From: Greg Kroah-Hartman Date: Mon, 8 Apr 2024 09:24:31 +0000 (+0200) Subject: 6.8-stable patches X-Git-Tag: v5.15.154~46 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7c7da385e06368c61d1895069273a06d32f03716;p=thirdparty%2Fkernel%2Fstable-queue.git 6.8-stable patches added patches: driver-core-introduce-device_link_wait_removal.patch of-dynamic-synchronize-of_changeset_destroy-with-the-devlink-removals.patch of-module-prevent-null-pointer-dereference-in-vsnprintf.patch x86-mm-pat-fix-vm_pat-handling-in-cow-mappings.patch --- diff --git a/queue-6.8/driver-core-introduce-device_link_wait_removal.patch b/queue-6.8/driver-core-introduce-device_link_wait_removal.patch new file mode 100644 index 00000000000..a5259e1ab31 --- /dev/null +++ b/queue-6.8/driver-core-introduce-device_link_wait_removal.patch @@ -0,0 +1,119 @@ +From 0462c56c290a99a7f03e817ae5b843116dfb575c Mon Sep 17 00:00:00 2001 +From: Herve Codina +Date: Mon, 25 Mar 2024 16:21:25 +0100 +Subject: driver core: Introduce device_link_wait_removal() + +From: Herve Codina + +commit 0462c56c290a99a7f03e817ae5b843116dfb575c upstream. + +The commit 80dd33cf72d1 ("drivers: base: Fix device link removal") +introduces a workqueue to release the consumer and supplier devices used +in the devlink. +In the job queued, devices are release and in turn, when all the +references to these devices are dropped, the release function of the +device itself is called. + +Nothing is present to provide some synchronisation with this workqueue +in order to ensure that all ongoing releasing operations are done and +so, some other operations can be started safely. + +For instance, in the following sequence: + 1) of_platform_depopulate() + 2) of_overlay_remove() + +During the step 1, devices are released and related devlinks are removed +(jobs pushed in the workqueue). +During the step 2, OF nodes are destroyed but, without any +synchronisation with devlink removal jobs, of_overlay_remove() can raise +warnings related to missing of_node_put(): + ERROR: memory leak, expected refcount 1 instead of 2 + +Indeed, the missing of_node_put() call is going to be done, too late, +from the workqueue job execution. + +Introduce device_link_wait_removal() to offer a way to synchronize +operations waiting for the end of devlink removals (i.e. end of +workqueue jobs). +Also, as a flushing operation is done on the workqueue, the workqueue +used is moved from a system-wide workqueue to a local one. + +Cc: stable@vger.kernel.org +Signed-off-by: Herve Codina +Tested-by: Luca Ceresoli +Reviewed-by: Nuno Sa +Reviewed-by: Saravana Kannan +Acked-by: Greg Kroah-Hartman +Link: https://lore.kernel.org/r/20240325152140.198219-2-herve.codina@bootlin.com +Signed-off-by: Rob Herring +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/core.c | 26 +++++++++++++++++++++++--- + include/linux/device.h | 1 + + 2 files changed, 24 insertions(+), 3 deletions(-) + +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -44,6 +44,7 @@ static bool fw_devlink_is_permissive(voi + static void __fw_devlink_link_to_consumers(struct device *dev); + static bool fw_devlink_drv_reg_done; + static bool fw_devlink_best_effort; ++static struct workqueue_struct *device_link_wq; + + /** + * __fwnode_link_add - Create a link between two fwnode_handles. +@@ -532,12 +533,26 @@ static void devlink_dev_release(struct d + /* + * It may take a while to complete this work because of the SRCU + * synchronization in device_link_release_fn() and if the consumer or +- * supplier devices get deleted when it runs, so put it into the "long" +- * workqueue. ++ * supplier devices get deleted when it runs, so put it into the ++ * dedicated workqueue. + */ +- queue_work(system_long_wq, &link->rm_work); ++ queue_work(device_link_wq, &link->rm_work); + } + ++/** ++ * device_link_wait_removal - Wait for ongoing devlink removal jobs to terminate ++ */ ++void device_link_wait_removal(void) ++{ ++ /* ++ * devlink removal jobs are queued in the dedicated work queue. ++ * To be sure that all removal jobs are terminated, ensure that any ++ * scheduled work has run to completion. ++ */ ++ flush_workqueue(device_link_wq); ++} ++EXPORT_SYMBOL_GPL(device_link_wait_removal); ++ + static struct class devlink_class = { + .name = "devlink", + .dev_groups = devlink_groups, +@@ -4098,9 +4113,14 @@ int __init devices_init(void) + sysfs_dev_char_kobj = kobject_create_and_add("char", dev_kobj); + if (!sysfs_dev_char_kobj) + goto char_kobj_err; ++ device_link_wq = alloc_workqueue("device_link_wq", 0, 0); ++ if (!device_link_wq) ++ goto wq_err; + + return 0; + ++ wq_err: ++ kobject_put(sysfs_dev_char_kobj); + char_kobj_err: + kobject_put(sysfs_dev_block_kobj); + block_kobj_err: +--- a/include/linux/device.h ++++ b/include/linux/device.h +@@ -1247,6 +1247,7 @@ void device_link_del(struct device_link + void device_link_remove(void *consumer, struct device *supplier); + void device_links_supplier_sync_state_pause(void); + void device_links_supplier_sync_state_resume(void); ++void device_link_wait_removal(void); + + /* Create alias, so I can be autoloaded. */ + #define MODULE_ALIAS_CHARDEV(major,minor) \ diff --git a/queue-6.8/of-dynamic-synchronize-of_changeset_destroy-with-the-devlink-removals.patch b/queue-6.8/of-dynamic-synchronize-of_changeset_destroy-with-the-devlink-removals.patch new file mode 100644 index 00000000000..9be54f0067b --- /dev/null +++ b/queue-6.8/of-dynamic-synchronize-of_changeset_destroy-with-the-devlink-removals.patch @@ -0,0 +1,71 @@ +From 8917e7385346bd6584890ed362985c219fe6ae84 Mon Sep 17 00:00:00 2001 +From: Herve Codina +Date: Mon, 25 Mar 2024 16:21:26 +0100 +Subject: of: dynamic: Synchronize of_changeset_destroy() with the devlink removals + +From: Herve Codina + +commit 8917e7385346bd6584890ed362985c219fe6ae84 upstream. + +In the following sequence: + 1) of_platform_depopulate() + 2) of_overlay_remove() + +During the step 1, devices are destroyed and devlinks are removed. +During the step 2, OF nodes are destroyed but +__of_changeset_entry_destroy() can raise warnings related to missing +of_node_put(): + ERROR: memory leak, expected refcount 1 instead of 2 ... + +Indeed, during the devlink removals performed at step 1, the removal +itself releasing the device (and the attached of_node) is done by a job +queued in a workqueue and so, it is done asynchronously with respect to +function calls. +When the warning is present, of_node_put() will be called but wrongly +too late from the workqueue job. + +In order to be sure that any ongoing devlink removals are done before +the of_node destruction, synchronize the of_changeset_destroy() with the +devlink removals. + +Fixes: 80dd33cf72d1 ("drivers: base: Fix device link removal") +Cc: stable@vger.kernel.org +Signed-off-by: Herve Codina +Reviewed-by: Saravana Kannan +Tested-by: Luca Ceresoli +Reviewed-by: Nuno Sa +Link: https://lore.kernel.org/r/20240325152140.198219-3-herve.codina@bootlin.com +Signed-off-by: Rob Herring +Signed-off-by: Greg Kroah-Hartman +--- + drivers/of/dynamic.