From aceae8a74231ebe8164ee93c80193ea51ebbb9a8 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 7 Aug 2023 10:50:04 +0200 Subject: [PATCH] 6.1-stable patches added patches: bluetooth-l2cap-fix-use-after-free-in-l2cap_sock_ready_cb.patch debugobjects-recheck-debug_objects_enabled-before-reporting.patch fs-ntfs3-use-__gfp_nowarn-allocation-at-ntfs_load_attr_list.patch fs-sysv-null-check-to-prevent-null-ptr-deref-bug.patch mm-kmem-fix-a-null-pointer-dereference-in-obj_stock_flush_required.patch --- ...se-after-free-in-l2cap_sock_ready_cb.patch | 150 +++++++++++++++++ ...bug_objects_enabled-before-reporting.patch | 69 ++++++++ ...rn-allocation-at-ntfs_load_attr_list.patch | 41 +++++ ...-check-to-prevent-null-ptr-deref-bug.patch | 35 ++++ ...eference-in-obj_stock_flush_required.patch | 153 ++++++++++++++++++ queue-6.1/series | 5 + 6 files changed, 453 insertions(+) create mode 100644 queue-6.1/bluetooth-l2cap-fix-use-after-free-in-l2cap_sock_ready_cb.patch create mode 100644 queue-6.1/debugobjects-recheck-debug_objects_enabled-before-reporting.patch create mode 100644 queue-6.1/fs-ntfs3-use-__gfp_nowarn-allocation-at-ntfs_load_attr_list.patch create mode 100644 queue-6.1/fs-sysv-null-check-to-prevent-null-ptr-deref-bug.patch create mode 100644 queue-6.1/mm-kmem-fix-a-null-pointer-dereference-in-obj_stock_flush_required.patch diff --git a/queue-6.1/bluetooth-l2cap-fix-use-after-free-in-l2cap_sock_ready_cb.patch b/queue-6.1/bluetooth-l2cap-fix-use-after-free-in-l2cap_sock_ready_cb.patch new file mode 100644 index 00000000000..f9dfdf4cdee --- /dev/null +++ b/queue-6.1/bluetooth-l2cap-fix-use-after-free-in-l2cap_sock_ready_cb.patch @@ -0,0 +1,150 @@ +From 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 Mon Sep 17 00:00:00 2001 +From: Sungwoo Kim +Date: Wed, 31 May 2023 01:39:56 -0400 +Subject: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb + +From: Sungwoo Kim + +commit 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 upstream. + +l2cap_sock_release(sk) frees sk. However, sk's children are still alive +and point to the already free'd sk's address. +To fix this, l2cap_sock_release(sk) also cleans sk's children. + +================================================================== +BUG: KASAN: use-after-free in l2cap_sock_ready_cb+0xb7/0x100 net/bluetooth/l2cap_sock.c:1650 +Read of size 8 at addr ffff888104617aa8 by task kworker/u3:0/276 + +CPU: 0 PID: 276 Comm: kworker/u3:0 Not tainted 6.2.0-00001-gef397bd4d5fb-dirty #59 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 +Workqueue: hci2 hci_rx_work +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x72/0x95 lib/dump_stack.c:106 + print_address_description mm/kasan/report.c:306 [inline] + print_report+0x175/0x478 mm/kasan/report.c:417 + kasan_report+0xb1/0x130 mm/kasan/report.c:517 + l2cap_sock_ready_cb+0xb7/0x100 net/bluetooth/l2cap_sock.c:1650 + l2cap_chan_ready+0x10e/0x1e0 net/bluetooth/l2cap_core.c:1386 + l2cap_config_req+0x753/0x9f0 net/bluetooth/l2cap_core.c:4480 + l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:5739 [inline] + l2cap_sig_channel net/bluetooth/l2cap_core.c:6509 [inline] + l2cap_recv_frame+0xe2e/0x43c0 net/bluetooth/l2cap_core.c:7788 + l2cap_recv_acldata+0x6ed/0x7e0 net/bluetooth/l2cap_core.c:8506 + hci_acldata_packet net/bluetooth/hci_core.c:3813 [inline] + hci_rx_work+0x66e/0xbc0 net/bluetooth/hci_core.c:4048 + process_one_work+0x4ea/0x8e0 kernel/workqueue.c:2289 + worker_thread+0x364/0x8e0 kernel/workqueue.c:2436 + kthread+0x1b9/0x200 kernel/kthread.c:376 + ret_from_fork+0x2c/0x50 arch/x86/entry/entry_64.S:308 + + +Allocated by task 288: + kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 + kasan_set_track+0x25/0x30 mm/kasan/common.c:52 + ____kasan_kmalloc mm/kasan/common.c:374 [inline] + __kasan_kmalloc+0x82/0x90 mm/kasan/common.c:383 + kasan_kmalloc include/linux/kasan.h:211 [inline] + __do_kmalloc_node mm/slab_common.c:968 [inline] + __kmalloc+0x5a/0x140 mm/slab_common.c:981 + kmalloc include/linux/slab.h:584 [inline] + sk_prot_alloc+0x113/0x1f0 net/core/sock.c:2040 + sk_alloc+0x36/0x3c0 net/core/sock.c:2093 + l2cap_sock_alloc.constprop.0+0x39/0x1c0 net/bluetooth/l2cap_sock.c:1852 + l2cap_sock_create+0x10d/0x220 net/bluetooth/l2cap_sock.c:1898 + bt_sock_create+0x183/0x290 net/bluetooth/af_bluetooth.c:132 + __sock_create+0x226/0x380 net/socket.c:1518 + sock_create net/socket.c:1569 [inline] + __sys_socket_create net/socket.c:1606 [inline] + __sys_socket_create net/socket.c:1591 [inline] + __sys_socket+0x112/0x200 net/socket.c:1639 + __do_sys_socket net/socket.c:1652 [inline] + __se_sys_socket net/socket.c:1650 [inline] + __x64_sys_socket+0x40/0x50 net/socket.c:1650 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Freed by task 288: + kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 + kasan_set_track+0x25/0x30 mm/kasan/common.c:52 + kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:523 + ____kasan_slab_free mm/kasan/common.c:236 [inline] + ____kasan_slab_free mm/kasan/common.c:200 [inline] + __kasan_slab_free+0x10a/0x190 mm/kasan/common.c:244 + kasan_slab_free include/linux/kasan.h:177 [inline] + slab_free_hook mm/slub.c:1781 [inline] + slab_free_freelist_hook mm/slub.c:1807 [inline] + slab_free mm/slub.c:3787 [inline] + __kmem_cache_free+0x88/0x1f0 mm/slub.c:3800 + sk_prot_free net/core/sock.c:2076 [inline] + __sk_destruct+0x347/0x430 net/core/sock.c:2168 + sk_destruct+0x9c/0xb0 net/core/sock.c:2183 + __sk_free+0x82/0x220 net/core/sock.c:2194 + sk_free+0x7c/0xa0 net/core/sock.c:2205 + sock_put include/net/sock.h:1991 [inline] + l2cap_sock_kill+0x256/0x2b0 net/bluetooth/l2cap_sock.c:1257 + l2cap_sock_release+0x1a7/0x220 net/bluetooth/l2cap_sock.c:1428 + __sock_release+0x80/0x150 net/socket.c:650 + sock_close+0x19/0x30 net/socket.c:1368 + __fput+0x17a/0x5c0 fs/file_table.c:320 + task_work_run+0x132/0x1c0 kernel/task_work.c:179 + resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] + exit_to_user_mode_loop kernel/entry/common.c:171 [inline] + exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203 + __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] + syscall_exit_to_user_mode+0x21/0x50 kernel/entry/common.c:296 + do_syscall_64+0x4c/0x90 arch/x86/entry/common.c:86 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +The buggy address belongs to the object at ffff888104617800 + which belongs to the cache kmalloc-1k of size 1024 +The buggy address is located 680 bytes inside of + 1024-byte region [ffff888104617800, ffff888104617c00) + +The buggy address belongs to the physical page: +page:00000000dbca6a80 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888104614000 pfn:0x104614 +head:00000000dbca6a80 order:2 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0 +flags: 0x200000000010200(slab|head|node=0|zone=2) +raw: 0200000000010200 ffff888100041dc0 ffffea0004212c10 ffffea0004234b10 +raw: ffff888104614000 0000000000080002 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected + +Memory state around the buggy address: + ffff888104617980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ffff888104617a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +>ffff888104617a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ^ + ffff888104617b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ffff888104617b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +================================================================== + +Ack: This bug is found by FuzzBT with a modified Syzkaller. Other +contributors are Ruoyu Wu and Hui Peng. +Signed-off-by: Sungwoo Kim +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/l2cap_sock.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -46,6 +46,7 @@ static const struct proto_ops l2cap_sock + static void l2cap_sock_init(struct sock *sk, struct sock *parent); + static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, + int proto, gfp_t prio, int kern); ++static void l2cap_sock_cleanup_listen(struct sock *parent); + + bool l2cap_is_socket(struct socket *sock) + { +@@ -1415,6 +1416,7 @@ static int l2cap_sock_release(struct soc + if (!sk) + return 0; + ++ l2cap_sock_cleanup_listen(sk); + bt_sock_unlink(&l2cap_sk_list, sk); + + err = l2cap_sock_shutdown(sock, SHUT_RDWR); diff --git a/queue-6.1/debugobjects-recheck-debug_objects_enabled-before-reporting.patch b/queue-6.1/debugobjects-recheck-debug_objects_enabled-before-reporting.patch new file mode 100644 index 00000000000..bda92426f2a --- /dev/null +++ b/queue-6.1/debugobjects-recheck-debug_objects_enabled-before-reporting.patch @@ -0,0 +1,69 @@ +From 8b64d420fe2450f82848178506d3e3a0bd195539 Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Wed, 7 Jun 2023 19:19:02 +0900 +Subject: debugobjects: Recheck debug_objects_enabled before reporting + +From: Tetsuo Handa + +commit 8b64d420fe2450f82848178506d3e3a0bd195539 upstream. + +syzbot is reporting false a positive ODEBUG message immediately after +ODEBUG was disabled due to OOM. + + [ 1062.309646][T22911] ODEBUG: Out of memory. ODEBUG disabled + [ 1062.886755][ T5171] ------------[ cut here ]------------ + [ 1062.892770][ T5171] ODEBUG: assert_init not available (active state 0) object: ffffc900056afb20 object type: timer_list hint: process_timeout+0x0/0x40 + + CPU 0 [ T5171] CPU 1 [T22911] + -------------- -------------- + debug_object_assert_init() { + if (!debug_objects_enabled) + return; + db = get_bucket(addr); + lookup_object_or_alloc() { + debug_objects_enabled = 0; + return NULL; + } + debug_objects_oom() { + pr_warn("Out of memory. ODEBUG disabled\n"); + // all buckets get emptied here, and + } + lookup_object_or_alloc(addr, db, descr, false, true) { + // this bucket is already empty. + return ERR_PTR(-ENOENT); + } + // Emits false positive warning. + debug_print_object(&o, "assert_init"); + } + +Recheck debug_object_enabled in debug_print_object() to avoid that. + +Reported-by: syzbot +Suggested-by: Thomas Gleixner +Signed-off-by: Tetsuo Handa +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/492fe2ae-5141-d548-ebd5-62f5fe2e57f7@I-love.SAKURA.ne.jp +Closes: https://syzkaller.appspot.com/bug?extid=7937ba6a50bdd00fffdf +Signed-off-by: Greg Kroah-Hartman +--- + lib/debugobjects.