--- /dev/null
+From e97f852fd4561e77721bb9a4e0ea9d98305b1e93 Mon Sep 17 00:00:00 2001
+From: Wanpeng Li <wanpengli@tencent.com>
+Date: Tue, 20 Nov 2018 16:34:18 +0800
+Subject: KVM: X86: Fix scan ioapic use-before-initialization
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wanpeng Li <wanpengli@tencent.com>
+
+commit e97f852fd4561e77721bb9a4e0ea9d98305b1e93 upstream.
+
+Reported by syzkaller:
+
+ BUG: unable to handle kernel NULL pointer dereference at 00000000000001c8
+ PGD 80000003ec4da067 P4D 80000003ec4da067 PUD 3f7bfa067 PMD 0
+ Oops: 0000 [#1] PREEMPT SMP PTI
+ CPU: 7 PID: 5059 Comm: debug Tainted: G OE 4.19.0-rc5 #16
+ RIP: 0010:__lock_acquire+0x1a6/0x1990
+ Call Trace:
+ lock_acquire+0xdb/0x210
+ _raw_spin_lock+0x38/0x70
+ kvm_ioapic_scan_entry+0x3e/0x110 [kvm]
+ vcpu_enter_guest+0x167e/0x1910 [kvm]
+ kvm_arch_vcpu_ioctl_run+0x35c/0x610 [kvm]
+ kvm_vcpu_ioctl+0x3e9/0x6d0 [kvm]
+ do_vfs_ioctl+0xa5/0x690
+ ksys_ioctl+0x6d/0x80
+ __x64_sys_ioctl+0x1a/0x20
+ do_syscall_64+0x83/0x6e0
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+The reason is that the testcase writes hyperv synic HV_X64_MSR_SINT6 msr
+and triggers scan ioapic logic to load synic vectors into EOI exit bitmap.
+However, irqchip is not initialized by this simple testcase, ioapic/apic
+objects should not be accessed.
+This can be triggered by the following program:
+
+ #define _GNU_SOURCE
+
+ #include <endian.h>
+ #include <stdint.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
+ #include <sys/syscall.h>
+ #include <sys/types.h>
+ #include <unistd.h>
+
+ uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};
+
+ int main(void)
+ {
+ syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
+ long res = 0;
+ memcpy((void*)0x20000040, "/dev/kvm", 9);
+ res = syscall(__NR_openat, 0xffffffffffffff9c, 0x20000040, 0, 0);
+ if (res != -1)
+ r[0] = res;
+ res = syscall(__NR_ioctl, r[0], 0xae01, 0);
+ if (res != -1)
+ r[1] = res;
+ res = syscall(__NR_ioctl, r[1], 0xae41, 0);
+ if (res != -1)
+ r[2] = res;
+ memcpy(
+ (void*)0x20000080,
+ "\x01\x00\x00\x00\x00\x5b\x61\xbb\x96\x00\x00\x40\x00\x00\x00\x00\x01\x00"
+ "\x08\x00\x00\x00\x00\x00\x0b\x77\xd1\x78\x4d\xd8\x3a\xed\xb1\x5c\x2e\x43"
+ "\xaa\x43\x39\xd6\xff\xf5\xf0\xa8\x98\xf2\x3e\x37\x29\x89\xde\x88\xc6\x33"
+ "\xfc\x2a\xdb\xb7\xe1\x4c\xac\x28\x61\x7b\x9c\xa9\xbc\x0d\xa0\x63\xfe\xfe"
+ "\xe8\x75\xde\xdd\x19\x38\xdc\x34\xf5\xec\x05\xfd\xeb\x5d\xed\x2e\xaf\x22"
+ "\xfa\xab\xb7\xe4\x42\x67\xd0\xaf\x06\x1c\x6a\x35\x67\x10\x55\xcb",
+ 106);
+ syscall(__NR_ioctl, r[2], 0x4008ae89, 0x20000080);
+ syscall(__NR_ioctl, r[2], 0xae80, 0);
+ return 0;
+ }
+
+This patch fixes it by bailing out scan ioapic if ioapic is not initialized in
+kernel.
