From: Greg Kroah-Hartman Date: Mon, 8 Apr 2024 10:35:04 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v5.15.154~35 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=989790652e4ae9a271c9338657e6332a6744ef37;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: arm64-ptrace-use-saved-floating-point-state-type-to-determine-sve-layout.patch drm-i915-gt-disable-hw-load-balancing-for-ccs.patch drm-i915-gt-do-not-generate-the-command-streamer-for-all-the-ccs.patch drm-i915-gt-enable-only-one-ccs-for-compute-workload.patch mm-secretmem-fix-gup-fast-succeeding-on-secretmem-folios.patch riscv-fix-spurious-errors-from-__get-put_kernel_nofault.patch riscv-process-fix-kernel-gp-leakage.patch s390-entry-align-system-call-table-on-8-bytes.patch selftests-mm-include-strings.h-for-ffsl.patch smb-client-fix-potential-uaf-in-cifs_debug_files_proc_show.patch smb-client-fix-potential-uaf-in-cifs_dump_full_key.patch smb-client-fix-potential-uaf-in-cifs_signal_cifsd_for_reconnect.patch smb-client-fix-potential-uaf-in-cifs_stats_proc_show.patch smb-client-fix-potential-uaf-in-cifs_stats_proc_write.patch smb-client-fix-potential-uaf-in-is_valid_oplock_break.patch smb-client-fix-potential-uaf-in-smb2_is_network_name_deleted.patch smb-client-fix-potential-uaf-in-smb2_is_valid_lease_break.patch smb-client-fix-potential-uaf-in-smb2_is_valid_oplock_break.patch smb-client-handle-dfs-tcons-in-cifs_construct_tcon.patch smb-client-serialise-cifs_construct_tcon-with-cifs_mount_mutex.patch smb3-retrying-on-failed-server-close.patch --- diff --git a/queue-6.6/arm64-ptrace-use-saved-floating-point-state-type-to-determine-sve-layout.patch b/queue-6.6/arm64-ptrace-use-saved-floating-point-state-type-to-determine-sve-layout.patch new file mode 100644 index 00000000000..36e909cc1ee --- /dev/null +++ b/queue-6.6/arm64-ptrace-use-saved-floating-point-state-type-to-determine-sve-layout.patch @@ -0,0 +1,61 @@ +From b017a0cea627fcbe158fc2c214fe893e18c4d0c4 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Mon, 25 Mar 2024 16:35:21 +0000 +Subject: arm64/ptrace: Use saved floating point state type to determine SVE layout + +From: Mark Brown + +commit b017a0cea627fcbe158fc2c214fe893e18c4d0c4 upstream. + +The SVE register sets have two different formats, one of which is a wrapped +version of the standard FPSIMD register set and another with actual SVE +register data. At present we check TIF_SVE to see if full SVE register +state should be provided when reading the SVE regset but if we were in a +syscall we may have saved only floating point registers even though that is +set. + +Fix this and simplify the logic by checking and using the format which we +recorded when deciding if we should use FPSIMD or SVE format. + +Fixes: 8c845e273104 ("arm64/sve: Leave SVE enabled on syscall if we don't context switch") +Cc: # 6.2.x +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20240325-arm64-ptrace-fp-type-v1-1-8dc846caf11f@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kernel/ptrace.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/arch/arm64/kernel/ptrace.c ++++ b/arch/arm64/kernel/ptrace.c +@@ -728,7 +728,6 @@ static void sve_init_header_from_task(st + { + unsigned int vq; + bool active; +- bool fpsimd_only; + enum vec_type task_type; + + memset(header, 0, sizeof(*header)); +@@ -744,12 +743,10 @@ static void sve_init_header_from_task(st + case ARM64_VEC_SVE: + if (test_tsk_thread_flag(target, TIF_SVE_VL_INHERIT)) + header->flags |= SVE_PT_VL_INHERIT; +- fpsimd_only = !test_tsk_thread_flag(target, TIF_SVE); + break; + case ARM64_VEC_SME: + if (test_tsk_thread_flag(target, TIF_SME_VL_INHERIT)) + header->flags |= SVE_PT_VL_INHERIT; +- fpsimd_only = false; + break; + default: + WARN_ON_ONCE(1); +@@ -757,7 +754,7 @@ static void sve_init_header_from_task(st + } + + if (active) { +- if (fpsimd_only) { ++ if (target->thread.fp_type == FP_STATE_FPSIMD) { + header->flags |= SVE_PT_REGS_FPSIMD; + } else { + header->flags |= SVE_PT_REGS_SVE; diff --git a/queue-6.6/drm-i915-gt-disable-hw-load-balancing-for-ccs.patch b/queue-6.6/drm-i915-gt-disable-hw-load-balancing-for-ccs.patch new file mode 100644 index 00000000000..d4187eca97b --- /dev/null +++ b/queue-6.6/drm-i915-gt-disable-hw-load-balancing-for-ccs.patch @@ -0,0 +1,87 @@ +From bc9a1ec01289e6e7259dc5030b413a9c6654a99a Mon Sep 17 00:00:00 2001 +From: Andi Shyti +Date: Thu, 28 Mar 2024 08:34:03 +0100 +Subject: drm/i915/gt: Disable HW load balancing for CCS + +From: Andi Shyti + +commit bc9a1ec01289e6e7259dc5030b413a9c6654a99a upstream. + +The hardware should not dynamically balance the load between CCS +engines. Wa_14019159160 recommends disabling it across all +platforms. + +Fixes: d2eae8e98d59 ("drm/i915/dg2: Drop force_probe requirement") +Signed-off-by: Andi Shyti +Cc: Chris Wilson +Cc: Joonas Lahtinen +Cc: Matt Roper +Cc: # v6.2+ +Reviewed-by: Matt Roper +Acked-by: Michal Mrozek +Link: https://patchwork.freedesktop.org/patch/msgid/20240328073409.674098-2-andi.shyti@linux.intel.com +(cherry picked from commit f5d2904cf814f20b79e3e4c1b24a4ccc2411b7e0) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gt/intel_gt_regs.h | 1 + + drivers/gpu/drm/i915/gt/intel_workarounds.c | 23 +++++++++++++++++++++-- + 2 files changed, 22 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h ++++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h +@@ -1468,6 +1468,7 @@ + #define ECOBITS_PPGTT_CACHE4B (0 << 8) + + #define GEN12_RCU_MODE _MMIO(0x14800) ++#define XEHP_RCU_MODE_FIXED_SLICE_CCS_MODE REG_BIT(1) + #define GEN12_RCU_MODE_CCS_ENABLE REG_BIT(0) + + #define CHV_FUSE_GT _MMIO(VLV_GUNIT_BASE + 0x2168) +--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c ++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c +@@ -50,7 +50,8 @@ + * registers belonging to BCS, VCS or VECS should be implemented in + * xcs_engine_wa_init(). Workarounds for registers not belonging to a specific + * engine's MMIO range but that are part of of the common RCS/CCS reset domain +- * should be implemented in general_render_compute_wa_init(). ++ * should be implemented in general_render_compute_wa_init(). The settings ++ * about the CCS load balancing should be added in ccs_engine_wa_mode(). + * + * - GT workarounds: the list of these WAs is applied whenever these registers + * revert to their default values: on GPU reset, suspend/resume [1]_, etc. +@@ -2823,6 +2824,22 @@ add_render_compute_tuning_settings(struc + wa_write_clr(wal, GEN8_GARBCNTL, GEN12_BUS_HASH_CTL_BIT_EXC); + } + ++static void ccs_engine_wa_mode(struct intel_engine_cs *engine, struct i915_wa_list *wal) ++{ ++ struct intel_gt *gt = engine->gt; ++ ++ if (!IS_DG2(gt->i915)) ++ return; ++ ++ /* ++ * Wa_14019159160: This workaround, along with others, leads to ++ * significant challenges in utilizing load balancing among the ++ * CCS slices. Consequently, an architectural