Fixes for 5.10

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-5.10/btrfs-tree-checker-check-if-chunk-item-end-overflows.patch b/queue-5.10/btrfs-tree-checker-check-if-chunk-item-end-overflows.patch
new file mode 100644 (file)
index 0000000..5d16b05
--- /dev/null
+++ b/queue-5.10/btrfs-tree-checker-check-if-chunk-item-end-overflows.patch
@@ -0,0 +1,182 @@
+From 9c4f1aee334bdd1f64aea3df5c726699d56a6955 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Jan 2021 17:28:04 +0800
+Subject: btrfs: tree-checker: check if chunk item end overflows
+
+From: Su Yue <l@damenly.su>
+
+[ Upstream commit 347fb0cfc9bab5195c6701e62eda488310d7938f ]
+
+While mounting a crafted image provided by user, kernel panics due to
+the invalid chunk item whose end is less than start.
+
+  [66.387422] loop: module loaded
+  [66.389773] loop0: detected capacity change from 262144 to 0
+  [66.427708] BTRFS: device fsid a62e00e8-e94e-4200-8217-12444de93c2e devid 1 transid 12 /dev/loop0 scanned by mount (613)
+  [66.431061] BTRFS info (device loop0): disk space caching is enabled
+  [66.431078] BTRFS info (device loop0): has skinny extents
+  [66.437101] BTRFS error: insert state: end < start 29360127 37748736
+  [66.437136] ------------[ cut here ]------------
+  [66.437140] WARNING: CPU: 16 PID: 613 at fs/btrfs/extent_io.c:557 insert_state.cold+0x1a/0x46 [btrfs]
+  [66.437369] CPU: 16 PID: 613 Comm: mount Tainted: G           O      5.11.0-rc1-custom #45
+  [66.437374] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ArchLinux 1.14.0-1 04/01/2014
+  [66.437378] RIP: 0010:insert_state.cold+0x1a/0x46 [btrfs]
+  [66.437420] RSP: 0018:ffff93e5414c3908 EFLAGS: 00010286
+  [66.437427] RAX: 0000000000000000 RBX: 0000000001bfffff RCX: 0000000000000000
+  [66.437431] RDX: 0000000000000000 RSI: ffffffffb90d4660 RDI: 00000000ffffffff
+  [66.437434] RBP: ffff93e5414c3938 R08: 0000000000000001 R09: 0000000000000001
+  [66.437438] R10: ffff93e5414c3658 R11: 0000000000000000 R12: ffff8ec782d72aa0
+  [66.437441] R13: ffff8ec78bc71628 R14: 0000000000000000 R15: 0000000002400000
+  [66.437447] FS:  00007f01386a8580(0000) GS:ffff8ec809000000(0000) knlGS:0000000000000000
+  [66.437451] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+  [66.437455] CR2: 00007f01382fa000 CR3: 0000000109a34000 CR4: 0000000000750ee0
+  [66.437460] PKRU: 55555554
+  [66.437464] Call Trace:
+  [66.437475]  set_extent_bit+0x652/0x740 [btrfs]
+  [66.437539]  set_extent_bits_nowait+0x1d/0x20 [btrfs]
+  [66.437576]  add_extent_mapping+0x1e0/0x2f0 [btrfs]
+  [66.437621]  read_one_chunk+0x33c/0x420 [btrfs]
+  [66.437674]  btrfs_read_chunk_tree+0x6a4/0x870 [btrfs]
+  [66.437708]  ? kvm_sched_clock_read+0x18/0x40
+  [66.437739]  open_ctree+0xb32/0x1734 [btrfs]
+  [66.437781]  ? bdi_register_va+0x1b/0x20
+  [66.437788]  ? super_setup_bdi_name+0x79/0xd0
+  [66.437810]  btrfs_mount_root.cold+0x12/0xeb [btrfs]
