From: Greg Kroah-Hartman Date: Wed, 10 Nov 2021 13:45:38 +0000 (+0100) Subject: 5.15-stable patches X-Git-Tag: v4.4.292~9 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2d0fc8789c8fbaf1056c9b401a9bed7dfb2b9d58;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: btrfs-fix-lzo_decompress_bio-kmap-leakage.patch --- diff --git a/queue-5.15/btrfs-fix-lzo_decompress_bio-kmap-leakage.patch b/queue-5.15/btrfs-fix-lzo_decompress_bio-kmap-leakage.patch new file mode 100644 index 00000000000..4b022a59db1 --- /dev/null +++ b/queue-5.15/btrfs-fix-lzo_decompress_bio-kmap-leakage.patch @@ -0,0 +1,48 @@ +From 2cf3f8133bda2a0945cc4c70e681ecb25b52b913 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Mon, 1 Nov 2021 12:46:47 -0700 +Subject: btrfs: fix lzo_decompress_bio() kmap leakage + +From: Linus Torvalds + +commit 2cf3f8133bda2a0945cc4c70e681ecb25b52b913 upstream. + +Commit ccaa66c8dd27 reinstated the kmap/kunmap that had been dropped in +commit 8c945d32e604 ("btrfs: compression: drop kmap/kunmap from lzo"). + +However, it seems to have done so incorrectly due to the change not +reverting cleanly, and lzo_decompress_bio() ended up not having a +matching "kunmap()" to the "kmap()" that was put back. + +Also, any assert that the page pointer is not NULL should be before the +kmap() of said pointer, since otherwise you'd just oops in the kmap() +before the assert would even trigger. + +I noticed this when trying to verify my btrfs merge, and things not +adding up. I'm doing this fixup before re-doing my merge, because this +commit needs to also be backported to 5.15 (after verification from the +btrfs people). + +Fixes: ccaa66c8dd27 ("Revert 'btrfs: compression: drop kmap/kunmap from lzo'") +Cc: David Sterba +Cc: stable@kernel.org +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/lzo.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/lzo.c ++++ b/fs/btrfs/lzo.c +@@ -357,9 +357,10 @@ int lzo_decompress_bio(struct list_head + ASSERT(cur_in / sectorsize == + (cur_in + LZO_LEN - 1) / sectorsize); + cur_page = cb->compressed_pages[cur_in / PAGE_SIZE]; +- kaddr = kmap(cur_page); + ASSERT(cur_page); ++ kaddr = kmap(cur_page); + seg_len = read_compress_length(kaddr + offset_in_page(cur_in)); ++ kunmap(cur_page); + cur_in += LZO_LEN; + + /* Copy the compressed segment payload into workspace */ diff --git a/queue-5.15/series b/queue-5.15/series index ef8be4928ec..33c43d3a48b 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -11,3 +11,4 @@ binder-use-cred-instead-of-task-for-getsecid.patch binder-don-t-detect-sender-target-during-buffer-cleanup.patch kfence-always-use-static-branches-to-guard-kfence_alloc.patch kfence-default-to-dynamic-branch-instead-of-static-keys-mode.patch +btrfs-fix-lzo_decompress_bio-kmap-leakage.patch