From: Greg Kroah-Hartman Date: Wed, 30 Nov 2022 12:27:35 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v5.10.157~46 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b5d94dce50d629111a4be14eae461dcb08d96e75;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: gcov-clang-fix-the-buffer-overflow-issue.patch nilfs2-fix-nilfs_sufile_mark_dirty-not-set-segment-usage-as-dirty.patch --- diff --git a/queue-5.4/gcov-clang-fix-the-buffer-overflow-issue.patch b/queue-5.4/gcov-clang-fix-the-buffer-overflow-issue.patch new file mode 100644 index 00000000000..5c638de6b5f --- /dev/null +++ b/queue-5.4/gcov-clang-fix-the-buffer-overflow-issue.patch @@ -0,0 +1,88 @@ +From a6f810efabfd789d3bbafeacb4502958ec56c5ce Mon Sep 17 00:00:00 2001 +From: Mukesh Ojha +Date: Thu, 10 Nov 2022 00:31:37 +0530 +Subject: gcov: clang: fix the buffer overflow issue + +From: Mukesh Ojha + +commit a6f810efabfd789d3bbafeacb4502958ec56c5ce upstream. + +Currently, in clang version of gcov code when module is getting removed +gcov_info_add() incorrectly adds the sfn_ptr->counter to all the +dst->functions and it result in the kernel panic in below crash report. +Fix this by properly handling it. + +[ 8.899094][ T599] Unable to handle kernel write to read-only memory at virtual address ffffff80461cc000 +[ 8.899100][ T599] Mem abort info: +[ 8.899102][ T599] ESR = 0x9600004f +[ 8.899103][ T599] EC = 0x25: DABT (current EL), IL = 32 bits +[ 8.899105][ T599] SET = 0, FnV = 0 +[ 8.899107][ T599] EA = 0, S1PTW = 0 +[ 8.899108][ T599] FSC = 0x0f: level 3 permission fault +[ 8.899110][ T599] Data abort info: +[ 8.899111][ T599] ISV = 0, ISS = 0x0000004f +[ 8.899113][ T599] CM = 0, WnR = 1 +[ 8.899114][ T599] swapper pgtable: 4k pages, 39-bit VAs, pgdp=00000000ab8de000 +[ 8.899116][ T599] [ffffff80461cc000] pgd=18000009ffcde003, p4d=18000009ffcde003, pud=18000009ffcde003, pmd=18000009ffcad003, pte=00600000c61cc787 +[ 8.899124][ T599] Internal error: Oops: 9600004f [#1] PREEMPT SMP +[ 8.899265][ T599] Skip md ftrace buffer dump for: 0x1609e0 +.... +.., +[ 8.899544][ T599] CPU: 7 PID: 599 Comm: modprobe Tainted: G S OE 5.15.41-android13-8-g38e9b1af6bce #1 +[ 8.899547][ T599] Hardware name: XXX (DT) +[ 8.899549][ T599] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) +[ 8.899551][ T599] pc : gcov_info_add+0x9c/0xb8 +[ 8.899557][ T599] lr : gcov_event+0x28c/0x6b8 +[ 8.899559][ T599] sp : ffffffc00e733b00 +[ 8.899560][ T599] x29: ffffffc00e733b00 x28: ffffffc00e733d30 x27: ffffffe8dc297470 +[ 8.899563][ T599] x26: ffffffe8dc297000 x25: ffffffe8dc297000 x24: ffffffe8dc297000 +[ 8.899566][ T599] x23: ffffffe8dc0a6200 x22: ffffff880f68bf20 x21: 0000000000000000 +[ 8.899569][ T599] x20: ffffff880f68bf00 x19: ffffff8801babc00 x18: ffffffc00d7f9058 +[ 8.899572][ T599] x17: 0000000000088793 x16: ffffff80461cbe00 x15: 9100052952800785 +[ 8.899575][ T599] x14: 0000000000000200 x13: 0000000000000041 x12: 9100052952800785 +[ 8.899577][ T599] x11: ffffffe8dc297000 x10: ffffffe8dc297000 x9 : ffffff80461cbc80 +[ 8.899580][ T599] x8 : ffffff8801babe80 x7 : ffffffe8dc2ec000 x6 : ffffffe8dc2ed000 +[ 8.899583][ T599] x5 : 000000008020001f x4 : fffffffe2006eae0 x3 : 000000008020001f +[ 8.899586][ T599] x2 : ffffff8027c49200 x1 : ffffff8801babc20 x0 : ffffff80461cb3a0 +[ 8.899589][ T599] Call trace: +[ 8.899590][ T599] gcov_info_add+0x9c/0xb8 +[ 8.899592][ T599] gcov_module_notifier+0xbc/0x120 +[ 8.899595][ T599] blocking_notifier_call_chain+0xa0/0x11c +[ 8.899598][ T599] do_init_module+0x2a8/0x33c +[ 8.899600][ T599] load_module+0x23cc/0x261c +[ 8.899602][ T599] __arm64_sys_finit_module+0x158/0x194 +[ 8.899604][ T599] invoke_syscall+0x94/0x2bc +[ 8.899607][ T599] el0_svc_common+0x1d8/0x34c +[ 8.899609][ T599] do_el0_svc+0x40/0x54 +[ 8.899611][ T599] el0_svc+0x94/0x2f0 +[ 8.899613][ T599] el0t_64_sync_handler+0x88/0xec +[ 8.899615][ T599] el0t_64_sync+0x1b4/0x1b8 +[ 8.899618][ T599] Code: f905f56c f86e69ec f86e6a0f 8b0c01ec (f82e6a0c) +[ 8.899620][ T599] ---[ end trace ed5218e9e5b6e2e6 ]--- + +Link: https://lkml.kernel.org/r/1668020497-13142-1-git-send-email-quic_mojha@quicinc.com +Fixes: e178a5beb369 ("gcov: clang support") +Signed-off-by: Mukesh Ojha +Reviewed-by: Peter Oberparleiter +Tested-by: Peter Oberparleiter +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Tom Rix +Cc: [5.2+] +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + kernel/gcov/clang.