+  [66.437854]  ? __kmalloc_track_caller+0x217/0x3b0
+  [66.437873]  legacy_get_tree+0x34/0x60
+  [66.437880]  vfs_get_tree+0x2d/0xc0
+  [66.437888]  vfs_kern_mount.part.0+0x78/0xc0
+  [66.437897]  vfs_kern_mount+0x13/0x20
+  [66.437902]  btrfs_mount+0x11f/0x3c0 [btrfs]
+  [66.437940]  ? kfree+0x5ff/0x670
+  [66.437944]  ? __kmalloc_track_caller+0x217/0x3b0
+  [66.437962]  legacy_get_tree+0x34/0x60
+  [66.437974]  vfs_get_tree+0x2d/0xc0
+  [66.437983]  path_mount+0x48c/0xd30
+  [66.437998]  __x64_sys_mount+0x108/0x140
+  [66.438011]  do_syscall_64+0x38/0x50
+  [66.438018]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+  [66.438023] RIP: 0033:0x7f0138827f6e
+  [66.438033] RSP: 002b:00007ffecd79edf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
+  [66.438040] RAX: ffffffffffffffda RBX: 00007f013894c264 RCX: 00007f0138827f6e
+  [66.438044] RDX: 00005593a4a41360 RSI: 00005593a4a33690 RDI: 00005593a4a3a6c0
+  [66.438047] RBP: 00005593a4a33440 R08: 0000000000000000 R09: 0000000000000001
+  [66.438050] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
+  [66.438054] R13: 00005593a4a3a6c0 R14: 00005593a4a41360 R15: 00005593a4a33440
+  [66.438078] irq event stamp: 18169
+  [66.438082] hardirqs last  enabled at (18175): [<ffffffffb81154bf>] console_unlock+0x4ff/0x5f0
+  [66.438088] hardirqs last disabled at (18180): [<ffffffffb8115427>] console_unlock+0x467/0x5f0
+  [66.438092] softirqs last  enabled at (16910): [<ffffffffb8a00fe2>] asm_call_irq_on_stack+0x12/0x20
+  [66.438097] softirqs last disabled at (16905): [<ffffffffb8a00fe2>] asm_call_irq_on_stack+0x12/0x20
+  [66.438103] ---[ end trace e114b111db64298b ]---
+  [66.438107] BTRFS error: found node 12582912 29360127 on insert of 37748736 29360127
+  [66.438127] BTRFS critical: panic in extent_io_tree_panic:679: locking error: extent tree was modified by another thread while locked (errno=-17 Object already exists)
+  [66.441069] ------------[ cut here ]------------
+  [66.441072] kernel BUG at fs/btrfs/extent_io.c:679!
+  [66.442064] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
+  [66.443018] CPU: 16 PID: 613 Comm: mount Tainted: G        W  O      5.11.0-rc1-custom #45
+  [66.444538] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ArchLinux 1.14.0-1 04/01/2014
+  [66.446223] RIP: 0010:extent_io_tree_panic.isra.0+0x23/0x25 [btrfs]
+  [66.450878] RSP: 0018:ffff93e5414c3948 EFLAGS: 00010246
+  [66.451840] RAX: 0000000000000000 RBX: 0000000001bfffff RCX: 0000000000000000
+  [66.453141] RDX: 0000000000000000 RSI: ffffffffb90d4660 RDI: 00000000ffffffff
+  [66.454445] RBP: ffff93e5414c3948 R08: 0000000000000001 R09: 0000000000000001
+  [66.455743] R10: ffff93e5414c3658 R11: 0000000000000000 R12: ffff8ec782d728c0
+  [66.457055] R13: ffff8ec78bc71628 R14: ffff8ec782d72aa0 R15: 0000000002400000
+  [66.458356] FS:  00007f01386a8580(0000) GS:ffff8ec809000000(0000) knlGS:0000000000000000
