From: Greg Kroah-Hartman Date: Mon, 21 Oct 2024 09:51:09 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v5.10.228~11 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=33d68e391c3bd00128e9b2ec7cc44654c3d5c861;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: mptcp-prevent-mpc-handshake-on-port-based-signal-endpoints.patch nilfs2-propagate-directory-read-errors-from-nilfs_find_entry.patch powerpc-64-add-big-endian-elfv2-flavour-to-crypto-vmx-asm-generation.patch tcp-fix-mptcp-dss-corruption-due-to-large-pmtu-xmit.patch --- diff --git a/queue-6.1/mptcp-prevent-mpc-handshake-on-port-based-signal-endpoints.patch b/queue-6.1/mptcp-prevent-mpc-handshake-on-port-based-signal-endpoints.patch new file mode 100644 index 00000000000..9a9aba381ec --- /dev/null +++ b/queue-6.1/mptcp-prevent-mpc-handshake-on-port-based-signal-endpoints.patch @@ -0,0 +1,250 @@ +From stable+bounces-86874-greg=kroah.com@vger.kernel.org Fri Oct 18 19:37:15 2024 +From: "Matthieu Baerts (NGI0)" +Date: Fri, 18 Oct 2024 19:36:59 +0200 +Subject: mptcp: prevent MPC handshake on port-based signal endpoints +To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org +Cc: Paolo Abeni , sashal@kernel.org, syzbot+f4aacdfef2c6a6529c3e@syzkaller.appspotmail.com, Cong Wang , Matthieu Baerts , Mat Martineau , Jakub Kicinski +Message-ID: <20241018173656.2813913-6-matttbe@kernel.org> + +From: Paolo Abeni + +commit 3d041393ea8c815f773020fb4a995331a69c0139 upstream. + +Syzkaller reported a lockdep splat: + + ============================================ + WARNING: possible recursive locking detected + 6.11.0-rc6-syzkaller-00019-g67784a74e258 #0 Not tainted + -------------------------------------------- + syz-executor364/5113 is trying to acquire lock: + ffff8880449f1958 (k-slock-AF_INET){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] + ffff8880449f1958 (k-slock-AF_INET){+.-.}-{2:2}, at: sk_clone_lock+0x2cd/0xf40 net/core/sock.c:2328 + + but task is already holding lock: + ffff88803fe3cb58 (k-slock-AF_INET){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] + ffff88803fe3cb58 (k-slock-AF_INET){+.-.}-{2:2}, at: sk_clone_lock+0x2cd/0xf40 net/core/sock.c:2328 + + other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(k-slock-AF_INET); + lock(k-slock-AF_INET); + + *** DEADLOCK *** + + May be due to missing lock nesting notation + + 7 locks held by syz-executor364/5113: + #0: ffff8880449f0e18 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1607 [inline] + #0: ffff8880449f0e18 (sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_sendmsg+0x153/0x1b10 net/mptcp/protocol.c:1806 + #1: ffff88803fe39ad8 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1607 [inline] + #1: ffff88803fe39ad8 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_sendmsg_fastopen+0x11f/0x530 net/mptcp/protocol.c:1727 + #2: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] + #2: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] + #2: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: __ip_queue_xmit+0x5f/0x1b80 net/ipv4/ip_output.c:470 + #3: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] + #3: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] + #3: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: ip_finish_output2+0x45f/0x1390 net/ipv4/ip_output.c:228 + #4: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: local_lock_acquire include/linux/local_lock_internal.h:29 [inline] + #4: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: process_backlog+0x33b/0x15b0 net/core/dev.c:6104 + #5: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] + #5: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] + #5: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: ip_local_deliver_finish+0x230/0x5f0 net/ipv4/ip_input.c:232 + #6: ffff88803fe3cb58 (k-slock-AF_INET){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] + #6: ffff88803fe3cb58 (k-slock-AF_INET){+.