+
+Reported-by: Wei Wu <ww9210@gmail.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Radim Krčmář <rkrcmar@redhat.com>
+Cc: Wei Wu <ww9210@gmail.com>
+Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+[ Srivatsa: Adjusted the context for 4.4.y ]
+Signed-off-by: Srivatsa S. Bhat (VMware) <srivatsa@csail.mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/x86.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -6409,7 +6409,8 @@ static void vcpu_scan_ioapic(struct kvm_
+ kvm_scan_ioapic_routes(vcpu, vcpu->arch.eoi_exit_bitmap);
+ else {
+ kvm_x86_ops->sync_pir_to_irr(vcpu);
+- kvm_ioapic_scan_entry(vcpu, vcpu->arch.eoi_exit_bitmap);
++ if (ioapic_in_kernel(vcpu->kvm))
++ kvm_ioapic_scan_entry(vcpu, vcpu->arch.eoi_exit_bitmap);
+ }
+ kvm_x86_ops->load_eoi_exitmap(vcpu);
+ }
--- /dev/null
+From 7298e3b0a149c91323b3205d325e942c3b3b9ef6 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 28 Jun 2019 12:07:05 -0700
+Subject: mm/page_idle.c: fix oops because end_pfn is larger than max_pfn
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit 7298e3b0a149c91323b3205d325e942c3b3b9ef6 upstream.
+
+Currently the calcuation of end_pfn can round up the pfn number to more
+than the actual maximum number of pfns, causing an Oops. Fix this by
+ensuring end_pfn is never more than max_pfn.
+
+This can be easily triggered when on systems where the end_pfn gets
+rounded up to more than max_pfn using the idle-page stress-ng stress test:
+
+sudo stress-ng --idle-page 0
+
+ BUG: unable to handle kernel paging request at 00000000000020d8
+ #PF error: [normal kernel read fault]
+ PGD 0 P4D 0
+ Oops: 0000 [#1] SMP PTI
+ CPU: 1 PID: 11039 Comm: stress-ng-idle- Not tainted 5.0.0-5-generic #6-Ubuntu
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+ RIP: 0010:page_idle_get_page+0xc8/0x1a0
+ Code: 0f b1 0a 75 7d 48 8b 03 48 89 c2 48 c1 e8 33 83 e0 07 48 c1 ea 36 48 8d 0c 40 4c 8d 24 88 49 c1 e4 07 4c 03 24 d5 00 89 c3 be <49> 8b 44 24 58 48 8d b8 80 a1 02 00 e8 07 d5 77 00 48 8b 53 08 48
+ RSP: 0018:ffffafd7c672fde8 EFLAGS: 00010202
+ RAX: 0000000000000005 RBX: ffffe36341fff700 RCX: 000000000000000f
+ RDX: 0000000000000284 RSI: 0000000000000275 RDI: 0000000001fff700
+ RBP: ffffafd7c672fe00 R08: ffffa0bc34056410 R09: 0000000000000276
+ R10: ffffa0bc754e9b40 R11: ffffa0bc330f6400 R12: 0000000000002080
+ R13: ffffe36341fff700 R14: 0000000000080000 R15: ffffa0bc330f6400
+ FS: 00007f0ec1ea5740(0000) GS:ffffa0bc7db00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00000000000020d8 CR3: 0000000077d68000 CR4: 00000000000006e0
+ Call Trace:
+ page_idle_bitmap_write+0x8c/0x140
+ sysfs_kf_bin_write+0x5c/0x70
+ kernfs_fop_write+0x12e/0x1b0
+ __vfs_write+0x1b/0x40
+ vfs_write+0xab/0x1b0
+ ksys_write+0x55/0xc0
+ __x64_sys_write+0x1a/0x20
+ do_syscall_64+0x5a/0x110
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Link: http://lkml.kernel.org/r/20190618124352.28307-1-colin.king@canonical.com
+Fixes: 33c3fc71c8cf ("mm: introduce idle page tracking")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Vladimir Davydov <vdavydov.dev@gmail.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Cc: Stephen Rothwell <sfr@canb.auug.org.au>
+Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/page_idle.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/mm/page_idle.c
++++ b/mm/page_idle.c
+@@ -130,7 +130,7 @@ static ssize_t page_idle_bitmap_read(str
+
+ end_pfn = pfn + count * BITS_PER_BYTE;
+ if (end_pfn > max_pfn)
+- end_pfn = ALIGN(max_pfn, BITMAP_CHUNK_BITS);
++ end_pfn = max_pfn;
+
+ for (; pfn < end_pfn; pfn++) {
+ bit = pfn % BITMAP_CHUNK_BITS;
+@@ -175,7 +175,7 @@ static ssize_t page_idle_bitmap_write(st
+
+ end_pfn = pfn + count * BITS_PER_BYTE;
+ if (end_pfn > max_pfn)
+- end_pfn = ALIGN(max_pfn, BITMAP_CHUNK_BITS);
++ end_pfn = max_pfn;
+
+ for (; pfn < end_pfn; pfn++) {
+ bit = pfn % BITMAP_CHUNK_BITS;
--- /dev/null
+From c0ca3d70e8d3cf81e2255a217f7ca402f5ed0862 Mon Sep 17 00:00:00 2001
+From: Vivek Goyal <vgoyal@redhat.com>
+Date: Fri, 1 Jul 2016 16:34:27 -0400
+Subject: ovl: modify ovl_permission() to do checks on two inodes
+
+From: Vivek Goyal <vgoyal@redhat.com>
+
+commit c0ca3d70e8d3cf81e2255a217f7ca402f5ed0862 upstream.