+  [66.459841] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+  [66.460895] CR2: 00007f01382fa000 CR3: 0000000109a34000 CR4: 0000000000750ee0
+  [66.462196] PKRU: 55555554
+  [66.462692] Call Trace:
+  [66.463139]  set_extent_bit.cold+0x30/0x98 [btrfs]
+  [66.464049]  set_extent_bits_nowait+0x1d/0x20 [btrfs]
+  [66.490466]  add_extent_mapping+0x1e0/0x2f0 [btrfs]
+  [66.514097]  read_one_chunk+0x33c/0x420 [btrfs]
+  [66.534976]  btrfs_read_chunk_tree+0x6a4/0x870 [btrfs]
+  [66.555718]  ? kvm_sched_clock_read+0x18/0x40
+  [66.575758]  open_ctree+0xb32/0x1734 [btrfs]
+  [66.595272]  ? bdi_register_va+0x1b/0x20
+  [66.614638]  ? super_setup_bdi_name+0x79/0xd0
+  [66.633809]  btrfs_mount_root.cold+0x12/0xeb [btrfs]
+  [66.652938]  ? __kmalloc_track_caller+0x217/0x3b0
+  [66.671925]  legacy_get_tree+0x34/0x60
+  [66.690300]  vfs_get_tree+0x2d/0xc0
+  [66.708221]  vfs_kern_mount.part.0+0x78/0xc0
+  [66.725808]  vfs_kern_mount+0x13/0x20
+  [66.742730]  btrfs_mount+0x11f/0x3c0 [btrfs]
+  [66.759350]  ? kfree+0x5ff/0x670
+  [66.775441]  ? __kmalloc_track_caller+0x217/0x3b0
+  [66.791750]  legacy_get_tree+0x34/0x60
+  [66.807494]  vfs_get_tree+0x2d/0xc0
+  [66.823349]  path_mount+0x48c/0xd30
+  [66.838753]  __x64_sys_mount+0x108/0x140
+  [66.854412]  do_syscall_64+0x38/0x50
+  [66.869673]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+  [66.885093] RIP: 0033:0x7f0138827f6e
+  [66.945613] RSP: 002b:00007ffecd79edf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
+  [66.977214] RAX: ffffffffffffffda RBX: 00007f013894c264 RCX: 00007f0138827f6e
+  [66.994266] RDX: 00005593a4a41360 RSI: 00005593a4a33690 RDI: 00005593a4a3a6c0
+  [67.011544] RBP: 00005593a4a33440 R08: 0000000000000000 R09: 0000000000000001
+  [67.028836] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
+  [67.045812] R13: 00005593a4a3a6c0 R14: 00005593a4a41360 R15: 00005593a4a33440
+  [67.216138] ---[ end trace e114b111db64298c ]---
+  [67.237089] RIP: 0010:extent_io_tree_panic.isra.0+0x23/0x25 [btrfs]
+  [67.325317] RSP: 0018:ffff93e5414c3948 EFLAGS: 00010246
+  [67.347946] RAX: 0000000000000000 RBX: 0000000001bfffff RCX: 0000000000000000
+  [67.371343] RDX: 0000000000000000 RSI: ffffffffb90d4660 RDI: 00000000ffffffff
+  [67.394757] RBP: ffff93e5414c3948 R08: 0000000000000001 R09: 0000000000000001
+  [67.418409] R10: ffff93e5414c3658 R11: 0000000000000000 R12: ffff8ec782d728c0
+  [67.441906] R13: ffff8ec78bc71628 R14: ffff8ec782d72aa0 R15: 0000000002400000
+  [67.465436] FS:  00007f01386a8580(0000) GS:ffff8ec809000000(0000) knlGS:0000000000000000
+  [67.511660] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+  [67.535047] CR2: 00007f01382fa000 CR3: 0000000109a34000 CR4: 0000000000750ee0
+  [67.558449] PKRU: 55555554
+  [67.581146] note: mount[613] exited with preempt_count 2
+
+The image has a chunk item which has a logical start 37748736 and length
+18446744073701163008 (-8M). The calculated end 29360127 overflows.