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/kernel/gcov/clang.c ++++ b/kernel/gcov/clang.c +@@ -327,6 +327,8 @@ void gcov_info_add(struct gcov_info *dst + + for (i = 0; i < sfn_ptr->num_counters; i++) + dfn_ptr->counters[i] += sfn_ptr->counters[i]; ++ ++ sfn_ptr = list_next_entry(sfn_ptr, head); + } + } + diff --git a/queue-5.4/nilfs2-fix-nilfs_sufile_mark_dirty-not-set-segment-usage-as-dirty.patch b/queue-5.4/nilfs2-fix-nilfs_sufile_mark_dirty-not-set-segment-usage-as-dirty.patch new file mode 100644 index 00000000000..9a31d29fa1c --- /dev/null +++ b/queue-5.4/nilfs2-fix-nilfs_sufile_mark_dirty-not-set-segment-usage-as-dirty.patch @@ -0,0 +1,77 @@ +From 512c5ca01a3610ab14ff6309db363de51f1c13a6 Mon Sep 17 00:00:00 2001 +From: Chen Zhongjin +Date: Fri, 18 Nov 2022 14:33:04 +0800 +Subject: nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty + +From: Chen Zhongjin + +commit 512c5ca01a3610ab14ff6309db363de51f1c13a6 upstream. + +When extending segments, nilfs_sufile_alloc() is called to get an +unassigned segment, then mark it as dirty to avoid accidentally allocating +the same segment in the future. + +But for some special cases such as a corrupted image it can be unreliable. +If such corruption of the dirty state of the segment occurs, nilfs2 may +reallocate a segment that is in use and pick the same segment for writing +twice at the same time. + +This will cause the problem reported by syzkaller: +https://syzkaller.appspot.com/bug?id=c7c4748e11ffcc367cef04f76e02e931833cbd24 + +This case started with segbuf1.segnum = 3, nextnum = 4 when constructed. +It supposed segment 4 has already been allocated and marked as dirty. + +However the dirty state was corrupted and segment 4 usage was not dirty. +For the first time nilfs_segctor_extend_segments() segment 4 was allocated +again, which made segbuf2 and next segbuf3 had same segment 4. + +sb_getblk() will get same bh for segbuf2 and segbuf3, and this bh is added +to both buffer lists of two segbuf. It makes the lists broken which +causes NULL pointer dereference. + +Fix the problem by setting usage as dirty every time in +nilfs_sufile_mark_dirty(), which is called during constructing current +segment to be written out and before allocating next segment. + +[chenzhongjin@huawei.com: add lock protection per Ryusuke] + Link: https://lkml.kernel.org/r/20221121091141.214703-1-chenzhongjin@huawei.com +Link: https://lkml.kernel.org/r/20221118063304.140187-1-chenzhongjin@huawei.com +Fixes: 9ff05123e3bf ("nilfs2: segment constructor") +Signed-off-by: Chen Zhongjin +Reported-by: +Reported-by: Liu Shixin +Acked-by: Ryusuke Konishi +Tested-by: Ryusuke Konishi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/nilfs2/sufile.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/fs/nilfs2/sufile.c ++++ b/fs/nilfs2/sufile.c +@@ -498,14 +498,22 @@ void nilfs_sufile_do_free(struct inode * + int nilfs_sufile_mark_dirty(struct inode *sufile, __u64 segnum) + { + struct buffer_head *bh; ++ void *kaddr; ++ struct nilfs_segment_usage *su; + int ret; + ++ down_write(&NILFS_MDT(sufile)->mi_sem); + ret = nilfs_sufile_get_segment_usage_block(sufile, segnum, 0, &bh); + if (!ret) { + mark_buffer_dirty(bh); + nilfs_mdt_mark_dirty(sufile); ++ kaddr = kmap_atomic(bh->b_page); ++ su = nilfs_sufile_block_get_segment_usage(sufile, segnum, bh, kaddr); ++ nilfs_segment_usage_set_dirty(su); ++ kunmap_atomic(kaddr); + brelse(bh); + } ++ up_write(&NILFS_MDT(sufile)->mi_sem); + return ret; + } + diff --git a/queue-5.4/series b/queue-5.4/series index a11eabb1f07..935c29a117e 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -60,3 +60,5 @@ revert-usb-bcma-add-a-check-for-devm_gpiod_get.patch usb-bcma-make-gpio-explicitly-optional.patch firmware-google-release-devices-before-unregistering.patch firmware-coreboot-register-bus-in-module-init.patch +nilfs2-fix-nilfs_sufile_mark_dirty-not-set-segment-usage-as-dirty.patch +gcov-clang-fix-the-buffer-overflow-issue.patch