From: Greg Kroah-Hartman Date: Mon, 14 Jun 2021 08:48:20 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.4.273~21 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=27f3e26e17899b43b723134983da64e20199eca0;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: nfsv4-nfs4_proc_set_acl-needs-to-restore-nfs_cap_uidgid_nomap-on-error.patch scsi-core-fix-error-handling-of-scsi_host_alloc.patch scsi-core-only-put-parent-device-if-host-state-differs-from-shost_created.patch scsi-core-put-.shost_dev-in-failure-path-if-host-state-changes-to-running.patch --- diff --git a/queue-4.14/nfsv4-nfs4_proc_set_acl-needs-to-restore-nfs_cap_uidgid_nomap-on-error.patch b/queue-4.14/nfsv4-nfs4_proc_set_acl-needs-to-restore-nfs_cap_uidgid_nomap-on-error.patch new file mode 100644 index 00000000000..96c90bed9e4 --- /dev/null +++ b/queue-4.14/nfsv4-nfs4_proc_set_acl-needs-to-restore-nfs_cap_uidgid_nomap-on-error.patch @@ -0,0 +1,62 @@ +From f8849e206ef52b584cd9227255f4724f0cc900bb Mon Sep 17 00:00:00 2001 +From: Dai Ngo +Date: Wed, 19 May 2021 17:15:10 -0400 +Subject: NFSv4: nfs4_proc_set_acl needs to restore NFS_CAP_UIDGID_NOMAP on error. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dai Ngo + +commit f8849e206ef52b584cd9227255f4724f0cc900bb upstream. + +Currently if __nfs4_proc_set_acl fails with NFS4ERR_BADOWNER it +re-enables the idmapper by clearing NFS_CAP_UIDGID_NOMAP before +retrying again. The NFS_CAP_UIDGID_NOMAP remains cleared even if +the retry fails. This causes problem for subsequent setattr +requests for v4 server that does not have idmapping configured. + +This patch modifies nfs4_proc_set_acl to detect NFS4ERR_BADOWNER +and NFS4ERR_BADNAME and skips the retry, since the kernel isn't +involved in encoding the ACEs, and return -EINVAL. + +Steps to reproduce the problem: + + # mount -o vers=4.1,sec=sys server:/export/test /tmp/mnt + # touch /tmp/mnt/file1 + # chown 99 /tmp/mnt/file1 + # nfs4_setfacl -a A::unknown.user@xyz.com:wrtncy /tmp/mnt/file1 + Failed setxattr operation: Invalid argument + # chown 99 /tmp/mnt/file1 + chown: changing ownership of ‘/tmp/mnt/file1’: Invalid argument + # umount /tmp/mnt + # mount -o vers=4.1,sec=sys server:/export/test /tmp/mnt + # chown 99 /tmp/mnt/file1 + # + +v2: detect NFS4ERR_BADOWNER and NFS4ERR_BADNAME and skip retry + in nfs4_proc_set_acl. +Signed-off-by: Dai Ngo +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/nfs4proc.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -5294,6 +5294,14 @@ static int nfs4_proc_set_acl(struct inod + do { + err = __nfs4_proc_set_acl(inode, buf, buflen); + trace_nfs4_set_acl(inode, err); ++ if (err == -NFS4ERR_BADOWNER || err == -NFS4ERR_BADNAME) { ++ /* ++ * no need to retry since the kernel ++ * isn't involved in encoding the ACEs. ++ */ ++ err = -EINVAL; ++ break; ++ } + err = nfs4_handle_exception(NFS_SERVER(inode), err, + &exception); + } while (exception.retry); diff --git a/queue-4.14/scsi-core-fix-error-handling-of-scsi_host_alloc.patch b/queue-4.14/scsi-core-fix-error-handling-of-scsi_host_alloc.patch new file mode 100644 index 00000000000..c01609819e5 --- /dev/null +++ b/queue-4.14/scsi-core-fix-error-handling-of-scsi_host_alloc.patch @@ -0,0 +1,83 @@ +From 66a834d092930cf41d809c0e989b13cd6f9ca006 Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Wed, 2 Jun 2021 21:30:26 +0800 +Subject: scsi: core: Fix error handling of scsi_host_alloc() + +From: Ming Lei + +commit 66a834d092930cf41d809c0e989b13cd6f9ca006 upstream. + +After device is initialized via device_initialize(), or its name is set via +dev_set_name(), the device has to be freed via put_device(). Otherwise +device name will be leaked because it is allocated dynamically in +dev_set_name(). + +Fix the leak by replacing kfree() with put_device(). Since +scsi_host_dev_release() properly handles IDA and kthread removal, remove +special-casing these from the error handling as well. + +Link: https://lore.kernel.org/r/20210602133029.2864069-2-ming.lei@redhat.com +Cc: Bart Van Assche +Cc: John Garry +Cc: Hannes Reinecke +Tested-by: John Garry +Reviewed-by: Bart Van Assche +Reviewed-by: John Garry +Reviewed-by: Hannes Reinecke +Signed-off-by: Ming Lei +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/hosts.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +--- a/drivers/scsi/hosts.c ++++ b/drivers/scsi/hosts.c +@@ -404,8 +404,10 @@ struct Scsi_Host *scsi_host_alloc(struct + mutex_init(&shost->scan_mutex); + + index = ida_simple_get(&host_index_ida, 0, 0, GFP_KERNEL); +- if (index < 0) +- goto fail_kfree; ++ if (index < 0) { ++ kfree(shost); ++ return NULL; ++ } + shost->host_no = index; + + shost->dma_channel = 0xff; +@@ -493,7 +495,7 @@ struct Scsi_Host *scsi_host_alloc(struct + shost_printk(KERN_WARNING, shost, + "error handler thread failed to spawn, error = %ld\n", + PTR_ERR(shost->ehandler)); +- goto fail_index_remove; ++ goto fail; + } + + shost->tmf_work_q = alloc_workqueue("scsi_tmf_%d", +@@ -502,17 +504,18 @@ struct Scsi_Host *scsi_host_alloc(struct + if (!shost->tmf_work_q) { + shost_printk(KERN_WARNING, shost, + "failed to create tmf workq\n"); +- goto fail_kthread; ++ goto fail; + } + scsi_proc_hostdir_add(shost->hostt); + return shost; ++ fail: ++ /* ++ * Host state is still SHOST_CREATED and that is enough to release ++ * ->shost_gendev. scsi_host_dev_release() will free ++ * dev_name(&shost->shost_dev). ++ */ ++ put_device(&shost->shost_gendev); + +- fail_kthread: +- kthread_stop(shost->ehandler); +- fail_index_remove: +- ida_simple_remove(&host_index_ida, shost->host_no); +- fail_kfree: +- kfree(shost); + return NULL; + } + EXPORT_SYMBOL(scsi_host_alloc); diff --git a/queue-4.14/scsi-core-only-put-parent-device-if-host-state-differs-from-shost_created.patch b/queue-4.14/scsi-core-only-put-parent-device-if-host-state-differs-from-shost_created.patch new file mode 100644 index 00000000000..38dd068dd04 --- /dev/null +++ b/queue-4.14/scsi-core-only-put-parent-device-if-host-state-differs-from-shost_created.patch @@ -0,0 +1,37 @@ +From 1e0d4e6225996f05271de1ebcb1a7c9381af0b27 Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Wed, 2 Jun 2021 21:30:29 +0800 +Subject: scsi: core: Only put parent device if host state differs from SHOST_CREATED + +From: Ming Lei + +commit 1e0d4e6225996f05271de1ebcb1a7c9381af0b27 upstream. + +get_device(shost->shost_gendev.parent) is called after host state has +switched to SHOST_RUNNING. scsi_host_dev_release() shouldn't release the +parent device if host state is still SHOST_CREATED. + +Link: https://lore.kernel.org/r/20210602133029.2864069-5-ming.lei@redhat.com +Cc: Bart Van Assche +Cc: John Garry +Cc: Hannes Reinecke +Tested-by: John Garry +Reviewed-by: John Garry +Signed-off-by: Ming Lei +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/hosts.