+EEXIST was caught by insert_state() because of the duplicate end and
+extent_io_tree_panic() was called.
+
+Add overflow check of chunk item end to tree checker so it can be
+detected early at mount time.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=208929
+CC: stable@vger.kernel.org # 4.19+
+Reviewed-by: Anand Jain <anand.jain@oracle.com>
+Signed-off-by: Su Yue <l@damenly.su>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/tree-checker.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
+index ea2bb4cb58909..40845428b739c 100644
+--- a/fs/btrfs/tree-checker.c
++++ b/fs/btrfs/tree-checker.c
+@@ -754,6 +754,7 @@ int btrfs_check_chunk_valid(struct extent_buffer *leaf,
+ {
+       struct btrfs_fs_info *fs_info = leaf->fs_info;
+       u64 length;
++      u64 chunk_end;
+       u64 stripe_len;
+       u16 num_stripes;
+       u16 sub_stripes;
+@@ -808,6 +809,12 @@ int btrfs_check_chunk_valid(struct extent_buffer *leaf,
+                         "invalid chunk length, have %llu", length);
+               return -EUCLEAN;
+       }
++      if (unlikely(check_add_overflow(logical, length, &chunk_end))) {
++              chunk_err(leaf, chunk, logical,
++"invalid chunk logical start and length, have logical start %llu length %llu",
++                        logical, length);
++              return -EUCLEAN;
++      }
+       if (!is_power_of_2(stripe_len) || stripe_len != BTRFS_STRIPE_LEN) {
+               chunk_err(leaf, chunk, logical,
+                         "invalid chunk stripe length: %llu",
+-- 
+2.27.0
+

diff --git a/queue-5.10/ext4-don-t-leak-old-mountpoint-samples.patch b/queue-5.10/ext4-don-t-leak-old-mountpoint-samples.patch
new file mode 100644 (file)
index 0000000..89c0468
--- /dev/null
+++ b/queue-5.10/ext4-don-t-leak-old-mountpoint-samples.patch
@@ -0,0 +1,54 @@
+From 797197fac0060441fb2b9841730cba795bd0491b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 13:24:15 -0500
+Subject: ext4: don't leak old mountpoint samples
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+[ Upstream commit 5a3b590d4b2db187faa6f06adc9a53d6199fb1f9 ]
+
+When the first file is opened, ext4 samples the mountpoint of the
+filesystem in 64 bytes of the super block.  It does so using
+strlcpy(), this means that the remaining bytes in the super block
+string buffer are untouched.  If the mount point before had a longer
+path than the current one, it can be reconstructed.
+
+Consider the case where the fs was mounted to "/media/johnjdeveloper"
+and later to "/".  The super block buffer then contains
+"/\x00edia/johnjdeveloper".
+
+This case was seen in the wild and caused confusion how the name
+of a developer ands up on the super block of a filesystem used
+in production...
+
+Fix this by using strncpy() instead of strlcpy().  The superblock
+field is defined to be a fixed-size char array, and it is already
+marked using __nonstring in fs/ext4/ext4.h.  The consumer of the field
+in e2fsprogs already assumes that in the case of a 64+ byte mount
+path, that s_last_mounted will not be NUL terminated.
