From: Greg Kroah-Hartman Date: Mon, 20 Dec 2021 12:31:57 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.4.296~21 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e64b811311d21755126ec487c1002a06e556d958;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: fuse-annotate-lock-in-fuse_reverse_inval_entry.patch mac80211-fix-regression-in-ssn-handling-of-addba-tx.patch net-sched-fix-suspicious-rcu-usage-while-accessing-tcf_tunnel_info.patch ovl-fix-warning-in-ovl_create_real.patch rcu-mark-accesses-to-rcu_state.n_force_qs.patch scsi-scsi_debug-sanity-check-block-descriptor-length-in-resp_mode_select.patch --- diff --git a/queue-5.4/fuse-annotate-lock-in-fuse_reverse_inval_entry.patch b/queue-5.4/fuse-annotate-lock-in-fuse_reverse_inval_entry.patch new file mode 100644 index 00000000000..de9b9bf0722 --- /dev/null +++ b/queue-5.4/fuse-annotate-lock-in-fuse_reverse_inval_entry.patch @@ -0,0 +1,29 @@ +From bda9a71980e083699a0360963c0135657b73f47a Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Fri, 22 Oct 2021 17:03:01 +0200 +Subject: fuse: annotate lock in fuse_reverse_inval_entry() + +From: Miklos Szeredi + +commit bda9a71980e083699a0360963c0135657b73f47a upstream. + +Add missing inode lock annotatation; found by syzbot. + +Reported-and-tested-by: syzbot+9f747458f5990eaa8d43@syzkaller.appspotmail.com +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman +--- + fs/fuse/dir.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -1032,7 +1032,7 @@ int fuse_reverse_inval_entry(struct supe + if (!parent) + return -ENOENT; + +- inode_lock(parent); ++ inode_lock_nested(parent, I_MUTEX_PARENT); + if (!S_ISDIR(parent->i_mode)) + goto unlock; + diff --git a/queue-5.4/mac80211-fix-regression-in-ssn-handling-of-addba-tx.patch b/queue-5.4/mac80211-fix-regression-in-ssn-handling-of-addba-tx.patch new file mode 100644 index 00000000000..33a46baf3b9 --- /dev/null +++ b/queue-5.4/mac80211-fix-regression-in-ssn-handling-of-addba-tx.patch @@ -0,0 +1,55 @@ +From 73111efacd3c6d9e644acca1d132566932be8af0 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Wed, 24 Nov 2021 10:40:24 +0100 +Subject: mac80211: fix regression in SSN handling of addba tx + +From: Felix Fietkau + +commit 73111efacd3c6d9e644acca1d132566932be8af0 upstream. + +Some drivers that do their own sequence number allocation (e.g. ath9k) rely +on being able to modify params->ssn on starting tx ampdu sessions. +This was broken by a change that modified it to use sta->tid_seq[tid] instead. + +Cc: stable@vger.kernel.org +Fixes: 31d8bb4e07f8 ("mac80211: agg-tx: refactor sending addba") +Reported-by: Eneas U de Queiroz +Signed-off-by: Felix Fietkau +Link: https://lore.kernel.org/r/20211124094024.43222-1-nbd@nbd.name +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/mac80211/agg-tx.c | 4 ++-- + net/mac80211/sta_info.h | 1 + + 2 files changed, 3 insertions(+), 2 deletions(-) + +--- a/net/mac80211/agg-tx.c ++++ b/net/mac80211/agg-tx.c +@@ -481,8 +481,7 @@ static void ieee80211_send_addba_with_ti + + /* send AddBA request */ + ieee80211_send_addba_request(sdata, sta->sta.addr, tid, +- tid_tx->dialog_token, +- sta->tid_seq[tid] >> 4, ++ tid_tx->dialog_token, tid_tx->ssn, + buf_size, tid_tx->timeout); + } + +@@ -522,6 +521,7 @@ void