From: Greg Kroah-Hartman Date: Thu, 11 Jan 2024 09:59:10 +0000 (+0100) Subject: 6.6-stable patches X-Git-Tag: v5.10.207~8 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=33dc361a4593cb20d39724d35f37e8e3fb816817;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: netlink-return-unsigned-value-for-nla_len.patch nfsd-drop-the-nfsd_put-helper.patch series --- diff --git a/queue-6.6/netlink-return-unsigned-value-for-nla_len.patch b/queue-6.6/netlink-return-unsigned-value-for-nla_len.patch new file mode 100644 index 00000000000..fbb7edac071 --- /dev/null +++ b/queue-6.6/netlink-return-unsigned-value-for-nla_len.patch @@ -0,0 +1,56 @@ +From 172db56d90d29e47e7d0d64885d5dbd92c87ec42 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Wed, 6 Dec 2023 12:59:07 -0800 +Subject: netlink: Return unsigned value for nla_len() + +From: Kees Cook + +commit 172db56d90d29e47e7d0d64885d5dbd92c87ec42 upstream. + +The return value from nla_len() is never expected to be negative, and can +never be more than struct nlattr::nla_len (a u16). Adjust the prototype +on the function. This will let GCC's value range optimization passes +know that the return can never be negative, and can never be larger than +u16. As recently discussed[1], this silences the following warning in +GCC 12+: + +net/wireless/nl80211.c: In function 'nl80211_set_cqm_rssi.isra': +net/wireless/nl80211.c:12892:17: warning: 'memcpy' specified bound 18446744073709551615 exceeds maximum object size 9223372036854775807 [-Wstringop-overflow=] +12892 | memcpy(cqm_config->rssi_thresholds, thresholds, + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +12893 | flex_array_size(cqm_config, rssi_thresholds, + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +12894 | n_thresholds)); + | ~~~~~~~~~~~~~~ + +A future change would be to clamp the subtraction to make sure it never +wraps around if nla_len is somehow less than NLA_HDRLEN, which would +have the additional benefit of being defensive in the face of nlattr +corruption or logic errors. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202311090752.hWcJWAHL-lkp@intel.com/ [1] +Cc: Johannes Berg +Cc: Jeff Johnson +Cc: Michael Walle +Cc: Max Schulze +Link: https://lore.kernel.org/r/20231202202539.it.704-kees@kernel.org +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20231206205904.make.018-kees@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + include/net/netlink.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/net/netlink.h ++++ b/include/net/netlink.h +@@ -1189,7 +1189,7 @@ static inline void *nla_data(const struc + * nla_len - length of payload + * @nla: netlink attribute + */ +-static inline int nla_len(const struct nlattr *nla) ++static inline u16 nla_len(const struct nlattr *nla) + { + return nla->nla_len - NLA_HDRLEN; + } diff --git a/queue-6.6/nfsd-drop-the-nfsd_put-helper.patch b/queue-6.6/nfsd-drop-the-nfsd_put-helper.patch new file mode 100644 index 00000000000..9830d729769 --- /dev/null +++ b/queue-6.6/nfsd-drop-the-nfsd_put-helper.patch @@ -0,0 +1,125 @@ +From 64e6304169f1e1f078e7f0798033f80a7fb0ea46 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Wed, 3 Jan 2024 08:36:52 -0500 +Subject: nfsd: drop the nfsd_put helper + +From: Jeff Layton + +commit 64e6304169f1e1f078e7f0798033f80a7fb0ea46 upstream. + +It's not safe to call nfsd_put once nfsd_last_thread has been called, as +that function will zero out the nn->nfsd_serv pointer. + +Drop the nfsd_put helper altogether and open-code the svc_put in its +callers instead. That allows us to not be reliant on the value of that +pointer when handling an error. + +Fixes: 2a501f55cd64 ("nfsd: call nfsd_last_thread() before final nfsd_put()") +Reported-by: Zhi Li +Cc: NeilBrown +Signed-off-by: Jeffrey Layton +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfsd/nfsctl.c | 31 +++++++++++++++++-------------- + fs/nfsd/nfsd.h | 7 ------- + 2 files changed, 17 insertions(+), 21 deletions(-) + +--- a/fs/nfsd/nfsctl.c ++++ b/fs/nfsd/nfsctl.c +@@ -692,6 +692,7 @@ static ssize_t __write_ports_addfd(char + char *mesg = buf; + int fd, err; + struct nfsd_net *nn = net_generic(net, nfsd_net_id); ++ struct svc_serv *serv; + + err = get_int(&mesg, &fd); + if (err != 0 || fd < 0) +@@ -702,15 +703,15 @@ static ssize_t __write_ports_addfd(char + if (err != 0) + return err; + +- err = svc_addsock(nn->nfsd_serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred); ++ serv = nn->nfsd_serv; ++ err = svc_addsock(serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred); + +- if (err < 0 && !nn->nfsd_serv->sv_nrthreads && !nn->keep_active) ++ if (err < 0 && !serv->sv_nrthreads && !nn->keep_active) + nfsd_last_thread(net); +- else if (err >= 0 && +- !nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) +- svc_get(nn->nfsd_serv); ++ else if (err >= 0 && !serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) ++ svc_get(serv); + +- nfsd_put(net); ++ svc_put(serv); + return err; + } + +@@ -724,6 +725,7 @@ static ssize_t __write_ports_addxprt(cha + struct svc_xprt *xprt; + int port, err; + struct nfsd_net *nn = net_generic(net, nfsd_net_id); ++ struct svc_serv *serv; + + if (sscanf(buf, "%15s %5u", transport, &port) != 2) + return -EINVAL; +@@ -736,32 +738,33 @@ static ssize_t __write_ports_addxprt(cha + if (err != 0) + return err; + +- err = svc_xprt_create(nn->nfsd_serv, transport, net, ++ serv = nn->nfsd_serv; ++ err = svc_xprt_create(serv, transport, net, + PF_INET, port, SVC_SOCK_ANONYMOUS, cred); + if (err < 0) + goto out_err; + +- err = svc_xprt_create(nn->nfsd_serv, transport, net, ++ err = svc_xprt_create(serv, transport, net, + PF_INET6, port, SVC_SOCK_ANONYMOUS, cred); + if (err < 0 && err != -EAFNOSUPPORT) + goto out_close; + +- if (!nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) +- svc_get(nn->nfsd_serv); ++ if (!serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) ++ svc_get(serv); + +- nfsd_put(net); ++ svc_put(serv); + return 0; + out_close: +- xprt = svc_find_xprt(nn->nfsd_serv, transport, net, PF_INET, port); ++ xprt = svc_find_xprt(serv, transport, net, PF_INET, port); + if (xprt != NULL) { + svc_xprt_close(xprt); + svc_xprt_put(xprt); + } + out_err: +- if (!nn->nfsd_serv->sv_nrthreads && !nn->keep_active) ++ if (!serv->sv_nrthreads && !nn->keep_active) + nfsd_last_thread(net); + +- nfsd_put(net); ++ svc_put(serv); + return err; + } + +--- a/fs/nfsd/nfsd.h ++++ b/fs/nfsd/nfsd.h +@@ -96,13 +96,6 @@ int nfsd_pool_stats_open(struct inode * + int nfsd_pool_stats_release(struct inode *, struct file *); + void nfsd_shutdown_threads(struct net *net); + +-static inline void nfsd_put(struct net *net) +-{ +- struct nfsd_net *nn = net_generic(net, nfsd_net_id); +- +- svc_put(nn->nfsd_serv); +-} +- + bool i_am_nfsd(void); + + struct nfsdfs_client { diff --git a/queue-6.6/series b/queue-6.6/series new file mode 100644 index 00000000000..2e19a8a0538 --- /dev/null +++ b/queue-6.6/series @@ -0,0 +1,2 @@ +nfsd-drop-the-nfsd_put-helper.patch +netlink-return-unsigned-value-for-nla_len.patch