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/lib/debugobjects.c ++++ b/lib/debugobjects.c +@@ -498,6 +498,15 @@ static void debug_print_object(struct de + const struct debug_obj_descr *descr = obj->descr; + static int limit; + ++ /* ++ * Don't report if lookup_object_or_alloc() by the current thread ++ * failed because lookup_object_or_alloc()/debug_objects_oom() by a ++ * concurrent thread turned off debug_objects_enabled and cleared ++ * the hash buckets. ++ */ ++ if (!debug_objects_enabled) ++ return; ++ + if (limit < 5 && descr != descr_test) { + void *hint = descr->debug_hint ? + descr->debug_hint(obj->object) : NULL; diff --git a/queue-6.1/fs-ntfs3-use-__gfp_nowarn-allocation-at-ntfs_load_attr_list.patch b/queue-6.1/fs-ntfs3-use-__gfp_nowarn-allocation-at-ntfs_load_attr_list.patch new file mode 100644 index 00000000000..c8b6d70afe5 --- /dev/null +++ b/queue-6.1/fs-ntfs3-use-__gfp_nowarn-allocation-at-ntfs_load_attr_list.patch @@ -0,0 +1,41 @@ +From ea303f72d70ce2f0b0aa94ab127085289768c5a6 Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Tue, 28 Mar 2023 20:05:16 +0900 +Subject: fs/ntfs3: Use __GFP_NOWARN allocation at ntfs_load_attr_list() + +From: Tetsuo Handa + +commit ea303f72d70ce2f0b0aa94ab127085289768c5a6 upstream. + +syzbot is reporting too large allocation at ntfs_load_attr_list(), for +a crafted filesystem can have huge data_size. + +Reported-by: syzbot +Link: https://syzkaller.appspot.com/bug?extid=89dbb3a789a5b9711793 +Signed-off-by: Tetsuo Handa +Signed-off-by: Konstantin Komarov +Signed-off-by: Greg Kroah-Hartman +--- + fs/ntfs3/attrlist.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/ntfs3/attrlist.c ++++ b/fs/ntfs3/attrlist.c +@@ -52,7 +52,7 @@ int ntfs_load_attr_list(struct ntfs_inod + + if (!attr->non_res) { + lsize = le32_to_cpu(attr->res.data_size); +- le = kmalloc(al_aligned(lsize), GFP_NOFS); ++ le = kmalloc(al_aligned(lsize), GFP_NOFS | __GFP_NOWARN); + if (!le) { + err = -ENOMEM; + goto out; +@@ -80,7 +80,7 @@ int ntfs_load_attr_list(struct ntfs_inod + if (err < 0) + goto out; + +- le = kmalloc(al_aligned(lsize), GFP_NOFS); ++ le = kmalloc(al_aligned(lsize), GFP_NOFS | __GFP_NOWARN); + if (!le) { + err = -ENOMEM; + goto out; diff --git a/queue-6.1/fs-sysv-null-check-to-prevent-null-ptr-deref-bug.patch b/queue-6.1/fs-sysv-null-check-to-prevent-null-ptr-deref-bug.patch new file mode 100644 index 00000000000..0fdd9ca2092 --- /dev/null +++ b/queue-6.1/fs-sysv-null-check-to-prevent-null-ptr-deref-bug.patch @@ -0,0 +1,35 @@ +From ea2b62f305893992156a798f665847e0663c9f41 Mon Sep 17 00:00:00 2001 +From: Prince Kumar Maurya +Date: Tue, 30 May 2023 18:31:41 -0700 +Subject: fs/sysv: Null check to prevent null-ptr-deref bug + +From: Prince Kumar Maurya + +commit ea2b62f305893992156a798f665847e0663c9f41 upstream. + +sb_getblk(inode->i_sb, parent) return a null ptr and taking lock on +that leads to the null-ptr-deref bug. + +Reported-by: syzbot+aad58150cbc64ba41bdc@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=aad58150cbc64ba41bdc +Signed-off-by: Prince Kumar Maurya +Message-Id: <20230531013141.19487-1-princekumarmaurya06@gmail.com> +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman +--- + fs/sysv/itree.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/sysv/itree.c ++++ b/fs/sysv/itree.c +@@ -145,6 +145,10 @@ static int alloc_branch(struct inode *in + */ + parent = block_to_cpu(SYSV_SB(inode->i_sb), branch[n-1].key); + bh = sb_getblk(inode->i_sb, parent); ++ if (!bh) { ++ sysv_free_block(inode->i_sb, branch[n].key); ++ break; ++ } + lock_buffer(bh); + memset(bh->b_data, 0, blocksize); + branch[n].bh = bh; diff --git a/queue-6.1/mm-kmem-fix-a-null-pointer-dereference-in-obj_stock_flush_required.patch