ieee80211_tx_ba_session_handle_star + + params.ssn = sta->tid_seq[tid] >> 4; + ret = drv_ampdu_action(local, sdata, ¶ms); ++ tid_tx->ssn = params.ssn; + if (ret) { + ht_dbg(sdata, + "BA request denied - HW unavailable for %pM tid %d\n", +--- a/net/mac80211/sta_info.h ++++ b/net/mac80211/sta_info.h +@@ -180,6 +180,7 @@ struct tid_ampdu_tx { + u8 stop_initiator; + bool tx_stop; + u16 buf_size; ++ u16 ssn; + + u16 failed_bar_ssn; + bool bar_pending; diff --git a/queue-5.4/net-sched-fix-suspicious-rcu-usage-while-accessing-tcf_tunnel_info.patch b/queue-5.4/net-sched-fix-suspicious-rcu-usage-while-accessing-tcf_tunnel_info.patch new file mode 100644 index 00000000000..5b58783c4cc --- /dev/null +++ b/queue-5.4/net-sched-fix-suspicious-rcu-usage-while-accessing-tcf_tunnel_info.patch @@ -0,0 +1,75 @@ +From d086a1c65aabb5a4e1edc580ca583e2964c62b44 Mon Sep 17 00:00:00 2001 +From: Leon Romanovsky +Date: Wed, 14 Oct 2020 11:56:42 +0300 +Subject: net: sched: Fix suspicious RCU usage while accessing tcf_tunnel_info + +From: Leon Romanovsky + +commit d086a1c65aabb5a4e1edc580ca583e2964c62b44 upstream. + +The access of tcf_tunnel_info() produces the following splat, so fix it +by dereferencing the tcf_tunnel_key_params pointer with marker that +internal tcfa_liock is held. + + ============================= + WARNING: suspicious RCU usage + 5.9.0+ #1 Not tainted + ----------------------------- + include/net/tc_act/tc_tunnel_key.h:59 suspicious rcu_dereference_protected() usage! + other info that might help us debug this: + + rcu_scheduler_active = 2, debug_locks = 1 + 1 lock held by tc/34839: + #0: ffff88828572c2a0 (&p->tcfa_lock){+...}-{2:2}, at: tc_setup_flow_action+0xb3/0x48b5 + stack backtrace: + CPU: 1 PID: 34839 Comm: tc Not tainted 5.9.0+ #1 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 + Call Trace: + dump_stack+0x9a/0xd0 + tc_setup_flow_action+0x14cb/0x48b5 + fl_hw_replace_filter+0x347/0x690 [cls_flower] + fl_change+0x2bad/0x4875 [cls_flower] + tc_new_tfilter+0xf6f/0x1ba0 + rtnetlink_rcv_msg+0x5f2/0x870 + netlink_rcv_skb+0x124/0x350 + netlink_unicast+0x433/0x700 + netlink_sendmsg+0x6f1/0xbd0 + sock_sendmsg+0xb0/0xe0 + ____sys_sendmsg+0x4fa/0x6d0 + ___sys_sendmsg+0x12e/0x1b0 + __sys_sendmsg+0xa4/0x120 + do_syscall_64+0x2d/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + RIP: 0033:0x7f1f8cd4fe57 + Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 + RSP: 002b:00007ffdc1e193b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e + RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1f8cd4fe57 + RDX: 0000000000000000 RSI: 00007ffdc1e19420 RDI: 0000000000000003 + RBP: 000000005f85aafa R08: 0000000000000001 R09: 00007ffdc1e1936c + R10: 000000000040522d R11: 0000000000000246 R12: 0000000000000001 + R13: 0000000000000000 R14: 00007ffdc1e1d6f0 R15: 0000000000482420 + +Fixes: 3ebaf6da0716 ("net: sched: Do not assume RTNL is held in tunnel key action helpers") +Fixes: 7a47281439ba ("net: sched: lock action when translating it to flow_action infra") +Signed-off-by: Leon Romanovsky +Acked-by: Cong Wang +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + include/net/tc_act/tc_tunnel_key.