From d2f433c05a798a9d6aa86b5548a56436061fb15f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 3 Oct 2019 12:17:15 +0200 Subject: [PATCH] drop some 5.2 and 5.3 erofs patches that broke the build --- queue-5.2/series | 1 - ...x-an-error-handling-in-erofs_readdir.patch | 54 ------------------- queue-5.3/series | 2 - ...-loop-of-invalid-lookback-distance-0.patch | 39 -------------- ...x-an-error-handling-in-erofs_readdir.patch | 54 ------------------- 5 files changed, 150 deletions(-) delete mode 100644 queue-5.2/staging-erofs-fix-an-error-handling-in-erofs_readdir.patch delete mode 100644 queue-5.3/staging-erofs-avoid-endless-loop-of-invalid-lookback-distance-0.patch delete mode 100644 queue-5.3/staging-erofs-fix-an-error-handling-in-erofs_readdir.patch diff --git a/queue-5.2/series b/queue-5.2/series index d7049e7b978..8c0209fe3eb 100644 --- a/queue-5.2/series +++ b/queue-5.2/series @@ -252,7 +252,6 @@ binfmt_elf-do-not-move-brk-for-interp-less-et_exec.patch asoc-intel-nhlt-fix-debug-print-format.patch asoc-intel-skylake-use-correct-function-to-access-iomem-space.patch asoc-intel-fix-use-of-potentially-uninitialized-variable.patch -staging-erofs-fix-an-error-handling-in-erofs_readdir.patch arm-samsung-fix-system-restart-on-s3c6410.patch arm-zynq-use-memcpy_toio-instead-of-memcpy-on-smp-bring-up.patch arm64-tlb-ensure-we-execute-an-isb-following-walk-cache-invalidation.patch diff --git a/queue-5.2/staging-erofs-fix-an-error-handling-in-erofs_readdir.patch b/queue-5.2/staging-erofs-fix-an-error-handling-in-erofs_readdir.patch deleted file mode 100644 index 8c3a778a7fe..00000000000 --- a/queue-5.2/staging-erofs-fix-an-error-handling-in-erofs_readdir.patch +++ /dev/null @@ -1,54 +0,0 @@ -From acb383f1dcb4f1e79b66d4be3a0b6f519a957b0d Mon Sep 17 00:00:00 2001 -From: Gao Xiang -Date: Sun, 18 Aug 2019 20:54:57 +0800 -Subject: staging: erofs: fix an error handling in erofs_readdir() - -From: Gao Xiang - -commit acb383f1dcb4f1e79b66d4be3a0b6f519a957b0d upstream. - -Richard observed a forever loop of erofs_read_raw_page() [1] -which can be generated by forcely setting ->u.i_blkaddr -to 0xdeadbeef (as my understanding block layer can -handle access beyond end of device correctly). - -After digging into that, it seems the problem is highly -related with directories and then I found the root cause -is an improper error handling in erofs_readdir(). - -Let's fix it now. - -[1] https://lore.kernel.org/r/1163995781.68824.1566084358245.JavaMail.zimbra@nod.at/ - -Reported-by: Richard Weinberger -Fixes: 3aa8ec716e52 ("staging: erofs: add directory operations") -Cc: # 4.19+ -Reviewed-by: Chao Yu -Signed-off-by: Gao Xiang -Link: https://lore.kernel.org/r/20190818125457.25906-1-hsiangkao@aol.com -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/staging/erofs/dir.c | 11 +++++++++-- - 1 file changed, 9 insertions(+), 2 deletions(-) - ---- a/drivers/staging/erofs/dir.c -+++ b/drivers/staging/erofs/dir.c -@@ -100,8 +100,15 @@ static int erofs_readdir(struct file *f, - unsigned int nameoff, maxsize; - - dentry_page = read_mapping_page(mapping, i, NULL); -- if (IS_ERR(dentry_page)) -- continue; -+ if (dentry_page == ERR_PTR(-ENOMEM)) { -+ err = -ENOMEM; -+ break; -+ } else if (IS_ERR(dentry_page)) { -+ errln("fail to readdir of logical block %u of nid %llu", -+ i, EROFS_V(dir)->nid); -+ err = -EFSCORRUPTED; -+ break; -+ } - - de = (struct erofs_dirent *)kmap(dentry_page); - diff --git a/queue-5.3/series b/queue-5.3/series index 2e615ecd3ca..6c4ed5dedf6 100644 --- a/queue-5.3/series +++ b/queue-5.3/series @@ -277,8 +277,6 @@ binfmt_elf-do-not-move-brk-for-interp-less-et_exec.patch asoc-intel-nhlt-fix-debug-print-format.patch asoc-intel-skylake-use-correct-function-to-access-iomem-space.patch asoc-intel-fix-use-of-potentially-uninitialized-variable.patch -staging-erofs-avoid-endless-loop-of-invalid-lookback-distance-0.patch -staging-erofs-fix-an-error-handling-in-erofs_readdir.patch staging-erofs-cannot-set-erofs_v_z_inited_bit-if-fill_inode_lazy-fails.patch arm-samsung-fix-system-restart-on-s3c6410.patch arm-zynq-use-memcpy_toio-instead-of-memcpy-on-smp-bring-up.patch diff --git a/queue-5.3/staging-erofs-avoid-endless-loop-of-invalid-lookback-distance-0.patch b/queue-5.3/staging-erofs-avoid-endless-loop-of-invalid-lookback-distance-0.patch deleted file mode 100644 index 94ef1450f80..00000000000 --- a/queue-5.3/staging-erofs-avoid-endless-loop-of-invalid-lookback-distance-0.