From: Greg Kroah-Hartman Date: Mon, 4 Mar 2024 10:41:55 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v4.19.309~51 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bf5fa441c896621a784d49d0ccc773c61cc3f8f8;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: cachefiles-fix-memory-leak-in-cachefiles_add_cache.patch ext4-avoid-bb_free-and-bb_fragments-inconsistency-in-mb_free_blocks.patch --- diff --git a/queue-5.10/cachefiles-fix-memory-leak-in-cachefiles_add_cache.patch b/queue-5.10/cachefiles-fix-memory-leak-in-cachefiles_add_cache.patch new file mode 100644 index 00000000000..be8839af3bf --- /dev/null +++ b/queue-5.10/cachefiles-fix-memory-leak-in-cachefiles_add_cache.patch @@ -0,0 +1,66 @@ +From e21a2f17566cbd64926fb8f16323972f7a064444 Mon Sep 17 00:00:00 2001 +From: Baokun Li +Date: Sat, 17 Feb 2024 16:14:31 +0800 +Subject: cachefiles: fix memory leak in cachefiles_add_cache() + +From: Baokun Li + +commit e21a2f17566cbd64926fb8f16323972f7a064444 upstream. + +The following memory leak was reported after unbinding /dev/cachefiles: + +================================================================== +unreferenced object 0xffff9b674176e3c0 (size 192): + comm "cachefilesd2", pid 680, jiffies 4294881224 + hex dump (first 32 bytes): + 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace (crc ea38a44b): + [] kmem_cache_alloc+0x2d5/0x370 + [] prepare_creds+0x26/0x2e0 + [] cachefiles_determine_cache_security+0x1f/0x120 + [] cachefiles_add_cache+0x13c/0x3a0 + [] cachefiles_daemon_write+0x146/0x1c0 + [] vfs_write+0xcb/0x520 + [] ksys_write+0x69/0xf0 + [] do_syscall_64+0x72/0x140 + [] entry_SYSCALL_64_after_hwframe+0x6e/0x76 +================================================================== + +Put the reference count of cache_cred in cachefiles_daemon_unbind() to +fix the problem. And also put cache_cred in cachefiles_add_cache() error +branch to avoid memory leaks. + +Fixes: 9ae326a69004 ("CacheFiles: A cache that backs onto a mounted filesystem") +CC: stable@vger.kernel.org +Signed-off-by: Baokun Li +Link: https://lore.kernel.org/r/20240217081431.796809-1-libaokun1@huawei.com +Acked-by: David Howells +Reviewed-by: Jingbo Xu +Reviewed-by: Jeff Layton +Signed-off-by: Christian Brauner +Signed-off-by: Baokun Li +Signed-off-by: Greg Kroah-Hartman +--- + fs/cachefiles/bind.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/cachefiles/bind.c ++++ b/fs/cachefiles/bind.c +@@ -245,6 +245,8 @@ error_open_root: + kmem_cache_free(cachefiles_object_jar, fsdef); + error_root_object: + cachefiles_end_secure(cache, saved_cred); ++ put_cred(cache->cache_cred); ++ cache->cache_cred = NULL; + pr_err("Failed to register: %d\n", ret); + return ret; + } +@@ -265,6 +267,7 @@ void cachefiles_daemon_unbind(struct cac + + dput(cache->graveyard); + mntput(cache->mnt); ++ put_cred(cache->cache_cred); + + kfree(cache->rootdirname); + kfree(cache->secctx); diff --git a/queue-5.10/ext4-avoid-bb_free-and-bb_fragments-inconsistency-in-mb_free_blocks.patch b/queue-5.10/ext4-avoid-bb_free-and-bb_fragments-inconsistency-in-mb_free_blocks.patch new file mode 100644 index 00000000000..eeda760e490 --- /dev/null +++ b/queue-5.10/ext4-avoid-bb_free-and-bb_fragments-inconsistency-in-mb_free_blocks.patch @@ -0,0 +1,101 @@ +From 2331fd4a49864e1571b4f50aa3aa1536ed6220d0 Mon Sep 17 00:00:00 2001 +From: Baokun Li +Date: Thu, 4 Jan 2024 22:20:36 +0800 +Subject: ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks() + +From: Baokun Li + +commit 2331fd4a49864e1571b4f50aa3aa1536ed6220d0 