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/hosts.c ++++ b/drivers/scsi/hosts.c +@@ -355,7 +355,7 @@ static void scsi_host_dev_release(struct + + ida_simple_remove(&host_index_ida, shost->host_no); + +- if (parent) ++ if (shost->shost_state != SHOST_CREATED) + put_device(parent); + kfree(shost); + } diff --git a/queue-4.14/scsi-core-put-.shost_dev-in-failure-path-if-host-state-changes-to-running.patch b/queue-4.14/scsi-core-put-.shost_dev-in-failure-path-if-host-state-changes-to-running.patch new file mode 100644 index 00000000000..5fff989a8ad --- /dev/null +++ b/queue-4.14/scsi-core-put-.shost_dev-in-failure-path-if-host-state-changes-to-running.patch @@ -0,0 +1,60 @@ +From 11714026c02d613c30a149c3f4c4a15047744529 Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Wed, 2 Jun 2021 21:30:28 +0800 +Subject: scsi: core: Put .shost_dev in failure path if host state changes to RUNNING + +From: Ming Lei + +commit 11714026c02d613c30a149c3f4c4a15047744529 upstream. + +scsi_host_dev_release() only frees dev_name when host state is +SHOST_CREATED. After host state has changed to SHOST_RUNNING, +scsi_host_dev_release() no longer cleans up. + +Fix this by doing a put_device(&shost->shost_dev) in the failure path when +host state is SHOST_RUNNING. Move get_device(&shost->shost_gendev) before +device_add(&shost->shost_dev) so that scsi_host_cls_release() can do a put +on this reference. + +Link: https://lore.kernel.org/r/20210602133029.2864069-4-ming.lei@redhat.com +Cc: Bart Van Assche +Cc: Hannes Reinecke +Reported-by: John Garry +Tested-by: John Garry +Reviewed-by: John Garry +Reviewed-by: Hannes Reinecke +Signed-off-by: Ming Lei +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/hosts.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/hosts.c ++++ b/drivers/scsi/hosts.c +@@ -256,12 +256,11 @@ int scsi_add_host_with_dma(struct Scsi_H + + device_enable_async_suspend(&shost->shost_dev); + ++ get_device(&shost->shost_gendev); + error = device_add(&shost->shost_dev); + if (error) + goto out_del_gendev; + +- get_device(&shost->shost_gendev); +- + if (shost->transportt->host_size) { + shost->shost_data = kzalloc(shost->transportt->host_size, + GFP_KERNEL); +@@ -298,6 +297,11 @@ int scsi_add_host_with_dma(struct Scsi_H + out_del_dev: + device_del(&shost->shost_dev); + out_del_gendev: ++ /* ++ * Host state is SHOST_RUNNING so we have to explicitly release ++ * ->shost_dev. ++ */ ++ put_device(&shost->shost_dev); + device_del(&shost->shost_gendev); + out_disable_runtime_pm: + device_disable_async_suspend(&shost->shost_gendev); diff --git a/queue-4.14/series b/queue-4.14/series index b4b1cf927de..4c5da865c8f 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -41,3 +41,7 @@ nfs-fix-a-potential-null-dereference-in-nfs_get_clie.patch perf-session-correct-buffer-copying-when-peeking-eve.patch kvm-fix-previous-commit-for-32-bit-builds.patch nfs-fix-use-after-free-in-nfs4_init_client.patch +nfsv4-nfs4_proc_set_acl-needs-to-restore-nfs_cap_uidgid_nomap-on-error.patch +scsi-core-fix-error-handling-of-scsi_host_alloc.patch +scsi-core-put-.shost_dev-in-failure-path-if-host-state-changes-to-running.patch +scsi-core-only-put-parent-device-if-host-state-differs-from-shost_created.patch