From: Greg Kroah-Hartman Date: Sat, 17 Jun 2023 08:26:55 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.14.319~54 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=151f1e1e92c68aba8ebf1c5292fc20bd4c65e300;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: kexec-support-purgatories-with-.text.hot-sections.patch net-usb-qmi_wwan-add-support-for-compal-rxm-g1.patch nilfs2-fix-incomplete-buffer-cleanup-in-nilfs_btnode_abort_change_key.patch nilfs2-fix-possible-out-of-bounds-segment-allocation-in-resize-ioctl.patch nios2-dts-fix-tse_mac-max-frame-size-property.patch nouveau-fix-client-work-fence-deletion-race.patch ocfs2-check-new-file-size-on-fallocate-call.patch ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem.patch powerpc-purgatory-remove-pgo-flags.patch rdma-uverbs-restrict-usage-of-privileged-qkeys.patch --- diff --git a/queue-4.19/kexec-support-purgatories-with-.text.hot-sections.patch b/queue-4.19/kexec-support-purgatories-with-.text.hot-sections.patch new file mode 100644 index 00000000000..aa99e4fc5c4 --- /dev/null +++ b/queue-4.19/kexec-support-purgatories-with-.text.hot-sections.patch @@ -0,0 +1,102 @@ +From 8652d44f466ad5772e7d1756e9457046189b0dfc Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Fri, 19 May 2023 16:47:36 +0200 +Subject: kexec: support purgatories with .text.hot sections + +From: Ricardo Ribalda + +commit 8652d44f466ad5772e7d1756e9457046189b0dfc upstream. + +Patch series "kexec: Fix kexec_file_load for llvm16 with PGO", v7. + +When upreving llvm I realised that kexec stopped working on my test +platform. + +The reason seems to be that due to PGO there are multiple .text sections +on the purgatory, and kexec does not supports that. + + +This patch (of 4): + +Clang16 links the purgatory text in two sections when PGO is in use: + + [ 1] .text PROGBITS 0000000000000000 00000040 + 00000000000011a1 0000000000000000 AX 0 0 16 + [ 2] .rela.text RELA 0000000000000000 00003498 + 0000000000000648 0000000000000018 I 24 1 8 + ... + [17] .text.hot. PROGBITS 0000000000000000 00003220 + 000000000000020b 0000000000000000 AX 0 0 1 + [18] .rela.text.hot. RELA 0000000000000000 00004428 + 0000000000000078 0000000000000018 I 24 17 8 + +And both of them have their range [sh_addr ... sh_addr+sh_size] on the +area pointed by `e_entry`. + +This causes that image->start is calculated twice, once for .text and +another time for .text.hot. The second calculation leaves image->start +in a random location. + +Because of this, the system crashes immediately after: + +kexec_core: Starting new kernel + +Link: https://lkml.kernel.org/r/20230321-kexec_clang16-v7-0-b05c520b7296@chromium.org +Link: https://lkml.kernel.org/r/20230321-kexec_clang16-v7-1-b05c520b7296@chromium.org +Fixes: 930457057abe ("kernel/kexec_file.c: split up __kexec_load_puragory") +Signed-off-by: Ricardo Ribalda +Reviewed-by: Ross Zwisler +Reviewed-by: Steven Rostedt (Google) +Reviewed-by: Philipp Rudo +Cc: Albert Ou +Cc: Baoquan He +Cc: Borislav Petkov (AMD) +Cc: Christophe Leroy +Cc: Dave Hansen +Cc: Dave Young +Cc: Eric W. Biederman +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: Michael Ellerman +Cc: Nathan Chancellor +Cc: Nicholas Piggin +Cc: Nick Desaulniers +Cc: Palmer Dabbelt +Cc: Palmer Dabbelt +Cc: Paul Walmsley +Cc: Simon Horman +Cc: Thomas Gleixner +Cc: Tom Rix +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + kernel/kexec_file.