-.}-{2:2}, at: sk_clone_lock+0x2cd/0xf40 net/core/sock.c:2328 + + stack backtrace: + CPU: 0 UID: 0 PID: 5113 Comm: syz-executor364 Not tainted 6.11.0-rc6-syzkaller-00019-g67784a74e258 #0 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 + Call Trace: + + __dump_stack lib/dump_stack.c:93 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 + check_deadlock kernel/locking/lockdep.c:3061 [inline] + validate_chain+0x15d3/0x5900 kernel/locking/lockdep.c:3855 + __lock_acquire+0x137a/0x2040 kernel/locking/lockdep.c:5142 + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5759 + __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] + _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 + spin_lock include/linux/spinlock.h:351 [inline] + sk_clone_lock+0x2cd/0xf40 net/core/sock.c:2328 + mptcp_sk_clone_init+0x32/0x13c0 net/mptcp/protocol.c:3279 + subflow_syn_recv_sock+0x931/0x1920 net/mptcp/subflow.c:874 + tcp_check_req+0xfe4/0x1a20 net/ipv4/tcp_minisocks.c:853 + tcp_v4_rcv+0x1c3e/0x37f0 net/ipv4/tcp_ipv4.c:2267 + ip_protocol_deliver_rcu+0x22e/0x440 net/ipv4/ip_input.c:205 + ip_local_deliver_finish+0x341/0x5f0 net/ipv4/ip_input.c:233 + NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314 + NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314 + __netif_receive_skb_one_core net/core/dev.c:5661 [inline] + __netif_receive_skb+0x2bf/0x650 net/core/dev.c:5775 + process_backlog+0x662/0x15b0 net/core/dev.c:6108 + __napi_poll+0xcb/0x490 net/core/dev.c:6772 + napi_poll net/core/dev.c:6841 [inline] + net_rx_action+0x89b/0x1240 net/core/dev.c:6963 + handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 + do_softirq+0x11b/0x1e0 kernel/softirq.c:455 + + + __local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:382 + local_bh_enable include/linux/bottom_half.h:33 [inline] + rcu_read_unlock_bh include/linux/rcupdate.h:908 [inline] + __dev_queue_xmit+0x1763/0x3e90 net/core/dev.c:4450 + dev_queue_xmit include/linux/netdevice.h:3105 [inline] + neigh_hh_output include/net/neighbour.h:526 [inline] + neigh_output include/net/neighbour.h:540 [inline] + ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:235 + ip_local_out net/ipv4/ip_output.c:129 [inline] + __ip_queue_xmit+0x118c/0x1b80 net/ipv4/ip_output.c:535 + __tcp_transmit_skb+0x2544/0x3b30 net/ipv4/tcp_output.c:1466 + tcp_rcv_synsent_state_process net/ipv4/tcp_input.c:6542 [inline] + tcp_rcv_state_process+0x2c32/0x4570 net/ipv4/tcp_input.c:6729 + tcp_v4_do_rcv+0x77d/0xc70 net/ipv4/tcp_ipv4.c:1934 + sk_backlog_rcv include/net/sock.h:1111 [inline] + __release_sock+0x214/0x350 net/core/sock.c:3004 + release_sock+0x61/0x1f0 net/core/sock.c:3558 + mptcp_sendmsg_fastopen+0x1ad/0x530 net/mptcp/protocol.c:1733 + mptcp_sendmsg+0x1884/0x1b10 net/mptcp/protocol.c:1812 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg+0x1a6/0x270 net/socket.c:745 + ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 + ___sys_sendmsg net/socket.c:2651 [inline] + __sys_sendmmsg+0x3b2/0x740 net/socket.c:2737 + __do_sys_sendmmsg net/socket.c:2766 [inline] + __se_sys_sendmmsg net/socket.c:2763 [inline] + __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2763 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + RIP: 0033:0x7f04fb13a6b9 + Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 01 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 + RSP: 002b:00007ffd651f42d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 + RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f04fb13a6b9 + RDX: 0000000000000001 RSI: 0000000020000d00 RDI: 0000000000000004 + RBP: 00007ffd651f4310 R08: 0000000000000001 R09: 0000000000000001 + R10: 0000000020000080 R11: 0000000000000246 R12: 00000000000f4240 + R13: 00007f04fb187449 R14: 00007ffd651f42f4 R15: 00007ffd651f4300 + + +As noted by Cong Wang, the