]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.14-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 24 Jan 2022 09:48:20 +0000 (10:48 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 24 Jan 2022 09:48:20 +0000 (10:48 +0100)
added patches:
crypto-stm32-crc32-fix-kernel-bug-triggered-in-probe.patch
fuse-fix-bad-inode.patch
fuse-fix-live-lock-in-fuse_iget.patch

queue-4.14/crypto-stm32-crc32-fix-kernel-bug-triggered-in-probe.patch [new file with mode: 0644]
queue-4.14/fuse-fix-bad-inode.patch [new file with mode: 0644]
queue-4.14/fuse-fix-live-lock-in-fuse_iget.patch [new file with mode: 0644]
queue-4.14/series

diff --git a/queue-4.14/crypto-stm32-crc32-fix-kernel-bug-triggered-in-probe.patch b/queue-4.14/crypto-stm32-crc32-fix-kernel-bug-triggered-in-probe.patch
new file mode 100644 (file)
index 0000000..779322d
--- /dev/null
@@ -0,0 +1,64 @@
+From 29009604ad4e3ef784fd9b9fef6f23610ddf633d Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Mon, 20 Dec 2021 20:50:22 +0100
+Subject: crypto: stm32/crc32 - Fix kernel BUG triggered in probe()
+
+From: Marek Vasut <marex@denx.de>
+
+commit 29009604ad4e3ef784fd9b9fef6f23610ddf633d upstream.
+
+The include/linux/crypto.h struct crypto_alg field cra_driver_name description
+states "Unique name of the transformation provider. " ... " this contains the
+name of the chip or provider and the name of the transformation algorithm."
+
+In case of the stm32-crc driver, field cra_driver_name is identical for all
+registered transformation providers and set to the name of the driver itself,
+which is incorrect. This patch fixes it by assigning a unique cra_driver_name
+to each registered transformation provider.
+
+The kernel crash is triggered when the driver calls crypto_register_shashes()
+which calls crypto_register_shash(), which calls crypto_register_alg(), which
+calls __crypto_register_alg(), which returns -EEXIST, which is propagated
+back through this call chain. Upon -EEXIST from crypto_register_shash(), the
+crypto_register_shashes() starts unregistering the providers back, and calls
+crypto_unregister_shash(), which calls crypto_unregister_alg(), and this is
+where the BUG() triggers due to incorrect cra_refcnt.
+
+Fixes: b51dbe90912a ("crypto: stm32 - Support for STM32 CRC32 crypto module")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: <stable@vger.kernel.org> # 4.12+
+Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Cc: Fabien Dessenne <fabien.dessenne@st.com>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Lionel Debieve <lionel.debieve@st.com>
+Cc: Nicolas Toromanoff <nicolas.toromanoff@st.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-stm32@st-md-mailman.stormreply.com
+To: linux-crypto@vger.kernel.org
+Acked-by: Nicolas Toromanoff <nicolas.toromanoff@foss.st.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/stm32/stm32_crc32.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/crypto/stm32/stm32_crc32.c
++++ b/drivers/crypto/stm32/stm32_crc32.c
+@@ -206,7 +206,7 @@ static struct shash_alg algs[] = {
+               .digestsize     = CHKSUM_DIGEST_SIZE,
+               .base           = {
+                       .cra_name               = "crc32",
+-                      .cra_driver_name        = DRIVER_NAME,
++                      .cra_driver_name        = "stm32-crc32-crc32",
+                       .cra_priority           = 200,
+                       .cra_flags              = CRYPTO_ALG_OPTIONAL_KEY,
+                       .cra_blocksize          = CHKSUM_BLOCK_SIZE,
+@@ -228,7 +228,7 @@ static struct shash_alg algs[] = {
+               .digestsize     = CHKSUM_DIGEST_SIZE,
+               .base           = {
+                       .cra_name               = "crc32c",
+-                      .cra_driver_name        = DRIVER_NAME,
++                      .cra_driver_name        = "stm32-crc32-crc32c",
+                       .cra_priority           = 200,
+                       .cra_flags              = CRYPTO_ALG_OPTIONAL_KEY,
+                       .cra_blocksize          = CHKSUM_BLOCK_SIZE,
diff --git a/queue-4.14/fuse-fix-bad-inode.patch b/queue-4.14/fuse-fix-bad-inode.patch
new file mode 100644 (file)
index 0000000..454f065
--- /dev/null
@@ -0,0 +1,359 @@
+From 5d069dbe8aaf2a197142558b6fb2978189ba3454 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@redhat.com>
+Date: Thu, 10 Dec 2020 15:33:14 +0100
+Subject: fuse: fix bad inode
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+commit 5d069dbe8aaf2a197142558b6fb2978189ba3454 upstream.