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/include/net/tc_act/tc_tunnel_key.h ++++ b/include/net/tc_act/tc_tunnel_key.h +@@ -52,7 +52,10 @@ static inline struct ip_tunnel_info *tcf + { + #ifdef CONFIG_NET_CLS_ACT + struct tcf_tunnel_key *t = to_tunnel_key(a); +- struct tcf_tunnel_key_params *params = rtnl_dereference(t->params); ++ struct tcf_tunnel_key_params *params; ++ ++ params = rcu_dereference_protected(t->params, ++ lockdep_is_held(&a->tcfa_lock)); + + return ¶ms->tcft_enc_metadata->u.tun_info; + #else diff --git a/queue-5.4/ovl-fix-warning-in-ovl_create_real.patch b/queue-5.4/ovl-fix-warning-in-ovl_create_real.patch new file mode 100644 index 00000000000..a914ebd0aa2 --- /dev/null +++ b/queue-5.4/ovl-fix-warning-in-ovl_create_real.patch @@ -0,0 +1,73 @@ +From 1f5573cfe7a7056e80a92c7a037a3e69f3a13d1c Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Thu, 4 Nov 2021 10:55:34 +0100 +Subject: ovl: fix warning in ovl_create_real() + +From: Miklos Szeredi + +commit 1f5573cfe7a7056e80a92c7a037a3e69f3a13d1c upstream. + +Syzbot triggered the following warning in ovl_workdir_create() -> +ovl_create_real(): + + if (!err && WARN_ON(!newdentry->d_inode)) { + +The reason is that the cgroup2 filesystem returns from mkdir without +instantiating the new dentry. + +Weird filesystems such as this will be rejected by overlayfs at a later +stage during setup, but to prevent such a warning, call ovl_mkdir_real() +directly from ovl_workdir_create() and reject this case early. + +Reported-and-tested-by: syzbot+75eab84fd0af9e8bf66b@syzkaller.appspotmail.com +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman +--- + fs/overlayfs/dir.c | 3 +-- + fs/overlayfs/overlayfs.h | 1 + + fs/overlayfs/super.c | 12 ++++++++---- + 3 files changed, 10 insertions(+), 6 deletions(-) + +--- a/fs/overlayfs/dir.c ++++ b/fs/overlayfs/dir.c +@@ -113,8 +113,7 @@ kill_whiteout: + goto out; + } + +-static int ovl_mkdir_real(struct inode *dir, struct dentry **newdentry, +- umode_t mode) ++int ovl_mkdir_real(struct inode *dir, struct dentry **newdentry, umode_t mode) + { + int err; + struct dentry *d, *dentry = *newdentry; +--- a/fs/overlayfs/overlayfs.h ++++ b/fs/overlayfs/overlayfs.h +@@ -409,6 +409,7 @@ struct ovl_cattr { + + #define OVL_CATTR(m) (&(struct ovl_cattr) { .mode = (m) }) + ++int ovl_mkdir_real(struct inode *dir, struct dentry **newdentry, umode_t mode); + struct dentry *ovl_create_real(struct inode *dir, struct dentry *newdentry, + struct ovl_cattr *attr); + int ovl_cleanup(struct inode *dir, struct dentry *dentry); +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -650,10 +650,14 @@ retry: + goto retry; + } + +- work = ovl_create_real(dir, work, OVL_CATTR(attr.ia_mode)); +- err = PTR_ERR(work); +- if (IS_ERR(work)) +- goto out_err; ++ err = ovl_mkdir_real(dir, &work, attr.ia_mode); ++ if (err) ++ goto out_dput; ++ ++ /* Weird filesystem returning with hashed negative (kernfs)? */ ++ err = -EINVAL; ++ if (d_really_is_negative(work)) ++ goto out_dput; + + /* + * Try to remove POSIX ACL xattrs from workdir. We are good if: diff --git a/queue-5.4/rcu-mark-accesses-to-rcu_state.n_force_qs.patch b/queue-5.4/rcu-mark-accesses-to-rcu_state.n_force_qs.patch new file mode 100644 index 00000000000..ea7e22e39be --- /dev/null +++ b/queue-5.4/rcu-mark-accesses-to-rcu_state.n_force_qs.patch @@ -0,0 +1,62 @@ +From 2431774f04d1050292054c763070021bade7b151 Mon Sep 17 00:00:00 2001 +From: "Paul E. McKenney" +Date: Tue, 20 Jul 2021 06:16:27 -0700 +Subject: rcu: Mark accesses to rcu_state.n_force_qs + +From: Paul E. McKenney + +commit 2431774f04d1050292054c763070021bade7b151 upstream. + +This commit marks accesses to the rcu_state.n_force_qs. These data +races are hard to make happen, but syzkaller was equal to the task. + +Reported-by: syzbot+e08a83a1940ec3846cd5@syzkaller.appspotmail.com +Acked-by: Marco Elver +Signed-off-by: Paul E. McKenney +Signed-off-by: Greg Kroah-Hartman +--- + kernel/rcu/tree.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/kernel/rcu/tree.c ++++ b/kernel/rcu/tree.c +@@ -1602,7 +1602,7 @@ static void rcu_gp_fqs(bool first_time) + struct rcu_node *rnp = rcu_get_root(); + + WRITE_ONCE(rcu_state.gp_activity, jiffies); +- rcu_state.n_force_qs++; ++ WRITE_ONCE(rcu_state.n_force_qs, rcu_state.n_force_qs + 1); + if (first_time) { + /* Collect dyntick-idle snapshots. */ + force_qs_rnp(dyntick_save_progress_counter); +@@ -2207,7 +2207,7 @@ static void rcu_do_batch(struct rcu_data + /* Reset ->qlen_last_fqs_check trigger if enough CBs have drained. */ + if (count == 0 && rdp->qlen_last_fqs_check != 0) { + rdp->qlen_last_fqs_check = 0; +- rdp->n_force_qs_snap = rcu_state.n_force_qs; ++ rdp->n_force_qs_snap = READ_ONCE(rcu_state.n_force_qs); + } else if (count < rdp->qlen_last_fqs_check - qhimark) + rdp->qlen_last_fqs_check = count; + +@@ -2535,10 +2535,10 @@ static void __call_rcu_core(struct rcu_d + } else { + /* Give the grace period a kick. */ + rdp->blimit = DEFAULT_MAX_RCU_BLIMIT; +- if (rcu_state.n_force_qs == rdp->n_force_qs_snap && ++ if (READ_ONCE(rcu_state.n_force_qs) == rdp->n_force_qs_snap && + rcu_segcblist_first_pend_cb(&rdp->cblist) != head) + rcu_force_quiescent_state(); +- rdp->n_force_qs_snap = rcu_state.n_force_qs; ++ rdp->n_force_qs_snap = READ_ONCE(rcu_state.n_force_qs); + rdp->qlen_last_fqs_check = rcu_segcblist_n_cbs(&rdp->cblist); + } + } +@@ -3029,7 +3029,7 @@ int rcutree_prepare_cpu(unsigned int cpu + /* Set up local state, ensuring consistent view of global state. */ + raw_spin_lock_irqsave_rcu_node(rnp, flags); + rdp->qlen_last_fqs_check = 0; +- rdp->n_force_qs_snap = rcu_state.n_force_qs; ++ rdp->n_force_qs_snap = READ_ONCE(rcu_state.n_force_qs); + rdp->blimit = blimit; + if (rcu_segcblist_empty(&rdp->cblist) && /* No early-boot CBs? */ + !rcu_segcblist_is_offloaded(&rdp->cblist)) diff --git a/queue-5.4/scsi-scsi_debug-sanity-check-block-descriptor-length-in-resp_mode_select.patch b/queue-5.4/scsi-scsi_debug-sanity-check-block-descriptor-length-in-resp_mode_select.patch new file mode 100644 index 00000000000..fc003daf41e --- /dev/null +++ b/queue-5.4/scsi-scsi_debug-sanity-check-block-descriptor-length-in-resp_mode_select.patch @@ -0,0 +1,68 @@ +From e0a2c28da11e2c2b963fc01d50acbf03045ac732 Mon Sep 17 00:00:00 2001 +From: George Kennedy +Date: Thu, 18 Nov 2021 14:03:28 -0500 +Subject: scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() + +From: George Kennedy + +commit e0a2c28da11e2c2b963fc01d50acbf03045ac732 upstream. + +In resp_mode_select() sanity check the block descriptor len to avoid UAF. + +BUG: KASAN: use-after-free in resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509 +Read of size 1 at addr ffff888026670f50 by task scsicmd/15032 + +CPU: 1 PID: 15032 Comm: scsicmd Not tainted 5.15.0-01d0625 #15 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS +Call Trace: + + dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:107 + print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:257 + kasan_report.cold.14+0x7d/0x117 mm/kasan/report.c:443 + __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306 + resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509 + schedule_resp+0x4af/0x1a10 drivers/scsi/scsi_debug.c:5483 + scsi_debug_queuecommand+0x8c9/0x1e70 drivers/scsi/scsi_debug.c:7537 + scsi_queue_rq+0x16b4/0x2d10 drivers/scsi/scsi_lib.c:1521 + blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1640 + __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325 + blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358 + __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1762 + __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1839 + blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891 + blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474 + blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:63 + sg_common_write.isra.18+0xeb3/0x2000 drivers/scsi/sg.c:837 + sg_new_write.isra.19+0x570/0x8c0 drivers/scsi/sg.c:775 + sg_ioctl_common+0x14d6/0x2710 drivers/scsi/sg.c:941 + sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1166 + __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:52 + do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:50 + entry_SYSCALL_64_after_hwframe+0x44/0xae arch/x86/entry/entry_64.S:113 + +Link: https://lore.kernel.org/r/1637262208-28850-1-git-send-email-george.kennedy@oracle.com +Reported-by: syzkaller +Acked-by: Douglas Gilbert +Signed-off-by: George Kennedy +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/scsi_debug.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/scsi_debug.c ++++ b/drivers/scsi/scsi_debug.c +@@ -2296,11 +2296,11 @@ static int resp_mode_select(struct scsi_ + __func__, param_len, res); + md_len = mselect6 ? (arr[0] + 1) : (get_unaligned_be16(arr + 0) + 2); + bd_len = mselect6 ? arr[3] : get_unaligned_be16(arr + 6); +- if (md_len > 2) { ++ off = bd_len + (mselect6 ? 4 : 8); ++ if (md_len > 2 || off >= res) { + mk_sense_invalid_fld(scp, SDEB_IN_DATA, 0, -1); + return check_condition_result; + } +- off = bd_len + (mselect6 ? 4 : 8); + mpage = arr[off] & 0x3f; + ps = !!(arr[off] & 0x80); + if (ps) { diff --git a/queue-5.4/series b/queue-5.4/series index 2b63138a9d7..7bea02a0904 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -57,3 +57,9 @@ input-touchscreen-avoid-bitwise-vs-logical-or-warning.patch arm-dts-imx6ull-pinfunc-fix-csi_data07__esai_tx0-pad-name.patch xsk-do-not-sleep-in-poll-when-need_wakeup-set.patch media-mxl111sf-change-mutex_init-location.patch +fuse-annotate-lock-in-fuse_reverse_inval_entry.patch +ovl-fix-warning-in-ovl_create_real.patch +scsi-scsi_debug-sanity-check-block-descriptor-length-in-resp_mode_select.patch +rcu-mark-accesses-to-rcu_state.n_force_qs.patch +mac80211-fix-regression-in-ssn-handling-of-addba-tx.patch +net-sched-fix-suspicious-rcu-usage-while-accessing-tcf_tunnel_info.patch