5.15-stable patches

added patches:
	btrfs-fix-lzo_decompress_bio-kmap-leakage.patch

diff --git a/queue-5.15/btrfs-fix-lzo_decompress_bio-kmap-leakage.patch b/queue-5.15/btrfs-fix-lzo_decompress_bio-kmap-leakage.patch
new file mode 100644 (file)
index 0000000..4b022a5
--- /dev/null
+++ b/queue-5.15/btrfs-fix-lzo_decompress_bio-kmap-leakage.patch
@@ -0,0 +1,48 @@
+From 2cf3f8133bda2a0945cc4c70e681ecb25b52b913 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Mon, 1 Nov 2021 12:46:47 -0700
+Subject: btrfs: fix lzo_decompress_bio() kmap leakage
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 2cf3f8133bda2a0945cc4c70e681ecb25b52b913 upstream.
+
+Commit ccaa66c8dd27 reinstated the kmap/kunmap that had been dropped in
+commit 8c945d32e604 ("btrfs: compression: drop kmap/kunmap from lzo").
+
+However, it seems to have done so incorrectly due to the change not
+reverting cleanly, and lzo_decompress_bio() ended up not having a
+matching "kunmap()" to the "kmap()" that was put back.
+
+Also, any assert that the page pointer is not NULL should be before the
+kmap() of said pointer, since otherwise you'd just oops in the kmap()
+before the assert would even trigger.
+
+I noticed this when trying to verify my btrfs merge, and things not
+adding up.  I'm doing this fixup before re-doing my merge, because this
+commit needs to also be backported to 5.15 (after verification from the
+btrfs people).
+
+Fixes: ccaa66c8dd27 ("Revert 'btrfs: compression: drop kmap/kunmap from lzo'")
+Cc: David Sterba <dsterba@suse.com>
+Cc: stable@kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/lzo.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/lzo.c
++++ b/fs/btrfs/lzo.c
+@@ -357,9 +357,10 @@ int lzo_decompress_bio(struct list_head
+               ASSERT(cur_in / sectorsize ==
+                      (cur_in + LZO_LEN - 1) / sectorsize);
+               cur_page = cb->compressed_pages[cur_in / PAGE_SIZE];
+-              kaddr = kmap(cur_page);
+               ASSERT(cur_page);
++              kaddr = kmap(cur_page);
+               seg_len = read_compress_length(kaddr + offset_in_page(cur_in));
++              kunmap(cur_page);
+               cur_in += LZO_LEN;
+ 
+               /* Copy the compressed segment payload into workspace */

diff --git a/queue-5.15/series b/queue-5.15/series
index ef8be4928eccd3b0fa1fa0c9837602f43da49191..33c43d3a48b53321925c917ac06e8b7ba1a20c13 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -11,3 +11,4 @@ binder-use-cred-instead-of-task-for-getsecid.patch
 binder-don-t-detect-sender-target-during-buffer-cleanup.patch
 kfence-always-use-static-branches-to-guard-kfence_alloc.patch
 kfence-default-to-dynamic-branch-instead-of-static-keys-mode.patch
+btrfs-fix-lzo_decompress_bio-kmap-leakage.patch