From ec5e39a9cc822736eea55cf72f197d1683edb1cf Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 19 Jul 2022 13:40:01 +0200 Subject: [PATCH] 4.14-stable patches added patches: can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch mm-invalidate-hwpoison-page-cache-page-in-fault-path.patch --- ...tx_handler-fix-use-after-free-of-skb.patch | 46 +++++++++++++ ...poison-page-cache-page-in-fault-path.patch | 65 +++++++++++++++++++ queue-4.14/series | 2 + 3 files changed, 113 insertions(+) create mode 100644 queue-4.14/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch create mode 100644 queue-4.14/mm-invalidate-hwpoison-page-cache-page-in-fault-path.patch diff --git a/queue-4.14/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch b/queue-4.14/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch new file mode 100644 index 00000000000..a9077961567 --- /dev/null +++ b/queue-4.14/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch @@ -0,0 +1,46 @@ +From foo@baz Tue Jul 19 01:38:56 PM CEST 2022 +From: Marc Kleine-Budde +Date: Thu, 17 Mar 2022 08:57:35 +0100 +Subject: can: m_can: m_can_tx_handler(): fix use after free of skb + +From: Marc Kleine-Budde + +commit 2e8e79c416aae1de224c0f1860f2e3350fa171f8 upstream. + +can_put_echo_skb() will clone skb then free the skb. Move the +can_put_echo_skb() for the m_can version 3.0.x directly before the +start of the xmit in hardware, similar to the 3.1.x branch. + +Fixes: 80646733f11c ("can: m_can: update to support CAN FD features") +Link: https://lore.kernel.org/all/20220317081305.739554-1-mkl@pengutronix.de +Cc: stable@vger.kernel.org +Reported-by: Hangyu Hua +Signed-off-by: Marc Kleine-Budde +[sudip: adjust context] +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/m_can/m_can.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -1420,8 +1420,6 @@ static netdev_tx_t m_can_start_xmit(stru + M_CAN_FIFO_DATA(i / 4), + *(u32 *)(cf->data + i)); + +- can_put_echo_skb(skb, dev, 0); +- + if (priv->can.ctrlmode & CAN_CTRLMODE_FD) { + cccr = m_can_read(priv, M_CAN_CCCR); + cccr &= ~(CCCR_CMR_MASK << CCCR_CMR_SHIFT); +@@ -1438,6 +1436,9 @@ static netdev_tx_t m_can_start_xmit(stru + m_can_write(priv, M_CAN_CCCR, cccr); + } + m_can_write(priv, M_CAN_TXBTIE, 0x1); ++ ++ can_put_echo_skb(skb, dev, 0); ++ + m_can_write(priv, M_CAN_TXBAR, 0x1); + /* End of xmit function for version 3.0.x */ + } else { diff --git a/queue-4.14/mm-invalidate-hwpoison-page-cache-page-in-fault-path.patch b/queue-4.14/mm-invalidate-hwpoison-page-cache-page-in-fault-path.patch new file mode 100644 index 00000000000..0e88df8ffaf --- /dev/null +++ b/queue-4.14/mm-invalidate-hwpoison-page-cache-page-in-fault-path.patch @@ -0,0 +1,65 @@ +From foo@baz Tue Jul 19 01:37:29 PM CEST 2022 +From: Rik van Riel +Date: Tue, 22 Mar 2022 14:44:09 -0700 +Subject: mm: invalidate hwpoison page cache page in fault path + +From: Rik van Riel + +commit e53ac7374e64dede04d745ff0e70ff5048378d1f upstream. + +Sometimes the page offlining code can leave behind a hwpoisoned clean +page cache page. This can lead to programs being killed over and over +and over again as they fault in the hwpoisoned page, get killed, and +then get re-spawned by whatever wanted to run them. + +This is particularly embarrassing when the page was offlined due to +having too many corrected memory errors. Now we are killing tasks due +to them trying to access memory that probably isn't even corrupted. + +This problem can be avoided by invalidating the page from the page fault +handler, which already has a branch for dealing with these kinds of +pages. With this patch we simply pretend the page fault was successful +if the page was invalidated, return to userspace, incur another page +fault, read in the file from disk (to a new memory page), and then +everything works again. + +Link: https://lkml.kernel.org/r/20220212213740.423efcea@imladris.surriel.com +Signed-off-by: Rik van Riel +Reviewed-by: Miaohe Lin +Acked-by: Naoya Horiguchi +Reviewed-by: Oscar Salvador +Cc: John Hubbard +Cc: Mel Gorman +Cc: Johannes Weiner +Cc: Matthew Wilcox +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +[sudip: use int instead of vm_fault_t] +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman +--- + mm/memory.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -3342,11 +3342,16 @@ static int __do_fault(struct vm_fault *v + return ret; + + if (unlikely(PageHWPoison(vmf->page))) { +- if (ret & VM_FAULT_LOCKED) ++ int poisonret = VM_FAULT_HWPOISON; ++ if (ret & VM_FAULT_LOCKED) { ++ /* Retry if a clean page was removed from the cache. */ ++ if (invalidate_inode_page(vmf->page)) ++ poisonret = 0; + unlock_page(vmf->page); ++ } + put_page(vmf->page); + vmf->page = NULL; +- return VM_FAULT_HWPOISON; ++ return poisonret; + } + + if (unlikely(!(ret & VM_FAULT_LOCKED))) diff --git a/queue-4.14/series b/queue-4.14/series index 17fb8ed552c..fa6eeba3c49 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -39,3 +39,5 @@ usb-serial-ftdi_sio-add-belimo-device-ids.patch usb-dwc3-gadget-fix-event-pending-check.patch tty-serial-samsung_tty-set-dma-burst_size-to-1.patch serial-8250-fix-return-error-code-in-serial8250_request_std_resource.patch +mm-invalidate-hwpoison-page-cache-page-in-fault-path.patch +can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch -- 2.47.3