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/of/dynamic.c ++++ b/drivers/of/dynamic.c +@@ -9,6 +9,7 @@ + + #define pr_fmt(fmt) "OF: " fmt + ++#include + #include + #include + #include +@@ -667,6 +668,17 @@ void of_changeset_destroy(struct of_chan + { + struct of_changeset_entry *ce, *cen; + ++ /* ++ * When a device is deleted, the device links to/from it are also queued ++ * for deletion. Until these device links are freed, the devices ++ * themselves aren't freed. If the device being deleted is due to an ++ * overlay change, this device might be holding a reference to a device ++ * node that will be freed. So, wait until all already pending device ++ * links are deleted before freeing a device node. This ensures we don't ++ * free any device node that has a non-zero reference count. ++ */ ++ device_link_wait_removal(); ++ + list_for_each_entry_safe_reverse(ce, cen, &ocs->entries, node) + __of_changeset_entry_destroy(ce); + } diff --git a/queue-6.8/of-module-prevent-null-pointer-dereference-in-vsnprintf.patch b/queue-6.8/of-module-prevent-null-pointer-dereference-in-vsnprintf.patch new file mode 100644 index 00000000000..a03dbbdb9fb --- /dev/null +++ b/queue-6.8/of-module-prevent-null-pointer-dereference-in-vsnprintf.patch @@ -0,0 +1,44 @@ +From a1aa5390cc912934fee76ce80af5f940452fa987 Mon Sep 17 00:00:00 2001 +From: Sergey Shtylyov +Date: Wed, 27 Mar 2024 19:52:49 +0300 +Subject: of: module: prevent NULL pointer dereference in vsnprintf() + +From: Sergey Shtylyov + +commit a1aa5390cc912934fee76ce80af5f940452fa987 upstream. + +In of_modalias(), we can get passed the str and len parameters which would +cause a kernel oops in vsnprintf() since it only allows passing a NULL ptr +when the length is also 0. Also, we need to filter out the negative values +of the len parameter as these will result in a really huge buffer since +snprintf() takes size_t parameter while ours is ssize_t... + +Found by Linux Verification Center (linuxtesting.org) with the Svace static +analysis tool. + +Signed-off-by: Sergey Shtylyov +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/1d211023-3923-685b-20f0-f3f90ea56e1f@omp.ru +Signed-off-by: Rob Herring +Signed-off-by: Greg Kroah-Hartman +--- + drivers/of/module.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/of/module.c ++++ b/drivers/of/module.c +@@ -16,6 +16,14 @@ ssize_t of_modalias(const struct device_ + ssize_t csize; + ssize_t tsize; + ++ /* ++ * Prevent a kernel oops in vsnprintf() -- it only allows passing a ++ * NULL ptr when the length is also 0. Also filter out the negative ++ * lengths... ++ */ ++ if ((len > 0 && !str) || len < 0) ++ return -EINVAL; ++ + /* Name & Type */ + /* %p eats all alphanum characters, so %c must be used here */ + csize = snprintf(str, len, "of:N%pOFn%c%s", np, 'T', diff --git a/queue-6.8/series b/queue-6.8/series index 528d37cd735..d954edb0e2d 100644 --- a/queue-6.8/series +++ b/queue-6.8/series @@ -228,3 +228,7 @@ asoc-sof-ipc4-pcm-invalidate-the-stream_start_offset-in-paused-state.patch asoc-sof-sof-pcm-add-pointer-callback-to-sof_ipc_pcm_ops.patch asoc-sof-ipc4-pcm-correct-the-delay-calculation.patch asoc-sof-intel-hda-compensate-llp-in-case-it-is-not-reset.patch +driver-core-introduce-device_link_wait_removal.patch +of-dynamic-synchronize-of_changeset_destroy-with-the-devlink-removals.patch +of-module-prevent-null-pointer-dereference-in-vsnprintf.patch +x86-mm-pat-fix-vm_pat-handling-in-cow-mappings.patch diff --git a/queue-6.8/x86-mm-pat-fix-vm_pat-handling-in-cow-mappings.patch b/queue-6.8/x86-mm-pat-fix-vm_pat-handling-in-cow-mappings.patch new file mode 100644 index 00000000000..a2e8ec213e2 --- /dev/null +++ b/queue-6.8/x86-mm-pat-fix-vm_pat-handling-in-cow-mappings.patch @@ -0,0 +1,230 @@ +From 04c35ab3bdae7fefbd7c7a7355f29fa03a035221 Mon Sep 17 00:00:00 2001 +From: David Hildenbrand +Date: Wed, 3 Apr 2024 23:21:30 +0200 +Subject: x86/mm/pat: fix VM_PAT handling in COW mappings + +From: David Hildenbrand + +commit 04c35ab3bdae7fefbd7c7a7355f29fa03a035221 upstream. + +PAT handling won't do the right thing in COW mappings: the first PTE (or, +in fact, all PTEs) can