splat is false positive, but the code +path leading to the report is an unexpected one: a client is +attempting an MPC handshake towards the in-kernel listener created +by the in-kernel PM for a port based signal endpoint. + +Such connection will be never accepted; many of them can make the +listener queue full and preventing the creation of MPJ subflow via +such listener - its intended role. + +Explicitly detect this scenario at initial-syn time and drop the +incoming MPC request. + +Fixes: 1729cf186d8a ("mptcp: create the listening socket for new port") +Cc: stable@vger.kernel.org +Reported-by: syzbot+f4aacdfef2c6a6529c3e@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=f4aacdfef2c6a6529c3e +Cc: Cong Wang +Signed-off-by: Paolo Abeni +Reviewed-by: Matthieu Baerts (NGI0) +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20241014-net-mptcp-mpc-port-endp-v2-1-7faea8e6b6ae@kernel.org +Signed-off-by: Jakub Kicinski +[ Conflicts in mib.[ch], because commit 6982826fe5e5 ("mptcp: fallback + to TCP after SYN+MPC drops"), and commit 27069e7cb3d1 ("mptcp: disable + active MPTCP in case of blackhole") are linked to new features, not + available in this version. Resolving the conflicts is easy, simply + adding the new lines declaring the new "endpoint attempt" MIB entry. + Also a conflict in protocol.h, because commit fce68b03086f ("mptcp: + add scheduled in mptcp_subflow_context") is not in this version, and + changes the context by introducing 'scheduled' variable just before. + Also a conflict in pm_netlink.c, because commit 3aa362494170 ("mptcp: + avoid ssock usage in mptcp_pm_nl_create_listen_socket()") is not in + this version, and refactor the function: that's fine, we can still set + pm_listener before doing the 'listen()', taking 'ssock->sk' as 'ssk' + is not defined before this refactoring. ] +Signed-off-by: Matthieu Baerts (NGI0) +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/mib.c | 1 + + net/mptcp/mib.h | 1 + + net/mptcp/pm_netlink.c | 1 + + net/mptcp/protocol.h | 1 + + net/mptcp/subflow.c | 11 +++++++++++ + 5 files changed, 15 insertions(+) + +--- a/net/mptcp/mib.c ++++ b/net/mptcp/mib.c +@@ -15,6 +15,7 @@ static const struct snmp_mib mptcp_snmp_ + SNMP_MIB_ITEM("MPCapableACKRX", MPTCP_MIB_MPCAPABLEPASSIVEACK), + SNMP_MIB_ITEM("MPCapableFallbackACK", MPTCP_MIB_MPCAPABLEPASSIVEFALLBACK), + SNMP_MIB_ITEM("MPCapableFallbackSYNACK", MPTCP_MIB_MPCAPABLEACTIVEFALLBACK), ++ SNMP_MIB_ITEM("MPCapableEndpAttempt", MPTCP_MIB_MPCAPABLEENDPATTEMPT), + SNMP_MIB_ITEM("MPFallbackTokenInit", MPTCP_MIB_TOKENFALLBACKINIT), + SNMP_MIB_ITEM("MPTCPRetrans", MPTCP_MIB_RETRANSSEGS), + SNMP_MIB_ITEM("MPJoinNoTokenFound", MPTCP_MIB_JOINNOTOKEN), +--- a/net/mptcp/mib.h ++++ b/net/mptcp/mib.h +@@ -8,6 +8,7 @@ enum linux_mptcp_mib_field { + MPTCP_MIB_MPCAPABLEPASSIVEACK, /* Received third ACK with MP_CAPABLE */ + MPTCP_MIB_MPCAPABLEPASSIVEFALLBACK,/* Server-side fallback during 3-way handshake */ + MPTCP_MIB_MPCAPABLEACTIVEFALLBACK, /* Client-side fallback during 3-way handshake */ ++ MPTCP_MIB_MPCAPABLEENDPATTEMPT, /* Prohibited MPC to port-based endp */ + MPTCP_MIB_TOKENFALLBACKINIT, /* Could not init/allocate token */ + MPTCP_MIB_RETRANSSEGS, /* Segments retransmitted at the MPTCP-level */ + MPTCP_MIB_JOINNOTOKEN, /* Received MP_JOIN but the token was not found */ +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -1111,6 +1111,7 @@ static int mptcp_pm_nl_create_listen_soc + } + + inet_sk_state_store(newsk, TCP_LISTEN); ++ WRITE_ONCE(mptcp_subflow_ctx(ssock->sk)->pm_listener, true); + err = kernel_listen(ssock, backlog); + if (err) { + pr_warn("kernel_listen error, err=%d", err); +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -483,6 +483,7 @@ struct mptcp_subflow_context { + close_event_done : 1, /* has done the post-closed part */ + __unused : 9; + enum mptcp_data_avail