From dd448b0de9e1ac87ee876a1c494cb6691e1afb21 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 8 Sep 2024 14:22:09 +0200 Subject: [PATCH] 4.19-stable patches added patches: ila-call-nf_unregister_net_hooks-sooner.patch nilfs2-fix-missing-cleanup-on-rollforward-recovery-error.patch nilfs2-fix-state-management-in-error-path-of-log-writing-function.patch --- ...-call-nf_unregister_net_hooks-sooner.patch | 194 ++++++++++++++++++ ...leanup-on-rollforward-recovery-error.patch | 90 ++++++++ ...n-error-path-of-log-writing-function.patch | 81 ++++++++ queue-4.19/series | 3 + 4 files changed, 368 insertions(+) create mode 100644 queue-4.19/ila-call-nf_unregister_net_hooks-sooner.patch create mode 100644 queue-4.19/nilfs2-fix-missing-cleanup-on-rollforward-recovery-error.patch create mode 100644 queue-4.19/nilfs2-fix-state-management-in-error-path-of-log-writing-function.patch diff --git a/queue-4.19/ila-call-nf_unregister_net_hooks-sooner.patch b/queue-4.19/ila-call-nf_unregister_net_hooks-sooner.patch new file mode 100644 index 00000000000..4326cac7a49 --- /dev/null +++ b/queue-4.19/ila-call-nf_unregister_net_hooks-sooner.patch @@ -0,0 +1,194 @@ +From 031ae72825cef43e4650140b800ad58bf7a6a466 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 4 Sep 2024 14:44:18 +0000 +Subject: ila: call nf_unregister_net_hooks() sooner + +From: Eric Dumazet + +commit 031ae72825cef43e4650140b800ad58bf7a6a466 upstream. + +syzbot found an use-after-free Read in ila_nf_input [1] + +Issue here is that ila_xlat_exit_net() frees the rhashtable, +then call nf_unregister_net_hooks(). + +It should be done in the reverse way, with a synchronize_rcu(). + +This is a good match for a pre_exit() method. + +[1] + BUG: KASAN: use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline] + BUG: KASAN: use-after-free in __rhashtable_lookup include/linux/rhashtable.h:604 [inline] + BUG: KASAN: use-after-free in rhashtable_lookup include/linux/rhashtable.h:646 [inline] + BUG: KASAN: use-after-free in rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672 +Read of size 4 at addr ffff888064620008 by task ksoftirqd/0/16 + +CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.11.0-rc4-syzkaller-00238-g2ad6d23f465a #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 +Call Trace: + + __dump_stack lib/dump_stack.c:93 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 + print_address_description mm/kasan/report.c:377 [inline] + print_report+0x169/0x550 mm/kasan/report.c:488 + kasan_report+0x143/0x180 mm/kasan/report.c:601 + rht_key_hashfn include/linux/rhashtable.h:159 [inline] + __rhashtable_lookup include/linux/rhashtable.h:604 [inline] + rhashtable_lookup include/linux/rhashtable.h:646 [inline] + rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672 + ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:132 [inline] + ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline] + ila_nf_input+0x1fe/0x3c0 net/ipv6/ila/ila_xlat.c:190 + nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] + nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 + nf_hook include/linux/netfilter.h:269 [inline] + NF_HOOK+0x29e/0x450 include/linux/netfilter.h:312 + __netif_receive_skb_one_core net/core/dev.c:5661 [inline] + __netif_receive_skb+0x1ea/0x650 net/core/dev.c:5775 + process_backlog+0x662/0x15b0 net/core/dev.c:6108 + __napi_poll+0xcb/0x490 net/core/dev.c:6772 + napi_poll net/core/dev.c:6841 [inline] + net_rx_action+0x89b/0x1240 net/core/dev.c:6963 + handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 + run_ksoftirqd+0xca/0x130 kernel/softirq.c:928 + smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 + kthread+0x2f0/0x390 kernel/kthread.c:389 + ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 + + +The buggy address belongs to the physical page: +page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x64620 +flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) +page_type: 0xbfffffff(buddy) +raw: 00fff00000000000 ffffea0000959608 ffffea00019d9408 0000000000000000 +raw: 0000000000000000 