From: Greg Kroah-Hartman Date: Thu, 12 Dec 2024 08:34:49 +0000 (+0100) Subject: 6.12-stable patches X-Git-Tag: v5.4.287~45 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=869556da32fc7926386416094372af74af62c37f;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: jffs2-fix-rtime-decompressor.patch jffs2-prevent-rtime-decompress-memory-corruption.patch kvm-x86-mmu-ensure-that-kvm_release_pfn_clean-takes-exact-pfn-from-kvm_faultin_pfn.patch --- diff --git a/queue-6.12/jffs2-fix-rtime-decompressor.patch b/queue-6.12/jffs2-fix-rtime-decompressor.patch new file mode 100644 index 00000000000..f1410bcceb0 --- /dev/null +++ b/queue-6.12/jffs2-fix-rtime-decompressor.patch @@ -0,0 +1,32 @@ +From b29bf7119d6bbfd04aabb8d82b060fe2a33ef890 Mon Sep 17 00:00:00 2001 +From: Richard Weinberger +Date: Tue, 3 Dec 2024 12:27:15 +0100 +Subject: jffs2: Fix rtime decompressor + +From: Richard Weinberger + +commit b29bf7119d6bbfd04aabb8d82b060fe2a33ef890 upstream. + +The fix for a memory corruption contained a off-by-one error and +caused the compressor to fail in legit cases. + +Cc: Kinsey Moore +Cc: stable@vger.kernel.org +Fixes: fe051552f5078 ("jffs2: Prevent rtime decompress memory corruption") +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman +--- + fs/jffs2/compr_rtime.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/jffs2/compr_rtime.c ++++ b/fs/jffs2/compr_rtime.c +@@ -95,7 +95,7 @@ static int jffs2_rtime_decompress(unsign + + positions[value]=outpos; + if (repeat) { +- if ((outpos + repeat) >= destlen) { ++ if ((outpos + repeat) > destlen) { + return 1; + } + if (backoffs + repeat >= outpos) { diff --git a/queue-6.12/jffs2-prevent-rtime-decompress-memory-corruption.patch b/queue-6.12/jffs2-prevent-rtime-decompress-memory-corruption.patch new file mode 100644 index 00000000000..078df2a6d66 --- /dev/null +++ b/queue-6.12/jffs2-prevent-rtime-decompress-memory-corruption.patch @@ -0,0 +1,34 @@ +From fe051552f5078fa02d593847529a3884305a6ffe Mon Sep 17 00:00:00 2001 +From: Kinsey Moore +Date: Tue, 23 Jul 2024 15:58:05 -0500 +Subject: jffs2: Prevent rtime decompress memory corruption + +From: Kinsey Moore + +commit fe051552f5078fa02d593847529a3884305a6ffe upstream. + +The rtime decompression routine does not fully check bounds during the +entirety of the decompression pass and can corrupt memory outside the +decompression buffer if the compressed data is corrupted. This adds the +required check to prevent this failure mode. + +Cc: stable@vger.kernel.org +Signed-off-by: Kinsey Moore +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman +--- + fs/jffs2/compr_rtime.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/jffs2/compr_rtime.c ++++ b/fs/jffs2/compr_rtime.c +@@ -95,6 +95,9 @@ static int jffs2_rtime_decompress(unsign + + positions[value]=outpos; + if (repeat) { ++ if ((outpos + repeat) >= destlen) { ++ return 1; ++ } + if (backoffs + repeat >= outpos) { + while(repeat) { + cpage_out[outpos++] = cpage_out[backoffs++]; diff --git a/queue-6.12/kvm-x86-mmu-ensure-that-kvm_release_pfn_clean-takes-exact-pfn-from-kvm_faultin_pfn.patch b/queue-6.12/kvm-x86-mmu-ensure-that-kvm_release_pfn_clean-takes-exact-pfn-from-kvm_faultin_pfn.patch new file mode 100644 index 00000000000..59be7f70786 --- /dev/null +++ b/queue-6.12/kvm-x86-mmu-ensure-that-kvm_release_pfn_clean-takes-exact-pfn-from-kvm_faultin_pfn.patch @@ -0,0 +1,136 @@ +From stable+bounces-100060-greg=kroah.com@vger.kernel.org Sun Dec 8 09:39:54 2024 +From: Nikolay Kuratov +Date: Sun, 8 Dec 2024 11:38:30 +0300 +Subject: KVM: x86/mmu: Ensure that kvm_release_pfn_clean() takes exact pfn from kvm_faultin_pfn() +To: stable@vger.kernel.org +Cc: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, x86@kernel.org, Sean Christopherson , Paolo Bonzini , Thomas Gleixner , Matthew Wilcox , Christoph Hellwig , Nikolay Kuratov +Message-ID: <20241208083830.77587-1-kniv@yandex-team.ru> + +From: Nikolay Kuratov + +Since 5.16 and prior to 6.13 KVM can't be used with FSDAX +guest memory (PMD pages). To reproduce the issue you need to reserve +guest memory with `memmap=` cmdline, create and mount FS in DAX mode +(tested both XFS and ext4), see doc link below. ndctl command for test: +ndctl create-namespace -v -e namespace1.0 --map=dev --mode=fsdax -a 2M +Then pass memory object to qemu like: +-m 8G -object