data_avail; ++ bool pm_listener; /* a listener managed by the kernel PM? */ + u32 remote_nonce; + u64 thmac; + u32 local_nonce; +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -131,6 +131,13 @@ static void subflow_add_reset_reason(str + } + } + ++static int subflow_reset_req_endp(struct request_sock *req, struct sk_buff *skb) ++{ ++ SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPCAPABLEENDPATTEMPT); ++ subflow_add_reset_reason(skb, MPTCP_RST_EPROHIBIT); ++ return -EPERM; ++} ++ + /* Init mptcp request socket. + * + * Returns an error code if a JOIN has failed and a TCP reset +@@ -162,6 +169,8 @@ static int subflow_check_req(struct requ + if (opt_mp_capable) { + SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPCAPABLEPASSIVE); + ++ if (unlikely(listener->pm_listener)) ++ return subflow_reset_req_endp(req, skb); + if (opt_mp_join) + return 0; + } else if (opt_mp_join) { +@@ -169,6 +178,8 @@ static int subflow_check_req(struct requ + + if (mp_opt.backup) + SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINSYNBACKUPRX); ++ } else if (unlikely(listener->pm_listener)) { ++ return subflow_reset_req_endp(req, skb); + } + + if (opt_mp_capable && listener->request_mptcp) { diff --git a/queue-6.1/nilfs2-propagate-directory-read-errors-from-nilfs_find_entry.patch b/queue-6.1/nilfs2-propagate-directory-read-errors-from-nilfs_find_entry.patch new file mode 100644 index 00000000000..fefff1f4faf --- /dev/null +++ b/queue-6.1/nilfs2-propagate-directory-read-errors-from-nilfs_find_entry.patch @@ -0,0 +1,230 @@ +From 08cfa12adf888db98879dbd735bc741360a34168 Mon Sep 17 00:00:00 2001 +From: Ryusuke Konishi +Date: Fri, 4 Oct 2024 12:35:31 +0900 +Subject: nilfs2: propagate directory read errors from nilfs_find_entry() + +From: Ryusuke Konishi + +commit 08cfa12adf888db98879dbd735bc741360a34168 upstream. + +Syzbot reported that a task hang occurs in vcs_open() during a fuzzing +test for nilfs2. + +The root cause of this problem is that in nilfs_find_entry(), which +searches for directory entries, ignores errors when loading a directory +page/folio via nilfs_get_folio() fails. + +If the filesystem images is corrupted, and the i_size of the directory +inode is large, and the directory page/folio is successfully read but +fails the sanity check, for example when it is zero-filled, +nilfs_check_folio() may continue to spit out error messages in bursts. + +Fix this issue by propagating the error to the callers when loading a +page/folio fails in nilfs_find_entry(). + +The current interface of nilfs_find_entry() and its callers is outdated +and cannot propagate error codes such as -EIO and -ENOMEM returned via +nilfs_find_entry(), so fix it together. + +Link: https://lkml.kernel.org/r/20241004033640.6841-1-konishi.ryusuke@gmail.com +Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") +Signed-off-by: Ryusuke Konishi +Reported-by: Lizhi Xu +Closes: https://lkml.kernel.org/r/20240927013806.3577931-1-lizhi.xu@windriver.com +Reported-by: syzbot+8a192e8d090fa9a31135@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=8a192e8d090fa9a31135 +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/nilfs2/dir.c | 50 +++++++++++++++++++++++++++----------------------- + fs/nilfs2/namei.c | 39 ++++++++++++++++++++++++++------------- + fs/nilfs2/nilfs.h | 2 +- + 3 files changed, 54 insertions(+), 37 deletions(-) + +--- a/fs/nilfs2/dir.c ++++ b/fs/nilfs2/dir.c +@@ -331,6 +331,8 @@ static int nilfs_readdir(struct file *fi + * returns the page in which the entry was found, and the entry itself + * (as a parameter - res_dir). Page is returned mapped and unlocked. + * Entry is guaranteed to be valid. ++ * ++ * On failure, returns an error pointer and the caller should ignore res_page. + */ + struct nilfs_dir_entry * + nilfs_find_entry(struct inode *dir, const struct qstr *qstr, +@@ -358,22 +360,24 @@ nilfs_find_entry(struct inode *dir, cons + do { + char *kaddr = nilfs_get_page(dir, n, &page); + +- if (!IS_ERR(kaddr)) { +- de = (struct nilfs_dir_entry *)kaddr; +- kaddr += nilfs_last_byte(dir, n) - reclen; +- while ((char *) de <= kaddr) { +- if (de->rec_len == 0) { +- nilfs_error(dir->i_sb, +- "zero-length directory entry"); +- nilfs_put_page(page); +- goto out; +- } +- if (nilfs_match(namelen, name, de)) +- goto found; +- de = nilfs_next_entry(de); ++ if (IS_ERR(kaddr)) ++ return ERR_CAST(kaddr); ++ ++ de = (struct nilfs_dir_entry *)kaddr; ++ kaddr += nilfs_last_byte(dir, n) - reclen; ++ while ((char *)de <= kaddr) { ++ if (de->rec_len == 0) { ++ nilfs_error(dir->i_sb, ++ "zero-length directory entry"); ++ nilfs_put_page(page); ++ goto out; + } +- nilfs_put_page(page); ++ if (nilfs_match(namelen, name, de)) ++ goto found; ++ de = nilfs_next_entry(de); + } ++ nilfs_put_page(page); ++ + if (++n >= npages) + n = 0; + /* next page is past the blocks we've got */ +@@ -386,7 +390,7 @@ nilfs_find_entry(struct inode *dir, cons + } + } while (n != start); + out: +- return NULL; ++ return ERR_PTR(-ENOENT); + + found: + *res_page = page; +@@ -431,19 +435,19 @@ fail: + return NULL; + } + +-ino_t nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr) ++int nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr, ino_t *ino) + { +- ino_t res = 0; + struct nilfs_dir_entry *de; + struct page *page; + + de = nilfs_find_entry(dir, qstr, &page); +- if (de) { +- res = le64_to_cpu(de->inode); +- kunmap(page); +- put_page(page); +- } +- return res; ++ if (IS_ERR(de)) ++ return PTR_ERR(de); ++ ++ *ino = le64_to_cpu(de->inode); ++ kunmap(page); ++ put_page(page); ++ return 0; + } + + /* Releases the page */ +--- a/fs/nilfs2/namei.c ++++ b/fs/nilfs2/namei.c +@@ -55,12 +55,20 @@ nilfs_lookup(struct inode *dir, struct d + { + struct inode *inode; + ino_t ino; ++ int res; + + if (dentry->d_name.len > NILFS_NAME_LEN) + return ERR_PTR(-ENAMETOOLONG); + +- ino = nilfs_inode_by_name(dir, &dentry->d_name); +- inode = ino ? nilfs_iget(dir->i_sb, NILFS_I(dir)->i_root, ino) : NULL; ++ res = nilfs_inode_by_name(dir, &dentry->d_name, &ino); ++ if (res) { ++ if (res != -ENOENT) ++ return ERR_PTR(res); ++ inode = NULL; ++ } else { ++ inode = nilfs_iget(dir->i_sb, NILFS_I(dir)->i_root, ino); ++ } ++ + return d_splice_alias(inode, dentry); + } + +@@ -263,10 +271,11 @@ static int nilfs_do_unlink(struct inode + struct page *page; + int err; + +- err = -ENOENT; + de = nilfs_find_entry(dir, &dentry->d_name, &page); +- if (!de) ++ if (IS_ERR(de)) { ++ err = PTR_ERR(de); + goto out; ++ } + + inode = d_inode(dentry); + err = -EIO; +@@ -361,10 +370,11 @@ static int nilfs_rename(struct user_name + if (unlikely(err)) + return err; + +- err = -ENOENT; + old_de = nilfs_find_entry(old_dir, &old_dentry->d_name, &old_page); +- if (!old_de) ++ if (IS_ERR(old_de)) { ++ err = PTR_ERR(old_de); + goto out; ++ } + + if (S_ISDIR(old_inode->i_mode)) { + err = -EIO; +@@ -381,10 +391,12 @@ static int nilfs_rename(struct user_name + if (dir_de && !nilfs_empty_dir(new_inode)) + goto out_dir; + +- err = -ENOENT; +- new_de = nilfs_find_entry(new_dir, &new_dentry->d_name, &new_page); +- if (!new_de) ++ new_de = nilfs_find_entry(new_dir, &new_dentry->d_name, ++ &new_page); ++ if (IS_ERR(new_de)) { ++ err = PTR_ERR(new_de); + goto out_dir; ++ } + nilfs_set_link(new_dir, new_de, new_page, old_inode); + nilfs_mark_inode_dirty(new_dir); + new_inode->i_ctime = current_time(new_inode); +@@ -438,13 +450,14 @@ out: + */ + static struct dentry *nilfs_get_parent(struct dentry *child) + { +- unsigned long ino; ++ ino_t ino; ++ int res; + struct inode *inode; + struct nilfs_root *root; + +- ino = nilfs_inode_by_name(d_inode(child), &dotdot_name); +- if (!ino) +- return ERR_PTR(-ENOENT); ++ res = nilfs_inode_by_name(d_inode(child), &dotdot_name, &ino); ++ if (res) ++ return ERR_PTR(res); + + root = NILFS_I(d_inode(child))->i_root; + +--- a/fs/nilfs2/nilfs.h ++++ b/fs/nilfs2/nilfs.h +@@ -233,7 +233,7 @@ static inline __u32 nilfs_mask_flags(umo + + /* dir.c */ + extern int nilfs_add_link(struct dentry *, struct inode *); +-extern ino_t nilfs_inode_by_name(struct inode *, const struct qstr *); ++int nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr, ino_t *ino); + extern int nilfs_make_empty(struct inode *, struct inode *); + extern struct nilfs_dir_entry * + nilfs_find_entry(struct inode *, const struct qstr *, struct page **); diff --git a/queue-6.1/powerpc-64-add-big-endian-elfv2-flavour-to-crypto-vmx-asm-generation.patch b/queue-6.1/powerpc-64-add-big-endian-elfv2-flavour-to-crypto-vmx-asm-generation.patch new file mode 100644 index 00000000000..3624b7adc3a --- /dev/null +++ b/queue-6.1/powerpc-64-add-big-endian-elfv2-flavour-to-crypto-vmx-asm-generation.patch @@ -0,0 +1,84 @@ +From 505ea33089dcfc3ee3201b0fcb94751165805413 Mon Sep 17 00:00:00 2001 +From: Nicholas Piggin +Date: Mon, 28 Nov 2022 14:15:38 +1000 +Subject: powerpc/64: Add big-endian ELFv2 flavour to crypto VMX asm generation + +From: Nicholas Piggin + +commit 505ea33089dcfc3ee3201b0fcb94751165805413 upstream. + +This allows asm generation for big-endian ELFv2 builds. + +Signed-off-by: Nicholas Piggin +Reviewed-by: Joel Stanley +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20221128041539.1742489-4-npiggin@gmail.com +Cc: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/vmx/Makefile | 12 +++++++++++- + drivers/crypto/vmx/ppc-xlate.pl | 10 ++++++---- + 2 files changed, 17 insertions(+), 5 deletions(-) + +--- a/drivers/crypto/vmx/Makefile ++++ b/drivers/crypto/vmx/Makefile +@@ -2,8 +2,18 @@ + obj-$(CONFIG_CRYPTO_DEV_VMX_ENCRYPT) += vmx-crypto.o + vmx-crypto-objs := vmx.o aesp8-ppc.o ghashp8-ppc.o aes.o aes_cbc.o aes_ctr.o aes_xts.o ghash.o + ++ifeq ($(CONFIG_CPU_LITTLE_ENDIAN),y) ++override flavour := linux-ppc64le ++else ++ifdef CONFIG_PPC64_ELF_ABI_V2 ++override flavour := linux-ppc64-elfv2 ++else ++override flavour := linux-ppc64 ++endif ++endif ++ + quiet_cmd_perl = PERL $@ +- cmd_perl = $(PERL) $< $(if $(CONFIG_CPU_LITTLE_ENDIAN), linux-ppc64le, linux-ppc64) > $@ ++ cmd_perl = $(PERL) $< $(flavour) > $@ + + targets += aesp8-ppc.S ghashp8-ppc.S + +--- a/drivers/crypto/vmx/ppc-xlate.pl ++++ b/drivers/crypto/vmx/ppc-xlate.pl +@@ -9,6 +9,8 @@ open STDOUT,">$output" || die "can't ope + + my %GLOBALS; + my $dotinlocallabels=($flavour=~/linux/)?1:0; ++my $elfv2abi=(($flavour =~ /linux-ppc64le/) or ($flavour =~ /linux-ppc64-elfv2/))?1:0; ++my $dotfunctions=($elfv2abi=~1)?0:1; + + ################################################################ + # directives which need special treatment on different platforms +@@ -40,7 +42,7 @@ my $globl = sub { + }; + my $text = sub { + my $ret = ($flavour =~ /aix/) ? ".csect\t.text[PR],7" : ".text"; +- $ret = ".abiversion 2\n".$ret if ($flavour =~ /linux.*64le/); ++ $ret = ".abiversion 2\n".$ret if ($elfv2abi); + $ret; + }; + my $machine = sub { +@@ -56,8 +58,8 @@ my $size = sub { + if ($flavour =~ /linux/) + { shift; + my $name = shift; $name =~ s|^[\.\_]||; +- my $ret = ".size $name,.-".($flavour=~/64$/?".":"").$name; +- $ret .= "\n.size .$name,.-.$name" if ($flavour=~/64$/); ++ my $ret = ".size $name,.-".($dotfunctions?".":"").$name; ++ $ret .= "\n.size .$name,.-.