be replaced during write faults to point at anon +folios. Reliably recovering the correct PFN and cachemode using +follow_phys() from PTEs will not work in COW mappings. + +Using follow_phys(), we might just get the address+protection of the anon +folio (which is very wrong), or fail on swap/nonswap entries, failing +follow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and +track_pfn_copy(), not properly calling free_pfn_range(). + +In free_pfn_range(), we either wouldn't call memtype_free() or would call +it with the wrong range, possibly leaking memory. + +To fix that, let's update follow_phys() to refuse returning anon folios, +and fallback to using the stored PFN inside vma->vm_pgoff for COW mappings +if we run into that. + +We will now properly handle untrack_pfn() with COW mappings, where we +don't need the cachemode. We'll have to fail fork()->track_pfn_copy() if +the first page was replaced by an anon folio, though: we'd have to store +the cachemode in the VMA to make this work, likely growing the VMA size. + +For now, lets keep it simple and let track_pfn_copy() just fail in that +case: it would have failed in the past with swap/nonswap entries already, +and it would have done the wrong thing with anon folios. + +Simple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn(): + +<--- C reproducer ---> + #include + #include + #include + #include + + int main(void) + { + struct io_uring_params p = {}; + int ring_fd; + size_t size; + char *map; + + ring_fd = io_uring_setup(1, &p); + if (ring_fd < 0) { + perror("io_uring_setup"); + return 1; + } + size = p.sq_off.array + p.sq_entries * sizeof(unsigned); + + /* Map the submission queue ring MAP_PRIVATE */ + map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE, + ring_fd, IORING_OFF_SQ_RING); + if (map == MAP_FAILED) { + perror("mmap"); + return 1; + } + + /* We have at least one page. Let's COW it. */ + *map = 0; + pause(); + return 0; + } +<--- C reproducer ---> + +On a system with 16 GiB RAM and swap configured: + # ./iouring & + # memhog 16G + # killall iouring +[ 301.552930] ------------[ cut here ]------------ +[ 301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100 +[ 301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g +[ 301.558232] CPU: 7 PID: 1402 Comm: iouring Not tainted 6.7.5-100.fc38.x86_64 #1 +[ 301.558772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4 +[ 301.559569] RIP: 0010:untrack_pfn+0xf4/0x100 +[ 301.559893] Code: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b 6b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000 +[ 301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282 +[ 301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 000000010455e047 +[ 301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200 +[ 301.562628] RBP: 0000000000000000 R08: ffffba2c0377fab8 R09: 0000000000000000 +[ 301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000 +[ 301.563669] R13: 0000000000000000 R14: ffffba2c0377fc08 R15: 0000000000000000 +[ 301.564186] FS: 0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000 +[ 301.564773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0 +[ 301.565725] PKRU: 55555554 +[ 301.565944] Call Trace: +[ 301.566148] +[ 301.566325] ? untrack_pfn+0xf4/0x100 +[ 301.566618] ? __warn+0x81/0x130 +[ 301.566876] ? untrack_pfn+0xf4/0x100 +[ 301.567163] ? report_bug+0x171/0x1a0 +[ 301.567466] ? handle_bug+0x3c/0x80 +[ 301.567743] ? exc_invalid_op+0x17/0x70 +[ 301.568038] ? asm_exc_invalid_op+0x1a/0x20 +[ 301.568363] ? untrack_pfn+0xf4/0x100 +[ 301.568660] ? untrack_pfn+0x65/0x100 +[ 301.568947] unmap_single_vma+0xa6/0xe0 +[ 301.569247] unmap_vmas+0xb5/0x190 +[ 301.569532] exit_mmap+0xec/0x340 +[ 