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +--- a/kernel/kexec_file.c ++++ b/kernel/kexec_file.c +@@ -793,10 +793,22 @@ static int kexec_purgatory_setup_sechdrs + } + + offset = ALIGN(offset, align); ++ ++ /* ++ * Check if the segment contains the entry point, if so, ++ * calculate the value of image->start based on it. ++ * If the compiler has produced more than one .text section ++ * (Eg: .text.hot), they are generally after the main .text ++ * section, and they shall not be used to calculate ++ * image->start. So do not re-calculate image->start if it ++ * is not set to the initial value, and warn the user so they ++ * have a chance to fix their purgatory's linker script. ++ */ + if (sechdrs[i].sh_flags & SHF_EXECINSTR && + pi->ehdr->e_entry >= sechdrs[i].sh_addr && + pi->ehdr->e_entry < (sechdrs[i].sh_addr +- + sechdrs[i].sh_size)) { ++ + sechdrs[i].sh_size) && ++ !WARN_ON(kbuf->image->start != pi->ehdr->e_entry)) { + kbuf->image->start -= sechdrs[i].sh_addr; + kbuf->image->start += kbuf->mem + offset; + } diff --git a/queue-4.19/net-usb-qmi_wwan-add-support-for-compal-rxm-g1.patch b/queue-4.19/net-usb-qmi_wwan-add-support-for-compal-rxm-g1.patch new file mode 100644 index 00000000000..347f371ec77 --- /dev/null +++ b/queue-4.19/net-usb-qmi_wwan-add-support-for-compal-rxm-g1.patch @@ -0,0 +1,88 @@ +From 863199199713908afaa47ba09332b87621c12496 Mon Sep 17 00:00:00 2001 +From: Wes Huang +Date: Thu, 8 Jun 2023 11:01:42 +0800 +Subject: net: usb: qmi_wwan: add support for Compal RXM-G1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wes Huang + +commit 863199199713908afaa47ba09332b87621c12496 upstream. + +Add support for Compal RXM-G1 which is based on Qualcomm SDX55 chip. +This patch adds support for two compositions: + +0x9091: DIAG + MODEM + QMI_RMNET + ADB +0x90db: DIAG + DUN + RMNET + DPL + QDSS(Trace) + ADB + +T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=05c6 ProdID=9091 Rev= 4.14 +S: Manufacturer=QCOM +S: Product=SDXPRAIRIE-MTP _SN:719AB680 +S: SerialNumber=719ab680 +C:* #Ifs= 4 Cfg#= 1 Atr=80 MxPwr=896mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none) +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=84(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=05c6 ProdID=90db Rev= 4.14 +S: Manufacturer=QCOM +S: Product=SDXPRAIRIE-MTP _SN:719AB680 +S: SerialNumber=719ab680 +C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=896mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none) +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=84(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=8f(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +Cc: stable@vger.kernel.org +Signed-off-by: Wes Huang +Acked-by: Bjørn Mork +Link: https://lore.kernel.org/r/20230608030141.3546-1-wes.huang@moxa.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/qmi_wwan.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1181,7 +1181,9 @@ static const struct usb_device_id produc + {QMI_FIXED_INTF(0x05c6, 0x9080, 8)}, + {QMI_FIXED_INTF(0x05c6, 0x9083, 3)}, + {QMI_FIXED_INTF(0x05c6, 0x9084, 4)}, ++ {QMI_QUIRK_SET_DTR(0x05c6, 0x9091, 2)}, /* Compal RXM-G1 */ + {QMI_FIXED_INTF(0x05c6, 0x90b2, 3)}, /* ublox R410M */ ++ {QMI_QUIRK_SET_DTR(0x05c6, 0x90db, 2)}, /* Compal RXM-G1 */ + {QMI_FIXED_INTF(0x05c6, 0x920d, 0)}, + {QMI_FIXED_INTF(0x05c6, 0x920d, 5)}, + {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */ diff --git a/queue-4.19/nilfs2-fix-incomplete-buffer-cleanup-in-nilfs_btnode_abort_change_key.patch b/queue-4.19/nilfs2-fix-incomplete-buffer-cleanup-in-nilfs_btnode_abort_change_key.patch new file mode 100644 index 00000000000..774eb32735a --- /dev/null +++ b/queue-4.19/nilfs2-fix-incomplete-buffer-cleanup-in-nilfs_btnode_abort_change_key.patch @@ -0,0 +1,53 @@ +From 2f012f2baca140c488e43d27a374029c1e59098d Mon Sep 17 00:00:00 2001 +From: Ryusuke Konishi +Date: Sat, 13 May 2023 19:24:28 +0900 +Subject: nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key() + +From: