From: Greg Kroah-Hartman Date: Fri, 7 Sep 2018 15:02:36 +0000 (+0200) Subject: drop ubifs patch from 3.18 X-Git-Tag: v4.18.7~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=09be8e41b04c91de8b396bca3a4ba109da7c8690;p=thirdparty%2Fkernel%2Fstable-queue.git drop ubifs patch from 3.18 --- diff --git a/queue-3.18/crypto-vmx-fix-sleep-in-atomic-bugs.patch b/queue-3.18/crypto-vmx-fix-sleep-in-atomic-bugs.patch deleted file mode 100644 index a1badf93c94..00000000000 --- a/queue-3.18/crypto-vmx-fix-sleep-in-atomic-bugs.patch +++ /dev/null @@ -1,161 +0,0 @@ -From 0522236d4f9c5ab2e79889cb020d1acbe5da416e Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 22 Aug 2018 08:26:31 +0200 -Subject: crypto: vmx - Fix sleep-in-atomic bugs - -From: Ondrej Mosnacek - -commit 0522236d4f9c5ab2e79889cb020d1acbe5da416e upstream. - -This patch fixes sleep-in-atomic bugs in AES-CBC and AES-XTS VMX -implementations. The problem is that the blkcipher_* functions should -not be called in atomic context. - -The bugs can be reproduced via the AF_ALG interface by trying to -encrypt/decrypt sufficiently large buffers (at least 64 KiB) using the -VMX implementations of 'cbc(aes)' or 'xts(aes)'. Such operations then -trigger BUG in crypto_yield(): - -[ 891.863680] BUG: sleeping function called from invalid context at include/crypto/algapi.h:424 -[ 891.864622] in_atomic(): 1, irqs_disabled(): 0, pid: 12347, name: kcapi-enc -[ 891.864739] 1 lock held by kcapi-enc/12347: -[ 891.864811] #0: 00000000f5d42c46 (sk_lock-AF_ALG){+.+.}, at: skcipher_recvmsg+0x50/0x530 -[ 891.865076] CPU: 5 PID: 12347 Comm: kcapi-enc Not tainted 4.19.0-0.rc0.git3.1.fc30.ppc64le #1 -[ 891.865251] Call Trace: -[ 891.865340] [c0000003387578c0] [c000000000d67ea4] dump_stack+0xe8/0x164 (unreliable) -[ 891.865511] [c000000338757910] [c000000000172a58] ___might_sleep+0x2f8/0x310 -[ 891.865679] [c000000338757990] [c0000000006bff74] blkcipher_walk_done+0x374/0x4a0 -[ 891.865825] [c0000003387579e0] [d000000007e73e70] p8_aes_cbc_encrypt+0x1c8/0x260 [vmx_crypto] -[ 891.865993] [c000000338757ad0] [c0000000006c0ee0] skcipher_encrypt_blkcipher+0x60/0x80 -[ 891.866128] [c000000338757b10] [c0000000006ec504] skcipher_recvmsg+0x424/0x530 -[ 891.866283] [c000000338757bd0] [c000000000b00654] sock_recvmsg+0x74/0xa0 -[ 891.866403] [c000000338757c10] [c000000000b00f64] ___sys_recvmsg+0xf4/0x2f0 -[ 891.866515] [c000000338757d90] [c000000000b02bb8] __sys_recvmsg+0x68/0xe0 -[ 891.866631] [c000000338757e30] [c00000000000bbe4] system_call+0x5c/0x70 - -Fixes: 8c755ace357c ("crypto: vmx - Adding CBC routines for VMX module") -Fixes: c07f5d3da643 ("crypto: vmx - Adding support for XTS") -Cc: stable@vger.kernel.org -Signed-off-by: Ondrej Mosnacek -Signed-off-by: Herbert Xu -Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c -index 5285ece4f33a..b71895871be3 100644 ---- a/drivers/crypto/vmx/aes_cbc.c -+++ b/drivers/crypto/vmx/aes_cbc.c -@@ -107,24 +107,23 @@ static int p8_aes_cbc_encrypt(struct blkcipher_desc *desc, - ret = crypto_skcipher_encrypt(req); - skcipher_request_zero(req); - } else { -- preempt_disable(); -- pagefault_disable(); -- enable_kernel_vsx(); -- - blkcipher_walk_init(&walk, dst, src, nbytes); - ret = blkcipher_walk_virt(desc, &walk); - while ((nbytes = walk.nbytes)) { -+ preempt_disable(); -+ pagefault_disable(); -+ enable_kernel_vsx(); - aes_p8_cbc_encrypt(walk.src.virt.addr, - walk.dst.virt.addr, - nbytes & AES_BLOCK_MASK, - &ctx->enc_key, walk.iv, 1); -+ disable_kernel_vsx(); -+ pagefault_enable(); -+ preempt_enable(); -+ - nbytes &= AES_BLOCK_SIZE - 1; - ret = blkcipher_walk_done(desc, &walk, nbytes); - } -- -- disable_kernel_vsx(); -- pagefault_enable(); -- preempt_enable(); - } - - return ret; -@@ -147,24 +146,23 @@ static int p8_aes_cbc_decrypt(struct blkcipher_desc *desc, - ret = crypto_skcipher_decrypt(req); - skcipher_request_zero(req); - } else { -- preempt_disable(); -- pagefault_disable(); -- enable_kernel_vsx(); -- - blkcipher_walk_init(&walk, dst, src, nbytes); - ret = blkcipher_walk_virt(desc, &walk); - while ((nbytes = walk.nbytes)) { -+ preempt_disable(); -+ pagefault_disable(); -+ enable_kernel_vsx(); - aes_p8_cbc_encrypt(walk.src.virt.addr, - walk.dst.virt.addr, - nbytes & AES_BLOCK_MASK, - &ctx->dec_key, walk.iv, 0); -+ disable_kernel_vsx(); -+ pagefault_enable(); -+ preempt_enable(); -+ - nbytes &= AES_BLOCK_SIZE - 1; - ret = blkcipher_walk_done(desc, &walk, nbytes); - } -- -- disable_kernel_vsx(); -- pagefault_enable(); -- preempt_enable(); - } - - return ret; -diff --git a/drivers/crypto/vmx/aes_xts.c b/drivers/crypto/vmx/aes_xts.c -index 8bd9aff0f55f..e9954a7d4694 100644 ---- a/drivers/crypto/vmx/aes_xts.c -+++ b/drivers/crypto/vmx/aes_xts.c -@@ -116,32 +116,39 @@ static int p8_aes_xts_crypt(struct blkcipher_desc *desc, - ret = enc? crypto_skcipher_encrypt(req) : crypto_skcipher_decrypt(req); - skcipher_request_zero(req); - } else { -+ blkcipher_walk_init(&walk, dst, src, nbytes); -+ -+ ret = blkcipher_walk_virt(desc, &walk); -+ - preempt_disable(); - pagefault_disable(); - enable_kernel_vsx(); - -- blkcipher_walk_init(&walk, dst, src, nbytes); -- -- ret = blkcipher_walk_virt(desc, &walk); - iv = walk.iv; - memset(tweak, 0, AES_BLOCK_SIZE); - aes_p8_encrypt(iv, tweak, &ctx->tweak_key); - -+ disable_kernel_vsx(); -+ pagefault_enable(); -+ preempt_enable(); -+ - while ((nbytes = walk.nbytes)) { -+ preempt_disable(); -+ pagefault_disable(); -+ enable_kernel_vsx(); - if (enc) - aes_p8_xts_encrypt(walk.src.virt.addr, walk.dst.virt.addr, - nbytes & AES_BLOCK_MASK, &ctx->enc_key, NULL, tweak); - else - aes_p8_xts_decrypt(walk.src.virt.addr, walk.dst.virt.addr, - nbytes & AES_BLOCK_MASK, &ctx->dec_key, NULL, tweak); -+ disable_kernel_vsx(); -+ pagefault_enable(); -+ preempt_enable(); - - nbytes &= AES_BLOCK_SIZE - 1; - ret = blkcipher_walk_done(desc, &walk, nbytes); - } -- -- disable_kernel_vsx(); -- pagefault_enable(); -- preempt_enable(); - } - return ret; - } diff --git a/queue-3.18/series b/queue-3.18/series index 5b04d2d2b38..ed029ff0523 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -21,11 +21,9 @@ userns-correct-the-comment-in-map_write.patch userns-move-user-access-out-of-the-mutex.patch ubifs-fix-memory-leak-in-lprobs-self-check.patch revert-ubifs-fix-potential-integer-overflow-in-allocation.patch -ubifs-check-data-node-size-before-truncate.patch ubifs-fix-synced_i_size-calculation-for-xattr-inodes.patch pwm-tiehrpwm-fix-disabling-of-output-of-pwms.patch fb-fix-lost-console-when-the-user-unplugs-a-usb-adapter.patch udlfb-set-optimal-write-delay.patch getxattr-use-correct-xattr-length.patch bcache-release-dc-writeback_lock-properly-in-bch_writeback_thread.patch -crypto-vmx-fix-sleep-in-atomic-bugs.patch diff --git a/queue-3.18/ubifs-check-data-node-size-before-truncate.patch b/queue-3.18/ubifs-check-data-node-size-before-truncate.patch deleted file mode 100644 index 5f54666983d..00000000000 --- a/queue-3.18/ubifs-check-data-node-size-before-truncate.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 95a22d2084d72ea067d8323cc85677dba5d97cae Mon Sep 17 00:00:00 2001 -From: Richard Weinberger -Date: Sun, 1 Jul 2018 23:20:51 +0200 -Subject: ubifs: Check data node size before truncate - -From: Richard Weinberger - -commit 95a22d2084d72ea067d8323cc85677dba5d97cae upstream. - -Check whether the size is within bounds before using it. -If the size is not correct, abort and dump the bad data node. - -Cc: Kees Cook -Cc: Silvio Cesare -Cc: stable@vger.kernel.org -Fixes: 1e51764a3c2ac ("UBIFS: add new flash file system") -Reported-by: Silvio Cesare -Signed-off-by: Richard Weinberger -Reviewed-by: Kees Cook -Signed-off-by: Richard Weinberger -Signed-off-by: Greg Kroah-Hartman - ---- - fs/ubifs/journal.c | 11 ++++++++++- - 1 file changed, 10 insertions(+), 1 deletion(-) - ---- a/fs/ubifs/journal.c -+++ b/fs/ubifs/journal.c -@@ -1180,7 +1180,16 @@ int ubifs_jnl_truncate(struct ubifs_info - else if (err) - goto out_free; - else { -- if (le32_to_cpu(dn->size) <= dlen) -+ int dn_len = le32_to_cpu(dn->size); -+ -+ if (dn_len <= 0 || dn_len > UBIFS_BLOCK_SIZE) { -+ ubifs_err(c, "bad data node (block %u, inode %lu)", -+ blk, inode->i_ino); -+ ubifs_dump_node(c, dn); -+ goto out_free; -+ } -+ -+ if (dn_len <= dlen) - dlen = 0; /* Nothing to do */ - else { - int compr_type = le16_to_cpu(dn->compr_type);