From: Greg Kroah-Hartman Date: Sun, 12 Jan 2025 12:38:12 +0000 (+0100) Subject: 6.6-stable patches X-Git-Tag: v6.1.125~42 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=159ff013763ae5e1e077d836247c6f59b0673f5c;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: dm-verity-fec-fix-rs-fec-repair-for-roots-unaligned-to-block-size-take-2.patch f2fs-fix-null-ptr-deref-in-f2fs_submit_page_bio.patch --- diff --git a/queue-6.6/dm-verity-fec-fix-rs-fec-repair-for-roots-unaligned-to-block-size-take-2.patch b/queue-6.6/dm-verity-fec-fix-rs-fec-repair-for-roots-unaligned-to-block-size-take-2.patch new file mode 100644 index 00000000000..bdac21b7319 --- /dev/null +++ b/queue-6.6/dm-verity-fec-fix-rs-fec-repair-for-roots-unaligned-to-block-size-take-2.patch @@ -0,0 +1,159 @@ +From 6df90c02bae468a3a6110bafbc659884d0c4966c Mon Sep 17 00:00:00 2001 +From: Milan Broz +Date: Wed, 18 Dec 2024 13:56:58 +0100 +Subject: dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2) + +From: Milan Broz + +commit 6df90c02bae468a3a6110bafbc659884d0c4966c upstream. + +This patch fixes an issue that was fixed in the commit + df7b59ba9245 ("dm verity: fix FEC for RS roots unaligned to block size") +but later broken again in the commit + 8ca7cab82bda ("dm verity fec: fix misaligned RS roots IO") + +If the Reed-Solomon roots setting spans multiple blocks, the code does not +use proper parity bytes and randomly fails to repair even trivial errors. + +This bug cannot happen if the sector size is multiple of RS roots +setting (Android case with roots 2). + +The previous solution was to find a dm-bufio block size that is multiple +of the device sector size and roots size. Unfortunately, the optimization +in commit 8ca7cab82bda ("dm verity fec: fix misaligned RS roots IO") +is incorrect and uses data block size for some roots (for example, it uses +4096 block size for roots = 20). + +This patch uses a different approach: + + - It always uses a configured data block size for dm-bufio to avoid + possible misaligned IOs. + + - and it caches the processed parity bytes, so it can join it + if it spans two blocks. + +As the RS calculation is called only if an error is detected and +the process is computationally intensive, copying a few more bytes +should not introduce performance issues. + +The issue was reported to cryptsetup with trivial reproducer + https://gitlab.com/cryptsetup/cryptsetup/-/issues/923 + +Reproducer (with roots=20): + + # create verity device with RS FEC + dd if=/dev/urandom of=data.img bs=4096 count=8 status=none + veritysetup format data.img hash.img --fec-device=fec.img --fec-roots=20 | \ + awk '/^Root hash/{ print $3 }' >roothash + + # create an erasure that should always be repairable with this roots setting + dd if=/dev/zero of=data.img conv=notrunc bs=1 count=4 seek=4 status=none + + # try to read it through dm-verity + veritysetup open data.img test hash.img --fec-device=fec.img --fec-roots=20 $(cat roothash) + dd if=/dev/mapper/test of=/dev/null bs=4096 status=noxfer + + Even now the log says it cannot repair it: + : verity-fec: 7:1: FEC 0: failed to correct: -74 + : device-mapper: verity: 7:1: data block 0 is corrupted + ... + +With this fix, errors are properly repaired. + : verity-fec: 7:1: FEC 0: corrected 4 errors + +Signed-off-by: Milan Broz +Fixes: 8ca7cab82bda ("dm verity fec: fix misaligned RS roots IO") +Cc: stable@vger.kernel.org +Signed-off-by: Mikulas Patocka +Signed-off-by: Milan