decision has been ++ * made to completely disable automatic CCS load balancing. ++ */ ++ wa_masked_en(wal, GEN12_RCU_MODE, XEHP_RCU_MODE_FIXED_SLICE_CCS_MODE); ++} ++ + /* + * The workarounds in this function apply to shared registers in + * the general render reset domain that aren't tied to a +@@ -2970,8 +2987,10 @@ engine_init_workarounds(struct intel_eng + * to a single RCS/CCS engine's workaround list since + * they're reset as part of the general render domain reset. + */ +- if (engine->flags & I915_ENGINE_FIRST_RENDER_COMPUTE) ++ if (engine->flags & I915_ENGINE_FIRST_RENDER_COMPUTE) { + general_render_compute_wa_init(engine, wal); ++ ccs_engine_wa_mode(engine, wal); ++ } + + if (engine->class == COMPUTE_CLASS) + ccs_engine_wa_init(engine, wal); diff --git a/queue-6.6/drm-i915-gt-do-not-generate-the-command-streamer-for-all-the-ccs.patch b/queue-6.6/drm-i915-gt-do-not-generate-the-command-streamer-for-all-the-ccs.patch new file mode 100644 index 00000000000..464202d93c7 --- /dev/null +++ b/queue-6.6/drm-i915-gt-do-not-generate-the-command-streamer-for-all-the-ccs.patch @@ -0,0 +1,56 @@ +From ea315f98e5d6d3191b74beb0c3e5fc16081d517c Mon Sep 17 00:00:00 2001 +From: Andi Shyti +Date: Thu, 28 Mar 2024 08:34:04 +0100 +Subject: drm/i915/gt: Do not generate the command streamer for all the CCS + +From: Andi Shyti + +commit ea315f98e5d6d3191b74beb0c3e5fc16081d517c upstream. + +We want a fixed load CCS balancing consisting in all slices +sharing one single user engine. For this reason do not create the +intel_engine_cs structure with its dedicated command streamer for +CCS slices beyond the first. + +Fixes: d2eae8e98d59 ("drm/i915/dg2: Drop force_probe requirement") +Signed-off-by: Andi Shyti +Cc: Chris Wilson +Cc: Joonas Lahtinen +Cc: Matt Roper +Cc: # v6.2+ +Acked-by: Michal Mrozek +Reviewed-by: Matt Roper +Link: https://patchwork.freedesktop.org/patch/msgid/20240328073409.674098-3-andi.shyti@linux.intel.com +(cherry picked from commit c7a5aa4e57f88470313a8277eb299b221b86e3b1) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gt/intel_engine_cs.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c ++++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c +@@ -912,6 +912,23 @@ static intel_engine_mask_t init_engine_m + info->engine_mask &= ~BIT(GSC0); + } + ++ /* ++ * Do not create the command streamer for CCS slices beyond the first. ++ * All the workload submitted to the first engine will be shared among ++ * all the slices. ++ * ++ * Once the user will be allowed to customize the CCS mode, then this ++ * check needs to be removed. ++ */ ++ if (IS_DG2(gt->i915)) { ++ u8 first_ccs = __ffs(CCS_MASK(gt)); ++ ++ /* Mask off all the CCS engine */ ++ info->engine_mask &= ~GENMASK(CCS3, CCS0); ++ /* Put back in the first CCS engine */ ++ info->engine_mask |= BIT(_CCS(first_ccs)); ++ } ++ + return info->engine_mask; + } + diff --git a/queue-6.6/drm-i915-gt-enable-only-one-ccs-for-compute-workload.patch b/queue-6.6/drm-i915-gt-enable-only-one-ccs-for-compute-workload.patch new file mode 100644 index 00000000000..d88cb37fbe4 --- /dev/null +++ b/queue-6.6/drm-i915-gt-enable-only-one-ccs-for-compute-workload.patch @@ -0,0 +1,145 @@ +From 6db31251bb265813994bfb104eb4b4d0f44d64fb Mon Sep 17 00:00:00 2001 +From: Andi Shyti +Date: Thu, 28 Mar 2024 08:34:05 +0100 +Subject: drm/i915/gt: Enable only one CCS for compute workload + +From: Andi Shyti + +commit 6db31251bb265813994bfb104eb4b4d0f44d64fb upstream. + +Enable only one CCS engine by default with all the compute sices +allocated to it. + +While generating the list of UABI engines to be exposed to the +user, exclude any additional CCS engines beyond the first +instance. + +This change can be tested with igt i915_query. + +Fixes: d2eae8e98d59 ("drm/i915/dg2: Drop force_probe requirement") +Signed-off-by: Andi Shyti +Cc: Chris Wilson +Cc: Joonas Lahtinen +Cc: Matt Roper +Cc: # v6.2+ +Reviewed-by: Matt Roper +Acked-by: Michal Mrozek +Link: https://patchwork.freedesktop.org/patch/msgid/20240328073409.674098-4-andi.shyti@linux.intel.com +(cherry picked from commit 2bebae0112b117de7e8a7289277a4bd2403b9e17) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/Makefile | 1 + drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.c | 39 ++++++++++++++++++++++++++++ + drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.h | 13 +++++++++ + drivers/gpu/drm/i915/gt/intel_gt_regs.h | 5 +++ + drivers/gpu/drm/i915/gt/intel_workarounds.c | 7 +++++ + 5 files changed, 65 insertions(+) + create mode 100644 drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.c + create mode 100644 drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.h + +--- a/drivers/gpu/drm/i915/Makefile ++++ b/drivers/gpu/drm/i915/Makefile +@@ -104,6 +104,7 @@ gt-y += \ + gt/intel_ggtt_fencing.o \ + gt/intel_gt.o \ + gt/intel_gt_buffer_pool.o \ ++ gt/intel_gt_ccs_mode.o \ + gt/intel_gt_clock_utils.o \ + gt/intel_gt_debugfs.o \ + gt/intel_gt_engines_debugfs.o \ +--- /dev/null ++++ b/drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.c +@@ -0,0 +1,39 @@ ++// SPDX-License-Identifier: MIT ++/* ++ * Copyright © 2024 Intel Corporation ++ */ ++ ++#include "i915_drv.h" ++#include "intel_gt.h" ++#include "intel_gt_ccs_mode.h" ++#include "intel_gt_regs.h" ++ ++void intel_gt_apply_ccs_mode(struct intel_gt *gt) ++{ ++ int cslice; ++ u32 mode = 0; ++ int first_ccs = __ffs(CCS_MASK(gt)); ++ ++ if (!IS_DG2(gt->i915)) ++ return; ++ ++ /* Build the value for the fixed CCS load balancing */ ++ for (cslice = 0; cslice < I915_MAX_CCS; cslice++) { ++ if (CCS_MASK(gt) & BIT(cslice)) ++ /* ++ * If available, assign the cslice ++ * to the first available engine... ++ */ ++ mode |= XEHP_CCS_MODE_CSLICE(cslice, first_ccs); ++ ++ else ++ /* ++ * ... otherwise, mark the cslice as ++ * unavailable if no CCS dispatches here ++ */ ++ mode |= XEHP_CCS_MODE_CSLICE(cslice, ++ XEHP_CCS_MODE_CSLICE_MASK); ++ } ++ ++ intel_uncore_write(gt->uncore, XEHP_CCS_MODE, mode); ++} +--- /dev/null ++++ b/drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.h +@@ -0,0 +1,13 @@ ++/* SPDX-License-Identifier: MIT */ ++/* ++ * Copyright © 2024 Intel Corporation ++ */ ++ ++#ifndef __INTEL_GT_CCS_MODE_H__ ++#define __INTEL_GT_CCS_MODE_H__ ++ ++struct intel_gt; ++ ++void intel_gt_apply_ccs_mode(struct intel_gt *gt); ++ ++#endif /* __INTEL_GT_CCS_MODE_H__ */ +--- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h ++++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h +@@ -1471,6 +1471,11 @@ + #define XEHP_RCU_MODE_FIXED_SLICE_CCS_MODE REG_BIT(1) + #define GEN12_RCU_MODE_CCS_ENABLE REG_BIT(0) + ++#define XEHP_CCS_MODE _MMIO(0x14804) ++#define XEHP_CCS_MODE_CSLICE_MASK REG_GENMASK(2, 0) /* CCS0-3 + rsvd */ ++#define XEHP_CCS_MODE_CSLICE_WIDTH ilog2(XEHP_CCS_MODE_CSLICE_MASK + 1) ++#define XEHP_CCS_MODE_CSLICE(cslice, ccs) (ccs << (cslice * XEHP_CCS_MODE_CSLICE_WIDTH)) ++ + #define CHV_FUSE_GT _MMIO(VLV_GUNIT_BASE + 0x2168) + #define CHV_FGT_DISABLE_SS0 (1 << 10) + #define CHV_FGT_DISABLE_SS1 (1 << 11) +--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c ++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c +@@ -10,6 +10,7 @@ + #include "intel_engine_regs.h" + #include "intel_gpu_commands.h" + #include "intel_gt.h" ++#include "intel_gt_ccs_mode.h" + #include "intel_gt_mcr.h" + #include "intel_gt_regs.h" + #include "intel_ring.h" +@@ -2838,6 +2839,12 @@ static void ccs_engine_wa_mode(struct in + * made to completely disable automatic CCS load balancing. + */ + wa_masked_en(wal, GEN12_RCU_MODE, XEHP_RCU_MODE_FIXED_SLICE_CCS_MODE); ++ ++ /* ++ * After having disabled automatic load balancing we need to ++ * assign all slices to a single CCS. We will call it CCS mode 1 ++ */ ++ intel_gt_apply_ccs_mode(gt); + } + + /* diff --git a/queue-6.6/mm-secretmem-fix-gup-fast-succeeding-on-secretmem-folios.patch b/queue-6.6/mm-secretmem-fix-gup-fast-succeeding-on-secretmem-folios.patch new file mode 100644 index 00000000000..cfe85a28ac9 --- /dev/null +++ b/queue-6.6/mm-secretmem-fix-gup-fast-succeeding-on-secretmem-folios.patch @@ -0,0 +1,60 @@ +From 65291dcfcf8936e1b23cfd7718fdfde7cfaf7706 Mon Sep 17 00:00:00 2001 +From: David Hildenbrand +Date: Tue, 26 Mar 2024 15:32:08 +0100 +Subject: mm/secretmem: fix GUP-fast succeeding on secretmem folios + +From: David Hildenbrand + +commit 65291dcfcf8936e1b23cfd7718fdfde7cfaf7706 upstream. + +folio_is_secretmem() currently relies on secretmem folios being LRU +folios, to save some cycles. + +However, folios might reside in a folio batch without the LRU flag set, or +temporarily have their LRU flag cleared. Consequently, the LRU flag is +unreliable for this purpose. + +In particular, this is the case when secretmem_fault() allocates a fresh +page and calls filemap_add_folio()->folio_add_lru(). The folio might be +added to the per-cpu folio batch and won't get the LRU flag set until the +batch was drained using e.g., lru_add_drain(). + +Consequently, folio_is_secretmem() might not detect secretmem folios and +GUP-fast can succeed in grabbing a secretmem folio, crashing the kernel +when we would later try reading/writing to the folio, because the folio +has been unmapped from the directmap. + +Fix it by removing that unreliable check. + +Link: https://lkml.kernel.org/r/20240326143210.291116-2-david@redhat.com +Fixes: 1507f51255c9 ("mm: introduce memfd_secret system call to create "secret" memory areas") +Signed-off-by: David Hildenbrand +Reported-by: xingwei lee +Reported-by: yue sun +Closes: https://lore.kernel.org/lkml/CABOYnLyevJeravW=QrH0JUPYEcDN160aZFb7kwndm-J2rmz0HQ@mail.gmail.com/ +Debugged-by: Miklos Szeredi +Tested-by: Miklos Szeredi +Reviewed-by: Mike Rapoport (IBM) +Cc: Lorenzo Stoakes +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/secretmem.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/linux/secretmem.h ++++ b/include/linux/secretmem.h +@@ -13,10 +13,10 @@ static inline bool folio_is_secretmem(st + /* + * Using folio_mapping() is quite slow because of the actual call + * instruction. +- * We know that secretmem pages are not compound and LRU so we can ++ * We know that secretmem pages are not compound, so we can + * save a couple of cycles here. + */ +- if (folio_test_large(folio) || !folio_test_lru(folio)) ++ if (folio_test_large(folio)) + return false; + + mapping = (struct address_space *) diff --git a/queue-6.6/riscv-fix-spurious-errors-from-__get-put_kernel_nofault.patch b/queue-6.6/riscv-fix-spurious-errors-from-__get-put_kernel_nofault.patch new file mode 100644 index 00000000000..40f4121b3cc --- /dev/null +++ b/queue-6.6/riscv-fix-spurious-errors-from-__get-put_kernel_nofault.patch @@ -0,0 +1,44 @@ +From d080a08b06b6266cc3e0e86c5acfd80db937cb6b Mon Sep 17 00:00:00 2001 +From: Samuel Holland +Date: Mon, 11 Mar 2024 19:19:13 -0700 +Subject: riscv: Fix spurious errors from __get/put_kernel_nofault + +From: Samuel Holland + +commit d080a08b06b6266cc3e0e86c5acfd80db937cb6b upstream. + +These macros did not initialize __kr_err, so they could fail even if +the access did not fault. + +Cc: stable@vger.kernel.org +Fixes: d464118cdc41 ("riscv: implement __get_kernel_nofault and __put_user_nofault") +Signed-off-by: Samuel Holland +Reviewed-by: Alexandre Ghiti +Reviewed-by: Charlie Jenkins +Link: https://lore.kernel.org/r/20240312022030.320789-1-samuel.holland@sifive.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/include/asm/uaccess.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/riscv/include/asm/uaccess.h ++++ b/arch/riscv/include/asm/uaccess.h +@@ -319,7 +319,7 @@ unsigned long __must_check clear_user(vo + + #define __get_kernel_nofault(dst, src, type, err_label) \ + do { \ +- long __kr_err; \ ++ long __kr_err = 0; \ + \ + __get_user_nocheck(*((type *)(dst)), (type *)(src), __kr_err); \ + if (unlikely(__kr_err)) \ +@@ -328,7 +328,7 @@ do { \ + + #define __put_kernel_nofault(dst, src, type, err_label) \ + do { \ +- long __kr_err; \ ++ long __kr_err = 0; \ + \ + __put_user_nocheck(*((type *)(src)), (type *)(dst), __kr_err); \ + if (unlikely(__kr_err)) \ diff --git a/queue-6.6/riscv-process-fix-kernel-gp-leakage.patch b/queue-6.6/riscv-process-fix-kernel-gp-leakage.patch new file mode 100644 index 00000000000..facbb841b82 --- /dev/null +++ b/queue-6.6/riscv-process-fix-kernel-gp-leakage.patch @@ -0,0 +1,80 @@ +From d14fa1fcf69db9d070e75f1c4425211fa619dfc8 Mon Sep 17 00:00:00 2001 +From: Stefan O'Rear +Date: Wed, 27 Mar 2024 02:12:58 -0400 +Subject: riscv: process: Fix kernel gp leakage + +From: Stefan O'Rear + +commit d14fa1fcf69db9d070e75f1c4425211fa619dfc8 upstream. + +childregs represents the registers which are active for the new thread +in user context. For a kernel thread, childregs->gp is never used since +the kernel gp is not touched by switch_to. For a user mode helper, the +gp value can be observed in user space after execve or possibly by other +means. + +[From the email thread] + +The /* Kernel thread */ comment is somewhat inaccurate in that it is also used +for user_mode_helper threads, which exec a user process, e.g. /sbin/init or +when /proc/sys/kernel/core_pattern is a pipe. Such threads do not have +PF_KTHREAD set and are valid targets for ptrace etc. even before they exec. + +childregs is the *user* context during syscall execution and it is observable +from userspace in at least five ways: + +1. kernel_execve does not currently clear integer registers, so the starting + register state for PID 1 and other user processes started by the kernel has + sp = user stack, gp = kernel __global_pointer$, all other integer registers + zeroed by the memset in the patch comment. + + This is a bug in its own right, but I'm unwilling to bet that it is the only + way to exploit the issue addressed by this