0000000000000003 00000000bfffffff 0000000000000000 +page dumped because: kasan: bad access detected +page_owner tracks the page as freed +page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52dc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO), pid 5242, tgid 5242 (syz-executor), ts 73611328570, free_ts 618981657187 + set_page_owner include/linux/page_owner.h:32 [inline] + post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1493 + prep_new_page mm/page_alloc.c:1501 [inline] + get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3439 + __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4695 + __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] + alloc_pages_node_noprof include/linux/gfp.h:296 [inline] + ___kmalloc_large_node+0x8b/0x1d0 mm/slub.c:4103 + __kmalloc_large_node_noprof+0x1a/0x80 mm/slub.c:4130 + __do_kmalloc_node mm/slub.c:4146 [inline] + __kmalloc_node_noprof+0x2d2/0x440 mm/slub.c:4164 + __kvmalloc_node_noprof+0x72/0x190 mm/util.c:650 + bucket_table_alloc lib/rhashtable.c:186 [inline] + rhashtable_init_noprof+0x534/0xa60 lib/rhashtable.c:1071 + ila_xlat_init_net+0xa0/0x110 net/ipv6/ila/ila_xlat.c:613 + ops_init+0x359/0x610 net/core/net_namespace.c:139 + setup_net+0x515/0xca0 net/core/net_namespace.c:343 + copy_net_ns+0x4e2/0x7b0 net/core/net_namespace.c:508 + create_new_namespaces+0x425/0x7b0 kernel/nsproxy.c:110 + unshare_nsproxy_namespaces+0x124/0x180 kernel/nsproxy.c:228 + ksys_unshare+0x619/0xc10 kernel/fork.c:3328 + __do_sys_unshare kernel/fork.c:3399 [inline] + __se_sys_unshare kernel/fork.c:3397 [inline] + __x64_sys_unshare+0x38/0x40 kernel/fork.c:3397 +page last free pid 11846 tgid 11846 stack trace: + reset_page_owner include/linux/page_owner.h:25 [inline] + free_pages_prepare mm/page_alloc.c:1094 [inline] + free_unref_page+0xd22/0xea0 mm/page_alloc.c:2612 + __folio_put+0x2c8/0x440 mm/swap.c:128 + folio_put include/linux/mm.h:1486 [inline] + free_large_kmalloc+0x105/0x1c0 mm/slub.c:4565 + kfree+0x1c4/0x360 mm/slub.c:4588 + rhashtable_free_and_destroy+0x7c6/0x920 lib/rhashtable.c:1169 + ila_xlat_exit_net+0x55/0x110 net/ipv6/ila/ila_xlat.c:626 + ops_exit_list net/core/net_namespace.c:173 [inline] + cleanup_net+0x802/0xcc0 net/core/net_namespace.c:640 + process_one_work kernel/workqueue.c:3231 [inline] + process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 + worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 + kthread+0x2f0/0x390 kernel/kthread.c:389 + ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 + +Memory state around the buggy address: + ffff88806461ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ffff88806461ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +>ffff888064620000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff + ^ + ffff888064620080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff + ffff888064620100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff + +Fixes: 7f00feaf1076 ("ila: Add generic ILA translation facility") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Tom Herbert +Reviewed-by: Florian Westphal +Link: https://patch.msgid.link/20240904144418.1162839-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ila/ila.h | 1 + + net/ipv6/ila/ila_main.c | 6 ++++++ + net/ipv6/ila/ila_xlat.c | 13 +++++++++---- + 3 files changed, 16 insertions(+), 4 deletions(-) + +--- a/net/ipv6/ila/ila.h ++++ b/net/ipv6/ila/ila.h +@@ -118,6 +118,7 @@ int ila_lwt_init(void); + void ila_lwt_fini(void); + + int ila_xlat_init_net(struct net *net); ++void ila_xlat_pre_exit_net(struct net *net); + void ila_xlat_exit_net(struct net *net); + + int ila_xlat_nl_cmd_add_mapping(struct sk_buff *skb, struct genl_info *info); +--- a/net/ipv6/ila/ila_main.c ++++ b/net/ipv6/ila/ila_main.c +@@ -70,6 +70,11 @@ ila_xlat_init_fail: + return err; + } + ++static __net_exit void ila_pre_exit_net(struct net *net) ++{ ++ ila_xlat_pre_exit_net(net); ++} ++ + static __net_exit void ila_exit_net(struct net *net) + { + ila_xlat_exit_net(net); +@@ -77,6 +82,7 @@ static __net_exit void ila_exit_net(stru + + static