Broz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/dm-verity-fec.c | 39 ++++++++++++++++++++++++++------------- + 1 file changed, 26 insertions(+), 13 deletions(-) + +--- a/drivers/md/dm-verity-fec.c ++++ b/drivers/md/dm-verity-fec.c +@@ -60,14 +60,19 @@ static int fec_decode_rs8(struct dm_veri + * to the data block. Caller is responsible for releasing buf. + */ + static u8 *fec_read_parity(struct dm_verity *v, u64 rsb, int index, +- unsigned int *offset, struct dm_buffer **buf) ++ unsigned int *offset, unsigned int par_buf_offset, ++ struct dm_buffer **buf) + { + u64 position, block, rem; + u8 *res; + ++ /* We have already part of parity bytes read, skip to the next block */ ++ if (par_buf_offset) ++ index++; ++ + position = (index + rsb) * v->fec->roots; + block = div64_u64_rem(position, v->fec->io_size, &rem); +- *offset = (unsigned int)rem; ++ *offset = par_buf_offset ? 0 : (unsigned int)rem; + + res = dm_bufio_read(v->fec->bufio, block, buf); + if (IS_ERR(res)) { +@@ -127,10 +132,11 @@ static int fec_decode_bufs(struct dm_ver + { + int r, corrected = 0, res; + struct dm_buffer *buf; +- unsigned int n, i, offset; +- u8 *par, *block; ++ unsigned int n, i, offset, par_buf_offset = 0; ++ u8 *par, *block, par_buf[DM_VERITY_FEC_RSM - DM_VERITY_FEC_MIN_RSN]; + +- par = fec_read_parity(v, rsb, block_offset, &offset, &buf); ++ par = fec_read_parity(v, rsb, block_offset, &offset, ++ par_buf_offset, &buf); + if (IS_ERR(par)) + return PTR_ERR(par); + +@@ -140,7 +146,8 @@ static int fec_decode_bufs(struct dm_ver + */ + fec_for_each_buffer_rs_block(fio, n, i) { + block = fec_buffer_rs_block(v, fio, n, i); +- res = fec_decode_rs8(v, fio, block, &par[offset], neras); ++ memcpy(&par_buf[par_buf_offset], &par[offset], v->fec->roots - par_buf_offset); ++ res = fec_decode_rs8(v, fio, block, par_buf, neras); + if (res < 0) { + r = res; + goto error; +@@ -153,12 +160,21 @@ static int fec_decode_bufs(struct dm_ver + if (block_offset >= 1 << v->data_dev_block_bits) + goto done; + +- /* read the next block when we run out of parity bytes */ +- offset += v->fec->roots; ++ /* Read the next block when we run out of parity bytes */ ++ offset += (v->fec->roots - par_buf_offset); ++ /* Check if parity bytes are split between blocks */ ++ if (offset < v->fec->io_size && (offset + v->fec->roots) > v->fec->io_size) { ++ par_buf_offset = v->fec->io_size - offset; ++ memcpy(par_buf, &par[offset], par_buf_offset); ++ offset += par_buf_offset; ++ } else ++ par_buf_offset = 0; ++ + if (offset >= v->fec->io_size) { + dm_bufio_release(buf); + +- par = fec_read_parity(v, rsb, block_offset, &offset, &buf); ++ par = fec_read_parity(v, rsb, block_offset, &offset, ++ par_buf_offset, &buf); + if (IS_ERR(par)) + return PTR_ERR(par); + } +@@ -743,10 +759,7 @@ int verity_fec_ctr(struct dm_verity *v) + return -E2BIG; + } + +- if ((f->roots << SECTOR_SHIFT) & ((1 << v->data_dev_block_bits) - 1)) +- f->io_size = 1 << v->data_dev_block_bits; +- else +- f->io_size = v->fec->roots << SECTOR_SHIFT; ++ f->io_size = 1 << v->data_dev_block_bits; + + f->bufio = dm_bufio_client_create(f->dev->bdev, + f->io_size, diff --git a/queue-6.6/f2fs-fix-null-ptr-deref-in-f2fs_submit_page_bio.patch b/queue-6.6/f2fs-fix-null-ptr-deref-in-f2fs_submit_page_bio.patch new file mode 100644 index 00000000000..4615e1933b4 --- /dev/null +++ b/queue-6.6/f2fs-fix-null-ptr-deref-in-f2fs_submit_page_bio.patch @@ -0,0 +1,96 @@ +From b7d0a97b28083084ebdd8e5c6bccd12e6ec18faa Mon Sep 17 00:00:00 