patch. + +2. ptrace(PTRACE_GETREGSET): you can PTRACE_ATTACH to a user_mode_helper thread + before it execs, but ptrace requires SIGSTOP to be delivered which can only + happen at user/kernel boundaries. + +3. /proc/*/task/*/syscall: this is perfectly happy to read pt_regs for + user_mode_helpers before the exec completes, but gp is not one of the + registers it returns. + +4. PERF_SAMPLE_REGS_USER: LOCKDOWN_PERF normally prevents access to kernel + addresses via PERF_SAMPLE_REGS_INTR, but due to this bug kernel addresses + are also exposed via PERF_SAMPLE_REGS_USER which is permitted under + LOCKDOWN_PERF. I have not attempted to write exploit code. + +5. Much of the tracing infrastructure allows access to user registers. I have + not attempted to determine which forms of tracing allow access to user + registers without already allowing access to kernel registers. + +Fixes: 7db91e57a0ac ("RISC-V: Task implementation") +Cc: stable@vger.kernel.org +Signed-off-by: Stefan O'Rear +Reviewed-by: Alexandre Ghiti +Link: https://lore.kernel.org/r/20240327061258.2370291-1-sorear@fastmail.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/kernel/process.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/arch/riscv/kernel/process.c ++++ b/arch/riscv/kernel/process.c +@@ -26,8 +26,6 @@ + #include + #include + +-register unsigned long gp_in_global __asm__("gp"); +- + #if defined(CONFIG_STACKPROTECTOR) && !defined(CONFIG_STACKPROTECTOR_PER_TASK) + #include + unsigned long __stack_chk_guard __read_mostly; +@@ -186,7 +184,6 @@ int copy_thread(struct task_struct *p, c + if (unlikely(args->fn)) { + /* Kernel thread */ + memset(childregs, 0, sizeof(struct pt_regs)); +- childregs->gp = gp_in_global; + /* Supervisor/Machine, irqs on: */ + childregs->status = SR_PP | SR_PIE; + diff --git a/queue-6.6/s390-entry-align-system-call-table-on-8-bytes.patch b/queue-6.6/s390-entry-align-system-call-table-on-8-bytes.patch new file mode 100644 index 00000000000..42e3fd3b8fe --- /dev/null +++ b/queue-6.6/s390-entry-align-system-call-table-on-8-bytes.patch @@ -0,0 +1,33 @@ +From 378ca2d2ad410a1cd5690d06b46c5e2297f4c8c0 Mon Sep 17 00:00:00 2001 +From: Sumanth Korikkar +Date: Tue, 26 Mar 2024 18:12:13 +0100 +Subject: s390/entry: align system call table on 8 bytes + +From: Sumanth Korikkar + +commit 378ca2d2ad410a1cd5690d06b46c5e2297f4c8c0 upstream. + +Align system call table on 8 bytes. With sys_call_table entry size +of 8 bytes that eliminates the possibility of a system call pointer +crossing cache line boundary. + +Cc: stable@kernel.org +Suggested-by: Ulrich Weigand +Reviewed-by: Alexander Gordeev +Signed-off-by: Sumanth Korikkar +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/kernel/entry.S | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/s390/kernel/entry.S ++++ b/arch/s390/kernel/entry.S +@@ -653,6 +653,7 @@ SYM_DATA_START_LOCAL(daton_psw) + SYM_DATA_END(daton_psw) + + .section .rodata, "a" ++ .balign 8 + #define SYSCALL(esame,emu) .quad __s390x_ ## esame + SYM_DATA_START(sys_call_table) + #include "asm/syscall_table.h" diff --git a/queue-6.6/selftests-mm-include-strings.h-for-ffsl.patch b/queue-6.6/selftests-mm-include-strings.h-for-ffsl.patch new file mode 100644 index 00000000000..193f4d40d18 --- /dev/null +++ b/queue-6.6/selftests-mm-include-strings.h-for-ffsl.patch @@ -0,0 +1,45 @@ +From 176517c9310281d00dd3210ab4cc4d3cdc26b17e Mon Sep 17 00:00:00 2001 +From: Edward Liaw +Date: Fri, 29 Mar 2024 18:58:10 +0000 +Subject: selftests/mm: include strings.h for ffsl + +From: Edward Liaw + +commit 176517c9310281d00dd3210ab4cc4d3cdc26b17e upstream. + +Got a compilation error on Android for ffsl after 91b80cc5b39f +("selftests: mm: fix map_hugetlb failure on 64K page size systems") +included vm_util.h. + +Link: https://lkml.kernel.org/r/20240329185814.16304-1-edliaw@google.com +Fixes: af605d26a8f2 ("selftests/mm: merge util.h into vm_util.h") +Signed-off-by: Edward Liaw +Reviewed-by: Muhammad Usama Anjum +Cc: Axel Rasmussen +Cc: David Hildenbrand +Cc: "Mike Rapoport (IBM)" +Cc: Peter Xu +Cc: Shuah Khan +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/mm/vm_util.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/mm/vm_util.h b/tools/testing/selftests/mm/vm_util.h +index c02990bbd56f..9007c420d52c 100644 +--- a/tools/testing/selftests/mm/vm_util.h ++++ b/tools/testing/selftests/mm/vm_util.h +@@ -3,7 +3,7 @@ + #include + #include + #include +-#include /* ffsl() */ ++#include /* ffsl() */ + #include /* _SC_PAGESIZE */ + + #define BIT_ULL(nr) (1ULL << (nr)) +-- +2.44.0 + diff --git a/queue-6.6/series b/queue-6.6/series index fede015b918..a65896a8ed4 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -217,4 +217,25 @@ x86-mm-pat-fix-vm_pat-handling-in-cow-mappings.patch x86-mce-make-sure-to-grab-mce_sysfs_mutex-in-set_bank.patch x86-coco-require-seeding-rng-with-rdrand-on-coco-systems.patch perf-x86-intel-ds-don-t-clear-pebs_data_cfg-for-the-last-pebs-event.patch +arm64-ptrace-use-saved-floating-point-state-type-to-determine-sve-layout.patch +mm-secretmem-fix-gup-fast-succeeding-on-secretmem-folios.patch +selftests-mm-include-strings.h-for-ffsl.patch +s390-entry-align-system-call-table-on-8-bytes.patch +riscv-fix-spurious-errors-from-__get-put_kernel_nofault.patch +riscv-process-fix-kernel-gp-leakage.patch +smb-client-handle-dfs-tcons-in-cifs_construct_tcon.patch +smb-client-serialise-cifs_construct_tcon-with-cifs_mount_mutex.patch +smb3-retrying-on-failed-server-close.patch +smb-client-fix-potential-uaf-in-cifs_debug_files_proc_show.patch +smb-client-fix-potential-uaf-in-cifs_stats_proc_write.patch +smb-client-fix-potential-uaf-in-cifs_stats_proc_show.patch +smb-client-fix-potential-uaf-in-cifs_dump_full_key.patch +smb-client-fix-potential-uaf-in-smb2_is_valid_oplock_break.patch +smb-client-fix-potential-uaf-in-smb2_is_valid_lease_break.patch +smb-client-fix-potential-uaf-in-is_valid_oplock_break.patch +smb-client-fix-potential-uaf-in-smb2_is_network_name_deleted.patch +smb-client-fix-potential-uaf-in-cifs_signal_cifsd_for_reconnect.patch +drm-i915-gt-disable-hw-load-balancing-for-ccs.patch +drm-i915-gt-do-not-generate-the-command-streamer-for-all-the-ccs.patch +drm-i915-gt-enable-only-one-ccs-for-compute-workload.patch of-module-prevent-null-pointer-dereference-in-vsnprintf.patch diff --git a/queue-6.6/smb-client-fix-potential-uaf-in-cifs_debug_files_proc_show.patch b/queue-6.6/smb-client-fix-potential-uaf-in-cifs_debug_files_proc_show.patch new file mode 100644 index 00000000000..b0d32451ac5 --- /dev/null +++ b/queue-6.6/smb-client-fix-potential-uaf-in-cifs_debug_files_proc_show.patch @@ -0,0 +1,49 @@ +From ca545b7f0823f19db0f1148d59bc5e1a56634502 Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Tue, 2 Apr 2024 16:33:53 -0300 +Subject: smb: client: fix potential UAF in cifs_debug_files_proc_show() + +From: Paulo Alcantara + +commit ca545b7f0823f19db0f1148d59bc5e1a56634502 upstream. + +Skip sessions that are being teared down (status == SES_EXITING) to +avoid UAF. + +Cc: stable@vger.kernel.org +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/cifs_debug.c | 2 ++ + fs/smb/client/cifsglob.h | 10 ++++++++++ + 2 files changed, 12 insertions(+) + +--- a/fs/smb/client/cifs_debug.c ++++ b/fs/smb/client/cifs_debug.c +@@ -250,6 +250,8 @@ static int cifs_debug_files_proc_show(st + spin_lock(&cifs_tcp_ses_lock); + list_for_each_entry(server, &cifs_tcp_ses_list, tcp_ses_list) { + list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { ++ if (cifs_ses_exiting(ses)) ++ continue; + list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { + spin_lock(&tcon->open_file_lock); + list_for_each_entry(cfile, &tcon->openFileList, tlist) { +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -2281,4 +2281,14 @@ struct smb2_compound_vars { + struct smb2_file_link_info link_info; + }; + ++static inline bool cifs_ses_exiting(struct cifs_ses *ses) ++{ ++ bool ret; ++ ++ spin_lock(&ses->ses_lock); ++ ret = ses->ses_status == SES_EXITING; ++ spin_unlock(&ses->ses_lock); ++ return ret; ++} ++ + #endif /* _CIFS_GLOB_H */ diff --git a/queue-6.6/smb-client-fix-potential-uaf-in-cifs_dump_full_key.patch b/queue-6.6/smb-client-fix-potential-uaf-in-cifs_dump_full_key.patch new file mode 100644 index 00000000000..10940f607e4 --- /dev/null +++ b/queue-6.6/smb-client-fix-potential-uaf-in-cifs_dump_full_key.patch @@ -0,0 +1,45 @@ +From 58acd1f497162e7d282077f816faa519487be045 Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Tue, 2 Apr 2024 16:33:54 -0300 +Subject: smb: client: fix potential UAF in cifs_dump_full_key() + +From: Paulo Alcantara + +commit 58acd1f497162e7d282077f816faa519487be045 upstream. + +Skip sessions that are being teared down (status == SES_EXITING) to +avoid UAF. + +Cc: stable@vger.kernel.org +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/ioctl.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/fs/smb/client/ioctl.c ++++ b/fs/smb/client/ioctl.c +@@ -246,7 +246,9 @@ static int cifs_dump_full_key(struct cif + spin_lock(&cifs_tcp_ses_lock); + list_for_each_entry(server_it, &cifs_tcp_ses_list, tcp_ses_list) { + list_for_each_entry(ses_it, &server_it->smb_ses_list, smb_ses_list) { +- if (ses_it->Suid == out.session_id) { ++ spin_lock(&ses_it->ses_lock); ++ if (ses_it->ses_status != SES_EXITING && ++ ses_it->Suid == out.session_id) { + ses = ses_it; + /* + * since we are using the session outside the crit +@@ -254,9 +256,11 @@ static int cifs_dump_full_key(struct cif + * so increment its refcount + */ + cifs_smb_ses_inc_refcount(ses); ++ spin_unlock(&ses_it->ses_lock); + found = true; + goto search_end; + } ++ spin_unlock(&ses_it->ses_lock); + } + } + search_end: diff --git a/queue-6.6/smb-client-fix-potential-uaf-in-cifs_signal_cifsd_for_reconnect.patch b/queue-6.6/smb-client-fix-potential-uaf-in-cifs_signal_cifsd_for_reconnect.patch new file mode 100644 index 00000000000..f71e6a51110 --- /dev/null +++ b/queue-6.6/smb-client-fix-potential-uaf-in-cifs_signal_cifsd_for_reconnect.patch @@ -0,0 +1,31 @@ +From e0e50401cc3921c9eaf1b0e667db174519ea939f Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Tue, 2 Apr 2024 16:34:04 -0300 +Subject: smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() + +From: Paulo Alcantara + +commit e0e50401cc3921c9eaf1b0e667db174519ea939f upstream. + +Skip sessions that are being teared down (status == SES_EXITING) to +avoid UAF. + +Cc: stable@vger.kernel.org +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/connect.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -178,6 +178,8 @@ cifs_signal_cifsd_for_reconnect(struct T + + spin_lock(&cifs_tcp_ses_lock); + list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { ++ if (cifs_ses_exiting(ses)) ++ continue; + spin_lock(&ses->chan_lock); + for (i = 0; i < ses->chan_count; i++) { + if (!ses->chans[i].server) diff --git a/queue-6.6/smb-client-fix-potential-uaf-in-cifs_stats_proc_show.patch b/queue-6.6/smb-client-fix-potential-uaf-in-cifs_stats_proc_show.patch new file mode 100644 index 00000000000..1bd058b8033 --- /dev/null +++ b/queue-6.6/smb-client-fix-potential-uaf-in-cifs_stats_proc_show.patch @@ -0,0 +1,31 @@ +From 0865ffefea197b437ba78b5dd8d8e256253efd65 Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Tue, 2 Apr 2024 16:33:56 -0300 +Subject: smb: client: fix potential UAF in cifs_stats_proc_show() + +From: Paulo Alcantara + +commit 0865ffefea197b437ba78b5dd8d8e256253efd65 upstream. + +Skip sessions that are being teared down (status == SES_EXITING) to +avoid UAF. + +Cc: stable@vger.kernel.org +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/cifs_debug.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/smb/client/cifs_debug.c ++++ b/fs/smb/client/cifs_debug.c +@@ -736,6 +736,8 @@ static int cifs_stats_proc_show(struct s + } + #endif /* STATS2 */ + list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { ++ if (cifs_ses_exiting(ses)) ++ continue; + list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { + i++; + seq_printf(m, "\n%d) %s", i, tcon->tree_name); diff --git a/queue-6.6/smb-client-fix-potential-uaf-in-cifs_stats_proc_write.patch b/queue-6.6/smb-client-fix-potential-uaf-in-cifs_stats_proc_write.patch new file mode 100644 index 00000000000..8d7ebc19505 --- /dev/null +++ b/queue-6.6/smb-client-fix-potential-uaf-in-cifs_stats_proc_write.patch @@ -0,0 +1,31 @@ +From d3da25c5ac84430f89875ca7485a3828150a7e0a Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Tue, 2 Apr 2024 16:33:55 -0300 +Subject: smb: client: fix potential UAF in cifs_stats_proc_write() + +From: Paulo Alcantara + +commit d3da25c5ac84430f89875ca7485a3828150a7e0a upstream. + +Skip sessions that are being teared down (status == SES_EXITING) to +avoid UAF. + +Cc: stable@vger.kernel.org +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/cifs_debug.