From cd91a3c678226b2ed501b3553286fd69ec9ce279 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 2 Mar 2021 20:02:19 +0100 Subject: [PATCH] drop take-mmap-lock-in-cacheflush-syscall.patch from 4.4, 4.9, 4.14, 4.19 and 5.4 --- queue-4.14/series | 1 - ...take-mmap-lock-in-cacheflush-syscall.patch | 61 ------------------- queue-4.19/series | 1 - ...take-mmap-lock-in-cacheflush-syscall.patch | 61 ------------------- queue-4.4/series | 1 - ...take-mmap-lock-in-cacheflush-syscall.patch | 61 ------------------- queue-4.9/series | 1 - ...take-mmap-lock-in-cacheflush-syscall.patch | 61 ------------------- queue-5.4/series | 1 - ...take-mmap-lock-in-cacheflush-syscall.patch | 61 ------------------- 10 files changed, 310 deletions(-) delete mode 100644 queue-4.14/take-mmap-lock-in-cacheflush-syscall.patch delete mode 100644 queue-4.19/take-mmap-lock-in-cacheflush-syscall.patch delete mode 100644 queue-4.4/take-mmap-lock-in-cacheflush-syscall.patch delete mode 100644 queue-4.9/take-mmap-lock-in-cacheflush-syscall.patch delete mode 100644 queue-5.4/take-mmap-lock-in-cacheflush-syscall.patch diff --git a/queue-4.14/series b/queue-4.14/series index 03c57d4a699..575854a7452 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -109,7 +109,6 @@ drm-msm-dsi-correct-io_start-for-msm8994-20nm-phy.patch ext4-fix-potential-htree-index-checksum-corruption.patch i40e-fix-flow-for-ipv6-next-header-extension-header.patch i40e-fix-overwriting-flow-control-settings-during-dr.patch -take-mmap-lock-in-cacheflush-syscall.patch net-mlx4_core-add-missed-mlx4_free_cmd_mailbox.patch ocfs2-fix-a-use-after-free-on-error.patch mm-memory.c-fix-potential-pte_unmap_unlock-pte-error.patch diff --git a/queue-4.14/take-mmap-lock-in-cacheflush-syscall.patch b/queue-4.14/take-mmap-lock-in-cacheflush-syscall.patch deleted file mode 100644 index 94ea31d6e22..00000000000 --- a/queue-4.14/take-mmap-lock-in-cacheflush-syscall.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 94c4e2a23429522082d63237493034d6a4435502 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 19 Feb 2021 14:59:35 +0800 -Subject: Take mmap lock in cacheflush syscall - -From: Jann Horn - -[ Upstream commit c26958cb5a0d9053d1358258827638773f3d36ed ] - -We need to take the mmap lock around find_vma() and subsequent use of the -VMA. Otherwise, we can race with concurrent operations like munmap(), which -can lead to use-after-free accesses to freed VMAs. - -Fixes: 1000197d8013 ("nios2: System calls handling") -Signed-off-by: Jann Horn -Signed-off-by: Ley Foon Tan -Signed-off-by: Sasha Levin ---- - arch/nios2/kernel/sys_nios2.c | 11 +++++++++-- - 1 file changed, 9 insertions(+), 2 deletions(-) - -diff --git a/arch/nios2/kernel/sys_nios2.c b/arch/nios2/kernel/sys_nios2.c -index cd390ec4f88bf..b1ca856999521 100644 ---- a/arch/nios2/kernel/sys_nios2.c -+++ b/arch/nios2/kernel/sys_nios2.c -@@ -22,6 +22,7 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len, - unsigned int op) - { - struct vm_area_struct *vma; -+ struct mm_struct *mm = current->mm; - - if (len == 0) - return 0; -@@ -34,16 +35,22 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len, - if (addr + len < addr) - return -EFAULT; - -+ if (mmap_read_lock_killable(mm)) -+ return -EINTR; -+ - /* - * Verify that the specified address region actually belongs - * to this process. - */ -- vma = find_vma(current->mm, addr); -- if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end) -+ vma = find_vma(mm, addr); -+ if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end) { -+ mmap_read_unlock(mm); - return -EFAULT; -+ } - - flush_cache_range(vma, addr, addr + len); - -+ mmap_read_unlock(mm); - return 0; - } - --- -2.27.0 - diff --git a/queue-4.19/series b/queue-4.19/series index 17f031a329d..90f48fa5578 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -163,7 +163,6 @@ i40e-fix-flow-for-ipv6-next-header-extension-header.patch i40e-add-zero-initialization-of-aq-command-structure.patch i40e-fix-overwriting-flow-control-settings-during-dr.patch i40e-fix-vfs-not-created.patch -take-mmap-lock-in-cacheflush-syscall.patch i40e-fix-add-tc-filter-for-ipv6.patch net-mlx4_core-add-missed-mlx4_free_cmd_mailbox.patch vxlan-move-debug-check-after-netdev-unregister.patch diff --git a/queue-4.19/take-mmap-lock-in-cacheflush-syscall.patch b/queue-4.19/take-mmap-lock-in-cacheflush-syscall.patch deleted file mode 100644 index ca0a86cc0bb..00000000000 --- a/queue-4.19/take-mmap-lock-in-cacheflush-syscall.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 1ef2f917d29933eccf325fccea8fb641240ebb13 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 19 Feb 2021 14:59:35 +0800 -Subject: Take mmap lock in cacheflush syscall - -From: Jann Horn - -[ Upstream commit c26958cb5a0d9053d1358258827638773f3d36ed ] - -We need to take the mmap lock around find_vma() and subsequent use of the -VMA. Otherwise, we can race with concurrent operations like munmap(), which -can lead to use-after-free accesses to freed VMAs. - -Fixes: 1000197d8013 ("nios2: System calls handling") -Signed-off-by: Jann Horn -Signed-off-by: Ley Foon Tan -Signed-off-by: Sasha Levin ---- - arch/nios2/kernel/sys_nios2.c | 11 +++++++++-- - 1 file changed, 9 insertions(+), 2 deletions(-) - -diff --git a/arch/nios2/kernel/sys_nios2.c b/arch/nios2/kernel/sys_nios2.c -index cd390ec4f88bf..b1ca856999521 100644 ---- a/arch/nios2/kernel/sys_nios2.c -+++ b/arch/nios2/kernel/sys_nios2.c -@@ -22,6 +22,7 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len, - unsigned int op) - { - struct vm_area_struct *vma; -+ struct mm_struct *mm = current->mm; - - if (len == 0) - return 0; -@@ -34,16 +35,22 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len, - if (addr + len < addr) - return -EFAULT; - -+ if (mmap_read_lock_killable(mm)) -+ return -EINTR; -+ - /* - * Verify that the specified address region actually belongs - * to this process. - */ -- vma = find_vma(current->mm, addr); -- if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end) -+ vma = find_vma(mm, addr); -+ if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end) { -+ mmap_read_unlock(mm); - return -EFAULT; -+ } - - flush_cache_range(vma, addr, addr + len); - -+ mmap_read_unlock(mm); - return 0; - } - --- -2.27.0 - diff --git a/queue-4.4/series b/queue-4.4/series index b1044dcc0ad..d62acb859b1 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -54,7 +54,6 @@ misc-eeprom_93xx46-fix-module-alias-to-enable-module.patch misc-eeprom_93xx46-add-module-alias-to-avoid-breakin.patch vmci-use-set_page_dirty_lock-when-unregistering-gues.patch pci-align-checking-of-syscall-user-config-accessors.patch -take-mmap-lock-in-cacheflush-syscall.patch mm-memory.c-fix-potential-pte_unmap_unlock-pte-error.patch mm-hugetlb-fix-potential-double-free-in-hugetlb_regi.patch i2c-brcmstb-fix-brcmstd_send_i2c_cmd-condition.patch diff --git a/queue-4.4/take-mmap-lock-in-cacheflush-syscall.patch b/queue-4.4/take-mmap-lock-in-cacheflush-syscall.patch deleted file mode 100644 index df7149b6d93..00000000000 --- a/queue-4.4/take-mmap-lock-in-cacheflush-syscall.