4.19-stable patches

added patches:
	mm-slub-clarify-verification-reporting.patch
	mm-slub.c-include-swab.h.patch

diff --git a/queue-4.19/mm-slub-clarify-verification-reporting.patch b/queue-4.19/mm-slub-clarify-verification-reporting.patch
new file mode 100644 (file)
index 0000000..731c1e3
--- /dev/null
+++ b/queue-4.19/mm-slub-clarify-verification-reporting.patch
@@ -0,0 +1,147 @@
+From 8669dbab2ae56085c128894b181c2aa50f97e368 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Tue, 15 Jun 2021 18:23:19 -0700
+Subject: mm/slub: clarify verification reporting
+
+From: Kees Cook <keescook@chromium.org>
+
+commit 8669dbab2ae56085c128894b181c2aa50f97e368 upstream.
+
+Patch series "Actually fix freelist pointer vs redzoning", v4.
+
+This fixes redzoning vs the freelist pointer (both for middle-position
+and very small caches).  Both are "theoretical" fixes, in that I see no
+evidence of such small-sized caches actually be used in the kernel, but
+that's no reason to let the bugs continue to exist, especially since
+people doing local development keep tripping over it.  :)
+
+This patch (of 3):
+
+Instead of repeating "Redzone" and "Poison", clarify which sides of
+those zones got tripped.  Additionally fix column alignment in the
+trailer.
+
+Before:
+
+  BUG test (Tainted: G    B            ): Redzone overwritten
+  ...
+  Redzone (____ptrval____): bb bb bb bb bb bb bb bb      ........
+  Object (____ptrval____): f6 f4 a5 40 1d e8            ...@..
+  Redzone (____ptrval____): 1a aa                        ..
+  Padding (____ptrval____): 00 00 00 00 00 00 00 00      ........
+
+After:
+
+  BUG test (Tainted: G    B            ): Right Redzone overwritten
+  ...
+  Redzone  (____ptrval____): bb bb bb bb bb bb bb bb      ........
+  Object   (____ptrval____): f6 f4 a5 40 1d e8            ...@..
+  Redzone  (____ptrval____): 1a aa                        ..
+  Padding  (____ptrval____): 00 00 00 00 00 00 00 00      ........
+
+The earlier commits that slowly resulted in the "Before" reporting were:
+
+  d86bd1bece6f ("mm/slub: support left redzone")
+  ffc79d288000 ("slub: use print_hex_dump")
+  2492268472e7 ("SLUB: change error reporting format to follow lockdep loosely")
+
+Link: https://lkml.kernel.org/r/20210608183955.280836-1-keescook@chromium.org
+Link: https://lkml.kernel.org/r/20210608183955.280836-2-keescook@chromium.org
+Link: https://lore.kernel.org/lkml/cfdb11d7-fb8e-e578-c939-f7f5fb69a6bd@suse.cz/
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Cc: Marco Elver <elver@google.com>
+Cc: "Lin, Zhenpeng" <zplin@psu.edu>
+Cc: Christoph Lameter <cl@linux.com>
+Cc: Pekka Enberg <penberg@kernel.org>
+Cc: David Rientjes <rientjes@google.com>
+Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Cc: Roman Gushchin <guro@fb.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/vm/slub.rst |   10 +++++-----
+ mm/slub.c                 |   14 +++++++-------
+ 2 files changed, 12 insertions(+), 12 deletions(-)
+
+--- a/Documentation/vm/slub.rst
++++ b/Documentation/vm/slub.rst
+@@ -154,7 +154,7 @@ SLUB Debug output
+ Here is a sample of slub debug output::
+ 
+  ====================================================================
+- BUG kmalloc-8: Redzone overwritten
++ BUG kmalloc-8: Right Redzone overwritten
+  --------------------------------------------------------------------
+ 
+  INFO: 0xc90f6d28-0xc90f6d2b. First byte 0x00 instead of 0xcc
+@@ -162,10 +162,10 @@ Here is a sample of slub debug output::
+  INFO: Object 0xc90f6d20 @offset=3360 fp=0xc90f6d58
+  INFO: Allocated in get_modalias+0x61/0xf5 age=53 cpu=1 pid=554
+ 
+- Bytes b4 0xc90f6d10:  00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ
+-   Object 0xc90f6d20:  31 30 31 39 2e 30 30 35                         1019.005
+-  Redzone 0xc90f6d28:  00 cc cc cc                                     .
+-  Padding 0xc90f6d50:  5a 5a 5a 5a 5a 5a 5a 5a                         ZZZZZZZZ
++ Bytes b4 (0xc90f6d10): 00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ
++ Object   (0xc90f6d20): 31 30 31 39 2e 30 30 35                         1019.005
++ Redzone  (0xc90f6d28): 00 cc cc cc                                     .
++ Padding  (0xc90f6d50): 5a 5a 5a 5a 5a 5a 5a 5a                         ZZZZZZZZ
+ 
+    [<c010523d>] dump_trace+0x63/0x1eb
+    [<c01053df>] show_trace_log_lvl+0x1a/0x2f
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -672,15 +672,15 @@ static void print_trailer(struct kmem_ca
+              p, p - addr, get_freepointer(s, p));
+ 
+       if (s->flags & SLAB_RED_ZONE)
+-              print_section(KERN_ERR, "Redzone ", p - s->red_left_pad,
++              print_section(KERN_ERR, "Redzone  ", p - s->red_left_pad,
+                             s->red_left_pad);
+       else if (p > addr + 16)
+               print_section(KERN_ERR, "Bytes b4 ", p - 16, 16);
+ 
+-      print_section(KERN_ERR, "Object ", p,
++      print_section(KERN_ERR,         "Object   ", p,
+                     min_t(unsigned int, s->object_size, PAGE_SIZE));
+       if (s->flags & SLAB_RED_ZONE)
+-              print_section(KERN_ERR, "Redzone ", p + s->object_size,
++              print_section(KERN_ERR, "Redzone  ", p + s->object_size,
+                       s->inuse - s->object_size);
+ 
+       if (s->offset)
+@@ -695,7 +695,7 @@ static void print_trailer(struct kmem_ca
+ 
+       if (off != size_from_object(s))
+               /* Beginning of the filler is the free pointer */
+-              print_section(KERN_ERR, "Padding ", p + off,
++              print_section(KERN_ERR, "Padding  ", p + off,
+                             size_from_object(s) - off);
+ 
+       dump_stack();
+@@ -873,11 +873,11 @@ static int check_object(struct kmem_cach
+       u8 *endobject = object + s->object_size;
+ 
+       if (s->flags & SLAB_RED_ZONE) {
+-              if (!check_bytes_and_report(s, page, object, "Redzone",
++              if (!check_bytes_and_report(s, page, object, "Left Redzone",
+                       object - s->red_left_pad, val, s->red_left_pad))
+                       return 0;
+ 
+-              if (!check_bytes_and_report(s, page, object, "Redzone",
++              if (!check_bytes_and_report(s, page, object, "Right Redzone",
+                       endobject, val, s->inuse - s->object_size))
+                       return 0;
+       } else {
+@@ -892,7 +892,7 @@ static int check_object(struct kmem_cach
+               if (val != SLUB_RED_ACTIVE && (s->flags & __OBJECT_POISON) &&
+                       (!check_bytes_and_report(s, page, p, "Poison", p,
+                                       POISON_FREE, s->object_size - 1) ||
+-                       !check_bytes_and_report(s, page, p, "Poison",
++                       !check_bytes_and_report(s, page, p, "End Poison",
+                               p + s->object_size - 1, POISON_END, 1)))
+                       return 0;
+               /*