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/smb/client/cifs_debug.c ++++ b/fs/smb/client/cifs_debug.c +@@ -656,6 +656,8 @@ static ssize_t cifs_stats_proc_write(str + } + #endif /* CONFIG_CIFS_STATS2 */ + list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { ++ if (cifs_ses_exiting(ses)) ++ continue; + list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { + atomic_set(&tcon->num_smbs_sent, 0); + spin_lock(&tcon->stat_lock); diff --git a/queue-6.6/smb-client-fix-potential-uaf-in-is_valid_oplock_break.patch b/queue-6.6/smb-client-fix-potential-uaf-in-is_valid_oplock_break.patch new file mode 100644 index 00000000000..5c26df43486 --- /dev/null +++ b/queue-6.6/smb-client-fix-potential-uaf-in-is_valid_oplock_break.patch @@ -0,0 +1,31 @@ +From 69ccf040acddf33a3a85ec0f6b45ef84b0f7ec29 Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Tue, 2 Apr 2024 16:34:00 -0300 +Subject: smb: client: fix potential UAF in is_valid_oplock_break() + +From: Paulo Alcantara + +commit 69ccf040acddf33a3a85ec0f6b45ef84b0f7ec29 upstream. + +Skip sessions that are being teared down (status == SES_EXITING) to +avoid UAF. + +Cc: stable@vger.kernel.org +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/misc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/smb/client/misc.c ++++ b/fs/smb/client/misc.c +@@ -489,6 +489,8 @@ is_valid_oplock_break(char *buffer, stru + /* look up tcon based on tid & uid */ + spin_lock(&cifs_tcp_ses_lock); + list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { ++ if (cifs_ses_exiting(ses)) ++ continue; + list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { + if (tcon->tid != buf->Tid) + continue; diff --git a/queue-6.6/smb-client-fix-potential-uaf-in-smb2_is_network_name_deleted.patch b/queue-6.6/smb-client-fix-potential-uaf-in-smb2_is_network_name_deleted.patch new file mode 100644 index 00000000000..14e79066a7a --- /dev/null +++ b/queue-6.6/smb-client-fix-potential-uaf-in-smb2_is_network_name_deleted.patch @@ -0,0 +1,31 @@ +From 63981561ffd2d4987807df4126f96a11e18b0c1d Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Tue, 2 Apr 2024 16:34:02 -0300 +Subject: smb: client: fix potential UAF in smb2_is_network_name_deleted() + +From: Paulo Alcantara + +commit 63981561ffd2d4987807df4126f96a11e18b0c1d upstream. + +Skip sessions that are being teared down (status == SES_EXITING) to +avoid UAF. + +Cc: stable@vger.kernel.org +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/smb2ops.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -2430,6 +2430,8 @@ smb2_is_network_name_deleted(char *buf, + + spin_lock(&cifs_tcp_ses_lock); + list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { ++ if (cifs_ses_exiting(ses)) ++ continue; + list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { + if (tcon->tid == le32_to_cpu(shdr->Id.SyncId.TreeId)) { + spin_lock(&tcon->tc_lock); diff --git a/queue-6.6/smb-client-fix-potential-uaf-in-smb2_is_valid_lease_break.patch b/queue-6.6/smb-client-fix-potential-uaf-in-smb2_is_valid_lease_break.patch new file mode 100644 index 00000000000..83914a6b03a --- /dev/null +++ b/queue-6.6/smb-client-fix-potential-uaf-in-smb2_is_valid_lease_break.patch @@ -0,0 +1,31 @@ +From 705c76fbf726c7a2f6ff9143d4013b18daaaebf1 Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Tue, 2 Apr 2024 16:33:58 -0300 +Subject: smb: client: fix potential UAF in smb2_is_valid_lease_break() + +From: Paulo Alcantara + +commit 705c76fbf726c7a2f6ff9143d4013b18daaaebf1 upstream. + +Skip sessions that are being teared down (status == SES_EXITING) to +avoid UAF. + +Cc: stable@vger.kernel.org +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/smb2misc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/smb/client/smb2misc.c ++++ b/fs/smb/client/smb2misc.c +@@ -622,6 +622,8 @@ smb2_is_valid_lease_break(char *buffer, + /* look up tcon based on tid & uid */ + spin_lock(&cifs_tcp_ses_lock); + list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { ++ if (cifs_ses_exiting(ses)) ++ continue; + list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { + spin_lock(&tcon->open_file_lock); + cifs_stats_inc( diff --git a/queue-6.6/smb-client-fix-potential-uaf-in-smb2_is_valid_oplock_break.patch b/queue-6.6/smb-client-fix-potential-uaf-in-smb2_is_valid_oplock_break.patch new file mode 100644 index 00000000000..d2939b33cb3 --- /dev/null +++ b/queue-6.6/smb-client-fix-potential-uaf-in-smb2_is_valid_oplock_break.patch @@ -0,0 +1,31 @@ +From 22863485a4626ec6ecf297f4cc0aef709bc862e4 Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Tue, 2 Apr 2024 16:33:59 -0300 +Subject: smb: client: fix potential UAF in smb2_is_valid_oplock_break() + +From: Paulo Alcantara + +commit 22863485a4626ec6ecf297f4cc0aef709bc862e4 upstream. + +Skip sessions that are being teared down (status == SES_EXITING) to +avoid UAF. + +Cc: stable@vger.kernel.org +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/smb2misc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/smb/client/smb2misc.c ++++ b/fs/smb/client/smb2misc.c +@@ -697,6 +697,8 @@ smb2_is_valid_oplock_break(char *buffer, + /* look up tcon based on tid & uid */ + spin_lock(&cifs_tcp_ses_lock); + list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { ++ if (cifs_ses_exiting(ses)) ++ continue; + list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { + + spin_lock(&tcon->open_file_lock); diff --git a/queue-6.6/smb-client-handle-dfs-tcons-in-cifs_construct_tcon.patch b/queue-6.6/smb-client-handle-dfs-tcons-in-cifs_construct_tcon.patch new file mode 100644 index 00000000000..43a36125eb0 --- /dev/null +++ b/queue-6.6/smb-client-handle-dfs-tcons-in-cifs_construct_tcon.patch @@ -0,0 +1,90 @@ +From 4a5ba0e0bfe552ac7451f57e304f6343c3d87f89 Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Mon, 1 Apr 2024 22:44:08 -0300 +Subject: smb: client: handle DFS tcons in cifs_construct_tcon() + +From: Paulo Alcantara + +commit 4a5ba0e0bfe552ac7451f57e304f6343c3d87f89 upstream. + +The tcons created by cifs_construct_tcon() on multiuser mounts must +also be able to failover and refresh DFS referrals, so set the +appropriate fields in order to get a full DFS tcon. They could be +shared among different superblocks later, too. + +Cc: stable@vger.kernel.org # 6.4+ +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202404021518.3Xu2VU4s-lkp@intel.com/ +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/connect.c | 30 ++++++++++++++++++++++++++++++ + 1 file changed, 30 insertions(+) + +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -3988,6 +3988,7 @@ cifs_construct_tcon(struct cifs_sb_info + struct cifs_ses *ses; + struct cifs_tcon *tcon = NULL; + struct smb3_fs_context *ctx; ++ char *origin_fullpath = NULL; + + ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); + if (ctx == NULL) +@@ -4011,6 +4012,7 @@ cifs_construct_tcon(struct cifs_sb_info + ctx->sign = master_tcon->ses->sign; + ctx->seal = master_tcon->seal; + ctx->witness = master_tcon->use_witness; ++ ctx->dfs_root_ses = master_tcon->ses->dfs_root_ses; + + rc = cifs_set_vol_auth(ctx, master_tcon->ses); + if (rc) { +@@ -4030,12 +4032,39 @@ cifs_construct_tcon(struct cifs_sb_info + goto out; + } + ++#ifdef CONFIG_CIFS_DFS_UPCALL ++ spin_lock(&master_tcon->tc_lock); ++ if (master_tcon->origin_fullpath) { ++ spin_unlock(&master_tcon->tc_lock); ++ origin_fullpath = dfs_get_path(cifs_sb, cifs_sb->ctx->source); ++ if (IS_ERR(origin_fullpath)) { ++ tcon = ERR_CAST(origin_fullpath); ++ origin_fullpath = NULL; ++ cifs_put_smb_ses(ses); ++ goto out; ++ } ++ } else { ++ spin_unlock(&master_tcon->tc_lock); ++ } ++#endif ++ + tcon = cifs_get_tcon(ses, ctx); + if (IS_ERR(tcon)) { + cifs_put_smb_ses(ses); + goto out; + } + ++#ifdef CONFIG_CIFS_DFS_UPCALL ++ if (origin_fullpath) { ++ spin_lock(&tcon->tc_lock); ++ tcon->origin_fullpath = origin_fullpath; ++ spin_unlock(&tcon->tc_lock); ++ origin_fullpath = NULL; ++ queue_delayed_work(dfscache_wq, &tcon->dfs_cache_work, ++ dfs_cache_get_ttl() * HZ); ++ } ++#endif ++ + #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY + if (cap_unix(ses)) + reset_cifs_unix_caps(0, tcon, NULL, ctx); +@@ -4044,6 +4073,7 @@ cifs_construct_tcon(struct cifs_sb_info + out: + kfree(ctx->username); + kfree_sensitive(ctx->password); ++ kfree(origin_fullpath); + kfree(ctx); + + return tcon; diff --git a/queue-6.6/smb-client-serialise-cifs_construct_tcon-with-cifs_mount_mutex.patch b/queue-6.6/smb-client-serialise-cifs_construct_tcon-with-cifs_mount_mutex.patch new file mode 100644 index 00000000000..fb6d2d75aa1 --- /dev/null +++ b/queue-6.6/smb-client-serialise-cifs_construct_tcon-with-cifs_mount_mutex.patch @@ -0,0 +1,94 @@ +From 93cee45ccfebc62a3bb4cd622b89e00c8c7d8493 Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Mon, 1 Apr 2024 22:44:09 -0300 +Subject: smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex + +From: Paulo Alcantara + +commit 93cee45ccfebc62a3bb4cd622b89e00c8c7d8493 upstream. + +Serialise cifs_construct_tcon() with cifs_mount_mutex to handle +parallel mounts that may end up reusing the session and tcon created +by it. + +Cc: stable@vger.kernel.org # 6.4+ +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/connect.c | 13 ++++++++++++- + fs/smb/client/fs_context.c | 6 +++--- + fs/smb/client/fs_context.h | 12 ++++++++++++ + 3 files changed, 27 insertions(+), 4 deletions(-) + +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -3981,7 +3981,7 @@ cifs_set_vol_auth(struct smb3_fs_context + } + + static struct cifs_tcon * +-cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid) ++__cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid) + { + int rc; + struct cifs_tcon *master_tcon = cifs_sb_master_tcon(cifs_sb); +@@ -4079,6 +4079,17 @@ out: + return tcon; + } + ++static struct cifs_tcon * ++cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid) ++{ ++ struct cifs_tcon *ret; ++ ++ cifs_mount_lock(); ++ ret = __cifs_construct_tcon(cifs_sb, fsuid); ++ cifs_mount_unlock(); ++ return ret; ++} ++ + struct cifs_tcon * + cifs_sb_master_tcon(struct cifs_sb_info *cifs_sb) + { +--- a/fs/smb/client/fs_context.c ++++ b/fs/smb/client/fs_context.c +@@ -37,7 +37,7 @@ + #include "rfc1002pdu.h" + #include "fs_context.h" + +-static DEFINE_MUTEX(cifs_mount_mutex); ++DEFINE_MUTEX(cifs_mount_mutex); + + static const match_table_t cifs_smb_version_tokens = { + { Smb_1, SMB1_VERSION_STRING }, +@@ -752,9 +752,9 @@ static int smb3_get_tree(struct fs_conte + + if (err) + return err; +- mutex_lock(&cifs_mount_mutex); ++ cifs_mount_lock(); + ret = smb3_get_tree_common(fc); +- mutex_unlock(&cifs_mount_mutex); ++ cifs_mount_unlock(); + return ret; + } + +--- a/fs/smb/client/fs_context.h ++++ b/fs/smb/client/fs_context.h +@@ -293,4 +293,16 @@ extern void smb3_update_mnt_flags(struct + #define MAX_CACHED_FIDS 16 + extern char *cifs_sanitize_prepath(char *prepath, gfp_t gfp); + ++extern struct mutex cifs_mount_mutex; ++ ++static inline void cifs_mount_lock(void) ++{ ++ mutex_lock(&cifs_mount_mutex); ++} ++ ++static inline void cifs_mount_unlock(void) ++{ ++ mutex_unlock(&cifs_mount_mutex); ++} ++ + #endif diff --git a/queue-6.6/smb3-retrying-on-failed-server-close.patch b/queue-6.6/smb3-retrying-on-failed-server-close.patch new file mode 100644 index 00000000000..c7470e974a0 --- /dev/null +++ b/queue-6.6/smb3-retrying-on-failed-server-close.patch @@ -0,0 +1,315 @@ +From 173217bd73365867378b5e75a86f0049e1069ee8 Mon Sep 17 00:00:00 2001 +From: Ritvik Budhiraja +Date: Tue, 2 Apr 2024 14:01:28 -0500 +Subject: smb3: retrying on failed server close + +From: Ritvik Budhiraja + +commit 173217bd73365867378b5e75a86f0049e1069ee8 upstream. + +In the current implementation, CIFS close sends a close to the +server and does not check for the success of the server close. +This patch adds functionality to check for server close return +status and retries in case of an EBUSY or EAGAIN error. + +This can help avoid handle leaks + +Cc: stable@vger.kernel.org +Signed-off-by: Ritvik Budhiraja +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/cached_dir.c | 6 ++-- + fs/smb/client/cifsfs.c | 11 +++++++ + fs/smb/client/cifsglob.h | 7 +++-- + fs/smb/client/file.c | 63 ++++++++++++++++++++++++++++++++++++++++----- + fs/smb/client/smb1ops.c | 4 +- + fs/smb/client/smb2ops.c | 9 +++--- + fs/smb/client/smb2pdu.c | 2 - + 7 files changed, 85 insertions(+), 17 deletions(-) + +--- a/fs/smb/client/cached_dir.c ++++ b/fs/smb/client/cached_dir.c +@@ -401,6 +401,7 @@ smb2_close_cached_fid(struct kref *ref) + { + struct cached_fid *cfid = container_of(ref, struct cached_fid, + refcount); ++ int rc; + + spin_lock(&cfid->cfids->cfid_list_lock); + if (cfid->on_list) { +@@ -414,9 +415,10 @@ smb2_close_cached_fid(struct kref *ref) + cfid->dentry = NULL; + + if (cfid->is_open) { +- SMB2_close(0, cfid->tcon, cfid->fid.persistent_fid, ++ rc = SMB2_close(0, cfid->tcon, cfid->fid.persistent_fid, + cfid->fid.volatile_fid); +- atomic_dec(&cfid->tcon->num_remote_opens); ++ if (rc != -EBUSY && rc != -EAGAIN) ++ atomic_dec(&cfid->tcon->num_remote_opens); + } + + free_cached_dir(cfid); +--- a/fs/smb/client/cifsfs.c ++++ b/fs/smb/client/cifsfs.c +@@ -159,6 +159,7 @@ struct workqueue_struct *decrypt_wq; + struct workqueue_struct *fileinfo_put_wq; + struct workqueue_struct *cifsoplockd_wq; + struct workqueue_struct *deferredclose_wq; ++struct workqueue_struct *serverclose_wq; + __u32 cifs_lock_secret; + + /* +@@ -1877,6 +1878,13 @@ init_cifs(void) + goto out_destroy_cifsoplockd_wq; + } + ++ serverclose_wq = alloc_workqueue("serverclose", ++ WQ_FREEZABLE|WQ_MEM_RECLAIM, 0); ++ if (!serverclose_wq) { ++ rc = -ENOMEM; ++ goto out_destroy_serverclose_wq; ++ } ++ + rc = cifs_init_inodecache(); + if (rc) + goto out_destroy_deferredclose_wq; +@@ -1951,6 +1959,8 @@ out_destroy_decrypt_wq: + destroy_workqueue(decrypt_wq); + out_destroy_cifsiod_wq: + destroy_workqueue(cifsiod_wq); ++out_destroy_serverclose_wq: ++ destroy_workqueue(serverclose_wq); + out_clean_proc: + cifs_proc_clean(); + return rc; +@@ -1980,6 +1990,7 @@ exit_cifs(void) + destroy_workqueue(cifsoplockd_wq); + destroy_workqueue(decrypt_wq); + destroy_workqueue(fileinfo_put_wq); ++ destroy_workqueue(serverclose_wq); + destroy_workqueue(cifsiod_wq); + cifs_proc_clean(); + } +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -425,10 +425,10 @@ struct smb_version_operations { + /* set fid protocol-specific info */ + void (*set_fid)(struct cifsFileInfo *, struct cifs_fid *, __u32); + /* close a file */ +- void (*close)(const unsigned int, struct cifs_tcon *, ++ int (*close)(const unsigned int, struct cifs_tcon *, + struct cifs_fid *); + /* close a file, returning file attributes and timestamps */ +- void (*close_getattr)(const