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 244758ba62fba26291ab05f76a696c10e5093eec Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 19 Feb 2021 14:59:35 +0800 -Subject: Take mmap lock in cacheflush syscall - -From: Jann Horn - -[ Upstream commit c26958cb5a0d9053d1358258827638773f3d36ed ] - -We need to take the mmap lock around find_vma() and subsequent use of the -VMA. Otherwise, we can race with concurrent operations like munmap(), which -can lead to use-after-free accesses to freed VMAs. - -Fixes: 1000197d8013 ("nios2: System calls handling") -Signed-off-by: Jann Horn -Signed-off-by: Ley Foon Tan -Signed-off-by: Sasha Levin ---- - arch/nios2/kernel/sys_nios2.c | 11 +++++++++-- - 1 file changed, 9 insertions(+), 2 deletions(-) - -diff --git a/arch/nios2/kernel/sys_nios2.c b/arch/nios2/kernel/sys_nios2.c -index cd390ec4f88bf..b1ca856999521 100644 ---- a/arch/nios2/kernel/sys_nios2.c -+++ b/arch/nios2/kernel/sys_nios2.c -@@ -22,6 +22,7 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len, - unsigned int op) - { - struct vm_area_struct *vma; -+ struct mm_struct *mm = current->mm; - - if (len == 0) - return 0; -@@ -34,16 +35,22 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len, - if (addr + len < addr) - return -EFAULT; - -+ if (mmap_read_lock_killable(mm)) -+ return -EINTR; -+ - /* - * Verify that the specified address region actually belongs - * to this process. - */ -- vma = find_vma(current->mm, addr); -- if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end) -+ vma = find_vma(mm, addr); -+ if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end) { -+ mmap_read_unlock(mm); - return -EFAULT; -+ } - - flush_cache_range(vma, addr, addr + len); - -+ mmap_read_unlock(mm); - return 0; - } - --- -2.27.0 - diff --git a/queue-4.9/series b/queue-4.9/series index e444b78fbc2..87e547a788e 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -78,7 +78,6 @@ vmci-use-set_page_dirty_lock-when-unregistering-gues.patch pci-align-checking-of-syscall-user-config-accessors.patch drm-msm-dsi-correct-io_start-for-msm8994-20nm-phy.patch i40e-fix-flow-for-ipv6-next-header-extension-header.patch -take-mmap-lock-in-cacheflush-syscall.patch net-mlx4_core-add-missed-mlx4_free_cmd_mailbox.patch ocfs2-fix-a-use-after-free-on-error.patch mm-memory.c-fix-potential-pte_unmap_unlock-pte-error.patch diff --git a/queue-4.9/take-mmap-lock-in-cacheflush-syscall.patch b/queue-4.9/take-mmap-lock-in-cacheflush-syscall.patch deleted file mode 100644 index 4ec2ae0ae94..00000000000 --- a/queue-4.9/take-mmap-lock-in-cacheflush-syscall.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 9588a1bbc0fcc95b5fd6cddeb7e27c70fca6b662 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 19 Feb 2021 14:59:35 +0800 -Subject: Take mmap lock in cacheflush syscall - -From: Jann Horn - -[ Upstream commit c26958cb5a0d9053d1358258827638773f3d36ed ] - -We need to take the mmap lock around find_vma() and subsequent use of the -VMA. Otherwise, we can race with concurrent operations like munmap(), which -can lead to use-after-free accesses to freed VMAs. - -Fixes: 1000197d8013 ("nios2: System calls handling") -Signed-off-by: Jann Horn -Signed-off-by: Ley Foon Tan -Signed-off-by: Sasha Levin ---- - arch/nios2/kernel/sys_nios2.c | 11 +++++++++-- - 1 file changed, 9 insertions(+), 2 deletions(-) - -diff --git a/arch/nios2/kernel/sys_nios2.c