Ryusuke Konishi + +commit 2f012f2baca140c488e43d27a374029c1e59098d upstream. + +A syzbot fault injection test reported that nilfs_btnode_create_block, a +helper function that allocates a new node block for b-trees, causes a +kernel BUG for disk images where the file system block size is smaller +than the page size. + +This was due to unexpected flags on the newly allocated buffer head, and +it turned out to be because the buffer flags were not cleared by +nilfs_btnode_abort_change_key() after an error occurred during a b-tree +update operation and the buffer was later reused in that state. + +Fix this issue by using nilfs_btnode_delete() to abandon the unused +preallocated buffer in nilfs_btnode_abort_change_key(). + +Link: https://lkml.kernel.org/r/20230513102428.10223-1-konishi.ryusuke@gmail.com +Signed-off-by: Ryusuke Konishi +Reported-by: syzbot+b0a35a5c1f7e846d3b09@syzkaller.appspotmail.com +Closes: https://lkml.kernel.org/r/000000000000d1d6c205ebc4d512@google.com +Tested-by: Ryusuke Konishi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/nilfs2/btnode.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/fs/nilfs2/btnode.c ++++ b/fs/nilfs2/btnode.c +@@ -295,6 +295,14 @@ void nilfs_btnode_abort_change_key(struc + radix_tree_delete(&btnc->i_pages, newkey); + xa_unlock_irq(&btnc->i_pages); + unlock_page(ctxt->bh->b_page); +- } else +- brelse(nbh); ++ } else { ++ /* ++ * When canceling a buffer that a prepare operation has ++ * allocated to copy a node block to another location, use ++ * nilfs_btnode_delete() to initialize and release the buffer ++ * so that the buffer flags will not be in an inconsistent ++ * state when it is reallocated. ++ */ ++ nilfs_btnode_delete(nbh); ++ } + } diff --git a/queue-4.19/nilfs2-fix-possible-out-of-bounds-segment-allocation-in-resize-ioctl.patch b/queue-4.19/nilfs2-fix-possible-out-of-bounds-segment-allocation-in-resize-ioctl.patch new file mode 100644 index 00000000000..6ac4464f016 --- /dev/null +++ b/queue-4.19/nilfs2-fix-possible-out-of-bounds-segment-allocation-in-resize-ioctl.patch @@ -0,0 +1,62 @@ +From fee5eaecca86afa544355569b831c1f90f334b85 Mon Sep 17 00:00:00 2001 +From: Ryusuke Konishi +Date: Wed, 24 May 2023 18:43:48 +0900 +Subject: nilfs2: fix possible out-of-bounds segment allocation in resize ioctl + +From: Ryusuke Konishi + +commit fee5eaecca86afa544355569b831c1f90f334b85 upstream. + +Syzbot reports that in its stress test for resize ioctl, the log writing +function nilfs_segctor_do_construct hits a WARN_ON in +nilfs_segctor_truncate_segments(). + +It turned out that there is a problem with the current implementation of +the resize ioctl, which changes the writable range on the device (the +range of allocatable segments) at the end of the resize process. + +This order is necessary for file system expansion to avoid corrupting the +superblock at trailing edge. However, in the case of a file system +shrink, if log writes occur after truncating out-of-bounds trailing +segments and before the resize is complete, segments may be allocated from +the truncated space. + +The userspace resize tool was fine as it limits the range of allocatable +segments before performing the resize, but it can run into this issue if +the resize ioctl is called alone. + +Fix this issue by changing nilfs_sufile_resize() to update the range of +allocatable segments immediately after successful truncation of segment +space in case of file system shrink. + +Link: https://lkml.kernel.org/r/20230524094348.3784-1-konishi.ryusuke@gmail.com +Fixes: 4e33f9eab07e ("nilfs2: implement resize ioctl") +Signed-off-by: Ryusuke Konishi +Reported-by: syzbot+33494cd0df2ec2931851@syzkaller.appspotmail.com +Closes: https://lkml.kernel.org/r/0000000000005434c405fbbafdc5@google.com +Tested-by: Ryusuke Konishi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/nilfs2/sufile.