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 598bb8913d015150b7734b55443c0e53e7189fc7 Mon Sep 17 00:00:00 2001 -From: Gao Xiang -Date: Mon, 19 Aug 2019 18:34:26 +0800 -Subject: staging: erofs: avoid endless loop of invalid lookback distance 0 - -From: Gao Xiang - -commit 598bb8913d015150b7734b55443c0e53e7189fc7 upstream. - -As reported by erofs-utils fuzzer, Lookback distance should -be a positive number, so it should be actually looked back -rather than spinning. - -Fixes: 02827e1796b3 ("staging: erofs: add erofs_map_blocks_iter") -Cc: # 4.19+ -Signed-off-by: Gao Xiang -Reviewed-by: Chao Yu -Link: https://lore.kernel.org/r/20190819103426.87579-7-gaoxiang25@huawei.com -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/staging/erofs/zmap.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/drivers/staging/erofs/zmap.c -+++ b/drivers/staging/erofs/zmap.c -@@ -351,6 +351,12 @@ static int vle_extent_lookback(struct z_ - - switch (m->type) { - case Z_EROFS_VLE_CLUSTER_TYPE_NONHEAD: -+ if (unlikely(!m->delta[0])) { -+ errln("invalid lookback distance 0 at nid %llu", -+ vi->nid); -+ DBG_BUGON(1); -+ return -EFSCORRUPTED; -+ } - return vle_extent_lookback(m, m->delta[0]); - case Z_EROFS_VLE_CLUSTER_TYPE_PLAIN: - map->m_flags &= ~EROFS_MAP_ZIPPED; diff --git a/queue-5.3/staging-erofs-fix-an-error-handling-in-erofs_readdir.patch b/queue-5.3/staging-erofs-fix-an-error-handling-in-erofs_readdir.patch deleted file mode 100644 index 3437ecddfd9..00000000000 --- a/queue-5.3/staging-erofs-fix-an-error-handling-in-erofs_readdir.patch +++ /dev/null @@ -1,54 +0,0 @@ -From acb383f1dcb4f1e79b66d4be3a0b6f519a957b0d Mon Sep 17 00:00:00 2001 -From: Gao Xiang -Date: Sun, 18 Aug 2019 20:54:57 +0800 -Subject: staging: erofs: fix an error handling in erofs_readdir() - -From: Gao Xiang - -commit acb383f1dcb4f1e79b66d4be3a0b6f519a957b0d upstream. - -Richard observed a forever loop of erofs_read_raw_page() [1] -which can be generated by forcely setting ->u.i_blkaddr -to 0xdeadbeef (as my understanding block layer can -handle access beyond end of device correctly). - -After digging into that, it seems the problem is highly -related with directories and then I found the root cause -is an improper error handling in erofs_readdir(). - -Let's fix it now. - -[1] https://lore.kernel.org/r/1163995781.68824.1566084358245.JavaMail.zimbra@nod.at/ - -Reported-by: Richard Weinberger -Fixes: 3aa8ec716e52 ("staging: erofs: add directory operations") -Cc: # 4.19+ -Reviewed-by: Chao Yu -Signed-off-by: Gao Xiang -Link: https://lore.kernel.org/r/20190818125457.25906-1-hsiangkao@aol.com -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/staging/erofs/dir.c | 11 +++++++++-- - 1 file changed, 9 insertions(+), 2 deletions(-) - ---- a/drivers/staging/erofs/dir.c -+++ b/drivers/staging/erofs/dir.c -@@ -99,8 +99,15 @@ static int erofs_readdir(struct file *f, - unsigned int nameoff, maxsize; - - dentry_page = read_mapping_page(mapping, i, NULL); -- if (IS_ERR(dentry_page)) -- continue; -+ if (dentry_page == ERR_PTR(-ENOMEM)) { -+ err = -ENOMEM; -+ break; -+ } else if (IS_ERR(dentry_page)) { -+ errln("fail to readdir of logical block %u of nid %llu", -+ i, EROFS_V(dir)->nid); -+ err = -EFSCORRUPTED; -+ break; -+ } - - de = (struct erofs_dirent *)kmap(dentry_page); - -- 2.47.3