b/queue-6.1/mm-kmem-fix-a-null-pointer-dereference-in-obj_stock_flush_required.patch new file mode 100644 index 00000000000..d539b07d093 --- /dev/null +++ b/queue-6.1/mm-kmem-fix-a-null-pointer-dereference-in-obj_stock_flush_required.patch @@ -0,0 +1,153 @@ +From 3b8abb3239530c423c0b97e42af7f7e856e1ee96 Mon Sep 17 00:00:00 2001 +From: Roman Gushchin +Date: Tue, 2 May 2023 09:08:38 -0700 +Subject: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() + +From: Roman Gushchin + +commit 3b8abb3239530c423c0b97e42af7f7e856e1ee96 upstream. + +KCSAN found an issue in obj_stock_flush_required(): +stock->cached_objcg can be reset between the check and dereference: + +================================================================== +BUG: KCSAN: data-race in drain_all_stock / drain_obj_stock + +write to 0xffff888237c2a2f8 of 8 bytes by task 19625 on cpu 0: + drain_obj_stock+0x408/0x4e0 mm/memcontrol.c:3306 + refill_obj_stock+0x9c/0x1e0 mm/memcontrol.c:3340 + obj_cgroup_uncharge+0xe/0x10 mm/memcontrol.c:3408 + memcg_slab_free_hook mm/slab.h:587 [inline] + __cache_free mm/slab.c:3373 [inline] + __do_kmem_cache_free mm/slab.c:3577 [inline] + kmem_cache_free+0x105/0x280 mm/slab.c:3602 + __d_free fs/dcache.c:298 [inline] + dentry_free fs/dcache.c:375 [inline] + __dentry_kill+0x422/0x4a0 fs/dcache.c:621 + dentry_kill+0x8d/0x1e0 + dput+0x118/0x1f0 fs/dcache.c:913 + __fput+0x3bf/0x570 fs/file_table.c:329 + ____fput+0x15/0x20 fs/file_table.c:349 + task_work_run+0x123/0x160 kernel/task_work.c:179 + resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] + exit_to_user_mode_loop+0xcf/0xe0 kernel/entry/common.c:171 + exit_to_user_mode_prepare+0x6a/0xa0 kernel/entry/common.c:203 + __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] + syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:296 + do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +read to 0xffff888237c2a2f8 of 8 bytes by task 19632 on cpu 1: + obj_stock_flush_required mm/memcontrol.c:3319 [inline] + drain_all_stock+0x174/0x2a0 mm/memcontrol.c:2361 + try_charge_memcg+0x6d0/0xd10 mm/memcontrol.c:2703 + try_charge mm/memcontrol.c:2837 [inline] + mem_cgroup_charge_skmem+0x51/0x140 mm/memcontrol.c:7290 + sock_reserve_memory+0xb1/0x390 net/core/sock.c:1025 + sk_setsockopt+0x800/0x1e70 net/core/sock.c:1525 + udp_lib_setsockopt+0x99/0x6c0 net/ipv4/udp.c:2692 + udp_setsockopt+0x73/0xa0 net/ipv4/udp.c:2817 + sock_common_setsockopt+0x61/0x70 net/core/sock.c:3668 + __sys_setsockopt+0x1c3/0x230 net/socket.c:2271 + __do_sys_setsockopt net/socket.c:2282 [inline] + __se_sys_setsockopt net/socket.c:2279 [inline] + __x64_sys_setsockopt+0x66/0x80 net/socket.c:2279 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +value changed: 0xffff8881382d52c0 -> 0xffff888138893740 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 PID: 19632 Comm: syz-executor.0 Not tainted 6.3.0-rc2-syzkaller-00387-g534293368afa #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 + +Fix it by using READ_ONCE()/WRITE_ONCE() for all accesses to +stock->cached_objcg. + +Link: https://lkml.kernel.org/r/20230502160839.361544-1-roman.gushchin@linux.dev +Fixes: bf4f059954dc ("mm: memcg/slab: obj_cgroup API") +Signed-off-by: Roman Gushchin +Reported-by: syzbot+774c29891415ab0fd29d@syzkaller.appspotmail.com +Reported-by: Dmitry Vyukov + Link: https://lore.kernel.org/linux-mm/CACT4Y+ZfucZhM60YPphWiCLJr6+SGFhT+jjm8k1P-a_8Kkxsjg@mail.gmail.com/T/#t +Reviewed-by: Yosry Ahmed +Acked-by: Shakeel Butt +Reviewed-by: Dmitry Vyukov +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/memcontrol.