From: Greg Kroah-Hartman Date: Fri, 3 Jun 2022 16:13:14 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.9.317~26 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dac27738b854ee752068e8195f4918407ad018bf;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: dm-crypt-make-printing-of-the-key-constant-time.patch dm-integrity-fix-error-code-in-dm_integrity_ctr.patch dm-stats-add-cond_resched-when-looping-over-entries.patch dm-verity-set-dm_target_immutable-feature-flag.patch hid-multitouch-add-support-for-google-whiskers-touchpad.patch zsmalloc-fix-races-between-asynchronous-zspage-free-and-page-migration.patch --- diff --git a/queue-4.19/dm-crypt-make-printing-of-the-key-constant-time.patch b/queue-4.19/dm-crypt-make-printing-of-the-key-constant-time.patch new file mode 100644 index 00000000000..f0b0f1a6505 --- /dev/null +++ b/queue-4.19/dm-crypt-make-printing-of-the-key-constant-time.patch @@ -0,0 +1,58 @@ +From 567dd8f34560fa221a6343729474536aa7ede4fd Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Mon, 25 Apr 2022 08:53:29 -0400 +Subject: dm crypt: make printing of the key constant-time + +From: Mikulas Patocka + +commit 567dd8f34560fa221a6343729474536aa7ede4fd upstream. + +The device mapper dm-crypt target is using scnprintf("%02x", cc->key[i]) to +report the current key to userspace. However, this is not a constant-time +operation and it may leak information about the key via timing, via cache +access patterns or via the branch predictor. + +Change dm-crypt's key printing to use "%c" instead of "%02x". Also +introduce hex2asc() that carefully avoids any branching or memory +accesses when converting a number in the range 0 ... 15 to an ascii +character. + +Cc: stable@vger.kernel.org +Signed-off-by: Mikulas Patocka +Tested-by: Milan Broz +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/dm-crypt.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -2932,6 +2932,11 @@ static int crypt_map(struct dm_target *t + return DM_MAPIO_SUBMITTED; + } + ++static char hex2asc(unsigned char c) ++{ ++ return c + '0' + ((unsigned)(9 - c) >> 4 & 0x27); ++} ++ + static void crypt_status(struct dm_target *ti, status_type_t type, + unsigned status_flags, char *result, unsigned maxlen) + { +@@ -2950,9 +2955,12 @@ static void crypt_status(struct dm_targe + if (cc->key_size > 0) { + if (cc->key_string) + DMEMIT(":%u:%s", cc->key_size, cc->key_string); +- else +- for (i = 0; i < cc->key_size; i++) +- DMEMIT("%02x", cc->key[i]); ++ else { ++ for (i = 0; i < cc->key_size; i++) { ++ DMEMIT("%c%c", hex2asc(cc->key[i] >> 4), ++ hex2asc(cc->key[i] & 0xf)); ++ } ++ } + } else + DMEMIT("-"); + diff --git a/queue-4.19/dm-integrity-fix-error-code-in-dm_integrity_ctr.patch b/queue-4.19/dm-integrity-fix-error-code-in-dm_integrity_ctr.patch new file mode 100644 index 00000000000..6674becf90f --- /dev/null +++ b/queue-4.19/dm-integrity-fix-error-code-in-dm_integrity_ctr.patch @@ -0,0 +1,37 @@ +From d3f2a14b8906df913cb04a706367b012db94a6e8 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 25 Apr 2022 14:56:48 +0300 +Subject: dm integrity: fix error code in dm_integrity_ctr() + +From: Dan Carpenter + +commit d3f2a14b8906df913cb04a706367b012db94a6e8 upstream. + +The "r" variable shadows an earlier "r" that has function scope. It +means that we accidentally return success instead of an error code. +Smatch has a warning for this: + + drivers/md/dm-integrity.c:4503 dm_integrity_ctr() + warn: missing error code 'r' + +Fixes: 7eada909bfd7 ("dm: add integrity target") +Cc: stable@vger.kernel.org +Signed-off-by: Dan Carpenter +Reviewed-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/dm-integrity.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -3565,8 +3565,6 @@ try_smaller_buffer: + } + + if (should_write_sb) { +- int r; +- + init_journal(ic, 0, ic->journal_sections, 0); + r = dm_integrity_failed(ic); + if (unlikely(r)) { diff --git a/queue-4.19/dm-stats-add-cond_resched-when-looping-over-entries.patch b/queue-4.19/dm-stats-add-cond_resched-when-looping-over-entries.patch new file mode 100644 index 00000000000..20d23feaffc --- /dev/null +++ b/queue-4.19/dm-stats-add-cond_resched-when-looping-over-entries.patch @@ -0,0 +1,80 @@ +From bfe2b0146c4d0230b68f5c71a64380ff8d361f8b Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Sun, 24 Apr 2022 16:43:00 -0400 +Subject: dm stats: add cond_resched when looping over entries + +From: Mikulas Patocka + +commit bfe2b0146c4d0230b68f5c71a64380ff8d361f8b upstream. + +dm-stats can be used with a very large number of entries (it is only +limited by 1/4 of total system memory), so add rescheduling points to +the loops that iterate over the entries. + +Cc: stable@vger.kernel.org +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/dm-stats.