+
+Jan Kara's analysis of the syzbot report (edited):
+
+  The reproducer opens a directory on FUSE filesystem, it then attaches
+  dnotify mark to the open directory.  After that a fuse_do_getattr() call
+  finds that attributes returned by the server are inconsistent, and calls
+  make_bad_inode() which, among other things does:
+
+          inode->i_mode = S_IFREG;
+
+  This then confuses dnotify which doesn't tear down its structures
+  properly and eventually crashes.
+
+Avoid calling make_bad_inode() on a live inode: switch to a private flag on
+the fuse inode.  Also add the test to ops which the bad_inode_ops would
+have caught.
+
+This bug goes back to the initial merge of fuse in 2.6.14...
+
+Reported-by: syzbot+f427adf9324b92652ccc@syzkaller.appspotmail.com
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Tested-by: Jan Kara <jack@suse.cz>
+Cc: <stable@vger.kernel.org>
+[adjusted for missing fs/fuse/readdir.c and changes in fuse_evict_inode() in 4.14]
+Signed-off-by: Samuel Mendoza-Jonas <samjonas@amazon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/fuse/acl.c    |    6 ++++++
+ fs/fuse/dir.c    |   37 ++++++++++++++++++++++++++++++++-----
+ fs/fuse/file.c   |   21 +++++++++++++++------
+ fs/fuse/fuse_i.h |   12 ++++++++++++
+ fs/fuse/inode.c  |    2 +-
+ fs/fuse/xattr.c  |    9 +++++++++
+ 6 files changed, 75 insertions(+), 12 deletions(-)
+
+--- a/fs/fuse/acl.c
++++ b/fs/fuse/acl.c
+@@ -19,6 +19,9 @@ struct posix_acl *fuse_get_acl(struct in
+       void *value = NULL;
+       struct posix_acl *acl;
++      if (fuse_is_bad(inode))
++              return ERR_PTR(-EIO);
++
+       if (!fc->posix_acl || fc->no_getxattr)
+               return NULL;
+@@ -53,6 +56,9 @@ int fuse_set_acl(struct inode *inode, st
+       const char *name;
+       int ret;
++      if (fuse_is_bad(inode))
++              return -EIO;
++
+       if (!fc->posix_acl || fc->no_setxattr)
+               return -EOPNOTSUPP;
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -187,7 +187,7 @@ static int fuse_dentry_revalidate(struct
+       int ret;
+       inode = d_inode_rcu(entry);
+-      if (inode && is_bad_inode(inode))
++      if (inode && fuse_is_bad(inode))
+               goto invalid;
+       else if (time_before64(fuse_dentry_time(entry), get_jiffies_64()) ||
+                (flags & LOOKUP_REVAL)) {
+@@ -364,6 +364,9 @@ static struct dentry *fuse_lookup(struct
+       bool outarg_valid = true;
+       bool locked;
++      if (fuse_is_bad(dir))
++              return ERR_PTR(-EIO);
++
+       locked = fuse_lock_inode(dir);
+       err = fuse_lookup_name(dir->i_sb, get_node_id(dir), &entry->d_name,
+                              &outarg, &inode);
+@@ -504,6 +507,9 @@ static int fuse_atomic_open(struct inode
+       struct fuse_conn *fc = get_fuse_conn(dir);
+       struct dentry *res = NULL;
++      if (fuse_is_bad(dir))
++              return -EIO;
++
+       if (d_in_lookup(entry)) {
+               res = fuse_lookup(dir, entry, 0);
+               if (IS_ERR(res))
+@@ -551,6 +557,9 @@ static int create_new_entry(struct fuse_
+       int err;
+       struct fuse_forget_link *forget;
++      if (fuse_is_bad(dir))
++              return -EIO;
++
+       forget = fuse_alloc_forget();
+       if (!forget)
+               return -ENOMEM;
+@@ -672,6 +681,9 @@ static int fuse_unlink(struct inode *dir