unsigned int xid, struct cifs_tcon *tcon, ++ int (*close_getattr)(const unsigned int xid, struct cifs_tcon *tcon, + struct cifsFileInfo *pfile_info); + /* send a flush request to the server */ + int (*flush)(const unsigned int, struct cifs_tcon *, struct cifs_fid *); +@@ -1408,6 +1408,7 @@ struct cifsFileInfo { + bool invalidHandle:1; /* file closed via session abend */ + bool swapfile:1; + bool oplock_break_cancelled:1; ++ bool offload:1; /* offload final part of _put to a wq */ + unsigned int oplock_epoch; /* epoch from the lease break */ + __u32 oplock_level; /* oplock/lease level from the lease break */ + int count; +@@ -1416,6 +1417,7 @@ struct cifsFileInfo { + struct cifs_search_info srch_inf; + struct work_struct oplock_break; /* work for oplock breaks */ + struct work_struct put; /* work for the final part of _put */ ++ struct work_struct serverclose; /* work for serverclose */ + struct delayed_work deferred; + bool deferred_close_scheduled; /* Flag to indicate close is scheduled */ + char *symlink_target; +@@ -2073,6 +2075,7 @@ extern struct workqueue_struct *decrypt_ + extern struct workqueue_struct *fileinfo_put_wq; + extern struct workqueue_struct *cifsoplockd_wq; + extern struct workqueue_struct *deferredclose_wq; ++extern struct workqueue_struct *serverclose_wq; + extern __u32 cifs_lock_secret; + + extern mempool_t *cifs_mid_poolp; +--- a/fs/smb/client/file.c ++++ b/fs/smb/client/file.c +@@ -459,6 +459,7 @@ cifs_down_write(struct rw_semaphore *sem + } + + static void cifsFileInfo_put_work(struct work_struct *work); ++void serverclose_work(struct work_struct *work); + + struct cifsFileInfo *cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, + struct tcon_link *tlink, __u32 oplock, +@@ -505,6 +506,7 @@ struct cifsFileInfo *cifs_new_fileinfo(s + cfile->tlink = cifs_get_tlink(tlink); + INIT_WORK(&cfile->oplock_break, cifs_oplock_break); + INIT_WORK(&cfile->put, cifsFileInfo_put_work); ++ INIT_WORK(&cfile->serverclose, serverclose_work); + INIT_DELAYED_WORK(&cfile->deferred, smb2_deferred_work_close); + mutex_init(&cfile->fh_mutex); + spin_lock_init(&cfile->file_info_lock); +@@ -596,6 +598,40 @@ static void cifsFileInfo_put_work(struct + cifsFileInfo_put_final(cifs_file); + } + ++void serverclose_work(struct work_struct *work) ++{ ++ struct cifsFileInfo *cifs_file = container_of(work, ++ struct cifsFileInfo, serverclose); ++ ++ struct cifs_tcon *tcon = tlink_tcon(cifs_file->tlink); ++ ++ struct TCP_Server_Info *server = tcon->ses->server; ++ int rc = 0; ++ int retries = 0; ++ int MAX_RETRIES = 4; ++ ++ do { ++ if (server->ops->close_getattr) ++ rc = server->ops->close_getattr(0, tcon, cifs_file); ++ else if (server->ops->close) ++ rc = server->ops->close(0, tcon, &cifs_file->fid); ++ ++ if (rc == -EBUSY || rc == -EAGAIN) { ++ retries++; ++ msleep(250); ++ } ++ } while ((rc == -EBUSY || rc == -EAGAIN) && (retries < MAX_RETRIES) ++ ); ++ ++ if (retries == MAX_RETRIES) ++ pr_warn("Serverclose failed %d times, giving up\n", MAX_RETRIES); ++ ++ if (cifs_file->offload) ++ queue_work(fileinfo_put_wq, &cifs_file->put); ++ else ++ cifsFileInfo_put_final(cifs_file); ++} ++ + /** + * cifsFileInfo_put - release a reference of file priv data + * +@@ -636,10 +672,13 @@ void _cifsFileInfo_put(struct cifsFileIn + struct cifs_fid fid = {}; + struct cifs_pending_open open; + bool oplock_break_cancelled; ++ bool serverclose_offloaded = false; + + spin_lock(&tcon->open_file_lock); + spin_lock(&cifsi->open_file_lock); + spin_lock(&cifs_file->file_info_lock); ++ ++ cifs_file->offload = offload; + if (--cifs_file->count > 0) { + spin_unlock(&cifs_file->file_info_lock); + spin_unlock(&cifsi->open_file_lock); +@@ -681,13 +720,20 @@ void _cifsFileInfo_put(struct cifsFileIn + if (!tcon->need_reconnect && !cifs_file->invalidHandle) { + struct TCP_Server_Info *server = tcon->ses->server; + unsigned int xid; ++ int rc = 0; + + xid = get_xid(); + if (server->ops->close_getattr) +- server->ops->close_getattr(xid, tcon, cifs_file); ++ rc = server->ops->close_getattr(xid, tcon, cifs_file); + else if (server->ops->close) +- server->ops->close(xid, tcon, &cifs_file->fid); ++ rc = server->ops->close(xid, tcon, &cifs_file->fid); + _free_xid(xid); ++ ++ if (rc == -EBUSY || rc == -EAGAIN) { ++ // Server close failed, hence offloading it as an async op ++ queue_work(serverclose_wq, &cifs_file->serverclose); ++ serverclose_offloaded = true; ++ } + } + + if (oplock_break_cancelled) +@@ -695,10 +741,15 @@ void _cifsFileInfo_put(struct cifsFileIn + + cifs_del_pending_open(&open); + +- if (offload) +- queue_work(fileinfo_put_wq, &cifs_file->put); +- else +- cifsFileInfo_put_final(cifs_file); ++ // if serverclose has been offloaded to wq (on failure), it will ++ // handle offloading put as well. If serverclose not offloaded, ++ // we need to handle offloading put here. ++ if (!serverclose_offloaded) { ++ if (offload) ++ queue_work(fileinfo_put_wq, &cifs_file->put); ++ else ++ cifsFileInfo_put_final(cifs_file); ++ } + } + + int cifs_open(struct inode *inode, struct file *file) +--- a/fs/smb/client/smb1ops.c ++++ b/fs/smb/client/smb1ops.c +@@ -753,11 +753,11 @@ cifs_set_fid(struct cifsFileInfo *cfile, + cinode->can_cache_brlcks = CIFS_CACHE_WRITE(cinode); + } + +-static void ++static int + cifs_close_file(const unsigned int xid, struct cifs_tcon *tcon, + struct cifs_fid *fid) + { +- CIFSSMBClose(xid, tcon, fid->netfid); ++ return CIFSSMBClose(xid, tcon, fid->netfid); + } + + static int +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -1392,14 +1392,14 @@ smb2_set_fid(struct cifsFileInfo *cfile, + memcpy(cfile->fid.create_guid, fid->create_guid, 16); + } + +-static void ++static int + smb2_close_file(const unsigned int xid, struct cifs_tcon *tcon, + struct cifs_fid *fid) + { +- SMB2_close(xid, tcon, fid->persistent_fid, fid->volatile_fid); ++ return SMB2_close(xid, tcon, fid->persistent_fid, fid->volatile_fid); + } + +-static void ++static int + smb2_close_getattr(const unsigned int xid, struct cifs_tcon *tcon, + struct cifsFileInfo *cfile) + { +@@ -1410,7 +1410,7 @@ smb2_close_getattr(const unsigned int xi + rc = __SMB2_close(xid, tcon, cfile->fid.persistent_fid, + cfile->fid.volatile_fid, &file_inf); + if (rc) +- return; ++ return rc; + + inode = d_inode(cfile->dentry); + +@@ -1439,6 +1439,7 @@ smb2_close_getattr(const unsigned int xi + + /* End of file and Attributes should not have to be updated on close */ + spin_unlock(&inode->i_lock); ++ return rc; + } + + static int +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -3549,9 +3549,9 @@ __SMB2_close(const unsigned int xid, str + memcpy(&pbuf->network_open_info, + &rsp->network_open_info, + sizeof(pbuf->network_open_info)); ++ atomic_dec(&tcon->num_remote_opens); + } + +- atomic_dec(&tcon->num_remote_opens); + close_exit: + SMB2_close_free(&rqst); + free_rsp_buf(resp_buftype, rsp);