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/fs/nilfs2/sufile.c ++++ b/fs/nilfs2/sufile.c +@@ -782,6 +782,15 @@ int nilfs_sufile_resize(struct inode *su + goto out_header; + + sui->ncleansegs -= nsegs - newnsegs; ++ ++ /* ++ * If the sufile is successfully truncated, immediately adjust ++ * the segment allocation space while locking the semaphore ++ * "mi_sem" so that nilfs_sufile_alloc() never allocates ++ * segments in the truncated space. ++ */ ++ sui->allocmax = newnsegs - 1; ++ sui->allocmin = 0; + } + + kaddr = kmap_atomic(header_bh->b_page); diff --git a/queue-4.19/nios2-dts-fix-tse_mac-max-frame-size-property.patch b/queue-4.19/nios2-dts-fix-tse_mac-max-frame-size-property.patch new file mode 100644 index 00000000000..1c875f35b57 --- /dev/null +++ b/queue-4.19/nios2-dts-fix-tse_mac-max-frame-size-property.patch @@ -0,0 +1,46 @@ +From 85041e12418fd0c08ff972b7729f7971afb361f8 Mon Sep 17 00:00:00 2001 +From: Janne Grunau +Date: Sun, 12 Feb 2023 13:16:32 +0100 +Subject: nios2: dts: Fix tse_mac "max-frame-size" property + +From: Janne Grunau + +commit 85041e12418fd0c08ff972b7729f7971afb361f8 upstream. + +The given value of 1518 seems to refer to the layer 2 ethernet frame +size without 802.1Q tag. Actual use of the "max-frame-size" including in +the consumer of the "altr,tse-1.0" compatible is the MTU. + +Fixes: 95acd4c7b69c ("nios2: Device tree support") +Fixes: 61c610ec61bb ("nios2: Add Max10 device tree") +Cc: +Signed-off-by: Janne Grunau +Signed-off-by: Dinh Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + arch/nios2/boot/dts/10m50_devboard.dts | 2 +- + arch/nios2/boot/dts/3c120_devboard.dts | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/nios2/boot/dts/10m50_devboard.dts ++++ b/arch/nios2/boot/dts/10m50_devboard.dts +@@ -108,7 +108,7 @@ + rx-fifo-depth = <8192>; + tx-fifo-depth = <8192>; + address-bits = <48>; +- max-frame-size = <1518>; ++ max-frame-size = <1500>; + local-mac-address = [00 00 00 00 00 00]; + altr,has-supplementary-unicast; + altr,enable-sup-addr = <1>; +--- a/arch/nios2/boot/dts/3c120_devboard.dts ++++ b/arch/nios2/boot/dts/3c120_devboard.dts +@@ -118,7 +118,7 @@ + interrupt-names = "rx_irq", "tx_irq"; + rx-fifo-depth = <8192>; + tx-fifo-depth = <8192>; +- max-frame-size = <1518>; ++ max-frame-size = <1500>; + local-mac-address = [ 00 00 00 00 00 00 ]; + phy-mode = "rgmii-id"; + phy-handle = <&phy0>; diff --git a/queue-4.19/nouveau-fix-client-work-fence-deletion-race.patch b/queue-4.19/nouveau-fix-client-work-fence-deletion-race.patch new file mode 100644 index 00000000000..70353294985 --- /dev/null +++ b/queue-4.19/nouveau-fix-client-work-fence-deletion-race.patch @@ -0,0 +1,60 @@ +From c8a5d5ea3ba6a18958f8d76430e4cd68eea33943 Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Thu, 15 Jun 2023 12:22:11 +1000 +Subject: nouveau: fix client work fence deletion race + +From: Dave Airlie + +commit c8a5d5ea3ba6a18958f8d76430e4cd68eea33943 upstream. + +This seems to have existed for ever but is now more apparant after +commit 9bff18d13473 ("drm/ttm: use per BO cleanup workers") + +My analysis: two threads are running, one in the irq signalling the +fence, in dma_fence_signal_timestamp_locked, it has done the +DMA_FENCE_FLAG_SIGNALLED_BIT setting, but hasn't yet reached the +callbacks. + +The second thread in nouveau_cli_work_ready, where it sees the fence is +signalled, so then puts the fence, cleanups the object and frees the +work item, which contains the callback. + +Thread one goes again and tries to call the callback and causes the +use-after-free. + +Proposed fix: lock the fence signalled check in nouveau_cli_work_ready, +so either the callbacks are done or the memory is freed. + +Reviewed-by: Karol Herbst +Fixes: 11e451e74050 ("drm/nouveau: remove fence wait code from deferred client work handler") +Cc: stable@vger.kernel.org +Signed-off-by: Dave Airlie +Link: https://lore.kernel.org/dri-devel/20230615024008.1600281-1-airlied@gmail.com/ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nouveau_drm.