+
+Link: https://lore.kernel.org/r/X9ujIOJG/HqMr88R@mit.edu
+Reported-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index 3ed8c048fb12c..b692355b8c770 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -809,7 +809,7 @@ static int ext4_sample_last_mounted(struct super_block *sb,
+       err = ext4_journal_get_write_access(handle, sbi->s_sbh);
+       if (err)
+               goto out_journal;
+-      strlcpy(sbi->s_es->s_last_mounted, cp,
++      strncpy(sbi->s_es->s_last_mounted, cp,
+               sizeof(sbi->s_es->s_last_mounted));
+       ext4_handle_dirty_super(handle, sb);
+ out_journal:
+-- 
+2.27.0
+

diff --git a/queue-5.10/io_uring-don-t-take-files-mm-for-a-dead-task.patch b/queue-5.10/io_uring-don-t-take-files-mm-for-a-dead-task.patch
new file mode 100644 (file)
index 0000000..38b0efa
--- /dev/null
+++ b/queue-5.10/io_uring-don-t-take-files-mm-for-a-dead-task.patch
@@ -0,0 +1,38 @@
+From 897b20753a6c556ed60d112317c6e8e0aeb59c4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 04:00:31 +0000
+Subject: io_uring: don't take files/mm for a dead task
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit 621fadc22365f3cf307bcd9048e3372e9ee9cdcc ]
+
+In rare cases a task may be exiting while io_ring_exit_work() trying to
+cancel/wait its requests. It's ok for __io_sq_thread_acquire_mm()
+because of SQPOLL check, but is not for __io_sq_thread_acquire_files().
+Play safe and fail for both of them.
+
+Cc: stable@vger.kernel.org # 5.5+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 4833b68f1a1cc..6c356b9e87b39 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -1009,6 +1009,8 @@ static int __io_sq_thread_acquire_mm(struct io_ring_ctx *ctx)
+ {
+       struct mm_struct *mm;
+ 
++      if (current->flags & PF_EXITING)
++              return -EFAULT;
+       if (current->mm)
+               return 0;
+ 
+-- 
+2.27.0
+

diff --git a/queue-5.10/io_uring-drop-mm-and-files-after-task_work_run.patch b/queue-5.10/io_uring-drop-mm-and-files-after-task_work_run.patch
new file mode 100644 (file)
index 0000000..c69935d
--- /dev/null
+++ b/queue-5.10/io_uring-drop-mm-and-files-after-task_work_run.patch
@@ -0,0 +1,48 @@
+From c997e1cf369bdb6b8d93c8611fe65bc288806817 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 04:00:30 +0000
+Subject: io_uring: drop mm and files after task_work_run
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit d434ab6db524ab1efd0afad4ffa1ee65ca6ac097 ]
+
+__io_req_task_submit() run by task_work can set mm and files, but
+io_sq_thread() in some cases, and because __io_sq_thread_acquire_mm()
+and __io_sq_thread_acquire_files() do a simple current->mm/files check
+it may end up submitting IO with mm/files of another task.
+
+We also need to drop it after in the end to drop potentially grabbed
+references to them.
+
+Cc: stable@vger.kernel.org # 5.9+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 6c356b9e87b39..cab640c10bc0f 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -6841,6 +6841,7 @@ static int io_sq_thread(void *data)
+ 
+               if (ret & SQT_SPIN) {
+                       io_run_task_work();
++                      io_sq_thread_drop_mm();
+                       cond_resched();
+               } else if (ret == SQT_IDLE) {
+                       if (kthread_should_park())
+@@ -6855,6 +6856,7 @@ static int io_sq_thread(void *data)
+       }
+ 
+       io_run_task_work();
++      io_sq_thread_drop_mm();
+ 
+       if (cur_css)
+               io_sq_thread_unassociate_blkcg();
+-- 
+2.27.0
+

diff --git a/queue-5.10/series b/queue-5.10/series
index 0b35ef7ba0eaaa2e4059b2b9ee805ff3ee80ab77..e6ce963285f0c6adbd04b731eee40e512a28099c 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -48,3 +48,7 @@ dm-crypt-do-not-call-bio_endio-from-the-dm-crypt-tasklet.patch
 dm-crypt-defer-decryption-to-a-tasklet-if-interrupts-disabled.patch
 stmmac-intel-change-all-ehl-tgl-to-auto-detect-phy-addr.patch
 r8152-add-lenovo-powered-usb-c-travel-hub.patch
+btrfs-tree-checker-check-if-chunk-item-end-overflows.patch
+ext4-don-t-leak-old-mountpoint-samples.patch
+io_uring-don-t-take-files-mm-for-a-dead-task.patch
+io_uring-drop-mm-and-files-after-task_work_run.patch