From 6147390fa92eb62334fae03d2f26ede7bdadd689 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 1 Jul 2019 17:24:04 +0200 Subject: [PATCH] 4.4-stable patches added patches: kvm-x86-fix-scan-ioapic-use-before-initialization.patch mm-page_idle.c-fix-oops-because-end_pfn-is-larger-than-max_pfn.patch ovl-modify-ovl_permission-to-do-checks-on-two-inodes.patch scsi-vmw_pscsi-fix-use-after-free-in-pvscsi_queue_lck.patch --- ...can-ioapic-use-before-initialization.patch | 109 ++++++++++++++++++ ...cause-end_pfn-is-larger-than-max_pfn.patch | 85 ++++++++++++++ ...ermission-to-do-checks-on-two-inodes.patch | 66 +++++++++++ ...x-use-after-free-in-pvscsi_queue_lck.patch | 52 +++++++++ queue-4.4/series | 4 + 5 files changed, 316 insertions(+) create mode 100644 queue-4.4/kvm-x86-fix-scan-ioapic-use-before-initialization.patch create mode 100644 queue-4.4/mm-page_idle.c-fix-oops-because-end_pfn-is-larger-than-max_pfn.patch create mode 100644 queue-4.4/ovl-modify-ovl_permission-to-do-checks-on-two-inodes.patch create mode 100644 queue-4.4/scsi-vmw_pscsi-fix-use-after-free-in-pvscsi_queue_lck.patch diff --git a/queue-4.4/kvm-x86-fix-scan-ioapic-use-before-initialization.patch b/queue-4.4/kvm-x86-fix-scan-ioapic-use-before-initialization.patch new file mode 100644 index 00000000000..6b01a64f0d5 --- /dev/null +++ b/queue-4.4/kvm-x86-fix-scan-ioapic-use-before-initialization.patch @@ -0,0 +1,109 @@ +From e97f852fd4561e77721bb9a4e0ea9d98305b1e93 Mon Sep 17 00:00:00 2001 +From: Wanpeng Li +Date: Tue, 20 Nov 2018 16:34:18 +0800 +Subject: KVM: X86: Fix scan ioapic use-before-initialization +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wanpeng Li + +commit e97f852fd4561e77721bb9a4e0ea9d98305b1e93 upstream. + +Reported by syzkaller: + + BUG: unable to handle kernel NULL pointer dereference at 00000000000001c8 + PGD 80000003ec4da067 P4D 80000003ec4da067 PUD 3f7bfa067 PMD 0 + Oops: 0000 [#1] PREEMPT SMP PTI + CPU: 7 PID: 5059 Comm: debug Tainted: G OE 4.19.0-rc5 #16 + RIP: 0010:__lock_acquire+0x1a6/0x1990 + Call Trace: + lock_acquire+0xdb/0x210 + _raw_spin_lock+0x38/0x70 + kvm_ioapic_scan_entry+0x3e/0x110 [kvm] + vcpu_enter_guest+0x167e/0x1910 [kvm] + kvm_arch_vcpu_ioctl_run+0x35c/0x610 [kvm] + kvm_vcpu_ioctl+0x3e9/0x6d0 [kvm] + do_vfs_ioctl+0xa5/0x690 + ksys_ioctl+0x6d/0x80 + __x64_sys_ioctl+0x1a/0x20 + do_syscall_64+0x83/0x6e0 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +The reason is that the testcase writes hyperv synic HV_X64_MSR_SINT6 msr +and triggers scan ioapic logic to load synic vectors into EOI exit bitmap. +However, irqchip is not initialized by this simple testcase, ioapic/apic +objects should not be accessed. +This can be triggered by the following program: + + #define _GNU_SOURCE + + #include + #include + #include + #include + #include + #include + #include + #include + + uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; + + int main(void) + { + syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); + long res = 0; + memcpy((void*)0x20000040, "/dev/kvm", 9); + res = syscall(__NR_openat, 0xffffffffffffff9c, 0x20000040, 0, 0); + if (res != -1) + r[0] = res; + res = syscall(__NR_ioctl, r[0], 0xae01, 0); + if (res != -1) + r[1] = res; + res = syscall(__NR_ioctl, r[1], 0xae41, 0); + if (res != -1) + r[2] = res; + memcpy( + (void*)0x20000080, + "\x01\x00\x00\x00\x00\x5b\x61\xbb\x96\x00\x00\x40\x00\x00\x00\x00\x01\x00" + "\x08\x00\x00\x00\x00\x00\x0b\x77\xd1\x78\x4d\xd8\x3a\xed\xb1\x5c\x2e\x43" + "\xaa\x43\x39\xd6\xff\xf5\xf0\xa8\x98\xf2\x3e\x37\x29\x89\xde\x88\xc6\x33" + "\xfc\x2a\xdb\xb7\xe1\x4c\xac\x28\x61\x7b\x9c\xa9\xbc\x0d\xa0\x63\xfe\xfe" + "\xe8\x75\xde\xdd\x19\x38\xdc\x34\xf5\xec\x05\xfd\xeb\x5d\xed\x2e\xaf\x22" + "\xfa\xab\xb7\xe4\x42\x67\xd0\xaf\x06\x1c\x6a\x35\x67\x10\x55\xcb", + 106); + syscall(__NR_ioctl, r[2], 0x4008ae89, 0x20000080); + syscall(__NR_ioctl, r[2], 0xae80, 0); + return 0; + } + +This patch fixes it by bailing out scan ioapic if ioapic is not initialized in +kernel. + +Reported-by: Wei Wu +Cc: Paolo Bonzini +Cc: Radim Krčmář +Cc: Wei Wu +Signed-off-by: Wanpeng Li +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Bonzini +[ Srivatsa: Adjusted the context for 4.4.y ] +Signed-off-by: Srivatsa S. Bhat (VMware) +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/x86.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -6409,7 +6409,8 @@ static void vcpu_scan_ioapic(struct kvm_ + kvm_scan_ioapic_routes(vcpu, vcpu->arch.eoi_exit_bitmap); + else { + kvm_x86_ops->sync_pir_to_irr(vcpu); +- kvm_ioapic_scan_entry(vcpu, vcpu->arch.eoi_exit_bitmap); ++ if (ioapic_in_kernel(vcpu->kvm)) ++ kvm_ioapic_scan_entry(vcpu, vcpu->arch.eoi_exit_bitmap); + } + kvm_x86_ops->load_eoi_exitmap(vcpu); + } diff --git a/queue-4.4/mm-page_idle.c-fix-oops-because-end_pfn-is-larger-than-max_pfn.patch b/queue-4.4/mm-page_idle.c-fix-oops-because-end_pfn-is-larger-than-max_pfn.patch new file mode 100644 index 00000000000..a9d2c9d86b9 --- /dev/null +++ b/queue-4.4/mm-page_idle.c-fix-oops-because-end_pfn-is-larger-than-max_pfn.patch @@ -0,0 +1,85 @@ +From 7298e3b0a149c91323b3205d325e942c3b3b9ef6 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Fri, 28 Jun 2019 12:07:05 -0700 +Subject: mm/page_idle.c: fix oops because end_pfn is larger than max_pfn + +From: Colin Ian King + +commit 7298e3b0a149c91323b3205d325e942c3b3b9ef6 upstream. + +Currently the calcuation of end_pfn can round up the pfn number to more +than the actual maximum number of pfns, causing an Oops. Fix this by +ensuring end_pfn is never more than max_pfn. + +This can be easily triggered when on systems where the end_pfn gets +rounded up to more than max_pfn using the idle-page stress-ng stress test: + +sudo stress-ng --idle-page 0 + + BUG: unable to handle kernel paging request at 00000000000020d8 + #PF error: [normal kernel read fault] + PGD 0 P4D 0 + Oops: 0000 [#1] SMP PTI + CPU: 1 PID: 11039 Comm: stress-ng-idle- Not tainted 5.0.0-5-generic #6-Ubuntu + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 + RIP: 0010:page_idle_get_page+0xc8/0x1a0 + Code: 0f b1 0a 75 7d 48 8b 03 48 89 c2 48 c1 e8 33 83 e0 07 48 c1 ea 36 48 8d 0c 40 4c 8d 24 88 49 c1 e4 07 4c 03 24 d5 00 89 c3 be <49> 8b 44 24 58 48 8d b8 80 a1 02 00 e8 07 d5 77 00 48 8b 53 08 48 + RSP: 0018:ffffafd7c672fde8 EFLAGS: 00010202 + RAX: 0000000000000005 RBX: ffffe36341fff700 RCX: 000000000000000f + RDX: 0000000000000284 RSI: 0000000000000275 RDI: 0000000001fff700 + RBP: ffffafd7c672fe00 R08: ffffa0bc34056410 R09: 0000000000000276 + R10: ffffa0bc754e9b40 R11: ffffa0bc330f6400 R12: 0000000000002080 + R13: ffffe36341fff700 R14: 0000000000080000 R15: ffffa0bc330f6400 + FS: 00007f0ec1ea5740(0000) GS:ffffa0bc7db00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00000000000020d8 CR3: 0000000077d68000 CR4: 00000000000006e0 + Call Trace: + page_idle_bitmap_write+0x8c/0x140 + sysfs_kf_bin_write+0x5c/0x70 + kernfs_fop_write+0x12e/0x1b0 + __vfs_write+0x1b/0x40 + vfs_write+0xab/0x1b0 + ksys_write+0x55/0xc0 + __x64_sys_write+0x1a/0x20 + do_syscall_64+0x5a/0x110 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Link: http://lkml.kernel.org/r/20190618124352.28307-1-colin.king@canonical.com +Fixes: 33c3fc71c8cf ("mm: introduce idle page tracking") +Signed-off-by: Colin Ian King +Reviewed-by: Andrew Morton +Acked-by: Vladimir Davydov +Cc: Michal Hocko +Cc: Mike Rapoport +Cc: Mel Gorman +Cc: Stephen Rothwell +Cc: Andrey Ryabinin +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/page_idle.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/mm/page_idle.c ++++ b/mm/page_idle.c +@@ -130,7 +130,7 @@ static ssize_t page_idle_bitmap_read(str + + end_pfn = pfn + count * BITS_PER_BYTE; + if (end_pfn > max_pfn) +- end_pfn = ALIGN(max_pfn, BITMAP_CHUNK_BITS); ++ end_pfn = max_pfn; + + for (; pfn < end_pfn; pfn++) { + bit = pfn % BITMAP_CHUNK_BITS; +@@ -175,7 +175,7 @@ static ssize_t page_idle_bitmap_write(st + + end_pfn = pfn + count * BITS_PER_BYTE; + if (end_pfn > max_pfn) +- end_pfn = ALIGN(max_pfn, BITMAP_CHUNK_BITS); ++ end_pfn = max_pfn; + + for (; pfn < end_pfn; pfn++) { + bit = pfn % BITMAP_CHUNK_BITS; diff --git a/queue-4.4/ovl-modify-ovl_permission-to-do-checks-on-two-inodes.patch b/queue-4.4/ovl-modify-ovl_permission-to-do-checks-on-two-inodes.patch new file mode 100644 index 00000000000..29a2865a0c5 --- /dev/null +++ b/queue-4.4/ovl-modify-ovl_permission-to-do-checks-on-two-inodes.patch @@ -0,0 +1,66 @@ +From c0ca3d70e8d3cf81e2255a217f7ca402f5ed0862 Mon Sep 17 00:00:00 2001 +From: Vivek Goyal +Date: Fri, 1 Jul 2016 16:34:27 -0400 +Subject: ovl: modify ovl_permission() to do checks on two inodes + +From: Vivek Goyal + +commit c0ca3d70e8d3cf81e2255a217f7ca402f5ed0862 upstream. + +Right now ovl_permission() calls __inode_permission(realinode), to do +permission checks on real inode and no checks are done on overlay inode. + +Modify it to do checks both on overlay inode as well as underlying inode. +Checks on overlay inode will be done with the creds of calling task while +checks on underlying inode will be done with the creds of mounter. + +Signed-off-by: Vivek Goyal +Signed-off-by: Miklos Szeredi +[ Srivatsa: 4.4.y backport: + - Skipped the hunk modifying non-existent function ovl_get_acl() + - Adjusted the error path + - Included linux/cred.h to get prototype for revert_creds() ] +Signed-off-by: Srivatsa S. Bhat (VMware) +Signed-off-by: Greg Kroah-Hartman + +--- + fs/overlayfs/inode.