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/nouveau/nouveau_drm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c +@@ -120,10 +120,16 @@ nouveau_name(struct drm_device *dev) + static inline bool + nouveau_cli_work_ready(struct dma_fence *fence) + { +- if (!dma_fence_is_signaled(fence)) +- return false; +- dma_fence_put(fence); +- return true; ++ bool ret = true; ++ ++ spin_lock_irq(fence->lock); ++ if (!dma_fence_is_signaled_locked(fence)) ++ ret = false; ++ spin_unlock_irq(fence->lock); ++ ++ if (ret == true) ++ dma_fence_put(fence); ++ return ret; + } + + static void diff --git a/queue-4.19/ocfs2-check-new-file-size-on-fallocate-call.patch b/queue-4.19/ocfs2-check-new-file-size-on-fallocate-call.patch new file mode 100644 index 00000000000..30087ffd10f --- /dev/null +++ b/queue-4.19/ocfs2-check-new-file-size-on-fallocate-call.patch @@ -0,0 +1,57 @@ +From 26a6ffff7de5dd369cdb12e38ba11db682f1dec0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Lu=C3=ADs=20Henriques?= +Date: Mon, 29 May 2023 16:26:45 +0100 +Subject: ocfs2: check new file size on fallocate call +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luís Henriques + +commit 26a6ffff7de5dd369cdb12e38ba11db682f1dec0 upstream. + +When changing a file size with fallocate() the new size isn't being +checked. In particular, the FSIZE ulimit isn't being checked, which makes +fstest generic/228 fail. Simply adding a call to inode_newsize_ok() fixes +this issue. + +Link: https://lkml.kernel.org/r/20230529152645.32680-1-lhenriques@suse.de +Signed-off-by: Luís Henriques +Reviewed-by: Mark Fasheh +Reviewed-by: Joseph Qi +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Gang He +Cc: Jun Piao +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/ocfs2/file.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/fs/ocfs2/file.c ++++ b/fs/ocfs2/file.c +@@ -2111,14 +2111,20 @@ static long ocfs2_fallocate(struct file + struct ocfs2_space_resv sr; + int change_size = 1; + int cmd = OCFS2_IOC_RESVSP64; ++ int ret = 0; + + if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE)) + return -EOPNOTSUPP; + if (!ocfs2_writes_unwritten_extents(osb)) + return -EOPNOTSUPP; + +- if (mode & FALLOC_FL_KEEP_SIZE) ++ if (mode & FALLOC_FL_KEEP_SIZE) { + change_size = 0; ++ } else { ++ ret = inode_newsize_ok(inode, offset + len); ++ if (ret) ++ return ret; ++ } + + if (mode & FALLOC_FL_PUNCH_HOLE) + cmd = OCFS2_IOC_UNRESVSP64; diff --git a/queue-4.19/ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem.patch b/queue-4.19/ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem.patch new file mode 100644 index 00000000000..c133dc0ef0c --- /dev/null +++ b/queue-4.19/ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem.patch @@ -0,0 +1,100 @@ +From 50d927880e0f90d5cb25e897e9d03e5edacc79a8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Lu=C3=ADs=20Henriques?