4.9-stable patches

added patches:
	btrfs-check-if-root-is-readonly-while-setting-security-xattr.patch
	loop-check-for-overflow-while-configuring-loop.patch

diff --git a/queue-4.9/btrfs-check-if-root-is-readonly-while-setting-security-xattr.patch b/queue-4.9/btrfs-check-if-root-is-readonly-while-setting-security-xattr.patch
new file mode 100644 (file)
index 0000000..f297597
--- /dev/null
+++ b/queue-4.9/btrfs-check-if-root-is-readonly-while-setting-security-xattr.patch
@@ -0,0 +1,60 @@
+From b51111271b0352aa596c5ae8faf06939e91b3b68 Mon Sep 17 00:00:00 2001
+From: Goldwyn Rodrigues <rgoldwyn@suse.de>
+Date: Tue, 16 Aug 2022 16:42:56 -0500
+Subject: btrfs: check if root is readonly while setting security xattr
+
+From: Goldwyn Rodrigues <rgoldwyn@suse.de>
+
+commit b51111271b0352aa596c5ae8faf06939e91b3b68 upstream.
+
+For a filesystem which has btrfs read-only property set to true, all
+write operations including xattr should be denied. However, security
+xattr can still be changed even if btrfs ro property is true.
+
+This happens because xattr_permission() does not have any restrictions
+on security.*, system.*  and in some cases trusted.* from VFS and
+the decision is left to the underlying filesystem. See comments in
+xattr_permission() for more details.
+
+This patch checks if the root is read-only before performing the set
+xattr operation.
+
+Testcase:
+
+  DEV=/dev/vdb
+  MNT=/mnt
+
+  mkfs.btrfs -f $DEV
+  mount $DEV $MNT
+  echo "file one" > $MNT/f1
+
+  setfattr -n "security.one" -v 2 $MNT/f1
+  btrfs property set /mnt ro true
+
+  setfattr -n "security.one" -v 1 $MNT/f1
+
+  umount $MNT
+
+CC: stable@vger.kernel.org # 4.9+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/xattr.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/btrfs/xattr.c
++++ b/fs/btrfs/xattr.c
+@@ -375,6 +375,9 @@ static int btrfs_xattr_handler_get(const
+                                  struct dentry *unused, struct inode *inode,
+                                  const char *name, void *buffer, size_t size)
+ {
++      if (btrfs_root_readonly(BTRFS_I(inode)->root))
++              return -EROFS;
++
+       name = xattr_full_name(handler, name);
+       return __btrfs_getxattr(inode, name, buffer, size);
+ }

diff --git a/queue-4.9/loop-check-for-overflow-while-configuring-loop.patch b/queue-4.9/loop-check-for-overflow-while-configuring-loop.patch
new file mode 100644 (file)
index 0000000..fdeab71
--- /dev/null
+++ b/queue-4.9/loop-check-for-overflow-while-configuring-loop.patch
@@ -0,0 +1,59 @@
+From c490a0b5a4f36da3918181a8acdc6991d967c5f3 Mon Sep 17 00:00:00 2001
+From: Siddh Raman Pant <code@siddh.me>
+Date: Tue, 23 Aug 2022 21:38:10 +0530
+Subject: loop: Check for overflow while configuring loop
+
+From: Siddh Raman Pant <code@siddh.me>
+
+commit c490a0b5a4f36da3918181a8acdc6991d967c5f3 upstream.
+
+The userspace can configure a loop using an ioctl call, wherein
+a configuration of type loop_config is passed (see lo_ioctl()'s
+case on line 1550 of drivers/block/loop.c). This proceeds to call
+loop_configure() which in turn calls loop_set_status_from_info()
+(see line 1050 of loop.c), passing &config->info which is of type
+loop_info64*. This function then sets the appropriate values, like
+the offset.
+
+loop_device has lo_offset of type loff_t (see line 52 of loop.c),
+which is typdef-chained to long long, whereas loop_info64 has
+lo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h).
+
+The function directly copies offset from info to the device as
+follows (See line 980 of loop.c):
+       lo->lo_offset = info->lo_offset;
+
+This results in an overflow, which triggers a warning in iomap_iter()
+due to a call to iomap_iter_done() which has:
+       WARN_ON_ONCE(iter->iomap.offset > iter->pos);
+
+Thus, check for negative value during loop_set_status_from_info().
+
+Bug report: https://syzkaller.appspot.com/bug?id=c620fe14aac810396d3c3edc9ad73848bf69a29e
+
+Reported-and-tested-by: syzbot+a8e049cd3abd342936b6@syzkaller.appspotmail.com
+Cc: stable@vger.kernel.org
+Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Siddh Raman Pant <code@siddh.me>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20220823160810.181275-1-code@siddh.me
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/block/loop.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1202,6 +1202,11 @@ loop_get_status(struct loop_device *lo,
+       info->lo_rdevice = huge_encode_dev(lo->lo_device ? stat.rdev : stat.dev);
+       info->lo_offset = lo->lo_offset;
+       info->lo_sizelimit = lo->lo_sizelimit;
++
++      /* loff_t vars have been assigned __u64 */
++      if (lo->lo_offset < 0 || lo->lo_sizelimit < 0)
++              return -EOVERFLOW;
++
+       info->lo_flags = lo->lo_flags;
+       memcpy(info->lo_file_name, lo->lo_file_name, LO_NAME_SIZE);
+       memcpy(info->lo_crypt_name, lo->lo_crypt_name, LO_NAME_SIZE);

diff --git a/queue-4.9/series b/queue-4.9/series
index fb7d6776fc26db33f1927cc74bcf4a5379be652a..20a89d5a0ebe8f0cc2aa17de3cef439aa42844a3 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -10,3 +10,5 @@ net-fix-a-data-race-around-sysctl_net_busy_poll.patch
 net-fix-a-data-race-around-sysctl_net_busy_read.patch
 net-fix-a-data-race-around-sysctl_somaxconn.patch
 ixgbe-stop-resetting-systime-in-ixgbe_ptp_start_cycl.patch
+btrfs-check-if-root-is-readonly-while-setting-security-xattr.patch
+loop-check-for-overflow-while-configuring-loop.patch