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -3165,12 +3165,12 @@ void mod_objcg_state(struct obj_cgroup * + * accumulating over a page of vmstat data or when pgdat or idx + * changes. + */ +- if (stock->cached_objcg != objcg) { ++ if (READ_ONCE(stock->cached_objcg) != objcg) { + old = drain_obj_stock(stock); + obj_cgroup_get(objcg); + stock->nr_bytes = atomic_read(&objcg->nr_charged_bytes) + ? atomic_xchg(&objcg->nr_charged_bytes, 0) : 0; +- stock->cached_objcg = objcg; ++ WRITE_ONCE(stock->cached_objcg, objcg); + stock->cached_pgdat = pgdat; + } else if (stock->cached_pgdat != pgdat) { + /* Flush the existing cached vmstat data */ +@@ -3224,7 +3224,7 @@ static bool consume_obj_stock(struct obj + local_lock_irqsave(&memcg_stock.stock_lock, flags); + + stock = this_cpu_ptr(&memcg_stock); +- if (objcg == stock->cached_objcg && stock->nr_bytes >= nr_bytes) { ++ if (objcg == READ_ONCE(stock->cached_objcg) && stock->nr_bytes >= nr_bytes) { + stock->nr_bytes -= nr_bytes; + ret = true; + } +@@ -3236,7 +3236,7 @@ static bool consume_obj_stock(struct obj + + static struct obj_cgroup *drain_obj_stock(struct memcg_stock_pcp *stock) + { +- struct obj_cgroup *old = stock->cached_objcg; ++ struct obj_cgroup *old = READ_ONCE(stock->cached_objcg); + + if (!old) + return NULL; +@@ -3289,7 +3289,7 @@ static struct obj_cgroup *drain_obj_stoc + stock->cached_pgdat = NULL; + } + +- stock->cached_objcg = NULL; ++ WRITE_ONCE(stock->cached_objcg, NULL); + /* + * The `old' objects needs to be released by the caller via + * obj_cgroup_put() outside of memcg_stock_pcp::stock_lock. +@@ -3300,10 +3300,11 @@ static struct obj_cgroup *drain_obj_stoc + static bool obj_stock_flush_required(struct memcg_stock_pcp *stock, + struct mem_cgroup *root_memcg) + { ++ struct obj_cgroup *objcg = READ_ONCE(stock->cached_objcg); + struct mem_cgroup *memcg; + +- if (stock->cached_objcg) { +- memcg = obj_cgroup_memcg(stock->cached_objcg); ++ if (objcg) { ++ memcg = obj_cgroup_memcg(objcg); + if (memcg && mem_cgroup_is_descendant(memcg, root_memcg)) + return true; + } +@@ -3322,10 +3323,10 @@ static void refill_obj_stock(struct obj_ + local_lock_irqsave(&memcg_stock.stock_lock, flags); + + stock = this_cpu_ptr(&memcg_stock); +- if (stock->cached_objcg != objcg) { /* reset if necessary */ ++ if (READ_ONCE(stock->cached_objcg) != objcg) { /* reset if necessary */ + old = drain_obj_stock(stock); + obj_cgroup_get(objcg); +- stock->cached_objcg = objcg; ++ WRITE_ONCE(stock->cached_objcg, objcg); + stock->nr_bytes = atomic_read(&objcg->nr_charged_bytes) + ? atomic_xchg(&objcg->nr_charged_bytes, 0) : 0; + allow_uncharge = true; /* Allow uncharge when objcg changes */ diff --git a/queue-6.1/series b/queue-6.1/series index efc49ce17e9..7fe2d1ef209 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -97,3 +97,8 @@ drm-i915-gt-cleanup-aux-invalidation-registers.patch clk-imx93-propagate-correct-error-in-imx93_clocks_probe.patch bpf-cpumap-make-sure-kthread-is-running-before-map-update-returns.patch file-reinstate-f_pos-locking-optimization-for-regular-files.patch +mm-kmem-fix-a-null-pointer-dereference-in-obj_stock_flush_required.patch +fs-ntfs3-use-__gfp_nowarn-allocation-at-ntfs_load_attr_list.patch +fs-sysv-null-check-to-prevent-null-ptr-deref-bug.patch +bluetooth-l2cap-fix-use-after-free-in-l2cap_sock_ready_cb.patch +debugobjects-recheck-debug_objects_enabled-before-reporting.patch -- 2.47.3