301.569801] __mmput+0x3e/0x130 +[ 301.570051] do_exit+0x305/0xaf0 +... + +Link: https://lkml.kernel.org/r/20240403212131.929421-3-david@redhat.com +Signed-off-by: David Hildenbrand +Reported-by: Wupeng Ma +Closes: https://lkml.kernel.org/r/20240227122814.3781907-1-mawupeng1@huawei.com +Fixes: b1a86e15dc03 ("x86, pat: remove the dependency on 'vm_pgoff' in track/untrack pfn vma routines") +Fixes: 5899329b1910 ("x86: PAT: implement track/untrack of pfnmap regions for x86 - v3") +Acked-by: Ingo Molnar +Cc: Dave Hansen +Cc: Andy Lutomirski +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Borislav Petkov +Cc: "H. Peter Anvin" +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/mm/pat/memtype.c | 49 ++++++++++++++++++++++++++++++++-------------- + mm/memory.c | 4 +++ + 2 files changed, 39 insertions(+), 14 deletions(-) + +--- a/arch/x86/mm/pat/memtype.c ++++ b/arch/x86/mm/pat/memtype.c +@@ -950,6 +950,38 @@ static void free_pfn_range(u64 paddr, un + memtype_free(paddr, paddr + size); + } + ++static int get_pat_info(struct vm_area_struct *vma, resource_size_t *paddr, ++ pgprot_t *pgprot) ++{ ++ unsigned long prot; ++ ++ VM_WARN_ON_ONCE(!(vma->vm_flags & VM_PAT)); ++ ++ /* ++ * We need the starting PFN and cachemode used for track_pfn_remap() ++ * that covered the whole VMA. For most mappings, we can obtain that ++ * information from the page tables. For COW mappings, we might now ++ * suddenly have anon folios mapped and follow_phys() will fail. ++ * ++ * Fallback to using vma->vm_pgoff, see remap_pfn_range_notrack(), to ++ * detect the PFN. If we need the cachemode as well, we're out of luck ++ * for now and have to fail fork(). ++ */ ++ if (!follow_phys(vma, vma->vm_start, 0, &prot, paddr)) { ++ if (pgprot) ++ *pgprot = __pgprot(prot); ++ return 0; ++ } ++ if (is_cow_mapping(vma->vm_flags)) { ++ if (pgprot) ++ return -EINVAL; ++ *paddr = (resource_size_t)vma->vm_pgoff << PAGE_SHIFT; ++ return 0; ++ } ++ WARN_ON_ONCE(1); ++ return -EINVAL; ++} ++ + /* + * track_pfn_copy is called when vma that is covering the pfnmap gets + * copied through copy_page_range(). +@@ -960,20 +992,13 @@ static void free_pfn_range(u64 paddr, un + int track_pfn_copy(struct vm_area_struct *vma) + { + resource_size_t paddr; +- unsigned long prot; + unsigned long vma_size = vma->vm_end - vma->vm_start; + pgprot_t pgprot; + + if (vma->vm_flags & VM_PAT) { +- /* +- * reserve the whole chunk covered by vma. We need the +- * starting address and protection from pte. +- */ +- if (follow_phys(vma, vma->vm_start, 0, &prot, &paddr)) { +- WARN_ON_ONCE(1); ++ if (get_pat_info(vma, &paddr, &pgprot)) + return -EINVAL; +- } +- pgprot = __pgprot(prot); ++ /* reserve the whole chunk covered by vma. */ + return reserve_pfn_range(paddr, vma_size, &pgprot, 1); + } + +@@ -1048,7 +1073,6 @@ void untrack_pfn(struct vm_area_struct * + unsigned long size, bool mm_wr_locked) + { + resource_size_t paddr; +- unsigned long prot; + + if (vma && !(vma->vm_flags & VM_PAT)) + return; +@@ -1056,11 +1080,8 @@ void untrack_pfn(struct vm_area_struct * + /* free the chunk starting from pfn or the whole chunk */ + paddr = (resource_size_t)pfn << PAGE_SHIFT; + if (!paddr && !size) { +- if (follow_phys(vma, vma->vm_start, 0, &prot, &paddr)) { +- WARN_ON_ONCE(1); ++ if (get_pat_info(vma, &paddr, NULL)) + return; +- } +- + size = vma->vm_end - vma->vm_start; + } + free_pfn_range(paddr, size); +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -5837,6 +5837,10 @@ int follow_phys(struct vm_area_struct *v + goto out; + pte = ptep_get(ptep); + ++ /* Never return PFNs of anon folios in COW mappings. */ ++ if (vm_normal_folio(vma, address, pte)) ++ goto unlock; ++ + if ((flags & FOLL_WRITE) && !pte_write(pte)) + goto unlock; +