= +Date: Mon, 22 May 2023 11:21:12 +0100 +Subject: ocfs2: fix use-after-free when unmounting read-only filesystem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luís Henriques + +commit 50d927880e0f90d5cb25e897e9d03e5edacc79a8 upstream. + +It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using +fstest generic/452. After a read-only remount, quotas are suspended and +ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting +the filesystem, an UAF access to the oinfo will eventually cause a crash. + +BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 +Read of size 8 at addr ffff8880389a8208 by task umount/669 +... +Call Trace: + + ... + timer_delete+0x54/0xc0 + try_to_grab_pending+0x31/0x230 + __cancel_work_timer+0x6c/0x270 + ocfs2_disable_quotas.isra.0+0x3e/0xf0 [ocfs2] + ocfs2_dismount_volume+0xdd/0x450 [ocfs2] + generic_shutdown_super+0xaa/0x280 + kill_block_super+0x46/0x70 + deactivate_locked_super+0x4d/0xb0 + cleanup_mnt+0x135/0x1f0 + ... + + +Allocated by task 632: + kasan_save_stack+0x1c/0x40 + kasan_set_track+0x21/0x30 + __kasan_kmalloc+0x8b/0x90 + ocfs2_local_read_info+0xe3/0x9a0 [ocfs2] + dquot_load_quota_sb+0x34b/0x680 + dquot_load_quota_inode+0xfe/0x1a0 + ocfs2_enable_quotas+0x190/0x2f0 [ocfs2] + ocfs2_fill_super+0x14ef/0x2120 [ocfs2] + mount_bdev+0x1be/0x200 + legacy_get_tree+0x6c/0xb0 + vfs_get_tree+0x3e/0x110 + path_mount+0xa90/0xe10 + __x64_sys_mount+0x16f/0x1a0 + do_syscall_64+0x43/0x90 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Freed by task 650: + kasan_save_stack+0x1c/0x40 + kasan_set_track+0x21/0x30 + kasan_save_free_info+0x2a/0x50 + __kasan_slab_free+0xf9/0x150 + __kmem_cache_free+0x89/0x180 + ocfs2_local_free_info+0x2ba/0x3f0 [ocfs2] + dquot_disable+0x35f/0xa70 + ocfs2_susp_quotas.isra.0+0x159/0x1a0 [ocfs2] + ocfs2_remount+0x150/0x580 [ocfs2] + reconfigure_super+0x1a5/0x3a0 + path_mount+0xc8a/0xe10 + __x64_sys_mount+0x16f/0x1a0 + do_syscall_64+0x43/0x90 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Link: https://lkml.kernel.org/r/20230522102112.9031-1-lhenriques@suse.de +Signed-off-by: Luís Henriques +Reviewed-by: Joseph Qi +Tested-by: Joseph Qi +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Gang He +Cc: Jun Piao +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/ocfs2/super.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/ocfs2/super.c ++++ b/fs/ocfs2/super.c +@@ -985,8 +985,10 @@ static void ocfs2_disable_quotas(struct + for (type = 0; type < OCFS2_MAXQUOTAS; type++) { + if (!sb_has_quota_loaded(sb, type)) + continue; +- oinfo = sb_dqinfo(sb, type)->dqi_priv; +- cancel_delayed_work_sync(&oinfo->dqi_sync_work); ++ if (!sb_has_quota_suspended(sb, type)) { ++ oinfo = sb_dqinfo(sb, type)->dqi_priv; ++ cancel_delayed_work_sync(&oinfo->dqi_sync_work); ++ } + inode = igrab(sb->s_dquot.files[type]); + /* Turn off quotas. This will remove all dquot structures from + * memory and so they will be automatically synced to global diff --git a/queue-4.19/powerpc-purgatory-remove-pgo-flags.patch b/queue-4.19/powerpc-purgatory-remove-pgo-flags.patch new file mode 100644 index 00000000000..8ead0bc99ee --- /dev/null +++ b/queue-4.19/powerpc-purgatory-remove-pgo-flags.patch @@ -0,0 +1,59 @@ +From 20188baceb7a1463dc0bcb0c8678b69c2f447df6 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Fri, 19 May 2023 16:47:38 +0200 +Subject: powerpc/purgatory: remove PGO flags + +From: Ricardo Ribalda + +commit 20188baceb7a1463dc0bcb0c8678b69c2f447df6 upstream. + +If profile-guided optimization is enabled, the purgatory ends up with +multiple .text sections. This is not supported by kexec and crashes the +system. + +Link: https://lkml.kernel.org/r/20230321-kexec_clang16-v7-3-b05c520b7296@chromium.org +Fixes: 930457057abe ("kernel/kexec_file.c: split up __kexec_load_puragory") +Signed-off-by: Ricardo Ribalda +Cc: Michael Ellerman +Cc: Nicholas Piggin +Cc: Christophe Leroy +Cc: +Cc: Albert Ou +Cc: Baoquan He +Cc: Borislav Petkov (AMD) +Cc: Dave Hansen +Cc: Dave Young +Cc: Eric W. Biederman +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Palmer Dabbelt +Cc: Palmer Dabbelt +Cc: Paul Walmsley +Cc: Philipp Rudo +Cc: Ross Zwisler +Cc: Simon Horman +Cc: Steven Rostedt (Google) +Cc: Thomas Gleixner +Cc: Tom Rix +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/purgatory/Makefile | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/arch/powerpc/purgatory/Makefile ++++ b/arch/powerpc/purgatory/Makefile +@@ -1,6 +1,11 @@ + # SPDX-License-Identifier: GPL-2.0 + targets += trampoline.o purgatory.ro kexec-purgatory.c + ++# When profile-guided optimization is enabled, llvm emits two different ++# overlapping text sections, which is not supported by kexec. Remove profile ++# optimization flags. ++KBUILD_CFLAGS := $(filter-out -fprofile-sample-use=% -fprofile-use=%,$(KBUILD_CFLAGS)) ++ + LDFLAGS_purgatory.ro := -e purgatory_start -r --no-undefined + + $(obj)/purgatory.ro: $(obj)/trampoline.o FORCE diff --git a/queue-4.19/rdma-uverbs-restrict-usage-of-privileged-qkeys.patch b/queue-4.19/rdma-uverbs-restrict-usage-of-privileged-qkeys.patch new file mode 100644 index 00000000000..959b2b6d308 --- /dev/null +++ b/queue-4.19/rdma-uverbs-restrict-usage-of-privileged-qkeys.patch @@ -0,0 +1,43 @@ +From 0cadb4db79e1d9eea66711c4031e435c2191907e Mon Sep 17 00:00:00 2001 +From: Edward Srouji +Date: Mon, 5 Jun 2023 13:33:24 +0300 +Subject: RDMA/uverbs: Restrict usage of privileged QKEYs + +From: Edward Srouji + +commit 0cadb4db79e1d9eea66711c4031e435c2191907e upstream. + +According to the IB specification rel-1.6, section 3.5.3: +"QKEYs with the most significant bit set are considered controlled +QKEYs, and a HCA does not allow a consumer to arbitrarily specify a +controlled QKEY." + +Thus, block non-privileged users from setting such a QKEY. + +Cc: stable@vger.kernel.org +Fixes: bc38a6abdd5a ("[PATCH] IB uverbs: core implementation") +Signed-off-by: Edward Srouji +Link: https://lore.kernel.org/r/c00c809ddafaaf87d6f6cb827978670989a511b3.1685960567.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/uverbs_cmd.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/core/uverbs_cmd.c ++++ b/drivers/infiniband/core/uverbs_cmd.c +@@ -2041,8 +2041,13 @@ static int modify_qp(struct ib_uverbs_fi + attr->path_mtu = cmd->base.path_mtu; + if (cmd->base.attr_mask & IB_QP_PATH_MIG_STATE) + attr->path_mig_state = cmd->base.path_mig_state; +- if (cmd->base.attr_mask & IB_QP_QKEY) ++ if (cmd->base.attr_mask & IB_QP_QKEY) { ++ if (cmd->base.qkey & IB_QP_SET_QKEY && !capable(CAP_NET_RAW)) { ++ ret = -EPERM; ++ goto release_qp; ++ } + attr->qkey = cmd->base.qkey; ++ } + if (cmd->base.attr_mask & IB_QP_RQ_PSN) + attr->rq_psn = cmd->base.rq_psn; + if (cmd->base.attr_mask & IB_QP_SQ_PSN) diff --git a/queue-4.19/series b/queue-4.19/series index f959eb113ab..5831ee2fcad 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -11,3 +11,13 @@ mips-restore-au1300-support.patch mips-alchemy-fix-dbdma2.patch mips-move-initrd_start-check-after-initrd-address-sa.patch xen-blkfront-only-check-req_fua-for-writes.patch +ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem.patch +ocfs2-check-new-file-size-on-fallocate-call.patch +nios2-dts-fix-tse_mac-max-frame-size-property.patch +nilfs2-fix-incomplete-buffer-cleanup-in-nilfs_btnode_abort_change_key.patch +nilfs2-fix-possible-out-of-bounds-segment-allocation-in-resize-ioctl.patch +kexec-support-purgatories-with-.text.hot-sections.patch +powerpc-purgatory-remove-pgo-flags.patch +nouveau-fix-client-work-fence-deletion-race.patch +rdma-uverbs-restrict-usage-of-privileged-qkeys.patch +net-usb-qmi_wwan-add-support-for-compal-rxm-g1.patch