2001 +From: Ye Bin +Date: Sat, 12 Oct 2024 00:44:50 +0800 +Subject: f2fs: fix null-ptr-deref in f2fs_submit_page_bio() + +From: Ye Bin + +commit b7d0a97b28083084ebdd8e5c6bccd12e6ec18faa upstream. + +There's issue as follows when concurrently installing the f2fs.ko +module and mounting the f2fs file system: +KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] +RIP: 0010:__bio_alloc+0x2fb/0x6c0 [f2fs] +Call Trace: + + f2fs_submit_page_bio+0x126/0x8b0 [f2fs] + __get_meta_page+0x1d4/0x920 [f2fs] + get_checkpoint_version.constprop.0+0x2b/0x3c0 [f2fs] + validate_checkpoint+0xac/0x290 [f2fs] + f2fs_get_valid_checkpoint+0x207/0x950 [f2fs] + f2fs_fill_super+0x1007/0x39b0 [f2fs] + mount_bdev+0x183/0x250 + legacy_get_tree+0xf4/0x1e0 + vfs_get_tree+0x88/0x340 + do_new_mount+0x283/0x5e0 + path_mount+0x2b2/0x15b0 + __x64_sys_mount+0x1fe/0x270 + do_syscall_64+0x5f/0x170 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Above issue happens as the biset of the f2fs file system is not +initialized before register "f2fs_fs_type". +To address above issue just register "f2fs_fs_type" at the last in +init_f2fs_fs(). Ensure that all f2fs file system resources are +initialized. + +Fixes: f543805fcd60 ("f2fs: introduce private bioset") +Signed-off-by: Ye Bin +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Bin Lan +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/super.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -4931,9 +4931,6 @@ static int __init init_f2fs_fs(void) + err = register_shrinker(&f2fs_shrinker_info, "f2fs-shrinker"); + if (err) + goto free_sysfs; +- err = register_filesystem(&f2fs_fs_type); +- if (err) +- goto free_shrinker; + f2fs_create_root_stats(); + err = f2fs_init_post_read_processing(); + if (err) +@@ -4956,7 +4953,12 @@ static int __init init_f2fs_fs(void) + err = f2fs_create_casefold_cache(); + if (err) + goto free_compress_cache; ++ err = register_filesystem(&f2fs_fs_type); ++ if (err) ++ goto free_casefold_cache; + return 0; ++free_casefold_cache: ++ f2fs_destroy_casefold_cache(); + free_compress_cache: + f2fs_destroy_compress_cache(); + free_compress_mempool: +@@ -4971,8 +4973,6 @@ free_post_read: + f2fs_destroy_post_read_processing(); + free_root_stats: + f2fs_destroy_root_stats(); +- unregister_filesystem(&f2fs_fs_type); +-free_shrinker: + unregister_shrinker(&f2fs_shrinker_info); + free_sysfs: + f2fs_exit_sysfs(); +@@ -4996,6 +4996,7 @@ fail: + + static void __exit exit_f2fs_fs(void) + { ++ unregister_filesystem(&f2fs_fs_type); + f2fs_destroy_casefold_cache(); + f2fs_destroy_compress_cache(); + f2fs_destroy_compress_mempool(); +@@ -5004,7 +5005,6 @@ static void __exit exit_f2fs_fs(void) + f2fs_destroy_iostat_processing(); + f2fs_destroy_post_read_processing(); + f2fs_destroy_root_stats(); +- unregister_filesystem(&f2fs_fs_type); + unregister_shrinker(&f2fs_shrinker_info); + f2fs_exit_sysfs(); + f2fs_destroy_garbage_collection_cache(); diff --git a/queue-6.6/series b/queue-6.6/series index 883c8ba56a4..bad1c950667 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -76,3 +76,5 @@ acpi-resource-add-asus-vivobook-x1504vap-to-irq1_level_low_skip_override.patch drm-amdkfd-fixed-page-fault-when-enable-mes-shader-debugger.patch drm-amd-display-increase-max_surfaces-to-the-value-supported-by-hw.patch io_uring-timeout-fix-multishot-updates.patch +f2fs-fix-null-ptr-deref-in-f2fs_submit_page_bio.patch +dm-verity-fec-fix-rs-fec-repair-for-roots-unaligned-to-block-size-take-2.patch