+
+Right now ovl_permission() calls __inode_permission(realinode), to do
+permission checks on real inode and no checks are done on overlay inode.
+
+Modify it to do checks both on overlay inode as well as underlying inode.
+Checks on overlay inode will be done with the creds of calling task while
+checks on underlying inode will be done with the creds of mounter.
+
+Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+[ Srivatsa: 4.4.y backport:
+ - Skipped the hunk modifying non-existent function ovl_get_acl()
+ - Adjusted the error path
+ - Included linux/cred.h to get prototype for revert_creds() ]
+Signed-off-by: Srivatsa S. Bhat (VMware) <srivatsa@csail.mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/overlayfs/inode.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -9,6 +9,7 @@
+
+ #include <linux/fs.h>
+ #include <linux/slab.h>
++#include <linux/cred.h>
+ #include <linux/xattr.h>
+ #include "overlayfs.h"
+
+@@ -91,6 +92,7 @@ int ovl_permission(struct inode *inode,
+ struct ovl_entry *oe;
+ struct dentry *alias = NULL;
+ struct inode *realinode;
++ const struct cred *old_cred;
+ struct dentry *realdentry;
+ bool is_upper;
+ int err;
+@@ -143,7 +145,18 @@ int ovl_permission(struct inode *inode,
+ goto out_dput;
+ }
+
++ /*
++ * Check overlay inode with the creds of task and underlying inode
++ * with creds of mounter
++ */
++ err = generic_permission(inode, mask);
++ if (err)
++ goto out_dput;
++
++ old_cred = ovl_override_creds(inode->i_sb);
+ err = __inode_permission(realinode, mask);
++ revert_creds(old_cred);
++
+ out_dput:
+ dput(alias);
+ return err;
--- /dev/null
+From 240b4cc8fd5db138b675297d4226ec46594d9b3b Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 19 Jun 2019 09:05:41 +0200
+Subject: scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck()
+
+From: Jan Kara <jack@suse.cz>
+
+commit 240b4cc8fd5db138b675297d4226ec46594d9b3b upstream.
+
+Once we unlock adapter->hw_lock in pvscsi_queue_lck() nothing prevents just
+queued scsi_cmnd from completing and freeing the request. Thus cmd->cmnd[0]
+dereference can dereference already freed request leading to kernel crashes
+or other issues (which one of our customers observed). Store cmd->cmnd[0]
+in a local variable before unlocking adapter->hw_lock to fix the issue.
+
+CC: <stable@vger.kernel.org>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/vmw_pvscsi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/vmw_pvscsi.c
++++ b/drivers/scsi/vmw_pvscsi.c
+@@ -733,6 +733,7 @@ static int pvscsi_queue_lck(struct scsi_
+ struct pvscsi_adapter *adapter = shost_priv(host);
+ struct pvscsi_ctx *ctx;
+ unsigned long flags;
++ unsigned char op;
+
+ spin_lock_irqsave(&adapter->hw_lock, flags);
+
+@@ -745,13 +746,14 @@ static int pvscsi_queue_lck(struct scsi_
+ }
+
+ cmd->scsi_done = done;
++ op = cmd->cmnd[0];
+
+ dev_dbg(&cmd->device->sdev_gendev,
+- "queued cmd %p, ctx %p, op=%x\n", cmd, ctx, cmd->cmnd[0]);
++ "queued cmd %p, ctx %p, op=%x\n", cmd, ctx, op);
+
+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
+
+- pvscsi_kick_io(adapter, cmd->cmnd[0]);
++ pvscsi_kick_io(adapter, op);
+
+ return 0;
+ }
fs-binfmt_flat.c-make-load_flat_shared_library-work.patch
+mm-page_idle.c-fix-oops-because-end_pfn-is-larger-than-max_pfn.patch
+scsi-vmw_pscsi-fix-use-after-free-in-pvscsi_queue_lck.patch
tracing-silence-gcc-9-array-bounds-warning.patch
gcc-9-silence-address-of-packed-member-warning.patch
usb-chipidea-udc-workaround-for-endpoint-conflict-issue.patch
9p-rdma-remove-useless-check-in-cm_event_handler.patch
9p-p9dirent_read-check-network-provided-name-length.patch
net-9p-include-trans_common.h-to-fix-missing-prototy.patch
+kvm-x86-fix-scan-ioapic-use-before-initialization.patch
+ovl-modify-ovl_permission-to-do-checks-on-two-inodes.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
