From: Greg Kroah-Hartman Date: Thu, 23 Jun 2022 16:27:17 +0000 (+0200) Subject: drop dm-mirror-log-round-up-region-bitmap-size-to-bits_per_long.patch fropm 4.9,... X-Git-Tag: v4.9.320~2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=eacdbc2f44bf9eda05e03ca4c8a98ffba8d26b11;p=thirdparty%2Fkernel%2Fstable-queue.git drop dm-mirror-log-round-up-region-bitmap-size-to-bits_per_long.patch fropm 4.9, 4.14, and 4.19 --- diff --git a/queue-4.14/dm-mirror-log-round-up-region-bitmap-size-to-bits_per_long.patch b/queue-4.14/dm-mirror-log-round-up-region-bitmap-size-to-bits_per_long.patch deleted file mode 100644 index a9552a7bd19..00000000000 --- a/queue-4.14/dm-mirror-log-round-up-region-bitmap-size-to-bits_per_long.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 85e123c27d5cbc22cfdc01de1e2ca1d9003a02d0 Mon Sep 17 00:00:00 2001 -From: Mikulas Patocka -Date: Thu, 16 Jun 2022 13:28:57 -0400 -Subject: dm mirror log: round up region bitmap size to BITS_PER_LONG - -From: Mikulas Patocka - -commit 85e123c27d5cbc22cfdc01de1e2ca1d9003a02d0 upstream. - -The code in dm-log rounds up bitset_size to 32 bits. It then uses -find_next_zero_bit_le on the allocated region. find_next_zero_bit_le -accesses the bitmap using unsigned long pointers. So, on 64-bit -architectures, it may access 4 bytes beyond the allocated size. - -Fix this bug by rounding up bitset_size to BITS_PER_LONG. - -This bug was found by running the lvm2 testsuite with kasan. - -Fixes: 29121bd0b00e ("[PATCH] dm mirror log: bitset_size fix") -Cc: stable@vger.kernel.org -Signed-off-by: Mikulas Patocka -Signed-off-by: Mike Snitzer -Signed-off-by: Greg Kroah-Hartman ---- - drivers/md/dm-log.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - ---- a/drivers/md/dm-log.c -+++ b/drivers/md/dm-log.c -@@ -415,8 +415,7 @@ static int create_log_context(struct dm_ - /* - * Work out how many "unsigned long"s we need to hold the bitset. - */ -- bitset_size = dm_round_up(region_count, -- sizeof(*lc->clean_bits) << BYTE_SHIFT); -+ bitset_size = dm_round_up(region_count, BITS_PER_LONG); - bitset_size >>= BYTE_SHIFT; - - lc->bitset_uint32_count = bitset_size / sizeof(*lc->clean_bits); diff --git a/queue-4.14/series b/queue-4.14/series index b7441f335bf..3fc546d51ec 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -220,7 +220,6 @@ usb-serial-io_ti-add-agilent-e5805a-support.patch usb-dwc2-fix-memory-leak-in-dwc2_hcd_init.patch usb-gadget-lpc32xx_udc-fix-refcount-leak-in-lpc32xx_udc_probe.patch serial-8250-store-to-lsr_save_flags-after-lsr-read.patch -dm-mirror-log-round-up-region-bitmap-size-to-bits_per_long.patch ext4-fix-bug_on-ext4_mb_use_inode_pa.patch ext4-make-variable-count-signed.patch ext4-add-reserved-gdt-blocks-check.patch diff --git a/queue-4.19/dm-mirror-log-round-up-region-bitmap-size-to-bits_per_long.patch b/queue-4.19/dm-mirror-log-round-up-region-bitmap-size-to-bits_per_long.patch deleted file mode 100644 index a9552a7bd19..00000000000 --- a/queue-4.19/dm-mirror-log-round-up-region-bitmap-size-to-bits_per_long.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 85e123c27d5cbc22cfdc01de1e2ca1d9003a02d0 Mon Sep 17 00:00:00 2001 -From: Mikulas Patocka -Date: Thu, 16 Jun 2022 13:28:57 -0400 -Subject: dm mirror log: round up region bitmap size to BITS_PER_LONG - -From: Mikulas Patocka - -commit 85e123c27d5cbc22cfdc01de1e2ca1d9003a02d0 upstream. - -The code in dm-log rounds up bitset_size to 32 bits. It then uses -find_next_zero_bit_le on the allocated region. find_next_zero_bit_le -accesses the bitmap using unsigned long pointers. So, on 64-bit -architectures, it may access 4 bytes beyond the allocated size. - -Fix this bug by rounding up bitset_size to BITS_PER_LONG. - -This bug was found by running the lvm2 testsuite with kasan. - -Fixes: 29121bd0b00e ("[PATCH] dm mirror log: bitset_size fix") -Cc: stable@vger.kernel.org -Signed-off-by: Mikulas Patocka -Signed-off-by: Mike Snitzer -Signed-off-by: Greg Kroah-Hartman ---- - drivers/md/dm-log.