From 28af709d8b85294515e0045c29061a0e0314ae85 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 28 Dec 2022 10:49:16 +0100 Subject: [PATCH] drop 9p patch from 5.10 --- ...to-zero-to-avoid-uninitialized-usage.patch | 96 ------------------- queue-5.10/series | 1 - 2 files changed, 97 deletions(-) delete mode 100644 queue-5.10/9p-set-req-refcount-to-zero-to-avoid-uninitialized-usage.patch diff --git a/queue-5.10/9p-set-req-refcount-to-zero-to-avoid-uninitialized-usage.patch b/queue-5.10/9p-set-req-refcount-to-zero-to-avoid-uninitialized-usage.patch deleted file mode 100644 index 44e40f53508..00000000000 --- a/queue-5.10/9p-set-req-refcount-to-zero-to-avoid-uninitialized-usage.patch +++ /dev/null @@ -1,96 +0,0 @@ -From 26273ade77f54716e30dfd40ac6e85ceb54ac0f9 Mon Sep 17 00:00:00 2001 -From: Schspa Shi -Date: Thu, 1 Dec 2022 11:33:10 +0800 -Subject: 9p: set req refcount to zero to avoid uninitialized usage - -From: Schspa Shi - -commit 26273ade77f54716e30dfd40ac6e85ceb54ac0f9 upstream. - -When a new request is allocated, the refcount will be zero if it is -reused, but if the request is newly allocated from slab, it is not fully -initialized before being added to idr. - -If the p9_read_work got a response before the refcount initiated. It will -use a uninitialized req, which will result in a bad request data struct. - -Here is the logs from syzbot. - -Corrupted memory at 0xffff88807eade00b [ 0xff 0x07 0x00 0x00 0x00 0x00 -0x00 0x00 . . . . . . . . ] (in kfence-#110): - p9_fcall_fini net/9p/client.c:248 [inline] - p9_req_put net/9p/client.c:396 [inline] - p9_req_put+0x208/0x250 net/9p/client.c:390 - p9_client_walk+0x247/0x540 net/9p/client.c:1165 - clone_fid fs/9p/fid.h:21 [inline] - v9fs_fid_xattr_set+0xe4/0x2b0 fs/9p/xattr.c:118 - v9fs_xattr_set fs/9p/xattr.c:100 [inline] - v9fs_xattr_handler_set+0x6f/0x120 fs/9p/xattr.c:159 - __vfs_setxattr+0x119/0x180 fs/xattr.c:182 - __vfs_setxattr_noperm+0x129/0x5f0 fs/xattr.c:216 - __vfs_setxattr_locked+0x1d3/0x260 fs/xattr.c:277 - vfs_setxattr+0x143/0x340 fs/xattr.c:309 - setxattr+0x146/0x160 fs/xattr.c:617 - path_setxattr+0x197/0x1c0 fs/xattr.c:636 - __do_sys_setxattr fs/xattr.c:652 [inline] - __se_sys_setxattr fs/xattr.c:648 [inline] - __ia32_sys_setxattr+0xc0/0x160 fs/xattr.c:648 - do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] - __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 - do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203 - entry_SYSENTER_compat_after_hwframe+0x70/0x82 - -Below is a similar scenario, the scenario in the syzbot log looks more -complicated than this one, but this patch can fix it. - - T21124 p9_read_work -======================== second trans ================================= -p9_client_walk - p9_client_rpc - p9_client_prepare_req - p9_tag_alloc - req = kmem_cache_alloc(p9_req_cache, GFP_NOFS); - tag = idr_alloc - << preempted >> - req->tc.tag = tag; - /* req->[refcount/tag] == uninitialized */ - m->rreq = p9_tag_lookup(m->client, m->rc.tag); - /* increments uninitalized refcount */ - - refcount_set(&req->refcount, 2); - /* cb drops one ref */ - p9_client_cb(req) - /* reader thread drops its ref: - request is incorrectly freed */ - p9_req_put(req) - /* use after free and ref underflow */ - p9_req_put(req) - -To fix it, we can initialize the refcount to zero before add to idr. - -Link: https://lkml.kernel.org/r/20221201033310.18589-1-schspa@gmail.com -Cc: stable@vger.kernel.org # 6.0+ due to 6cda12864cb0 ("9p: Drop kref usage") -Fixes: 728356dedeff ("9p: Add refcount to p9_req_t") -Reported-by: syzbot+8f1060e2aaf8ca55220b@syzkaller.appspotmail.com -Signed-off-by: Schspa Shi -Reviewed-by: Christian Schoenebeck -Signed-off-by: Dominique Martinet -Signed-off-by: Greg Kroah-Hartman ---- - net/9p/client.c | 5 +++++ - 1 file changed, 5 insertions(+) - ---- a/net/9p/client.c -+++ b/net/9p/client.c -@@ -283,6 +283,11 @@ p9_tag_alloc(struct p9_client *c, int8_t - p9pdu_reset(&req->rc); - req->t_err = 0; - req->status = REQ_STATUS_ALLOC; -+ /* refcount needs to be set to 0 before inserting into the idr -+ * so p9_tag_lookup does not accept a request that is not fully -+ * initialized. refcount_set to 2 below will mark request ready. -+ */ -+ refcount_set(&req->refcount, 0); - init_waitqueue_head(&req->wq); - INIT_LIST_HEAD(&req->req_list); - diff --git a/queue-5.10/series b/queue-5.10/series index f76efc69ce6..deb752ac795 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -564,7 +564,6 @@ usb-dwc3-fix-race-between-dwc3_set_mode-and-__dwc3_set_mode.patch usb-dwc3-core-defer-probe-on-ulpi_read_id-timeout.patch hid-wacom-ensure-bootloader-pid-is-usable-in-hidraw-mode.patch hid-mcp2221-don-t-connect-hidraw.patch -9p-set-req-refcount-to-zero-to-avoid-uninitialized-usage.patch reiserfs-add-missing-calls-to-reiserfs_security_free.patch iio-adc-ad_sigma_delta-do-not-use-internal-iio_dev-lock.patch iio-adc128s052-add-proper-.data-members-in-adc128_of_match-table.patch -- 2.47.3