From: Greg Kroah-Hartman Date: Fri, 14 Feb 2025 13:30:11 +0000 (+0100) Subject: 6.13-stable patches X-Git-Tag: v6.6.78~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=86020cc051f916054915db09de390c4a86e4c47d;p=thirdparty%2Fkernel%2Fstable-queue.git 6.13-stable patches added patches: fs-netfs-read_collect-fix-crash-due-to-uninitialized-prev-variable.patch fs-netfs-read_pgpriv2-skip-folio-queues-without-marks3.patch --- diff --git a/queue-6.13/fs-netfs-read_collect-fix-crash-due-to-uninitialized-prev-variable.patch b/queue-6.13/fs-netfs-read_collect-fix-crash-due-to-uninitialized-prev-variable.patch new file mode 100644 index 0000000000..bcd29510ae --- /dev/null +++ b/queue-6.13/fs-netfs-read_collect-fix-crash-due-to-uninitialized-prev-variable.patch @@ -0,0 +1,109 @@ +From stable+bounces-116416-greg=kroah.com@vger.kernel.org Fri Feb 14 14:19:30 2025 +From: Max Kellermann +Date: Fri, 14 Feb 2025 14:12:25 +0100 +Subject: fs/netfs/read_collect: fix crash due to uninitialized `prev` variable +To: dhowells@redhat.com, netfs@lists.linux.dev, linux-kernel@vger.kernel.org +Cc: Max Kellermann , stable@vger.kernel.org +Message-ID: <20250214131225.492756-1-max.kellermann@ionos.com> + +From: Max Kellermann + +[ Just like the other two netfs patches I sent yesterday, this one + doesn't apply to v6.14 as it was obsoleted by commit e2d46f2ec332 + ("netfs: Change the read result collector to only use one work item"). ] + +When checking whether the edges of adjacent subrequests touch, the +`prev` variable is deferenced, but it might not have been initialized. +This causes crashes like this one: + + BUG: unable to handle page fault for address: 0000000181343843 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 8000001c66db0067 P4D 8000001c66db0067 PUD 0 + Oops: Oops: 0000 [#1] SMP PTI + CPU: 1 UID: 33333 PID: 24424 Comm: php-cgi8.2 Kdump: loaded Not tainted 6.13.2-cm4all0-hp+ #427 + Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 11/23/2021 + RIP: 0010:netfs_consume_read_data.isra.0+0x5ef/0xb00 + Code: fe ff ff 48 8b 83 88 00 00 00 48 8b 4c 24 30 4c 8b 43 78 48 85 c0 48 8d 51 70 75 20 48 8b 73 30 48 39 d6 74 17 48 8b 7c 24 40 <48> 8b 4f 78 48 03 4f 68 48 39 4b 68 0f 84 ab 02 00 00 49 29 c0 48 + RSP: 0000:ffffc90037adbd00 EFLAGS: 00010283 + RAX: 0000000000000000 RBX: ffff88811bda0600 RCX: ffff888620e7b980 + RDX: ffff888620e7b9f0 RSI: ffff88811bda0428 RDI: 00000001813437cb + RBP: 0000000000000000 R08: 0000000000004000 R09: 0000000000000000 + R10: ffffffff82e070c0 R11: 0000000007ffffff R12: 0000000000004000 + R13: ffff888620e7bb68 R14: 0000000000008000 R15: ffff888620e7bb68 + FS: 00007ff2e0e7ddc0(0000) GS:ffff88981f840000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000181343843 CR3: 0000001bc10ba006 CR4: 00000000001706f0 + Call Trace: + + ? __die+0x1f/0x60 + ? page_fault_oops+0x15c/0x450 + ? search_extable+0x22/0x30 + ? netfs_consume_read_data.isra.0+0x5ef/0xb00 + ? search_module_extables+0xe/0x40 + ? exc_page_fault+0x5e/0x100 + ? asm_exc_page_fault+0x22/0x30 + ? netfs_consume_read_data.isra.0+0x5ef/0xb00 + ? intel_iommu_unmap_pages+0xaa/0x190 + ? __pfx_cachefiles_read_complete+0x10/0x10 + netfs_read_subreq_terminated+0x24f/0x390 + cachefiles_read_complete+0x48/0xf0 + iomap_dio_bio_end_io+0x125/0x160 + blk_update_request+0xea/0x3e0 + scsi_end_request+0x27/0x190 + scsi_io_completion+0x43/0x6c0 + blk_complete_reqs+0x40/0x50 + handle_softirqs+0xd1/0x280 + irq_exit_rcu+0x91/0xb0 + common_interrupt+0x3b/0xa0 + asm_common_interrupt+0x22/0x40 + RIP: 0033:0x55fe8470d2ab + Code: 00 00 3c 7e 74 3b 3c b6 0f 84 dd 03 00 00 3c 1e 74 2f 83 c1 01 48 83 c2 38 48 83 c7 30 44 39 d1 74 3e 48 63 42 08 85 c0 79 a3 <49> 8b 46 48 8b 04 38 f6 c4 04 75 0b 0f b6 42 30 83 e0 0c 3c 04 75 + RSP: 002b:00007ffca5ef2720 EFLAGS: 00000216 + RAX: 0000000000000023 RBX: 0000000000000008 RCX: 000000000000001b + RDX: 00007ff2e0cdb6f8 RSI: 0000000000000006 RDI: 0000000000000510 + RBP: 00007ffca5ef27a0 R08: 00007ffca5ef2720 R09: 0000000000000001 + R10: 000000000000001e R11: 00007ff2e0c10d08 R12: 0000000000000001 + R13: 0000000000000120 R14: 00007ff2e0cb1ed0 R15: 00000000000000b0 + + +Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") +Cc: stable@vger.kernel.org +Signed-off-by: Max Kellermann +Signed-off-by: David Howells +Signed-off-by: Greg Kroah-Hartman +--- + fs/netfs/read_collect.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +--- a/fs/netfs/read_collect.c ++++ b/fs/netfs/read_collect.c +@@ -258,17 +258,18 @@ donation_changed: + */ + if (!subreq->consumed && + !prev_donated && +- !list_is_first(&subreq->rreq_link, &rreq->subrequests) && +- subreq->start == prev->start + prev->len) { ++ !list_is_first(&subreq->rreq_link, &rreq->subrequests)) { + prev = list_prev_entry(subreq, rreq_link); +- WRITE_ONCE(prev->next_donated, prev->next_donated + subreq->len); +- subreq->start += subreq->len; +- subreq->len = 0; +- subreq->transferred = 0; +- trace_netfs_donate(rreq, subreq, prev, subreq->len, +- netfs_trace_donate_to_prev); +- trace_netfs_sreq(subreq, netfs_sreq_trace_donate_to_prev); +- goto remove_subreq_locked; ++ if (subreq->start == prev->start + prev->len) { ++ WRITE_ONCE(prev->next_donated, prev->next_donated + subreq->len); ++ subreq->start += subreq->len; ++ subreq->len = 0; ++ subreq->transferred = 0; ++ trace_netfs_donate(rreq, subreq, prev, subreq->len, ++ netfs_trace_donate_to_prev); ++ trace_netfs_sreq(subreq, netfs_sreq_trace_donate_to_prev); ++ goto remove_subreq_locked; ++ } + } + + /* If we can't donate down the chain, donate up the chain instead. */ diff --git a/queue-6.13/fs-netfs-read_pgpriv2-skip-folio-queues-without-marks3.patch b/queue-6.13/fs-netfs-read_pgpriv2-skip-folio-queues-without-marks3.patch new file mode 100644 index 0000000000..db05c83956 --- /dev/null +++ b/queue-6.13/fs-netfs-read_pgpriv2-skip-folio-queues-without-marks3.patch @@ -0,0 +1,94 @@ +From stable+bounces-114731-greg=kroah.com@vger.kernel.org Mon Feb 10 23:32:01 2025 +From: Max Kellermann +Date: Mon, 10 Feb 2025 23:31:44 +0100 +Subject: fs/netfs/read_pgpriv2: skip folio queues without `marks3` +To: dhowells@redhat.com, netfs@lists.linux.dev, linux-kernel@vger.kernel.org +Cc: Max Kellermann , stable@vger.kernel.org +Message-ID: <20250210223144.3481766-1-max.kellermann@ionos.com> + +From: Max Kellermann + +[ Note this patch doesn't apply to v6.14 as it was obsoleted by commit + e2d46f2ec332 ("netfs: Change the read result collector to only use one + work item"). ] + +At the beginning of the function, folio queues with marks3==0 are +skipped, but after that, the `marks3` field is ignored. If one such +queue