From: Greg Kroah-Hartman Date: Tue, 15 Jul 2025 12:00:23 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v5.4.296~20 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6a9ce5aee453578457d54fc216173d02e1ba7b31;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: vhost-scsi-protect-vq-log_used-with-vq-mutex.patch x86-mm-disable-hugetlb-page-table-sharing-on-32-bit.patch --- diff --git a/queue-5.10/series b/queue-5.10/series index e59bde87dc..be5ee0fc06 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -215,3 +215,5 @@ vt-add-missing-notification-when-switching-back-to-t.patch hid-add-ignore-quirk-for-smartlinktechnology.patch hid-quirks-add-quirk-for-2-chicony-electronics-hp-5m.patch input-atkbd-do-not-skip-atkbd_deactivate-when-skipping-atkbd_cmd_getid.patch +vhost-scsi-protect-vq-log_used-with-vq-mutex.patch +x86-mm-disable-hugetlb-page-table-sharing-on-32-bit.patch diff --git a/queue-5.10/vhost-scsi-protect-vq-log_used-with-vq-mutex.patch b/queue-5.10/vhost-scsi-protect-vq-log_used-with-vq-mutex.patch new file mode 100644 index 0000000000..bfbe190426 --- /dev/null +++ b/queue-5.10/vhost-scsi-protect-vq-log_used-with-vq-mutex.patch @@ -0,0 +1,73 @@ +From f591cf9fce724e5075cc67488c43c6e39e8cbe27 Mon Sep 17 00:00:00 2001 +From: Dongli Zhang +Date: Wed, 2 Apr 2025 23:29:46 -0700 +Subject: vhost-scsi: protect vq->log_used with vq->mutex + +From: Dongli Zhang + +commit f591cf9fce724e5075cc67488c43c6e39e8cbe27 upstream. + +The vhost-scsi completion path may access vq->log_base when vq->log_used is +already set to false. + + vhost-thread QEMU-thread + +vhost_scsi_complete_cmd_work() +-> vhost_add_used() + -> vhost_add_used_n() + if (unlikely(vq->log_used)) + QEMU disables vq->log_used + via VHOST_SET_VRING_ADDR. + mutex_lock(&vq->mutex); + vq->log_used = false now! + mutex_unlock(&vq->mutex); + + QEMU gfree(vq->log_base) + log_used() + -> log_write(vq->log_base) + +Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be +reclaimed via gfree(). As a result, this causes invalid memory writes to +QEMU userspace. + +The control queue path has the same issue. + +Signed-off-by: Dongli Zhang +Acked-by: Jason Wang +Reviewed-by: Mike Christie +Message-Id: <20250403063028.16045-2-dongli.zhang@oracle.com> +Signed-off-by: Michael S. Tsirkin +[ Resolved conflicts in drivers/vhost/scsi.c + bacause vhost_scsi_complete_cmd_work() has been refactored. ] +Signed-off-by: Xinyu Zheng +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vhost/scsi.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -579,8 +579,10 @@ static void vhost_scsi_complete_cmd_work + ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter); + if (likely(ret == sizeof(v_rsp))) { + struct vhost_scsi_virtqueue *q; +- vhost_add_used(cmd->tvc_vq, cmd->tvc_vq_desc, 0); + q = container_of(cmd->tvc_vq, struct vhost_scsi_virtqueue, vq); ++ mutex_lock(&q->vq.mutex); ++ vhost_add_used(cmd->tvc_vq, cmd->tvc_vq_desc, 0); ++ mutex_unlock(&q->vq.mutex); + vq = q - vs->vqs; + __set_bit(vq, signal); + } else +@@ -1193,8 +1195,11 @@ static void vhost_scsi_tmf_resp_work(str + else + resp_code = VIRTIO_SCSI_S_FUNCTION_REJECTED; + ++ mutex_lock(&tmf->svq->vq.mutex); + vhost_scsi_send_tmf_resp(tmf->vhost, &tmf->svq->vq, tmf->in_iovs, + tmf->vq_desc, &tmf->resp_iov, resp_code); ++ mutex_unlock(&tmf->svq->vq.mutex); ++ + vhost_scsi_release_tmf_res(tmf); + } + diff --git a/queue-5.10/x86-mm-disable-hugetlb-page-table-sharing-on-32-bit.patch b/queue-5.10/x86-mm-disable-hugetlb-page-table-sharing-on-32-bit.patch new file mode 100644 index 0000000000..cb5a12382c --- /dev/null +++ b/queue-5.10/x86-mm-disable-hugetlb-page-table-sharing-on-32-bit.patch @@ -0,0 +1,55 @@ +From 76303ee8d54bff6d9a6d55997acd88a6c2ba63cf Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Wed, 2 Jul 2025 10:32:04 +0200 +Subject: x86/mm: Disable hugetlb page table sharing on 32-bit + +From: Jann Horn + +commit 76303ee8d54bff6d9a6d55997acd88a6c2ba63cf upstream. + +Only select ARCH_WANT_HUGE_PMD_SHARE on 64-bit x86. +Page table sharing requires at least three levels because it involves +shared references to PMD tables; 32-bit x86 has either two-level paging +(without PAE) or three-level paging (with PAE), but even with +three-level paging, having a dedicated PGD entry for hugetlb is only +barely possible (because the PGD only has four entries), and it seems +unlikely anyone's actually using PMD sharing on 32-bit. + +Having ARCH_WANT_HUGE_PMD_SHARE enabled on non-PAE 32-bit X86 (which +has 2-level paging) became particularly problematic after commit +59d9094df3d7 ("mm: hugetlb: independent PMD page table shared count"), +since that changes `struct ptdesc` such that the `pt_mm` (for PGDs) and +the `pt_share_count` (for PMDs) share the same union storage - and with +2-level paging, PMDs are PGDs. + +(For comparison, arm64 also gates ARCH_WANT_HUGE_PMD_SHARE on the +configuration of page tables such that it is never enabled with 2-level +paging.) + +Closes: https://lore.kernel.org/r/srhpjxlqfna67blvma5frmy3aa@altlinux.org +Fixes: cfe28c5d63d8 ("x86: mm: Remove x86 version of huge_pmd_share.") +Reported-by: Vitaly Chikunov +Suggested-by: Dave Hansen +Signed-off-by: Jann Horn +Signed-off-by: Dave Hansen +Acked-by: Oscar Salvador +Acked-by: David Hildenbrand +Tested-by: Vitaly Chikunov +Cc:stable@vger.kernel.org +Link: https://lore.kernel.org/all/20250702-x86-2level-hugetlb-v2-1-1a98096edf92%40google.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -102,7 +102,7 @@ config X86 + select ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH + select ARCH_WANT_DEFAULT_BPF_JIT if X86_64 + select ARCH_WANTS_DYNAMIC_TASK_STRUCT +- select ARCH_WANT_HUGE_PMD_SHARE ++ select ARCH_WANT_HUGE_PMD_SHARE if X86_64 + select ARCH_WANT_LD_ORPHAN_WARN + select ARCH_WANTS_THP_SWAP if X86_64 + select BUILDTIME_TABLE_SORT