From: Greg Kroah-Hartman Date: Fri, 23 Feb 2024 15:41:15 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.19.308~107 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cbea0e4af0fa8dde90bbe4665e520d21ef2b9e35;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: memcg-add-refcnt-for-pcpu-stock-to-avoid-uaf-problem-in-drain_all_stock.patch net-stmmac-fix-notifier-registration.patch stmmac-no-need-to-check-return-value-of-debugfs_create-functions.patch --- diff --git a/queue-4.19/memcg-add-refcnt-for-pcpu-stock-to-avoid-uaf-problem-in-drain_all_stock.patch b/queue-4.19/memcg-add-refcnt-for-pcpu-stock-to-avoid-uaf-problem-in-drain_all_stock.patch new file mode 100644 index 00000000000..b88d023a44f --- /dev/null +++ b/queue-4.19/memcg-add-refcnt-for-pcpu-stock-to-avoid-uaf-problem-in-drain_all_stock.patch @@ -0,0 +1,135 @@ +From gongruiqi1@huawei.com Fri Feb 23 16:36:49 2024 +From: "GONG, Ruiqi" +Date: Thu, 22 Feb 2024 11:02:37 +0800 +Subject: memcg: add refcnt for pcpu stock to avoid UAF problem in drain_all_stock() +To: , , Johannes Weiner , Michal Hocko , Roman Gushchin , Shakeel Butt , Muchun Song +Cc: , , Wang Weiyang , Xiu Jianfeng +Message-ID: <20240222030237.82486-1-gongruiqi1@huawei.com> + +From: "GONG, Ruiqi" + +commit 1a3e1f40962c445b997151a542314f3c6097f8c3 upstream. + +NOTE: This is a partial backport since we only need the refcnt between +memcg and stock to fix the problem stated below, and in this way +multiple versions use the same code and align with each other. + +There was a kernel panic happened on an in-house environment running +3.10, and the same problem was reproduced on 4.19: + +general protection fault: 0000 [#1] SMP PTI +CPU: 1 PID: 2085 Comm: bash Kdump: loaded Tainted: G L 4.19.90+ #7 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 +RIP: 0010 drain_all_stock+0xad/0x140 +Code: 00 00 4d 85 ff 74 2c 45 85 c9 74 27 4d 39 fc 74 42 41 80 bc 24 28 04 00 00 00 74 17 49 8b 04 24 49 8b 17 48 8b 88 90 02 00 00 <48> 39 8a 90 02 00 00 74 02 eb 86 48 63 88 3c 01 00 00 39 8a 3c 01 +RSP: 0018:ffffa7efc5813d70 EFLAGS: 00010202 +RAX: ffff8cb185548800 RBX: ffff8cb89f420160 RCX: ffff8cb1867b6000 +RDX: babababababababa RSI: 0000000000000001 RDI: 0000000000231876 +RBP: 0000000000000000 R08: 0000000000000415 R09: 0000000000000002 +R10: 0000000000000000 R11: 0000000000000001 R12: ffff8cb186f89040 +R13: 0000000000020160 R14: 0000000000000001 R15: ffff8cb186b27040 +FS: 00007f4a308d3740(0000) GS:ffff8cb89f440000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007ffe4d634a68 CR3: 000000010b022000 CR4: 00000000000006e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + mem_cgroup_force_empty_write+0x31/0xb0 + cgroup_file_write+0x60/0x140 + ? __check_object_size+0x136/0x147 + kernfs_fop_write+0x10e/0x190 + __vfs_write+0x37/0x1b0 + ? selinux_file_permission+0xe8/0x130 + ? security_file_permission+0x2e/0xb0 + vfs_write+0xb6/0x1a0 + ksys_write+0x57/0xd0 + do_syscall_64+0x63/0x250 + ? async_page_fault+0x8/0x30 + entry_SYSCALL_64_after_hwframe+0x5c/0xc1 +Modules linked in: ... + +It is found that in case of stock->nr_pages == 0, the memcg on +stock->cached could be freed due to its refcnt decreased to 0, which +made stock->cached become a dangling pointer. It could cause a UAF +problem in drain_all_stock() in the following concurrent scenario. Note +that drain_all_stock() doesn't disable irq but only preemption. + +CPU1 CPU2 +============================================================================== +stock->cached = memcgA (freed) + drain_all_stock(memcgB) + rcu_read_lock() + memcg = CPU1's stock->cached (memcgA) + (interrupted) +refill_stock(memcgC) + drain_stock(memcgA) + stock->cached = memcgC + stock->nr_pages += xxx (> 0) + stock->nr_pages > 0 + mem_cgroup_is_descendant(memcgA, memcgB) [UAF] + rcu_read_unlock() + +This problem is, unintentionally, fixed at 5.9, where commit +1a3e1f40962c ("mm: memcontrol: decouple reference counting from page +accounting") adds memcg refcnt for stock. Therefore affected LTS +versions include 4.19 and 5.4. + +For 4.19, memcg's css offline process doesn't call drain_all_stock(). so +it's easier for the released memcg to be left on the stock. For 5.4, +although mem_cgroup_css_offline() does call drain_all_stock(), but the +flushing could be skipped when stock->nr_pages happens to be 0, and +besides the async draining could be delayed and take place after the UAF +problem has happened. + +Fix this problem by adding (and decreasing) memcg's refcnt when memcg is +put onto (and removed from) stock, just like how commit 1a3e1f40962c +("mm: memcontrol: decouple reference counting from page accounting") +does. After all, "being on the stock" is a kind of reference with +regards to memcg. As such, it's guaranteed that a css on stock would not +be freed. + +It's good to mention that refill_stock() is executed in an irq-disabled +context, so the drain_stock() patched with css_put() would not actually +free memcgA until the end of refill_stock(), since css_put() is an RCU +free and it's still in grace period. For CPU2, the access to CPU1's +stock->cached is protected by rcu_read_lock(), so in this case it gets +either NULL from stock->cached or a memcgA that is still good. + +Cc: stable@vger.kernel.org # 4.19 5.4 +Fixes: cdec2e4265df ("memcg: coalesce charging via percpu storage") +Signed-off-by: GONG, Ruiqi +Acked-by: Michal Hocko +Signed-off-by: Greg Kroah-Hartman +--- + mm/memcontrol.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -2015,6 +2015,9 @@ static void drain_stock(struct memcg_sto + { + struct mem_cgroup *old = stock->cached; + ++ if (!old) ++ return; ++ + if (stock->nr_pages) { + page_counter_uncharge(&old->memory, stock->nr_pages); + if (do_memsw_account()) +@@ -2022,6 +2025,8 @@ static void drain_stock(struct memcg_sto + css_put_many(&old->css, stock->nr_pages); + stock->nr_pages = 0; + } ++ ++ css_put(&old->css); + stock->cached = NULL; + } + +@@ -2057,6 +2062,7 @@ static void refill_stock(struct mem_cgro + stock = this_cpu_ptr(&memcg_stock); + if (stock->cached != memcg) { /* reset if necessary */ + drain_stock(stock); ++ css_get(&memcg->css); + stock->cached = memcg; + } + stock->nr_pages += nr_pages; diff --git a/queue-4.19/net-stmmac-fix-notifier-registration.patch b/queue-4.19/net-stmmac-fix-notifier-registration.patch new file mode 100644 index 00000000000..a733d08a003 --- /dev/null +++ b/queue-4.19/net-stmmac-fix-notifier-registration.patch @@ -0,0 +1,83 @@ +From 474a31e13a4e9749fb3ee55794d69d0f17ee0998 Mon Sep 17 00:00:00 2001 +From: Aaro Koskinen +Date: Wed, 26 Feb 2020 18:49:01 +0200 +Subject: net: stmmac: fix notifier registration + +From: Aaro Koskinen + +commit 474a31e13a4e9749fb3ee55794d69d0f17ee0998 upstream. + +We cannot register the same netdev notifier multiple times when probing +stmmac devices. Register the notifier only once in module init, and also +make debugfs creation/deletion safe against simultaneous