+       struct fuse_conn *fc = get_fuse_conn(dir);
+       FUSE_ARGS(args);
++      if (fuse_is_bad(dir))
++              return -EIO;
++
+       args.in.h.opcode = FUSE_UNLINK;
+       args.in.h.nodeid = get_node_id(dir);
+       args.in.numargs = 1;
+@@ -708,6 +720,9 @@ static int fuse_rmdir(struct inode *dir,
+       struct fuse_conn *fc = get_fuse_conn(dir);
+       FUSE_ARGS(args);
++      if (fuse_is_bad(dir))
++              return -EIO;
++
+       args.in.h.opcode = FUSE_RMDIR;
+       args.in.h.nodeid = get_node_id(dir);
+       args.in.numargs = 1;
+@@ -786,6 +801,9 @@ static int fuse_rename2(struct inode *ol
+       struct fuse_conn *fc = get_fuse_conn(olddir);
+       int err;
++      if (fuse_is_bad(olddir))
++              return -EIO;
++
+       if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE))
+               return -EINVAL;
+@@ -921,7 +939,7 @@ static int fuse_do_getattr(struct inode
+       if (!err) {
+               if (fuse_invalid_attr(&outarg.attr) ||
+                   (inode->i_mode ^ outarg.attr.mode) & S_IFMT) {
+-                      make_bad_inode(inode);
++                      fuse_make_bad(inode);
+                       err = -EIO;
+               } else {
+                       fuse_change_attributes(inode, &outarg.attr,
+@@ -1110,6 +1128,9 @@ static int fuse_permission(struct inode
+       bool refreshed = false;
+       int err = 0;
++      if (fuse_is_bad(inode))
++              return -EIO;
++
+       if (!fuse_allow_current_process(fc))
+               return -EACCES;
+@@ -1247,7 +1268,7 @@ retry:
+                       dput(dentry);
+                       goto retry;
+               }
+-              if (is_bad_inode(inode)) {
++              if (fuse_is_bad(inode)) {
+                       dput(dentry);
+                       return -EIO;
+               }
+@@ -1345,7 +1366,7 @@ static int fuse_readdir(struct file *fil
+       u64 attr_version = 0;
+       bool locked;
+-      if (is_bad_inode(inode))
++      if (fuse_is_bad(inode))
+               return -EIO;
+       req = fuse_get_req(fc, 1);
+@@ -1703,7 +1724,7 @@ int fuse_do_setattr(struct dentry *dentr
+       if (fuse_invalid_attr(&outarg.attr) ||
+           (inode->i_mode ^ outarg.attr.mode) & S_IFMT) {
+-              make_bad_inode(inode);
++              fuse_make_bad(inode);
+               err = -EIO;
+               goto error;
+       }
+@@ -1759,6 +1780,9 @@ static int fuse_setattr(struct dentry *e
+       struct file *file = (attr->ia_valid & ATTR_FILE) ? attr->ia_file : NULL;
+       int ret;
++      if (fuse_is_bad(inode))
++              return -EIO;
++
+       if (!fuse_allow_current_process(get_fuse_conn(inode)))
+               return -EACCES;
+@@ -1817,6 +1841,9 @@ static int fuse_getattr(const struct pat
+       struct inode *inode = d_inode(path->dentry);
+       struct fuse_conn *fc = get_fuse_conn(inode);
++      if (fuse_is_bad(inode))
++              return -EIO;
++
+       if (!fuse_allow_current_process(fc))
+               return -EACCES;
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -206,6 +206,9 @@ int fuse_open_common(struct inode *inode
+                         fc->atomic_o_trunc &&
+                         fc->writeback_cache;
++      if (fuse_is_bad(inode))
++              return -EIO;
++
+       err = generic_file_open(inode, file);
+       if (err)
+               return err;
