {
+-              WARN_ON(ret == -ENOENT);
++      if (ret < 0)
+               return ret;
+-      }
+ 
+       kaddr = kmap_atomic(req->pr_entry_bh->b_page);
+       entry = nilfs_palloc_block_get_entry(dat, req->pr_entry_nr,

diff --git a/queue-4.19/series b/queue-4.19/series
index aa933253c50becf7d9073b34f28744bd3bbda979..d20ce0426972faa7ccf4d56baba956e0317a12b5 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -4,3 +4,5 @@ net-sched-retire-dsmark-qdisc.patch
 stmmac-no-need-to-check-return-value-of-debugfs_create-functions.patch
 net-stmmac-fix-notifier-registration.patch
 memcg-add-refcnt-for-pcpu-stock-to-avoid-uaf-problem-in-drain_all_stock.patch
+nilfs2-replace-warn_ons-for-invalid-dat-metadata-block-requests.patch
+userfaultfd-fix-mmap_changing-checking-in-mfill_atomic_hugetlb.patch

diff --git a/queue-4.19/userfaultfd-fix-mmap_changing-checking-in-mfill_atomic_hugetlb.patch b/queue-4.19/userfaultfd-fix-mmap_changing-checking-in-mfill_atomic_hugetlb.patch
new file mode 100644 (file)
index 0000000..cd0b303
--- /dev/null
+++ b/queue-4.19/userfaultfd-fix-mmap_changing-checking-in-mfill_atomic_hugetlb.patch
@@ -0,0 +1,80 @@
+From 67695f18d55924b2013534ef3bdc363bc9e14605 Mon Sep 17 00:00:00 2001
+From: Lokesh Gidra <lokeshgidra@google.com>
+Date: Wed, 17 Jan 2024 14:37:29 -0800
+Subject: userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
+
+From: Lokesh Gidra <lokeshgidra@google.com>
+
+commit 67695f18d55924b2013534ef3bdc363bc9e14605 upstream.
+
+In mfill_atomic_hugetlb(), mmap_changing isn't being checked
+again if we drop mmap_lock and reacquire it. When the lock is not held,
+mmap_changing could have been incremented. This is also inconsistent
+with the behavior in mfill_atomic().
+
+Link: https://lkml.kernel.org/r/20240117223729.1444522-1-lokeshgidra@google.com
+Fixes: df2cc96e77011 ("userfaultfd: prevent non-cooperative events vs mcopy_atomic races")
+Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Axel Rasmussen <axelrasmussen@google.com>
+Cc: Brian Geffon <bgeffon@google.com>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: Jann Horn <jannh@google.com>
+Cc: Kalesh Singh <kaleshsingh@google.com>
+Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
+Cc: Nicolas Geoffray <ngeoffray@google.com>
+Cc: Peter Xu <peterx@redhat.com>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Mike Rapoport (IBM) <rppt@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/userfaultfd.c |   14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/mm/userfaultfd.c
++++ b/mm/userfaultfd.c
+@@ -179,6 +179,7 @@ static __always_inline ssize_t __mcopy_a
+                                             unsigned long dst_start,
+                                             unsigned long src_start,
+                                             unsigned long len,
++                                            bool *mmap_changing,
+                                             bool zeropage)
+ {
+       int vm_alloc_shared = dst_vma->vm_flags & VM_SHARED;
+@@ -310,6 +311,15 @@ retry:
+                               goto out;
+                       }
+                       down_read(&dst_mm->mmap_sem);
++                      /*
++                       * If memory mappings are changing because of non-cooperative
++                       * operation (e.g. mremap) running in parallel, bail out and
++                       * request the user to retry later
++                       */
++                      if (mmap_changing && READ_ONCE(*mmap_changing)) {
++                              err = -EAGAIN;
++                              break;
++                      }
+ 
+                       dst_vma = NULL;
+                       goto retry;
+@@ -391,6 +401,7 @@ extern ssize_t __mcopy_atomic_hugetlb(st
+                                     unsigned long dst_start,
+                                     unsigned long src_start,
+                                     unsigned long len,
++                                    bool *mmap_changing,
+                                     bool zeropage);
+ #endif /* CONFIG_HUGETLB_PAGE */
+ 
+@@ -508,7 +519,8 @@ retry:
+        */
+       if (is_vm_hugetlb_page(dst_vma))
+               return  __mcopy_atomic_hugetlb(dst_mm, dst_vma, dst_start,
+-                                              src_start, len, zeropage);
++                                             src_start, len, mmap_changing,
++                                             zeropage);
+ 
+       if (!vma_is_anonymous(dst_vma) && !vma_is_shmem(dst_vma))
+               goto out_unlock;