diff --git a/queue-4.19/mm-slub.c-include-swab.h.patch b/queue-4.19/mm-slub.c-include-swab.h.patch
new file mode 100644 (file)
index 0000000..b74f615
--- /dev/null
+++ b/queue-4.19/mm-slub.c-include-swab.h.patch
@@ -0,0 +1,35 @@
+From 1b3865d016815cbd69a1879ca1c8a8901fda1072 Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Tue, 15 Jun 2021 18:23:39 -0700
+Subject: mm/slub.c: include swab.h
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit 1b3865d016815cbd69a1879ca1c8a8901fda1072 upstream.
+
+Fixes build with CONFIG_SLAB_FREELIST_HARDENED=y.
+
+Hopefully.  But it's the right thing to do anwyay.
+
+Fixes: 1ad53d9fa3f61 ("slub: improve bit diffusion for freelist ptr obfuscation")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=213417
+Reported-by: <vannguye@cisco.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/slub.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -15,6 +15,7 @@
+ #include <linux/module.h>
+ #include <linux/bit_spinlock.h>
+ #include <linux/interrupt.h>
++#include <linux/swab.h>
+ #include <linux/bitops.h>
+ #include <linux/slab.h>
+ #include "slab.h"

diff --git a/queue-4.19/series b/queue-4.19/series
index 476a91de4daab0dbd638e100dcecf94721653bcf..ea505864ff97bd81fd82e1b7fbc62b69676ac234 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -70,3 +70,5 @@ dmaengine-pl330-fix-wrong-usage-of-spinlock-flags-in-dma_cyclc.patch
 cfg80211-make-certificate-generation-more-robust.patch
 net-bridge-fix-vlan-tunnel-dst-null-pointer-dereference.patch
 net-bridge-fix-vlan-tunnel-dst-refcnt-when-egressing.patch
+mm-slub-clarify-verification-reporting.patch
+mm-slub.c-include-swab.h.patch