From 16ff9c2aa2190cd51a5e5a6432fd7a4849ba9afa Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 28 Mar 2023 16:12:58 +0200 Subject: [PATCH] 5.10-stable patches added patches: kvm-fix-memoryleak-in-kvm_init.patch nfsd-fix-use-after-free-in-__nfs42_ssc_open.patch --- .../kvm-fix-memoryleak-in-kvm_init.patch | 46 ++++++++++ ...x-use-after-free-in-__nfs42_ssc_open.patch | 90 +++++++++++++++++++ queue-5.10/series | 2 + 3 files changed, 138 insertions(+) create mode 100644 queue-5.10/kvm-fix-memoryleak-in-kvm_init.patch create mode 100644 queue-5.10/nfsd-fix-use-after-free-in-__nfs42_ssc_open.patch diff --git a/queue-5.10/kvm-fix-memoryleak-in-kvm_init.patch b/queue-5.10/kvm-fix-memoryleak-in-kvm_init.patch new file mode 100644 index 00000000000..1b7f168c575 --- /dev/null +++ b/queue-5.10/kvm-fix-memoryleak-in-kvm_init.patch @@ -0,0 +1,46 @@ +From 5a2a961be2ad6a16eb388a80442443b353c11d16 Mon Sep 17 00:00:00 2001 +From: Miaohe Lin +Date: Tue, 23 Aug 2022 14:34:14 +0800 +Subject: KVM: fix memoryleak in kvm_init() + +From: Miaohe Lin + +commit 5a2a961be2ad6a16eb388a80442443b353c11d16 upstream. + +When alloc_cpumask_var_node() fails for a certain cpu, there might be some +allocated cpumasks for percpu cpu_kick_mask. We should free these cpumasks +or memoryleak will occur. + +Fixes: baff59ccdc65 ("KVM: Pre-allocate cpumasks for kvm_make_all_cpus_request_except()") +Signed-off-by: Miaohe Lin +Link: https://lore.kernel.org/r/20220823063414.59778-1-linmiaohe@huawei.com +Signed-off-by: Sean Christopherson +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +--- + virt/kvm/kvm_main.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -5014,7 +5014,7 @@ int kvm_init(void *opaque, unsigned vcpu + + r = kvm_async_pf_init(); + if (r) +- goto out_free_5; ++ goto out_free_4; + + kvm_chardev_ops.owner = module; + kvm_vm_fops.owner = module; +@@ -5047,10 +5047,9 @@ err_register: + kvm_vfio_ops_exit(); + err_vfio: + kvm_async_pf_deinit(); +-out_free_5: ++out_free_4: + for_each_possible_cpu(cpu) + free_cpumask_var(per_cpu(cpu_kick_mask, cpu)); +-out_free_4: + kmem_cache_destroy(kvm_vcpu_cache); + out_free_3: + unregister_reboot_notifier(&kvm_reboot_notifier); diff --git a/queue-5.10/nfsd-fix-use-after-free-in-__nfs42_ssc_open.patch b/queue-5.10/nfsd-fix-use-after-free-in-__nfs42_ssc_open.patch new file mode 100644 index 00000000000..1e5966d0c1c --- /dev/null +++ b/queue-5.10/nfsd-fix-use-after-free-in-__nfs42_ssc_open.patch @@ -0,0 +1,90 @@ +From 75333d48f92256a0dec91dbf07835e804fc411c0 Mon Sep 17 00:00:00 2001 +From: Dai Ngo +Date: Mon, 12 Dec 2022 14:50:11 -0800 +Subject: NFSD: fix use-after-free in __nfs42_ssc_open() + +From: Dai Ngo + +commit 75333d48f92256a0dec91dbf07835e804fc411c0 upstream. + +Problem caused by source's vfsmount being unmounted but remains +on the delayed unmount list. This happens when nfs42_ssc_open() +return errors. + +Fixed by removing nfsd4_interssc_connect(), leave the vfsmount +for the laundromat to unmount when idle time expires. + +We don't need to call nfs_do_sb_deactive when nfs42_ssc_open +return errors since the file was not opened so nfs_server->active +was not incremented. Same as in nfsd4_copy, if we fail to +launch nfsd4_do_async_copy thread then there's no need to +call nfs_do_sb_deactive + +Reported-by: Xingyuan Mo +Signed-off-by: Dai Ngo +Tested-by: Xingyuan Mo +Signed-off-by: Chuck Lever +Signed-off-by: Ovidiu Panait +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfsd/nfs4proc.c | 22 ++++++---------------- + 1 file changed, 6 insertions(+), 16 deletions(-) + +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1248,13 +1248,6 @@ out_err: + return status; + } + +-static void +-nfsd4_interssc_disconnect(struct vfsmount *ss_mnt) +-{ +- nfs_do_sb_deactive(ss_mnt->mnt_sb); +- mntput(ss_mnt); +-} +- + /* + * Verify COPY destination stateid. + * +@@ -1325,11 +1318,6 @@ nfsd4_cleanup_inter_ssc(struct vfsmount + { + } + +-static void +-nfsd4_interssc_disconnect(struct vfsmount *ss_mnt) +-{ +-} +- + static struct file *nfs42_ssc_open(struct vfsmount *ss_mnt, + struct nfs_fh *src_fh, + nfs4_stateid *stateid) +@@ -1471,14 +1459,14 @@ static int nfsd4_do_async_copy(void *dat + copy->nf_src = kzalloc(sizeof(struct nfsd_file), GFP_KERNEL); + if (!copy->nf_src) { + copy->nfserr = nfserr_serverfault; +- nfsd4_interssc_disconnect(copy->ss_mnt); ++ /* ss_mnt will be unmounted by the laundromat */ + goto do_callback; + } + copy->nf_src->nf_file = nfs42_ssc_open(copy->ss_mnt, ©->c_fh, + ©->stateid); + if (IS_ERR(copy->nf_src->nf_file)) { + copy->nfserr = nfserr_offload_denied; +- nfsd4_interssc_disconnect(copy->ss_mnt); ++ /* ss_mnt will be unmounted by the laundromat */ + goto do_callback; + } + } +@@ -1561,8 +1549,10 @@ out_err: + if (async_copy) + cleanup_async_copy(async_copy); + status = nfserrno(-ENOMEM); +- if (!copy->cp_intra) +- nfsd4_interssc_disconnect(copy->ss_mnt); ++ /* ++ * source's vfsmount of inter-copy will be unmounted ++ * by the laundromat ++ */ + goto out; + } + diff --git a/queue-5.10/series b/queue-5.10/series index de2dbccc373..a3b423e74ed 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -100,3 +100,5 @@ sched-fair-sanitize-vruntime-of-entity-being-migrated.patch ocfs2-fix-data-corruption-after-failed-write.patch xfs-shut-down-the-filesystem-if-we-screw-up-quota-reservation.patch xfs-don-t-reuse-busy-extents-on-extent-trim.patch +kvm-fix-memoryleak-in-kvm_init.patch +nfsd-fix-use-after-free-in-__nfs42_ssc_open.patch -- 2.47.3