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -9,6 +9,7 @@ + + #include + #include ++#include + #include + #include "overlayfs.h" + +@@ -91,6 +92,7 @@ int ovl_permission(struct inode *inode, + struct ovl_entry *oe; + struct dentry *alias = NULL; + struct inode *realinode; ++ const struct cred *old_cred; + struct dentry *realdentry; + bool is_upper; + int err; +@@ -143,7 +145,18 @@ int ovl_permission(struct inode *inode, + goto out_dput; + } + ++ /* ++ * Check overlay inode with the creds of task and underlying inode ++ * with creds of mounter ++ */ ++ err = generic_permission(inode, mask); ++ if (err) ++ goto out_dput; ++ ++ old_cred = ovl_override_creds(inode->i_sb); + err = __inode_permission(realinode, mask); ++ revert_creds(old_cred); ++ + out_dput: + dput(alias); + return err; diff --git a/queue-4.4/scsi-vmw_pscsi-fix-use-after-free-in-pvscsi_queue_lck.patch b/queue-4.4/scsi-vmw_pscsi-fix-use-after-free-in-pvscsi_queue_lck.patch new file mode 100644 index 00000000000..0f79bbddbb8 --- /dev/null +++ b/queue-4.4/scsi-vmw_pscsi-fix-use-after-free-in-pvscsi_queue_lck.patch @@ -0,0 +1,52 @@ +From 240b4cc8fd5db138b675297d4226ec46594d9b3b Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 19 Jun 2019 09:05:41 +0200 +Subject: scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck() + +From: Jan Kara + +commit 240b4cc8fd5db138b675297d4226ec46594d9b3b upstream. + +Once we unlock adapter->hw_lock in pvscsi_queue_lck() nothing prevents just +queued scsi_cmnd from completing and freeing the request. Thus cmd->cmnd[0] +dereference can dereference already freed request leading to kernel crashes +or other issues (which one of our customers observed). Store cmd->cmnd[0] +in a local variable before unlocking adapter->hw_lock to fix the issue. + +CC: +Signed-off-by: Jan Kara +Reviewed-by: Ewan D. Milne +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/vmw_pvscsi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/vmw_pvscsi.c ++++ b/drivers/scsi/vmw_pvscsi.c +@@ -733,6 +733,7 @@ static int pvscsi_queue_lck(struct scsi_ + struct pvscsi_adapter *adapter = shost_priv(host); + struct pvscsi_ctx *ctx; + unsigned long flags; ++ unsigned char op; + + spin_lock_irqsave(&adapter->hw_lock, flags); + +@@ -745,13 +746,14 @@ static int pvscsi_queue_lck(struct scsi_ + } + + cmd->scsi_done = done; ++ op = cmd->cmnd[0]; + + dev_dbg(&cmd->device->sdev_gendev, +- "queued cmd %p, ctx %p, op=%x\n", cmd, ctx, cmd->cmnd[0]); ++ "queued cmd %p, ctx %p, op=%x\n", cmd, ctx, op); + + spin_unlock_irqrestore(&adapter->hw_lock, flags); + +- pvscsi_kick_io(adapter, cmd->cmnd[0]); ++ pvscsi_kick_io(adapter, op); + + return 0; + } diff --git a/queue-4.4/series b/queue-4.4/series index 500702e9bf3..ef4e6cf78b5 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -1,4 +1,6 @@ fs-binfmt_flat.c-make-load_flat_shared_library-work.patch +mm-page_idle.c-fix-oops-because-end_pfn-is-larger-than-max_pfn.patch +scsi-vmw_pscsi-fix-use-after-free-in-pvscsi_queue_lck.patch tracing-silence-gcc-9-array-bounds-warning.patch gcc-9-silence-address-of-packed-member-warning.patch usb-chipidea-udc-workaround-for-endpoint-conflict-issue.patch @@ -31,3 +33,5 @@ perf-help-remove-needless-use-of-strncpy.patch 9p-rdma-remove-useless-check-in-cm_event_handler.patch 9p-p9dirent_read-check-network-provided-name-length.patch net-9p-include-trans_common.h-to-fix-missing-prototy.patch +kvm-x86-fix-scan-ioapic-use-before-initialization.patch +ovl-modify-ovl_permission-to-do-checks-on-two-inodes.patch -- 2.47.3