5.6-stable patches

added patches:
	revert-net-mlx5-annotate-mutex-destroy-for-root-ns.patch
	uprobes-ensure-that-uprobe-offset-and-ref_ctr_offset-are-properly-aligned.patch

diff --git a/queue-5.6/revert-net-mlx5-annotate-mutex-destroy-for-root-ns.patch b/queue-5.6/revert-net-mlx5-annotate-mutex-destroy-for-root-ns.patch
new file mode 100644 (file)
index 0000000..5aa2278
--- /dev/null
+++ b/queue-5.6/revert-net-mlx5-annotate-mutex-destroy-for-root-ns.patch
@@ -0,0 +1,59 @@
+From a352745bd156ccb0c76bf2a8b317e60316647901 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Tue, 9 Jun 2020 19:29:42 +0200
+Subject: Revert "net/mlx5: Annotate mutex destroy for root ns"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+This reverts commit 9b035b08e7e5fe7b2e75636324edf41ee30c5f94 which is
+commit 9ca415399dae133b00273a4283ef31d003a6818d upstream.
+
+It was backported incorrectly, Paul writes at:
+       https://lore.kernel.org/r/20200607203425.GD23662@windriver.com
+
+       I happened to notice this commit:
+
+       9ca415399dae - "net/mlx5: Annotate mutex destroy for root ns"
+
+       ...was backported to 4.19 and 5.4 and v5.6 in linux-stable.
+
+       It patches del_sw_root_ns() - which only exists after v5.7-rc7 from:
+
+       6eb7a268a99b - "net/mlx5: Don't maintain a case of del_sw_func being
+       null"
+
+       which creates the one line del_sw_root_ns stub function around
+       kfree(node) by breaking it out of tree_put_node().
+
+       In the absense of del_sw_root_ns - the backport finds an identical one
+       line kfree stub fcn - named del_sw_prio from this earlier commit:
+
+       139ed6c6c46a - "net/mlx5: Fix steering memory leak"  [in v4.15-rc5]
+
+       and then puts the mutex_destroy() into that (wrong) function, instead of
+       putting it into tree_put_node where the root ns case used to be hand
+
+Reported-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+Cc: Roi Dayan <roid@mellanox.com>
+Cc: Mark Bloch <markb@mellanox.com>
+Cc: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/fs_core.c |    6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -416,12 +416,6 @@ static void del_sw_ns(struct fs_node *no
+ 
+ static void del_sw_prio(struct fs_node *node)
+ {
+-      struct mlx5_flow_root_namespace *root_ns;
+-      struct mlx5_flow_namespace *ns;
+-
+-      fs_get_obj(ns, node);
+-      root_ns = container_of(ns, struct mlx5_flow_root_namespace, ns);
+-      mutex_destroy(&root_ns->chain_lock);
+       kfree(node);
+ }
+ 

diff --git a/queue-5.6/series b/queue-5.6/series
index ca94bf18d21f34fdddeba368bcb8fdc9bff60e44..d6580ea9840f37d6b1b0a097419a182029c8f4cf 100644 (file)
--- a/queue-5.6/series
+++ b/queue-5.6/series
@@ -37,3 +37,5 @@ x86-cpu-add-table-argument-to-cpu_matches.patch
 x86-speculation-add-special-register-buffer-data-sampling-srbds-mitigation.patch
 x86-speculation-add-srbds-vulnerability-and-mitigation-documentation.patch
 x86-speculation-add-ivy-bridge-to-affected-list.patch
+uprobes-ensure-that-uprobe-offset-and-ref_ctr_offset-are-properly-aligned.patch
+revert-net-mlx5-annotate-mutex-destroy-for-root-ns.patch

diff --git a/queue-5.6/uprobes-ensure-that-uprobe-offset-and-ref_ctr_offset-are-properly-aligned.patch b/queue-5.6/uprobes-ensure-that-uprobe-offset-and-ref_ctr_offset-are-properly-aligned.patch
new file mode 100644 (file)
index 0000000..3e0f07c
--- /dev/null
+++ b/queue-5.6/uprobes-ensure-that-uprobe-offset-and-ref_ctr_offset-are-properly-aligned.patch
@@ -0,0 +1,76 @@
+From 013b2deba9a6b80ca02f4fafd7dedf875e9b4450 Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Mon, 4 May 2020 18:47:25 +0200
+Subject: uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit 013b2deba9a6b80ca02f4fafd7dedf875e9b4450 upstream.
+
+uprobe_write_opcode() must not cross page boundary; prepare_uprobe()
+relies on arch_uprobe_analyze_insn() which should validate "vaddr" but
+some architectures (csky, s390, and sparc) don't do this.
+
+We can remove the BUG_ON() check in prepare_uprobe() and validate the
+offset early in __uprobe_register(). The new IS_ALIGNED() check matches
+the alignment check in arch_prepare_kprobe() on supported architectures,
+so I think that all insns must be aligned to UPROBE_SWBP_INSN_SIZE.
+
+Another problem is __update_ref_ctr() which was wrong from the very
+beginning, it can read/write outside of kmap'ed page unless "vaddr" is
+aligned to sizeof(short), __uprobe_register() should check this too.
+
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Tested-by: Sven Schnelle <svens@linux.ibm.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/events/uprobes.c |   16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -867,10 +867,6 @@ static int prepare_uprobe(struct uprobe
+       if (ret)
+               goto out;
+ 
+-      /* uprobe_write_opcode() assumes we don't cross page boundary */
+-      BUG_ON((uprobe->offset & ~PAGE_MASK) +
+-                      UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
+-
+       smp_wmb(); /* pairs with the smp_rmb() in handle_swbp() */
+       set_bit(UPROBE_COPY_INSN, &uprobe->flags);
+ 
+@@ -1166,6 +1162,15 @@ static int __uprobe_register(struct inod
+       if (offset > i_size_read(inode))
+               return -EINVAL;
+ 
++      /*
++       * This ensures that copy_from_page(), copy_to_page() and
++       * __update_ref_ctr() can't cross page boundary.
++       */
++      if (!IS_ALIGNED(offset, UPROBE_SWBP_INSN_SIZE))
++              return -EINVAL;
++      if (!IS_ALIGNED(ref_ctr_offset, sizeof(short)))
++              return -EINVAL;
++
+  retry:
+       uprobe = alloc_uprobe(inode, offset, ref_ctr_offset);
+       if (!uprobe)
+@@ -2014,6 +2019,9 @@ static int is_trap_at_addr(struct mm_str
+       uprobe_opcode_t opcode;
+       int result;
+ 
++      if (WARN_ON_ONCE(!IS_ALIGNED(vaddr, UPROBE_SWBP_INSN_SIZE)))
++              return -EINVAL;
++
+       pagefault_disable();
+       result = __get_user(opcode, (uprobe_opcode_t __user *)vaddr);
+       pagefault_enable();