notifier call. + +Fixes: 481a7d154cbb ("stmmac: debugfs entry name is not be changed when udev rename device name.") +Signed-off-by: Aaro Koskinen +Signed-off-by: David S. Miller +Signed-off-by: Hugo SIMELIERE +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -4067,6 +4067,8 @@ static void stmmac_init_fs(struct net_de + { + struct stmmac_priv *priv = netdev_priv(dev); + ++ rtnl_lock(); ++ + /* Create per netdev entries */ + priv->dbgfs_dir = debugfs_create_dir(dev->name, stmmac_fs_dir); + +@@ -4078,14 +4080,13 @@ static void stmmac_init_fs(struct net_de + debugfs_create_file("dma_cap", 0444, priv->dbgfs_dir, dev, + &stmmac_dma_cap_fops); + +- register_netdevice_notifier(&stmmac_notifier); ++ rtnl_unlock(); + } + + static void stmmac_exit_fs(struct net_device *dev) + { + struct stmmac_priv *priv = netdev_priv(dev); + +- unregister_netdevice_notifier(&stmmac_notifier); + debugfs_remove_recursive(priv->dbgfs_dir); + } + #endif /* CONFIG_DEBUG_FS */ +@@ -4455,14 +4456,14 @@ int stmmac_dvr_remove(struct device *dev + + netdev_info(priv->dev, "%s: removing driver", __func__); + +-#ifdef CONFIG_DEBUG_FS +- stmmac_exit_fs(ndev); +-#endif + stmmac_stop_all_dma(priv); + + stmmac_mac_set(priv, priv->ioaddr, false); + netif_carrier_off(ndev); + unregister_netdev(ndev); ++#ifdef CONFIG_DEBUG_FS ++ stmmac_exit_fs(ndev); ++#endif + if (priv->plat->stmmac_rst) + reset_control_assert(priv->plat->stmmac_rst); + clk_disable_unprepare(priv->plat->pclk); +@@ -4679,6 +4680,7 @@ static int __init stmmac_init(void) + /* Create debugfs main directory if it doesn't exist yet */ + if (!stmmac_fs_dir) + stmmac_fs_dir = debugfs_create_dir(STMMAC_RESOURCE_NAME, NULL); ++ register_netdevice_notifier(&stmmac_notifier); + #endif + + return 0; +@@ -4687,6 +4689,7 @@ static int __init stmmac_init(void) + static void __exit stmmac_exit(void) + { + #ifdef CONFIG_DEBUG_FS ++ unregister_netdevice_notifier(&stmmac_notifier); + debugfs_remove_recursive(stmmac_fs_dir); + #endif + } diff --git a/queue-4.19/series b/queue-4.19/series index d97558d11df..aa933253c50 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -1,3 +1,6 @@ net-sched-retire-cbq-qdisc.patch net-sched-retire-atm-qdisc.patch net-sched-retire-dsmark-qdisc.patch +stmmac-no-need-to-check-return-value-of-debugfs_create-functions.patch +net-stmmac-fix-notifier-registration.patch +memcg-add-refcnt-for-pcpu-stock-to-avoid-uaf-problem-in-drain_all_stock.patch diff --git a/queue-4.19/stmmac-no-need-to-check-return-value-of-debugfs_create-functions.patch b/queue-4.19/stmmac-no-need-to-check-return-value-of-debugfs_create-functions.patch new file mode 100644 index 00000000000..466e32e79e8 --- /dev/null +++ b/queue-4.19/stmmac-no-need-to-check-return-value-of-debugfs_create-functions.patch @@ -0,0 +1,139 @@ +From 8d72ab119f42f25abb393093472ae0ca275088b6 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Sat, 10 Aug 2019 12:17:24 +0200 +Subject: stmmac: no need to check return value of debugfs_create functions + +From: Greg Kroah-Hartman + +commit 8d72ab119f42f25abb393093472ae0ca275088b6 upstream. + +When calling debugfs functions, there is no need to ever check the +return value. The function can work or not, but the code logic should +never do something different based on this. + +Because we don't care about the individual files, we can remove the +stored dentry for the files, as they are not needed to be kept track of +at all. + +Cc: Giuseppe Cavallaro +Cc: Alexandre