memory-backend-file,id=ram0,size=8G,\ +mem-path=/mnt/pmem/guestmem,share=on,prealloc=on,dump=off,align=2097152 \ +-numa node,memdev=ram0,cpus=0-1 +QEMU fails to run guest with error: kvm run failed Bad address +and there are two warnings in dmesg: +WARN_ON_ONCE(!page_count(page)) in kvm_is_zone_device_page() and +WARN_ON_ONCE(folio_ref_count(folio) <= 0) in try_grab_folio() (v6.6.63) + +It looks like in the past assumption was made that pfn won't change from +faultin_pfn() to release_pfn_clean(), e.g. see +commit 4cd071d13c5c ("KVM: x86/mmu: Move calls to thp_adjust() down a level") +But kvm_page_fault structure made pfn part of mutable state, so +now release_pfn_clean() can take hugepage-adjusted pfn. +And it works for all cases (/dev/shm, hugetlb, devdax) except fsdax. +Apparently in fsdax mode faultin-pfn and adjusted-pfn may refer to +different folios, so we're getting get_page/put_page imbalance. + +To solve this preserve faultin pfn in separate local variable +and pass it in kvm_release_pfn_clean(). + +Patch tested for all mentioned guest memory backends with tdp_mmu={0,1}. + +No bug in upstream as it was solved fundamentally by +commit 8dd861cc07e2 ("KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns") +and related patch series. + +Link: https://nvdimm.docs.kernel.org/2mib_fs_dax.html +Fixes: 2f6305dd5676 ("KVM: MMU: change kvm_tdp_mmu_map() arguments to kvm_page_fault") +Co-developed-by: Sean Christopherson +Signed-off-by: Sean Christopherson +Reviewed-by: Sean Christopherson +Signed-off-by: Nikolay Kuratov +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/mmu/mmu.c | 10 ++++++++-- + arch/x86/kvm/mmu/paging_tmpl.h | 5 ++++- + 2 files changed, 12 insertions(+), 3 deletions(-) + +--- a/arch/x86/kvm/mmu/mmu.c ++++ b/arch/x86/kvm/mmu/mmu.c +@@ -4580,6 +4580,7 @@ static bool is_page_fault_stale(struct k + + static int direct_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault) + { ++ kvm_pfn_t orig_pfn; + int r; + + /* Dummy roots are used only for shadowing bad guest roots. */ +@@ -4601,6 +4602,8 @@ static int direct_page_fault(struct kvm_ + if (r != RET_PF_CONTINUE) + return r; + ++ orig_pfn = fault->pfn; ++ + r = RET_PF_RETRY; + write_lock(&vcpu->kvm->mmu_lock); + +@@ -4615,7 +4618,7 @@ static int direct_page_fault(struct kvm_ + + out_unlock: + write_unlock(&vcpu->kvm->mmu_lock); +- kvm_release_pfn_clean(fault->pfn); ++ kvm_release_pfn_clean(orig_pfn); + return r; + } + +@@ -4675,6 +4678,7 @@ EXPORT_SYMBOL_GPL(kvm_handle_page_fault) + static int kvm_tdp_mmu_page_fault(struct kvm_vcpu *vcpu, + struct kvm_page_fault *fault) + { ++ kvm_pfn_t orig_pfn; + int r; + + if (page_fault_handle_page_track(vcpu, fault)) +@@ -4692,6 +4696,8 @@ static int kvm_tdp_mmu_page_fault(struct + if (r != RET_PF_CONTINUE) + return r; + ++ orig_pfn = fault->pfn; ++ + r = RET_PF_RETRY; + read_lock(&vcpu->kvm->mmu_lock); + +@@ -4702,7 +4708,7 @@ static int kvm_tdp_mmu_page_fault(struct + + out_unlock: + read_unlock(&vcpu->kvm->mmu_lock); +- kvm_release_pfn_clean(fault->pfn); ++ kvm_release_pfn_clean(orig_pfn); + return r; + } + #endif +--- a/arch/x86/kvm/mmu/paging_tmpl.h ++++ b/arch/x86/kvm/mmu/paging_tmpl.h +@@ -778,6 +778,7 @@ static int FNAME(fetch)(struct kvm_vcpu + static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault) + { + struct guest_walker walker; ++ kvm_pfn_t orig_pfn; + int r; + + WARN_ON_ONCE(fault->is_tdp); +@@ -836,6 +837,8 @@ static int FNAME(page_fault)(struct kvm_ + walker.pte_access &= ~ACC_EXEC_MASK; + } + ++ orig_pfn = fault->pfn; ++ + r = RET_PF_RETRY; + write_lock(&vcpu->kvm->mmu_lock); + +@@ -849,7 +852,7 @@ static int FNAME(page_fault)(struct kvm_ + + out_unlock: + write_unlock(&vcpu->kvm->mmu_lock); +- kvm_release_pfn_clean(fault->pfn); ++ kvm_release_pfn_clean(orig_pfn); + return r; + } + diff --git a/queue-6.12/series b/queue-6.12/series index daa5d83afab..91114b8d46a 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -453,3 +453,6 @@ x86-fix-build-regression-with-config_kexec_jump-enab.patch revert-unicode-don-t-special-case-ignorable-code-poi.patch vfio-mlx5-align-the-page-tracking-max-message-size-w.patch selftests-ftrace-adjust-offset-for-kprobe-syntax-err.patch +kvm-x86-mmu-ensure-that-kvm_release_pfn_clean-takes-exact-pfn-from-kvm_faultin_pfn.patch +jffs2-prevent-rtime-decompress-memory-corruption.patch +jffs2-fix-rtime-decompressor.patch