struct pernet_operations ila_net_ops = { + .init = ila_init_net, ++ .pre_exit = ila_pre_exit_net, + .exit = ila_exit_net, + .id = &ila_net_id, + .size = sizeof(struct ila_net), +--- a/net/ipv6/ila/ila_xlat.c ++++ b/net/ipv6/ila/ila_xlat.c +@@ -627,6 +627,15 @@ int ila_xlat_init_net(struct net *net) + return 0; + } + ++void ila_xlat_pre_exit_net(struct net *net) ++{ ++ struct ila_net *ilan = net_generic(net, ila_net_id); ++ ++ if (ilan->xlat.hooks_registered) ++ nf_unregister_net_hooks(net, ila_nf_hook_ops, ++ ARRAY_SIZE(ila_nf_hook_ops)); ++} ++ + void ila_xlat_exit_net(struct net *net) + { + struct ila_net *ilan = net_generic(net, ila_net_id); +@@ -634,10 +643,6 @@ void ila_xlat_exit_net(struct net *net) + rhashtable_free_and_destroy(&ilan->xlat.rhash_table, ila_free_cb, NULL); + + free_bucket_spinlocks(ilan->xlat.locks); +- +- if (ilan->xlat.hooks_registered) +- nf_unregister_net_hooks(net, ila_nf_hook_ops, +- ARRAY_SIZE(ila_nf_hook_ops)); + } + + static int ila_xlat_addr(struct sk_buff *skb, bool sir2ila) diff --git a/queue-4.19/nilfs2-fix-missing-cleanup-on-rollforward-recovery-error.patch b/queue-4.19/nilfs2-fix-missing-cleanup-on-rollforward-recovery-error.patch new file mode 100644 index 00000000000..b32a711c34a --- /dev/null +++ b/queue-4.19/nilfs2-fix-missing-cleanup-on-rollforward-recovery-error.patch @@ -0,0 +1,90 @@ +From 5787fcaab9eb5930f5378d6a1dd03d916d146622 Mon Sep 17 00:00:00 2001 +From: Ryusuke Konishi +Date: Sat, 10 Aug 2024 15:52:42 +0900 +Subject: nilfs2: fix missing cleanup on rollforward recovery error + +From: Ryusuke Konishi + +commit 5787fcaab9eb5930f5378d6a1dd03d916d146622 upstream. + +In an error injection test of a routine for mount-time recovery, KASAN +found a use-after-free bug. + +It turned out that if data recovery was performed using partial logs +created by dsync writes, but an error occurred before starting the log +writer to create a recovered checkpoint, the inodes whose data had been +recovered were left in the ns_dirty_files list of the nilfs object and +were not freed. + +Fix this issue by cleaning up inodes that have read the recovery data if +the recovery routine fails midway before the log writer starts. + +Link: https://lkml.kernel.org/r/20240810065242.3701-1-konishi.ryusuke@gmail.com +Fixes: 0f3e1c7f23f8 ("nilfs2: recovery functions") +Signed-off-by: Ryusuke Konishi +Tested-by: Ryusuke Konishi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/nilfs2/recovery.c | 35 +++++++++++++++++++++++++++++++++-- + 1 file changed, 33 insertions(+), 2 deletions(-) + +--- a/fs/nilfs2/recovery.c ++++ b/fs/nilfs2/recovery.c +@@ -709,6 +709,33 @@ static void nilfs_finish_roll_forward(st + } + + /** ++ * nilfs_abort_roll_forward - cleaning up after a failed rollforward recovery ++ * @nilfs: nilfs object ++ */ ++static void nilfs_abort_roll_forward(struct the_nilfs *nilfs) ++{ ++ struct nilfs_inode_info *ii, *n; ++ LIST_HEAD(head); ++ ++ /* Abandon inodes that have read recovery data */ ++ spin_lock(&nilfs->ns_inode_lock); ++ list_splice_init(&nilfs->ns_dirty_files, &head); ++ spin_unlock(&nilfs->ns_inode_lock); ++ if (list_empty(&head)) ++ return; ++ ++ set_nilfs_purging(nilfs); ++ list_for_each_entry_safe(ii, n, &head, i_dirty) { ++ spin_lock(&nilfs->ns_inode_lock); ++ list_del_init(&ii->i_dirty); ++ spin_unlock(&nilfs->ns_inode_lock); ++ ++ iput(&ii->vfs_inode); ++ } ++ clear_nilfs_purging(nilfs); ++} ++ ++/** + * nilfs_salvage_orphan_logs - salvage logs written after the latest checkpoint + * @nilfs: nilfs object + * @sb: super block instance +@@ -766,15 +793,19 @@ int nilfs_salvage_orphan_logs(struct the + if (unlikely(err)) { + nilfs_err(sb, "error %d writing segment for recovery", + err); +- goto failed; ++ goto put_root; + } + + nilfs_finish_roll_forward(nilfs, ri); + } + +- failed: ++put_root: + nilfs_put_root(root); + return err; ++ ++failed: ++ nilfs_abort_roll_forward(nilfs); ++ goto put_root; + } + + /** diff --git a/queue-4.19/nilfs2-fix-state-management-in-error-path-of-log-writing-function.patch