is found, `slot` is set to 64 (because `__ffs(0)==64`), leading +to a buffer overflow in the folioq_folio() call. The resulting crash +may look like this: + + BUG: kernel NULL pointer dereference, address: 0000000000000000 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: Oops: 0000 [#1] SMP PTI + CPU: 11 UID: 0 PID: 2909 Comm: kworker/u262:1 Not tainted 6.13.1-cm4all2-vm #415 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 + Workqueue: events_unbound netfs_read_termination_worker + RIP: 0010:netfs_pgpriv2_write_to_the_cache+0x15a/0x3f0 + Code: 48 85 c0 48 89 44 24 08 0f 84 24 01 00 00 48 8b 80 40 01 00 00 48 8b 7c 24 08 f3 48 0f bc c0 89 44 24 18 89 c0 48 8b 74 c7 08 <48> 8b 06 48 c7 04 24 00 10 00 00 a8 40 74 10 0f b6 4e 40 b8 00 10 + RSP: 0018:ffffbbc440effe18 EFLAGS: 00010203 + RAX: 0000000000000040 RBX: ffff96f8fc034000 RCX: 0000000000000000 + RDX: 0000000000000040 RSI: 0000000000000000 RDI: ffff96f8fc036400 + RBP: 0000000000001000 R08: ffff96f9132bb400 R09: 0000000000001000 + R10: ffff96f8c1263c80 R11: 0000000000000003 R12: 0000000000001000 + R13: ffff96f8fb75ade8 R14: fffffaaf5ca90000 R15: ffff96f8fb75ad00 + FS: 0000000000000000(0000) GS:ffff9703cf0c0000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000000 CR3: 000000010c9ca003 CR4: 00000000001706b0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + + ? __die+0x1f/0x60 + ? page_fault_oops+0x158/0x450 + ? search_extable+0x22/0x30 + ? netfs_pgpriv2_write_to_the_cache+0x15a/0x3f0 + ? search_module_extables+0xe/0x40 + ? exc_page_fault+0x62/0x120 + ? asm_exc_page_fault+0x22/0x30 + ? netfs_pgpriv2_write_to_the_cache+0x15a/0x3f0 + ? netfs_pgpriv2_write_to_the_cache+0xf6/0x3f0 + netfs_read_termination_worker+0x1f/0x60 + process_one_work+0x138/0x2d0 + worker_thread+0x2a5/0x3b0 + ? __pfx_worker_thread+0x10/0x10 + kthread+0xba/0xe0 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x30/0x50 + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1a/0x30 + + +Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") +Cc: stable@vger.kernel.org +Signed-off-by: Max Kellermann +Signed-off-by: David Howells +Signed-off-by: Greg Kroah-Hartman +--- + fs/netfs/read_pgpriv2.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/fs/netfs/read_pgpriv2.c ++++ b/fs/netfs/read_pgpriv2.c +@@ -181,16 +181,17 @@ void netfs_pgpriv2_write_to_the_cache(st + break; + + folioq_unmark3(folioq, slot); +- if (!folioq->marks3) { ++ while (!folioq->marks3) { + folioq = folioq->next; + if (!folioq) +- break; ++ goto end_of_queue; + } + + slot = __ffs(folioq->marks3); + folio = folioq_folio(folioq, slot); + } + ++end_of_queue: + netfs_issue_write(wreq, &wreq->io_streams[1]); + smp_wmb(); /* Write lists before ALL_QUEUED. */ + set_bit(NETFS_RREQ_ALL_QUEUED, &wreq->flags); diff --git a/queue-6.13/series b/queue-6.13/series index a3b50bdfce..071f9554c9 100644 --- a/queue-6.13/series +++ b/queue-6.13/series @@ -440,3 +440,5 @@ revert-drm-amd-display-fix-green-screen-issue-after-suspend.patch wifi-rtw89-pci-disable-pcie-wake-bit-when-pcie-deinit.patch fs-prepend-statmount.mnt_opts-string-with-security_sb_mnt_opts.patch fs-fix-adding-security-options-to-statmount.mnt_opt.patch +fs-netfs-read_pgpriv2-skip-folio-queues-without-marks3.patch +fs-netfs-read_collect-fix-crash-due-to-uninitialized-prev-variable.patch