upstream. + +After updating bb_free in mb_free_blocks, it is possible to return without +updating bb_fragments because the block being freed is found to have +already been freed, which leads to inconsistency between bb_free and +bb_fragments. + +Since the group may be unlocked in ext4_grp_locked_error(), this can lead +to problems such as dividing by zero when calculating the average fragment +length. Hence move the update of bb_free to after the block double-free +check guarantees that the corresponding statistics are updated only after +the core block bitmap is modified. + +Fixes: eabe0444df90 ("ext4: speed-up releasing blocks on commit") +CC: # 3.10 +Suggested-by: Jan Kara +Signed-off-by: Baokun Li +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20240104142040.2835097-5-libaokun1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Baokun Li +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/mballoc.c | 39 +++++++++++++++++++++------------------ + 1 file changed, 21 insertions(+), 18 deletions(-) + +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -1494,11 +1494,6 @@ static void mb_free_blocks(struct inode + mb_check_buddy(e4b); + mb_free_blocks_double(inode, e4b, first, count); + +- this_cpu_inc(discard_pa_seq); +- e4b->bd_info->bb_free += count; +- if (first < e4b->bd_info->bb_first_free) +- e4b->bd_info->bb_first_free = first; +- + /* access memory sequentially: check left neighbour, + * clear range and then check right neighbour + */ +@@ -1512,23 +1507,31 @@ static void mb_free_blocks(struct inode + struct ext4_sb_info *sbi = EXT4_SB(sb); + ext4_fsblk_t blocknr; + ++ /* ++ * Fastcommit replay can free already freed blocks which ++ * corrupts allocation info. Regenerate it. ++ */ ++ if (sbi->s_mount_state & EXT4_FC_REPLAY) { ++ mb_regenerate_buddy(e4b); ++ goto check; ++ } ++ + blocknr = ext4_group_first_block_no(sb, e4b->bd_group); + blocknr += EXT4_C2B(sbi, block); +- if (!(sbi->s_mount_state & EXT4_FC_REPLAY)) { +- ext4_grp_locked_error(sb, e4b->bd_group, +- inode ? inode->i_ino : 0, +- blocknr, +- "freeing already freed block (bit %u); block bitmap corrupt.", +- block); +- ext4_mark_group_bitmap_corrupted( +- sb, e4b->bd_group, ++ ext4_grp_locked_error(sb, e4b->bd_group, ++ inode ? inode->i_ino : 0, blocknr, ++ "freeing already freed block (bit %u); block bitmap corrupt.", ++ block); ++ ext4_mark_group_bitmap_corrupted(sb, e4b->bd_group, + EXT4_GROUP_INFO_BBITMAP_CORRUPT); +- } else { +- mb_regenerate_buddy(e4b); +- } +- goto done; ++ return; + } + ++ this_cpu_inc(discard_pa_seq); ++ e4b->bd_info->bb_free += count; ++ if (first < e4b->bd_info->bb_first_free) ++ e4b->bd_info->bb_first_free = first; ++ + /* let's maintain fragments counter */ + if (left_is_free && right_is_free) + e4b->bd_info->bb_fragments--; +@@ -1553,8 +1556,8 @@ static void mb_free_blocks(struct inode + if (first <= last) + mb_buddy_mark_free(e4b, first >> 1, last >> 1); + +-done: + mb_set_largest_free_order(sb, e4b->bd_info); ++check: + mb_check_buddy(e4b); + } + diff --git a/queue-5.10/series b/queue-5.10/series index 654dc5c58ee..8cd27526620 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -36,3 +36,5 @@ pmdomain-qcom-rpmhpd-fix-enabled_corner-aggregation.patch fs-aio-make-io_cancel-generate-completions-again.patch x86-cpu-intel-detect-tme-keyid-bits-before-setting-mtrr-mask-registers.patch mptcp-fix-possible-deadlock-in-subflow-diag.patch +ext4-avoid-bb_free-and-bb_fragments-inconsistency-in-mb_free_blocks.patch +cachefiles-fix-memory-leak-in-cachefiles_add_cache.patch