+@@ -407,7 +410,7 @@ static int fuse_flush(struct file *file,
+       struct fuse_flush_in inarg;
+       int err;
+-      if (is_bad_inode(inode))
++      if (fuse_is_bad(inode))
+               return -EIO;
+       if (fc->no_flush)
+@@ -455,7 +458,7 @@ int fuse_fsync_common(struct file *file,
+       struct fuse_fsync_in inarg;
+       int err;
+-      if (is_bad_inode(inode))
++      if (fuse_is_bad(inode))
+               return -EIO;
+       inode_lock(inode);
+@@ -770,7 +773,7 @@ static int fuse_readpage(struct file *fi
+       int err;
+       err = -EIO;
+-      if (is_bad_inode(inode))
++      if (fuse_is_bad(inode))
+               goto out;
+       err = fuse_do_readpage(file, page);
+@@ -897,7 +900,7 @@ static int fuse_readpages(struct file *f
+       int nr_alloc = min_t(unsigned, nr_pages, FUSE_MAX_PAGES_PER_REQ);
+       err = -EIO;
+-      if (is_bad_inode(inode))
++      if (fuse_is_bad(inode))
+               goto out;
+       data.file = file;
+@@ -927,6 +930,9 @@ static ssize_t fuse_file_read_iter(struc
+       struct inode *inode = iocb->ki_filp->f_mapping->host;
+       struct fuse_conn *fc = get_fuse_conn(inode);
++      if (fuse_is_bad(inode))
++              return -EIO;
++
+       /*
+        * In auto invalidate mode, always update attributes on read.
+        * Otherwise, only update if we attempt to read past EOF (to ensure
+@@ -1184,6 +1190,9 @@ static ssize_t fuse_file_write_iter(stru
+       ssize_t err;
+       loff_t endbyte = 0;
++      if (fuse_is_bad(inode))
++              return -EIO;
++
+       if (get_fuse_conn(inode)->writeback_cache) {
+               /* Update size (EOF optimization) and mode (SUID clearing) */
+               err = fuse_update_attributes(mapping->host, file);
+@@ -1916,7 +1925,7 @@ static int fuse_writepages(struct addres
+       int err;
+       err = -EIO;
+-      if (is_bad_inode(inode))
++      if (fuse_is_bad(inode))
+               goto out;
+       data.inode = inode;
+@@ -2701,7 +2710,7 @@ long fuse_ioctl_common(struct file *file
+       if (!fuse_allow_current_process(fc))
+               return -EACCES;
+-      if (is_bad_inode(inode))
++      if (fuse_is_bad(inode))
+               return -EIO;
+       return fuse_do_ioctl(file, cmd, arg, flags);
+--- a/fs/fuse/fuse_i.h
++++ b/fs/fuse/fuse_i.h
+@@ -117,6 +117,8 @@ enum {
+       FUSE_I_INIT_RDPLUS,
+       /** An operation changing file size is in progress  */
+       FUSE_I_SIZE_UNSTABLE,
++      /* Bad inode */
++      FUSE_I_BAD,
+ };
+ struct fuse_conn;
+@@ -687,6 +689,16 @@ static inline u64 get_node_id(struct ino
+       return get_fuse_inode(inode)->nodeid;
+ }
++static inline void fuse_make_bad(struct inode *inode)
++{
++      set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state);
++}
++
++static inline bool fuse_is_bad(struct inode *inode)
++{
++      return unlikely(test_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state));
++}
++
+ /** Device operations */
+ extern const struct file_operations fuse_dev_operations;
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -317,7 +317,7 @@ struct inode *fuse_iget(struct super_blo
+               unlock_new_inode(inode);
+       } else if ((inode->i_mode ^ attr->mode) & S_IFMT) {
+               /* Inode has changed type, any I/O on the old should fail */
+-              make_bad_inode(inode);
++              fuse_make_bad(inode);