$name" if ($dotfunctions); + $ret; + } + else +@@ -142,7 +144,7 @@ my $vmr = sub { + + # Some ABIs specify vrsave, special-purpose register #256, as reserved + # for system use. +-my $no_vrsave = ($flavour =~ /linux-ppc64le/); ++my $no_vrsave = ($elfv2abi); + my $mtspr = sub { + my ($f,$idx,$ra) = @_; + if ($idx == 256 && $no_vrsave) { diff --git a/queue-6.1/series b/queue-6.1/series index 08f2771e826..c6bc0d0a6dd 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -84,3 +84,7 @@ pinctrl-ocelot-fix-system-hang-on-level-based-interrupts.patch pinctrl-apple-check-devm_kasprintf-returned-value.patch irqchip-gic-v4-don-t-allow-a-vmovp-on-a-dying-vpe.patch irqchip-sifive-plic-unmask-interrupt-in-plic_irq_enable.patch +tcp-fix-mptcp-dss-corruption-due-to-large-pmtu-xmit.patch +mptcp-prevent-mpc-handshake-on-port-based-signal-endpoints.patch +nilfs2-propagate-directory-read-errors-from-nilfs_find_entry.patch +powerpc-64-add-big-endian-elfv2-flavour-to-crypto-vmx-asm-generation.patch diff --git a/queue-6.1/tcp-fix-mptcp-dss-corruption-due-to-large-pmtu-xmit.patch b/queue-6.1/tcp-fix-mptcp-dss-corruption-due-to-large-pmtu-xmit.patch new file mode 100644 index 00000000000..60ca6f54f52 --- /dev/null +++ b/queue-6.1/tcp-fix-mptcp-dss-corruption-due-to-large-pmtu-xmit.patch @@ -0,0 +1,145 @@ +From stable+bounces-86873-greg=kroah.com@vger.kernel.org Fri Oct 18 19:37:13 2024 +From: "Matthieu Baerts (NGI0)" +Date: Fri, 18 Oct 2024 19:36:58 +0200 +Subject: tcp: fix mptcp DSS corruption due to large pmtu xmit +To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org +Cc: Paolo Abeni , sashal@kernel.org, syzbot+d1bff73460e33101f0e7@syzkaller.appspotmail.com, Matthieu Baerts , Jakub Kicinski +Message-ID: <20241018173656.2813913-5-matttbe@kernel.org> + +From: Paolo Abeni + +commit 4dabcdf581217e60690467a37c956a5b8dbc6bd9 upstream. + +Syzkaller was able to trigger a DSS corruption: + + TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. + ------------[ cut here ]------------ + WARNING: CPU: 0 PID: 5227 at net/mptcp/protocol.c:695 __mptcp_move_skbs_from_subflow+0x20a9/0x21f0 net/mptcp/protocol.c:695 + Modules linked in: + CPU: 0 UID: 0 PID: 5227 Comm: syz-executor350 Not tainted 6.11.0-syzkaller-08829-gaf9c191ac2a0 #0 + Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 + RIP: 0010:__mptcp_move_skbs_from_subflow+0x20a9/0x21f0 net/mptcp/protocol.c:695 + Code: 0f b6 dc 31 ff 89 de e8 b5 dd ea f5 89 d8 48 81 c4 50 01 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 98 da ea f5 90 <0f> 0b 90 e9 47 ff ff ff e8 8a da ea f5 90 0f 0b 90 e9 99 e0 ff ff + RSP: 0018:ffffc90000006db8 EFLAGS: 00010246 + RAX: ffffffff8ba9df18 RBX: 00000000000055f0 RCX: ffff888030023c00 + RDX: 0000000000000100 RSI: 00000000000081e5 RDI: 00000000000055f0 + RBP: 1ffff110062bf1ae R08: ffffffff8ba9cf12 R09: 1ffff110062bf1b8 + R10: dffffc0000000000 R11: ffffed10062bf1b9 R12: 0000000000000000 + R13: dffffc0000000000 R14: 00000000700cec61 R15: 00000000000081e5 + FS: 000055556679c380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000020287000 CR3: 0000000077892000 CR4: 00000000003506f0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + + move_skbs_to_msk net/mptcp/protocol.c:811 [inline] + mptcp_data_ready+0x29c/0xa90 net/mptcp/protocol.c:854 + subflow_data_ready+0x34a/0x920 net/mptcp/subflow.c:1490 + tcp_data_queue+0x20fd/0x76c0 net/ipv4/tcp_input.c:5283 + tcp_rcv_established+0xfba/0x2020 net/ipv4/tcp_input.c:6237 + tcp_v4_do_rcv+0x96d/0xc70 net/ipv4/tcp_ipv4.c:1915 + tcp_v4_rcv+0x2dc0/0x37f0 net/ipv4/tcp_ipv4.c:2350 + ip_protocol_deliver_rcu+0x22e/0x440 net/ipv4/ip_input.c:205 + ip_local_deliver_finish+0x341/0x5f0 net/ipv4/ip_input.c:233 + NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314 + NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314 + __netif_receive_skb_one_core net/core/dev.c:5662 [inline] + __netif_receive_skb+0x2bf/0x650 net/core/dev.c:5775 + process_backlog+0x662/0x15b0 net/core/dev.c:6107 + __napi_poll+0xcb/0x490 net/core/dev.c:6771 + napi_poll net/core/dev.c:6840 [inline] + net_rx_action+0x89b/0x1240 net/core/dev.c:6962 + handle_softirqs+0x2c5/0x980 kernel/softirq.c:554 + do_softirq+0x11b/0x1e0 kernel/softirq.c:455 + + + __local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:382 + local_bh_enable include/linux/bottom_half.h:33 [inline] + rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline] + __dev_queue_xmit+0x1764/0x3e80 net/core/dev.c:4451 + dev_queue_xmit include/linux/netdevice.h:3094 [inline] + neigh_hh_output include/net/neighbour.h:526 [inline] + neigh_output include/net/neighbour.h:540 [inline] + ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236 + ip_local_out net/ipv4/ip_output.c:130 [inline] + __ip_queue_xmit+0x118c/0x1b80 net/ipv4/ip_output.c:536 + __tcp_transmit_skb+0x2544/0x3b30 net/ipv4/tcp_output.c:1466 + tcp_transmit_skb net/ipv4/tcp_output.c:1484 [inline] + tcp_mtu_probe net/ipv4/tcp_output.c:2547 [inline] + tcp_write_xmit+0x641d/0x6bf0 net/ipv4/tcp_output.c:2752 + __tcp_push_pending_frames+0x9b/0x360 net/ipv4/tcp_output.c:3015 + tcp_push_pending_frames include/net/tcp.h:2107 [inline] + tcp_data_snd_check net/ipv4/tcp_input.c:5714 [inline] + tcp_rcv_established+0x1026/0x2020 net/ipv4/tcp_input.c:6239 + tcp_v4_do_rcv+0x96d/0xc70 net/ipv4/tcp_ipv4.c:1915 + sk_backlog_rcv include/net/sock.h:1113 [inline] + __release_sock+0x214/0x350 net/core/sock.c:3072 + release_sock+0x61/0x1f0 net/core/sock.c:3626 + mptcp_push_release net/mptcp/protocol.c:1486 [inline] + __mptcp_push_pending+0x6b5/0x9f0 net/mptcp/protocol.c:1625 + mptcp_sendmsg+0x10bb/0x1b10 net/mptcp/protocol.c:1903 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg+0x1a6/0x270 net/socket.c:745 + ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2603 + ___sys_sendmsg net/socket.c:2657 [inline] + __sys_sendmsg+0x2aa/0x390 net/socket.c:2686 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + RIP: 0033:0x7fb06e9317f9 + Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 + RSP: 002b:00007ffe2cfd4f98 EFLAGS: 00000246 ORIG_RAX: 000000000000002e + RAX: ffffffffffffffda RBX: 00007fb06e97f468 RCX: 00007fb06e9317f9 + RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000005 + RBP: 00007fb06e97f446 R08: 0000555500000000 R09: 0000555500000000 + R10: 0000555500000000 R11: 0000000000000246 R12: 00007fb06e97f406 + R13: 0000000000000001 R14: 00007ffe2cfd4fe0 R15: 0000000000000003 + + +Additionally syzkaller provided a nice reproducer. The repro enables +pmtu on the loopback device, leading to tcp_mtu_probe() generating +very large probe packets. + +tcp_can_coalesce_send_queue_head() currently does not check for +mptcp-level invariants, and allowed the creation of cross-DSS probes, +leading to the mentioned corruption. + +Address the issue teaching tcp_can_coalesce_send_queue_head() about +mptcp using the tcp_skb_can_collapse(), also reducing the code +duplication. + +Fixes: 85712484110d ("tcp: coalesce/collapse must respect MPTCP extensions") +Cc: stable@vger.kernel.org +Reported-by: syzbot+d1bff73460e33101f0e7@syzkaller.appspotmail.com +Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/513 +Signed-off-by: Paolo Abeni +Acked-by: Matthieu Baerts (NGI0) +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20241008-net-mptcp-fallback-fixes-v1-2-c6fb8e93e551@kernel.org +Signed-off-by: Jakub Kicinski +[ Conflict in tcp_output.c, because the commit 65249feb6b3d ("net: add + support for skbs with unreadable frags") is not in this version. This + commit is linked to a new feature (Devmem TCP) and introduces a new + condition which causes the conflicts. Resolving this is easy: we can + ignore the missing new condition, and use tcp_skb_can_collapse() like + in the original patch. ] +Signed-off-by: Matthieu Baerts (NGI0) +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_output.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2312,9 +2312,7 @@ static bool tcp_can_coalesce_send_queue_ + if (len <= skb->len) + break; + +- if (unlikely(TCP_SKB_CB(skb)->eor) || +- tcp_has_tx_tstamp(skb) || +- !skb_pure_zcopy_same(skb, next)) ++ if (tcp_has_tx_tstamp(skb) || !tcp_skb_can_collapse(skb, next)) + return false; + + len -= skb->len;