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/md/dm-stats.c ++++ b/drivers/md/dm-stats.c +@@ -224,6 +224,7 @@ void dm_stats_cleanup(struct dm_stats *s + atomic_read(&shared->in_flight[READ]), + atomic_read(&shared->in_flight[WRITE])); + } ++ cond_resched(); + } + dm_stat_free(&s->rcu_head); + } +@@ -313,6 +314,7 @@ static int dm_stats_create(struct dm_sta + for (ni = 0; ni < n_entries; ni++) { + atomic_set(&s->stat_shared[ni].in_flight[READ], 0); + atomic_set(&s->stat_shared[ni].in_flight[WRITE], 0); ++ cond_resched(); + } + + if (s->n_histogram_entries) { +@@ -325,6 +327,7 @@ static int dm_stats_create(struct dm_sta + for (ni = 0; ni < n_entries; ni++) { + s->stat_shared[ni].tmp.histogram = hi; + hi += s->n_histogram_entries + 1; ++ cond_resched(); + } + } + +@@ -345,6 +348,7 @@ static int dm_stats_create(struct dm_sta + for (ni = 0; ni < n_entries; ni++) { + p[ni].histogram = hi; + hi += s->n_histogram_entries + 1; ++ cond_resched(); + } + } + } +@@ -474,6 +478,7 @@ static int dm_stats_list(struct dm_stats + } + DMEMIT("\n"); + } ++ cond_resched(); + } + mutex_unlock(&stats->mutex); + +@@ -750,6 +755,7 @@ static void __dm_stat_clear(struct dm_st + local_irq_enable(); + } + } ++ cond_resched(); + } + } + +@@ -865,6 +871,8 @@ static int dm_stats_print(struct dm_stat + + if (unlikely(sz + 1 >= maxlen)) + goto buffer_overflow; ++ ++ cond_resched(); + } + + if (clear) diff --git a/queue-4.19/dm-verity-set-dm_target_immutable-feature-flag.patch b/queue-4.19/dm-verity-set-dm_target_immutable-feature-flag.patch new file mode 100644 index 00000000000..371acb1639c --- /dev/null +++ b/queue-4.19/dm-verity-set-dm_target_immutable-feature-flag.patch @@ -0,0 +1,35 @@ +From 4caae58406f8ceb741603eee460d79bacca9b1b5 Mon Sep 17 00:00:00 2001 +From: Sarthak Kukreti +Date: Tue, 31 May 2022 15:56:40 -0400 +Subject: dm verity: set DM_TARGET_IMMUTABLE feature flag + +From: Sarthak Kukreti + +commit 4caae58406f8ceb741603eee460d79bacca9b1b5 upstream. + +The device-mapper framework provides a mechanism to mark targets as +immutable (and hence fail table reloads that try to change the target +type). Add the DM_TARGET_IMMUTABLE flag to the dm-verity target's +feature flags to prevent switching the verity target with a different +target type. + +Fixes: a4ffc152198e ("dm: add verity target") +Cc: stable@vger.kernel.org +Signed-off-by: Sarthak Kukreti +Reviewed-by: Kees Cook +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/dm-verity-target.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/md/dm-verity-target.c ++++ b/drivers/md/dm-verity-target.c +@@ -1176,6 +1176,7 @@ bad: + + static struct target_type verity_target = { + .name = "verity", ++ .features = DM_TARGET_IMMUTABLE, + .version = {1, 4, 0}, + .module = THIS_MODULE, + .ctr = verity_ctr, diff --git a/queue-4.19/hid-multitouch-add-support-for-google-whiskers-touchpad.patch b/queue-4.19/hid-multitouch-add-support-for-google-whiskers-touchpad.patch new file mode 100644 index 00000000000..16fe6ced722 --- /dev/null +++ b/queue-4.19/hid-multitouch-add-support-for-google-whiskers-touchpad.patch @@ -0,0 +1,33 @@ +From 1d07cef7fd7599450b3d03e1915efc2a96e1f03f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Marek=20Ma=C5=9Blanka?= +Date: Tue, 5 Apr 2022 17:04:07 +0200 +Subject: HID: multitouch: Add support for Google Whiskers Touchpad + +From: Marek Maślanka + +commit 1d07cef7fd7599450b3d03e1915efc2a96e1f03f upstream. + +The Google Whiskers touchpad does not work properly with the default +multitouch configuration. Instead, use the same configuration as Google +Rose. + +Signed-off-by: Marek Maslanka +Acked-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-multitouch.