+               iput(inode);
+               goto retry;
+       }
+--- a/fs/fuse/xattr.c
++++ b/fs/fuse/xattr.c
+@@ -113,6 +113,9 @@ ssize_t fuse_listxattr(struct dentry *en
+       struct fuse_getxattr_out outarg;
+       ssize_t ret;
++      if (fuse_is_bad(inode))
++              return -EIO;
++
+       if (!fuse_allow_current_process(fc))
+               return -EACCES;
+@@ -178,6 +181,9 @@ static int fuse_xattr_get(const struct x
+                        struct dentry *dentry, struct inode *inode,
+                        const char *name, void *value, size_t size)
+ {
++      if (fuse_is_bad(inode))
++              return -EIO;
++
+       return fuse_getxattr(inode, name, value, size);
+ }
+@@ -186,6 +192,9 @@ static int fuse_xattr_set(const struct x
+                         const char *name, const void *value, size_t size,
+                         int flags)
+ {
++      if (fuse_is_bad(inode))
++              return -EIO;
++
+       if (!value)
+               return fuse_removexattr(inode, name);
diff --git a/queue-4.14/fuse-fix-live-lock-in-fuse_iget.patch b/queue-4.14/fuse-fix-live-lock-in-fuse_iget.patch
new file mode 100644 (file)
index 0000000..ab64dc5
--- /dev/null
@@ -0,0 +1,53 @@
+From 775c5033a0d164622d9d10dd0f0a5531639ed3ed Mon Sep 17 00:00:00 2001
+From: Amir Goldstein <amir73il@gmail.com>
+Date: Thu, 4 Mar 2021 11:09:12 +0200
+Subject: fuse: fix live lock in fuse_iget()
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+commit 775c5033a0d164622d9d10dd0f0a5531639ed3ed upstream.
+
+Commit 5d069dbe8aaf ("fuse: fix bad inode") replaced make_bad_inode()
+in fuse_iget() with a private implementation fuse_make_bad().
+
+The private implementation fails to remove the bad inode from inode
+cache, so the retry loop with iget5_locked() finds the same bad inode
+and marks it bad forever.
+
+kmsg snip:
+
+[ ] rcu: INFO: rcu_sched self-detected stall on CPU
+...
+[ ]  ? bit_wait_io+0x50/0x50
+[ ]  ? fuse_init_file_inode+0x70/0x70
+[ ]  ? find_inode.isra.32+0x60/0xb0
+[ ]  ? fuse_init_file_inode+0x70/0x70
+[ ]  ilookup5_nowait+0x65/0x90
+[ ]  ? fuse_init_file_inode+0x70/0x70
+[ ]  ilookup5.part.36+0x2e/0x80
+[ ]  ? fuse_init_file_inode+0x70/0x70
+[ ]  ? fuse_inode_eq+0x20/0x20
+[ ]  iget5_locked+0x21/0x80
+[ ]  ? fuse_inode_eq+0x20/0x20
+[ ]  fuse_iget+0x96/0x1b0
+
+Fixes: 5d069dbe8aaf ("fuse: fix bad inode")
+Cc: stable@vger.kernel.org # 5.10+
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Samuel Mendoza-Jonas <samjonas@amazon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/fuse/fuse_i.h |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/fuse/fuse_i.h
++++ b/fs/fuse/fuse_i.h
+@@ -691,6 +691,7 @@ static inline u64 get_node_id(struct ino
+ static inline void fuse_make_bad(struct inode *inode)
+ {
++      remove_inode_hash(inode);
+       set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state);
+ }
index 00a2aec30a31bd95b0aa6649499fe34d6187ac4b..e35e9ad6ecc6377de98bf449390c40db4b11417c 100644 (file)
@@ -154,3 +154,6 @@ ext4-make-sure-quota-gets-properly-shutdown-on-error.patch
 ext4-set-csum-seed-in-tmp-inode-while-migrating-to-extents.patch
 ext4-fix-bug_on-in-ext4_bread-when-write-quota-data.patch
 ext4-don-t-use-the-orphan-list-when-migrating-an-inode.patch
+crypto-stm32-crc32-fix-kernel-bug-triggered-in-probe.patch
+fuse-fix-bad-inode.patch
+fuse-fix-live-lock-in-fuse_iget.patch