From: Greg Kroah-Hartman Date: Tue, 9 Jun 2020 17:38:20 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.7.2~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=22f5cf6275ea47494c456e6bfab4ba560eedcf12;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: revert-net-mlx5-annotate-mutex-destroy-for-root-ns.patch uprobes-ensure-that-uprobe-offset-and-ref_ctr_offset-are-properly-aligned.patch --- diff --git a/queue-5.4/revert-net-mlx5-annotate-mutex-destroy-for-root-ns.patch b/queue-5.4/revert-net-mlx5-annotate-mutex-destroy-for-root-ns.patch new file mode 100644 index 00000000000..98f3cac9d10 --- /dev/null +++ b/queue-5.4/revert-net-mlx5-annotate-mutex-destroy-for-root-ns.patch @@ -0,0 +1,59 @@ +From a352745bd156ccb0c76bf2a8b317e60316647901 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Tue, 9 Jun 2020 19:29:42 +0200 +Subject: Revert "net/mlx5: Annotate mutex destroy for root ns" + +From: Greg Kroah-Hartman + +This reverts commit 3f4f034a8676e366857861e76c3ad11ae059b2fb which is +commit 9ca415399dae133b00273a4283ef31d003a6818d upstream. + +It was backported incorrectly, Paul writes at: + https://lore.kernel.org/r/20200607203425.GD23662@windriver.com + + I happened to notice this commit: + + 9ca415399dae - "net/mlx5: Annotate mutex destroy for root ns" + + ...was backported to 4.19 and 5.4 and v5.6 in linux-stable. + + It patches del_sw_root_ns() - which only exists after v5.7-rc7 from: + + 6eb7a268a99b - "net/mlx5: Don't maintain a case of del_sw_func being + null" + + which creates the one line del_sw_root_ns stub function around + kfree(node) by breaking it out of tree_put_node(). + + In the absense of del_sw_root_ns - the backport finds an identical one + line kfree stub fcn - named del_sw_prio from this earlier commit: + + 139ed6c6c46a - "net/mlx5: Fix steering memory leak" [in v4.15-rc5] + + and then puts the mutex_destroy() into that (wrong) function, instead of + putting it into tree_put_node where the root ns case used to be hand + +Reported-by: Paul Gortmaker +Cc: Roi Dayan +Cc: Mark Bloch +Cc: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 6 ------ + 1 file changed, 6 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +@@ -417,12 +417,6 @@ static void del_sw_ns(struct fs_node *no + + static void del_sw_prio(struct fs_node *node) + { +- struct mlx5_flow_root_namespace *root_ns; +- struct mlx5_flow_namespace *ns; +- +- fs_get_obj(ns, node); +- root_ns = container_of(ns, struct mlx5_flow_root_namespace, ns); +- mutex_destroy(&root_ns->chain_lock); + kfree(node); + } + diff --git a/queue-5.4/series b/queue-5.4/series index 47726aff2cf..5fe0d50722f 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -30,3 +30,5 @@ x86-cpu-add-table-argument-to-cpu_matches.patch x86-speculation-add-special-register-buffer-data-sampling-srbds-mitigation.patch x86-speculation-add-srbds-vulnerability-and-mitigation-documentation.patch x86-speculation-add-ivy-bridge-to-affected-list.patch +uprobes-ensure-that-uprobe-offset-and-ref_ctr_offset-are-properly-aligned.patch +revert-net-mlx5-annotate-mutex-destroy-for-root-ns.patch diff --git a/queue-5.4/uprobes-ensure-that-uprobe-offset-and-ref_ctr_offset-are-properly-aligned.patch b/queue-5.4/uprobes-ensure-that-uprobe-offset-and-ref_ctr_offset-are-properly-aligned.patch new file mode 100644 index 00000000000..3e0f07cc17c --- /dev/null +++ b/queue-5.4/uprobes-ensure-that-uprobe-offset-and-ref_ctr_offset-are-properly-aligned.patch @@ -0,0 +1,76 @@ +From 013b2deba9a6b80ca02f4fafd7dedf875e9b4450 Mon Sep 17 00:00:00 2001 +From: Oleg Nesterov +Date: Mon, 4 May 2020 18:47:25 +0200 +Subject: uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned + +From: Oleg Nesterov + +commit 013b2deba9a6b80ca02f4fafd7dedf875e9b4450 upstream. + +uprobe_write_opcode() must not cross page boundary; prepare_uprobe() +relies on arch_uprobe_analyze_insn() which should validate "vaddr" but +some architectures (csky, s390, and sparc) don't do this. + +We can remove the BUG_ON() check in prepare_uprobe() and validate the +offset early in __uprobe_register(). The new IS_ALIGNED() check matches +the alignment check in arch_prepare_kprobe() on supported architectures, +so I think that all insns must be aligned to UPROBE_SWBP_INSN_SIZE. + +Another problem is __update_ref_ctr() which was wrong from the very +beginning, it can read/write outside of kmap'ed page unless "vaddr" is +aligned to sizeof(short), __uprobe_register() should check this too. + +Reported-by: Linus Torvalds +Suggested-by: Linus Torvalds +Signed-off-by: Oleg Nesterov +Reviewed-by: Srikar Dronamraju +Acked-by: Christian Borntraeger +Tested-by: Sven Schnelle +Cc: Steven Rostedt +Cc: stable@vger.kernel.org +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/events/uprobes.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +--- a/kernel/events/uprobes.c ++++ b/kernel/events/uprobes.c +@@ -867,10 +867,6 @@ static int prepare_uprobe(struct uprobe + if (ret) + goto out; + +- /* uprobe_write_opcode() assumes we don't cross page boundary */ +- BUG_ON((uprobe->offset & ~PAGE_MASK) + +- UPROBE_SWBP_INSN_SIZE > PAGE_SIZE); +- + smp_wmb(); /* pairs with the smp_rmb() in handle_swbp() */ + set_bit(UPROBE_COPY_INSN, &uprobe->flags); + +@@ -1166,6 +1162,15 @@ static int __uprobe_register(struct inod + if (offset > i_size_read(inode)) + return -EINVAL; + ++ /* ++ * This ensures that copy_from_page(), copy_to_page() and ++ * __update_ref_ctr() can't cross page boundary. ++ */ ++ if (!IS_ALIGNED(offset, UPROBE_SWBP_INSN_SIZE)) ++ return -EINVAL; ++ if (!IS_ALIGNED(ref_ctr_offset, sizeof(short))) ++ return -EINVAL; ++ + retry: + uprobe = alloc_uprobe(inode, offset, ref_ctr_offset); + if (!uprobe) +@@ -2014,6 +2019,9 @@ static int is_trap_at_addr(struct mm_str + uprobe_opcode_t opcode; + int result; + ++ if (WARN_ON_ONCE(!IS_ALIGNED(vaddr, UPROBE_SWBP_INSN_SIZE))) ++ return -EINVAL; ++ + pagefault_disable(); + result = __get_user(opcode, (uprobe_opcode_t __user *)vaddr); + pagefault_enable();