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2111,6 +2111,9 @@ static const struct hid_device_id mt_dev + { .driver_data = MT_CLS_GOOGLE, + HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, USB_VENDOR_ID_GOOGLE, + USB_DEVICE_ID_GOOGLE_TOUCH_ROSE) }, ++ { .driver_data = MT_CLS_GOOGLE, ++ HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8, USB_VENDOR_ID_GOOGLE, ++ USB_DEVICE_ID_GOOGLE_WHISKERS) }, + + /* Generic MT device */ + { HID_DEVICE(HID_BUS_ANY, HID_GROUP_MULTITOUCH, HID_ANY_ID, HID_ANY_ID) }, diff --git a/queue-4.19/series b/queue-4.19/series index 2f063670637..dc7e191ea44 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -17,3 +17,9 @@ drm-i915-fix-wstringop-overflow-warning-in-call-to-intel_read_wm_latency.patch block-map-add-__gfp_zero-flag-for-alloc_page-in-function-bio_copy_kern.patch exec-force-single-empty-string-when-argv-is-empty.patch netfilter-conntrack-re-fetch-conntrack-after-insertion.patch +zsmalloc-fix-races-between-asynchronous-zspage-free-and-page-migration.patch +dm-integrity-fix-error-code-in-dm_integrity_ctr.patch +dm-crypt-make-printing-of-the-key-constant-time.patch +dm-stats-add-cond_resched-when-looping-over-entries.patch +dm-verity-set-dm_target_immutable-feature-flag.patch +hid-multitouch-add-support-for-google-whiskers-touchpad.patch diff --git a/queue-4.19/zsmalloc-fix-races-between-asynchronous-zspage-free-and-page-migration.patch b/queue-4.19/zsmalloc-fix-races-between-asynchronous-zspage-free-and-page-migration.patch new file mode 100644 index 00000000000..4e7ddb8b512 --- /dev/null +++ b/queue-4.19/zsmalloc-fix-races-between-asynchronous-zspage-free-and-page-migration.patch @@ -0,0 +1,86 @@ +From 2505a981114dcb715f8977b8433f7540854851d8 Mon Sep 17 00:00:00 2001 +From: Sultan Alsawaf +Date: Fri, 13 May 2022 15:11:26 -0700 +Subject: zsmalloc: fix races between asynchronous zspage free and page migration + +From: Sultan Alsawaf + +commit 2505a981114dcb715f8977b8433f7540854851d8 upstream. + +The asynchronous zspage free worker tries to lock a zspage's entire page +list without defending against page migration. Since pages which haven't +yet been locked can concurrently migrate off the zspage page list while +lock_zspage() churns away, lock_zspage() can suffer from a few different +lethal races. + +It can lock a page which no longer belongs to the zspage and unsafely +dereference page_private(), it can unsafely dereference a torn pointer to +the next page (since there's a data race), and it can observe a spurious +NULL pointer to the next page and thus not lock all of the zspage's pages +(since a single page migration will reconstruct the entire page list, and +create_page_chain() unconditionally zeroes out each list pointer in the +process). + +Fix the races by using migrate_read_lock() in lock_zspage() to synchronize +with page migration. + +Link: https://lkml.kernel.org/r/20220509024703.243847-1-sultan@kerneltoast.com +Fixes: 77ff465799c602 ("zsmalloc: zs_page_migrate: skip unnecessary loops but not return -EBUSY if zspage is not inuse") +Signed-off-by: Sultan Alsawaf +Acked-by: Minchan Kim +Cc: Nitin Gupta +Cc: Sergey Senozhatsky +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/zsmalloc.c | 37 +++++++++++++++++++++++++++++++++---- + 1 file changed, 33 insertions(+), 4 deletions(-) + +--- a/mm/zsmalloc.c ++++ b/mm/zsmalloc.c +@@ -1812,11 +1812,40 @@ static enum fullness_group putback_zspag + */ + static void lock_zspage(struct zspage *zspage) + { +- struct page *page = get_first_page(zspage); ++ struct page *curr_page, *page; + +- do { +- lock_page(page); +- } while ((page = get_next_page(page)) != NULL); ++ /* ++ * Pages we haven't locked yet can be migrated off the list while we're ++ * trying to lock them, so we need to be careful and only attempt to ++ * lock each page under migrate_read_lock(). Otherwise, the page we lock ++ * may no longer belong to the zspage. This means that we may wait for ++ * the wrong page to unlock, so we must take a reference to the page ++ * prior to waiting for it to unlock outside migrate_read_lock(). ++ */ ++ while (1) { ++ migrate_read_lock(zspage); ++ page = get_first_page(zspage); ++ if (trylock_page(page)) ++ break; ++ get_page(page); ++ migrate_read_unlock(zspage); ++ wait_on_page_locked(page); ++ put_page(page); ++ } ++ ++ curr_page = page; ++ while ((page = get_next_page(curr_page))) { ++ if (trylock_page(page)) { ++ curr_page = page; ++ } else { ++ get_page(page); ++ migrate_read_unlock(zspage); ++ wait_on_page_locked(page); ++ put_page(page); ++ migrate_read_lock(zspage); ++ } ++ } ++ migrate_read_unlock(zspage); + } + + static struct dentry *zs_mount(struct file_system_type *fs_type,