From 187c9d5f1f7ddcf2034bc9ee253fb4cb357f9ad1 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 19 May 2022 14:49:10 +0200 Subject: [PATCH] 5.10-stable patches added patches: floppy-use-a-statically-allocated-error-counter.patch io_uring-always-grab-file-table-for-deferred-statx.patch --- ...a-statically-allocated-error-counter.patch | 115 ++++++++++++++++++ ...s-grab-file-table-for-deferred-statx.patch | 43 +++++++ queue-5.10/series | 2 + 3 files changed, 160 insertions(+) create mode 100644 queue-5.10/floppy-use-a-statically-allocated-error-counter.patch create mode 100644 queue-5.10/io_uring-always-grab-file-table-for-deferred-statx.patch diff --git a/queue-5.10/floppy-use-a-statically-allocated-error-counter.patch b/queue-5.10/floppy-use-a-statically-allocated-error-counter.patch new file mode 100644 index 00000000000..50fdacbeb8c --- /dev/null +++ b/queue-5.10/floppy-use-a-statically-allocated-error-counter.patch @@ -0,0 +1,115 @@ +From f71f01394f742fc4558b3f9f4c7ef4c4cf3b07c8 Mon Sep 17 00:00:00 2001 +From: Willy Tarreau +Date: Sun, 8 May 2022 11:37:07 +0200 +Subject: floppy: use a statically allocated error counter + +From: Willy Tarreau + +commit f71f01394f742fc4558b3f9f4c7ef4c4cf3b07c8 upstream. + +Interrupt handler bad_flp_intr() may cause a UAF on the recently freed +request just to increment the error count. There's no point keeping +that one in the request anyway, and since the interrupt handler uses a +static pointer to the error which cannot be kept in sync with the +pending request, better make it use a static error counter that's reset +for each new request. This reset now happens when entering +redo_fd_request() for a new request via set_next_request(). + +One initial concern about a single error counter was that errors on one +floppy drive could be reported on another one, but this problem is not +real given that the driver uses a single drive at a time, as that +PC-compatible controllers also have this limitation by using shared +signals. As such the error count is always for the "current" drive. + +Reported-by: Minh Yuan +Suggested-by: Linus Torvalds +Tested-by: Denis Efremov +Signed-off-by: Willy Tarreau +Signed-off-by: Linus Torvalds +Signed-off-by: Denis Efremov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/floppy.c | 20 +++++++++----------- + 1 file changed, 9 insertions(+), 11 deletions(-) + +--- a/drivers/block/floppy.c ++++ b/drivers/block/floppy.c +@@ -509,8 +509,8 @@ static unsigned long fdc_busy; + static DECLARE_WAIT_QUEUE_HEAD(fdc_wait); + static DECLARE_WAIT_QUEUE_HEAD(command_done); + +-/* Errors during formatting are counted here. */ +-static int format_errors; ++/* errors encountered on the current (or last) request */ ++static int floppy_errors; + + /* Format request descriptor. */ + static struct format_descr format_req; +@@ -530,7 +530,6 @@ static struct format_descr format_req; + static char *floppy_track_buffer; + static int max_buffer_sectors; + +-static int *errors; + typedef void (*done_f)(int); + static const struct cont_t { + void (*interrupt)(void); +@@ -1455,7 +1454,7 @@ static int interpret_errors(void) + if (drive_params[current_drive].flags & FTD_MSG) + DPRINT("Over/Underrun - retrying\n"); + bad = 0; +- } else if (*errors >= drive_params[current_drive].max_errors.reporting) { ++ } else if (floppy_errors >= drive_params[current_drive].max_errors.reporting) { + print_errors(); + } + if (reply_buffer[ST2] & ST2_WC || reply_buffer[ST2] & ST2_BC) +@@ -2095,7 +2094,7 @@ static void bad_flp_intr(void) + if (!next_valid_format(current_drive)) + return; + } +- err_count = ++(*errors); ++ err_count = ++floppy_errors; + INFBOUND(write_errors[current_drive].badness, err_count); + if (err_count > drive_params[current_drive].max_errors.abort) + cont->done(0); +@@ -2240,9 +2239,8 @@ static int do_format(int drive, struct f + return -EINVAL; + } + format_req = *tmp_format_req; +- format_errors = 0; + cont = &format_cont; +- errors = &format_errors; ++ floppy_errors = 0; + ret = wait_til_done(redo_format, true); + if (ret == -EINTR) + return -EINTR; +@@ -2721,7 +2719,7 @@ static int make_raw_rw_request(void) + */ + if (!direct || + (indirect * 2 > direct * 3 && +- *errors < drive_params[current_drive].max_errors.read_track && ++ floppy_errors < drive_params[current_drive].max_errors.read_track && + ((!probing || + (drive_params[current_drive].read_track & (1 << drive_state[current_drive].probed_format)))))) { + max_size = blk_rq_sectors(current_req); +@@ -2846,10 +2844,11 @@ static int set_next_request(void) + current_req = list_first_entry_or_null(&floppy_reqs, struct request, + queuelist); + if (current_req) { +- current_req->error_count = 0; ++ floppy_errors = 0; + list_del_init(¤t_req->queuelist); ++ return 1; + } +- return current_req != NULL; ++ return 0; + } + + /* Starts or continues processing request. Will automatically unlock the +@@ -2908,7 +2907,6 @@ do_request: + _floppy = floppy_type + drive_params[current_drive].autodetect[drive_state[current_drive].probed_format]; + } else + probing = 0; +- errors = &(current_req->error_count); + tmp = make_raw_rw_request(); + if (tmp < 2) { + request_done(tmp); diff --git a/queue-5.10/io_uring-always-grab-file-table-for-deferred-statx.patch b/queue-5.10/io_uring-always-grab-file-table-for-deferred-statx.patch new file mode 100644 index 00000000000..18c3d96ec44 --- /dev/null +++ b/queue-5.10/io_uring-always-grab-file-table-for-deferred-statx.patch @@ -0,0 +1,43 @@ +From b1da21187de121e2ed2dc2e0c70d5aabce469691 Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Thu, 19 May 2022 06:05:27 -0600 +Subject: io_uring: always grab file table for deferred statx + +From: Jens Axboe + +Lee reports that there's a use-after-free of the process file table. +There's an assumption that we don't need the file table for some +variants of statx invocation, but that turns out to be false and we +end up with not grabbing a reference for the request even if the +deferred execution uses it. + +Get rid of the REQ_F_NO_FILE_TABLE optimization for statx, and always +grab that reference. + +This issues doesn't exist upstream since the native workers got +introduced with 5.12. + +Link: https://lore.kernel.org/io-uring/YoOJ%2FT4QRKC+fAZE@google.com/ +Reported-by: Lee Jones +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + fs/io_uring.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -4252,12 +4252,8 @@ static int io_statx(struct io_kiocb *req + struct io_statx *ctx = &req->statx; + int ret; + +- if (force_nonblock) { +- /* only need file table for an actual valid fd */ +- if (ctx->dfd == -1 || ctx->dfd == AT_FDCWD) +- req->flags |= REQ_F_NO_FILE_TABLE; ++ if (force_nonblock) + return -EAGAIN; +- } + + ret = do_statx(ctx->dfd, ctx->filename, ctx->flags, ctx->mask, + ctx->buffer); diff --git a/queue-5.10/series b/queue-5.10/series index 7ac09b3bef6..4c9216b6dbe 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -1 +1,3 @@ usb-gadget-fix-race-when-gadget-driver-register-via-ioctl.patch +io_uring-always-grab-file-table-for-deferred-statx.patch +floppy-use-a-statically-allocated-error-counter.patch -- 2.47.3