Torgue +Cc: Jose Abreu +Cc: "David S. Miller" +Cc: Maxime Coquelin +Cc: netdev@vger.kernel.org +Cc: linux-stm32@st-md-mailman.stormreply.com +Signed-off-by: David S. Miller +Signed-off-by: Hugo SIMELIERE +Reviewed-by: Jacob Keller +Stable-dep-of: 474a31e13a4e ("net: stmmac: fix notifier registration") +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/stmmac.h | 2 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 52 +++------------------- + 2 files changed, 8 insertions(+), 46 deletions(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h +@@ -188,8 +188,6 @@ struct stmmac_priv { + + #ifdef CONFIG_DEBUG_FS + struct dentry *dbgfs_dir; +- struct dentry *dbgfs_rings_status; +- struct dentry *dbgfs_dma_cap; + #endif + + unsigned long state; +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -115,7 +115,7 @@ static irqreturn_t stmmac_interrupt(int + + #ifdef CONFIG_DEBUG_FS + static const struct net_device_ops stmmac_netdev_ops; +-static int stmmac_init_fs(struct net_device *dev); ++static void stmmac_init_fs(struct net_device *dev); + static void stmmac_exit_fs(struct net_device *dev); + #endif + +@@ -4063,47 +4063,22 @@ static struct notifier_block stmmac_noti + .notifier_call = stmmac_device_event, + }; + +-static int stmmac_init_fs(struct net_device *dev) ++static void stmmac_init_fs(struct net_device *dev) + { + struct stmmac_priv *priv = netdev_priv(dev); + + /* Create per netdev entries */ + priv->dbgfs_dir = debugfs_create_dir(dev->name, stmmac_fs_dir); + +- if (!priv->dbgfs_dir || IS_ERR(priv->dbgfs_dir)) { +- netdev_err(priv->dev, "ERROR failed to create debugfs directory\n"); +- +- return -ENOMEM; +- } +- + /* Entry to report DMA RX/TX rings */ +- priv->dbgfs_rings_status = +- debugfs_create_file("descriptors_status", 0444, +- priv->dbgfs_dir, dev, +- &stmmac_rings_status_fops); +- +- if (!priv->dbgfs_rings_status || IS_ERR(priv->dbgfs_rings_status)) { +- netdev_err(priv->dev, "ERROR creating stmmac ring debugfs file\n"); +- debugfs_remove_recursive(priv->dbgfs_dir); +- +- return -ENOMEM; +- } ++ debugfs_create_file("descriptors_status", 0444, priv->dbgfs_dir, dev, ++ &stmmac_rings_status_fops); + + /* Entry to report the DMA HW features */ +- priv->dbgfs_dma_cap = debugfs_create_file("dma_cap", 0444, +- priv->dbgfs_dir, +- dev, &stmmac_dma_cap_fops); +- +- if (!priv->dbgfs_dma_cap || IS_ERR(priv->dbgfs_dma_cap)) { +- netdev_err(priv->dev, "ERROR creating stmmac MMC debugfs file\n"); +- debugfs_remove_recursive(priv->dbgfs_dir); +- +- return -ENOMEM; +- } ++ debugfs_create_file("dma_cap", 0444, priv->dbgfs_dir, dev, ++ &stmmac_dma_cap_fops); + + register_netdevice_notifier(&stmmac_notifier); +- +- return 0; + } + + static void stmmac_exit_fs(struct net_device *dev) +@@ -4442,10 +4417,7 @@ int stmmac_dvr_probe(struct device *devi + } + + #ifdef CONFIG_DEBUG_FS +- ret = stmmac_init_fs(ndev); +- if (ret < 0) +- netdev_warn(priv->dev, "%s: failed debugFS registration\n", +- __func__); ++ stmmac_init_fs(ndev); + #endif + + return ret; +@@ -4705,16 +4677,8 @@ static int __init stmmac_init(void) + { + #ifdef CONFIG_DEBUG_FS + /* Create debugfs main directory if it doesn't exist yet */ +- if (!stmmac_fs_dir) { ++ if (!stmmac_fs_dir) + stmmac_fs_dir = debugfs_create_dir(STMMAC_RESOURCE_NAME, NULL); +- +- if (!stmmac_fs_dir || IS_ERR(stmmac_fs_dir)) { +- pr_err("ERROR %s, debugfs create directory failed\n", +- STMMAC_RESOURCE_NAME); +- +- return -ENOMEM; +- } +- } + #endif + + return 0;