b/arch/nios2/kernel/sys_nios2.c -index cd390ec4f88bf..b1ca856999521 100644 ---- a/arch/nios2/kernel/sys_nios2.c -+++ b/arch/nios2/kernel/sys_nios2.c -@@ -22,6 +22,7 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len, - unsigned int op) - { - struct vm_area_struct *vma; -+ struct mm_struct *mm = current->mm; - - if (len == 0) - return 0; -@@ -34,16 +35,22 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len, - if (addr + len < addr) - return -EFAULT; - -+ if (mmap_read_lock_killable(mm)) -+ return -EINTR; -+ - /* - * Verify that the specified address region actually belongs - * to this process. - */ -- vma = find_vma(current->mm, addr); -- if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end) -+ vma = find_vma(mm, addr); -+ if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end) { -+ mmap_read_unlock(mm); - return -EFAULT; -+ } - - flush_cache_range(vma, addr, addr + len); - -+ mmap_read_unlock(mm); - return 0; - } - --- -2.27.0 - diff --git a/queue-5.4/series b/queue-5.4/series index 65c8b2d4981..0714350e850 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -217,7 +217,6 @@ i40e-add-zero-initialization-of-aq-command-structure.patch i40e-fix-overwriting-flow-control-settings-during-dr.patch i40e-fix-addition-of-rx-filters-after-enabling-fw-ll.patch i40e-fix-vfs-not-created.patch -take-mmap-lock-in-cacheflush-syscall.patch i40e-fix-add-tc-filter-for-ipv6.patch vfio-type1-use-follow_pte.patch net-mlx4_core-add-missed-mlx4_free_cmd_mailbox.patch diff --git a/queue-5.4/take-mmap-lock-in-cacheflush-syscall.patch b/queue-5.4/take-mmap-lock-in-cacheflush-syscall.patch deleted file mode 100644 index 93cf6065b76..00000000000 --- a/queue-5.4/take-mmap-lock-in-cacheflush-syscall.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 3cc567f67f91469d57e4777720b585e4b8cd0f7a Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 19 Feb 2021 14:59:35 +0800 -Subject: Take mmap lock in cacheflush syscall - -From: Jann Horn - -[ Upstream commit c26958cb5a0d9053d1358258827638773f3d36ed ] - -We need to take the mmap lock around find_vma() and subsequent use of the -VMA. Otherwise, we can race with concurrent operations like munmap(), which -can lead to use-after-free accesses to freed VMAs. - -Fixes: 1000197d8013 ("nios2: System calls handling") -Signed-off-by: Jann Horn -Signed-off-by: Ley Foon Tan -Signed-off-by: Sasha Levin ---- - arch/nios2/kernel/sys_nios2.c | 11 +++++++++-- - 1 file changed, 9 insertions(+), 2 deletions(-) - -diff --git a/arch/nios2/kernel/sys_nios2.c b/arch/nios2/kernel/sys_nios2.c -index cd390ec4f88bf..b1ca856999521 100644 ---- a/arch/nios2/kernel/sys_nios2.c -+++ b/arch/nios2/kernel/sys_nios2.c -@@ -22,6 +22,7 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len, - unsigned int op) - { - struct vm_area_struct *vma; -+ struct mm_struct *mm = current->mm; - - if (len == 0) - return 0; -@@ -34,16 +35,22 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len, - if (addr + len < addr) - return -EFAULT; - -+ if (mmap_read_lock_killable(mm)) -+ return -EINTR; -+ - /* - * Verify that the specified address region actually belongs - * to this process. - */ -- vma = find_vma(current->mm, addr); -- if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end) -+ vma = find_vma(mm, addr); -+ if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end) { -+ mmap_read_unlock(mm); - return -EFAULT; -+ } - - flush_cache_range(vma, addr, addr + len); - -+ mmap_read_unlock(mm); - return 0; - } - --- -2.27.0 - -- 2.47.3