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - ---- a/drivers/md/dm-log.c -+++ b/drivers/md/dm-log.c -@@ -415,8 +415,7 @@ static int create_log_context(struct dm_ - /* - * Work out how many "unsigned long"s we need to hold the bitset. - */ -- bitset_size = dm_round_up(region_count, -- sizeof(*lc->clean_bits) << BYTE_SHIFT); -+ bitset_size = dm_round_up(region_count, BITS_PER_LONG); - bitset_size >>= BYTE_SHIFT; - - lc->bitset_uint32_count = bitset_size / sizeof(*lc->clean_bits); diff --git a/queue-4.19/series b/queue-4.19/series index 6cc2c66f95a..4796c487b7c 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -214,7 +214,6 @@ usb-serial-io_ti-add-agilent-e5805a-support.patch usb-dwc2-fix-memory-leak-in-dwc2_hcd_init.patch usb-gadget-lpc32xx_udc-fix-refcount-leak-in-lpc32xx_udc_probe.patch serial-8250-store-to-lsr_save_flags-after-lsr-read.patch -dm-mirror-log-round-up-region-bitmap-size-to-bits_per_long.patch ext4-fix-bug_on-ext4_mb_use_inode_pa.patch ext4-make-variable-count-signed.patch ext4-add-reserved-gdt-blocks-check.patch diff --git a/queue-4.9/dm-mirror-log-round-up-region-bitmap-size-to-bits_per_long.patch b/queue-4.9/dm-mirror-log-round-up-region-bitmap-size-to-bits_per_long.patch deleted file mode 100644 index a9552a7bd19..00000000000 --- a/queue-4.9/dm-mirror-log-round-up-region-bitmap-size-to-bits_per_long.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 85e123c27d5cbc22cfdc01de1e2ca1d9003a02d0 Mon Sep 17 00:00:00 2001 -From: Mikulas Patocka -Date: Thu, 16 Jun 2022 13:28:57 -0400 -Subject: dm mirror log: round up region bitmap size to BITS_PER_LONG - -From: Mikulas Patocka - -commit 85e123c27d5cbc22cfdc01de1e2ca1d9003a02d0 upstream. - -The code in dm-log rounds up bitset_size to 32 bits. It then uses -find_next_zero_bit_le on the allocated region. find_next_zero_bit_le -accesses the bitmap using unsigned long pointers. So, on 64-bit -architectures, it may access 4 bytes beyond the allocated size. - -Fix this bug by rounding up bitset_size to BITS_PER_LONG. - -This bug was found by running the lvm2 testsuite with kasan. - -Fixes: 29121bd0b00e ("[PATCH] dm mirror log: bitset_size fix") -Cc: stable@vger.kernel.org -Signed-off-by: Mikulas Patocka -Signed-off-by: Mike Snitzer -Signed-off-by: Greg Kroah-Hartman ---- - drivers/md/dm-log.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - ---- a/drivers/md/dm-log.c -+++ b/drivers/md/dm-log.c -@@ -415,8 +415,7 @@ static int create_log_context(struct dm_ - /* - * Work out how many "unsigned long"s we need to hold the bitset. - */ -- bitset_size = dm_round_up(region_count, -- sizeof(*lc->clean_bits) << BYTE_SHIFT); -+ bitset_size = dm_round_up(region_count, BITS_PER_LONG); - bitset_size >>= BYTE_SHIFT; - - lc->bitset_uint32_count = bitset_size / sizeof(*lc->clean_bits); diff --git a/queue-4.9/series b/queue-4.9/series index c5a5351e877..9dff4f55835 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -244,7 +244,6 @@ usb-serial-option-add-support-for-cinterion-mv31-with-new-baseline.patch usb-serial-io_ti-add-agilent-e5805a-support.patch usb-gadget-lpc32xx_udc-fix-refcount-leak-in-lpc32xx_udc_probe.patch serial-8250-store-to-lsr_save_flags-after-lsr-read.patch -dm-mirror-log-round-up-region-bitmap-size-to-bits_per_long.patch ext4-fix-bug_on-ext4_mb_use_inode_pa.patch ext4-make-variable-count-signed.patch ext4-add-reserved-gdt-blocks-check.patch