b/queue-4.19/nilfs2-fix-state-management-in-error-path-of-log-writing-function.patch new file mode 100644 index 00000000000..4ae70c6118d --- /dev/null +++ b/queue-4.19/nilfs2-fix-state-management-in-error-path-of-log-writing-function.patch @@ -0,0 +1,81 @@ +From 6576dd6695f2afca3f4954029ac4a64f82ba60ab Mon Sep 17 00:00:00 2001 +From: Ryusuke Konishi +Date: Wed, 14 Aug 2024 19:11:19 +0900 +Subject: nilfs2: fix state management in error path of log writing function + +From: Ryusuke Konishi + +commit 6576dd6695f2afca3f4954029ac4a64f82ba60ab upstream. + +After commit a694291a6211 ("nilfs2: separate wait function from +nilfs_segctor_write") was applied, the log writing function +nilfs_segctor_do_construct() was able to issue I/O requests continuously +even if user data blocks were split into multiple logs across segments, +but two potential flaws were introduced in its error handling. + +First, if nilfs_segctor_begin_construction() fails while creating the +second or subsequent logs, the log writing function returns without +calling nilfs_segctor_abort_construction(), so the writeback flag set on +pages/folios will remain uncleared. This causes page cache operations to +hang waiting for the writeback flag. For example, +truncate_inode_pages_final(), which is called via nilfs_evict_inode() when +an inode is evicted from memory, will hang. + +Second, the NILFS_I_COLLECTED flag set on normal inodes remain uncleared. +As a result, if the next log write involves checkpoint creation, that's +fine, but if a partial log write is performed that does not, inodes with +NILFS_I_COLLECTED set are erroneously removed from the "sc_dirty_files" +list, and their data and b-tree blocks may not be written to the device, +corrupting the block mapping. + +Fix these issues by uniformly calling nilfs_segctor_abort_construction() +on failure of each step in the loop in nilfs_segctor_do_construct(), +having it clean up logs and segment usages according to progress, and +correcting the conditions for calling nilfs_redirty_inodes() to ensure +that the NILFS_I_COLLECTED flag is cleared. + +Link: https://lkml.kernel.org/r/20240814101119.4070-1-konishi.ryusuke@gmail.com +Fixes: a694291a6211 ("nilfs2: separate wait function from nilfs_segctor_write") +Signed-off-by: Ryusuke Konishi +Tested-by: Ryusuke Konishi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/nilfs2/segment.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -1828,6 +1828,9 @@ static void nilfs_segctor_abort_construc + nilfs_abort_logs(&logs, ret ? : err); + + list_splice_tail_init(&sci->sc_segbufs, &logs); ++ if (list_empty(&logs)) ++ return; /* if the first segment buffer preparation failed */ ++ + nilfs_cancel_segusage(&logs, nilfs->ns_sufile); + nilfs_free_incomplete_logs(&logs, nilfs); + +@@ -2072,7 +2075,7 @@ static int nilfs_segctor_do_construct(st + + err = nilfs_segctor_begin_construction(sci, nilfs); + if (unlikely(err)) +- goto out; ++ goto failed; + + /* Update time stamp */ + sci->sc_seg_ctime = ktime_get_real_seconds(); +@@ -2135,10 +2138,9 @@ static int nilfs_segctor_do_construct(st + return err; + + failed_to_write: +- if (sci->sc_stage.flags & NILFS_CF_IFILE_STARTED) +- nilfs_redirty_inodes(&sci->sc_dirty_files); +- + failed: ++ if (mode == SC_LSEG_SR && nilfs_sc_cstage_get(sci) >= NILFS_ST_IFILE) ++ nilfs_redirty_inodes(&sci->sc_dirty_files); + if (nilfs_doing_gc()) + nilfs_redirty_inodes(&sci->sc_gc_inodes); + nilfs_segctor_abort_construction(sci, nilfs, err); diff --git a/queue-4.19/series b/queue-4.19/series index ff9fc62cb13..a85ee969c45 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -21,3 +21,6 @@ ata-libata-fix-memory-leak-for-error-path-in-ata_host_alloc.patch mmc-dw_mmc-fix-idmac-operation-with-pages-bigger-than-4k.patch fuse-use-unsigned-type-for-getxattr-listxattr-size-truncation.patch clk-qcom-clk-alpha-pll-fix-the-pll-post-div-mask.patch +ila-call-nf_unregister_net_hooks-sooner.patch +nilfs2-fix-missing-cleanup-on-rollforward-recovery-error.patch +nilfs2-fix-state-management-in-error-path-of-log-writing-function.patch -- 2.47.3