When client on the host tries to connect(SOCK_STREAM, O_NONBLOCK) to the
server on the guest, there will be a panic on a ThunderX2 (armv8a server):
[ 463.718844] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[ 463.718848] Mem abort info:
[ 463.718849] ESR = 0x96000044
[ 463.718852] EC = 0x25: DABT (current EL), IL = 32 bits
[ 463.718853] SET = 0, FnV = 0
[ 463.718854] EA = 0, S1PTW = 0
[ 463.718855] Data abort info:
[ 463.718856] ISV = 0, ISS = 0x00000044
[ 463.718857] CM = 0, WnR = 1
[ 463.718859] user pgtable: 4k pages, 48-bit VAs, pgdp=0000008f6f6e9000
[ 463.718861] [0000000000000000] pgd=0000000000000000
[ 463.718866] Internal error: Oops: 96000044 [#1] SMP
[...]
[ 463.718977] CPU: 213 PID: 5040 Comm: vhost-5032 Tainted: G O 5.7.0-rc7+ #139
[ 463.718980] Hardware name: GIGABYTE R281-T91-00/MT91-FS1-00, BIOS F06 09/25/2018
[ 463.718982] pstate: 60400009 (nZCv daif +PAN -UAO)
[ 463.718995] pc : virtio_transport_recv_pkt+0x4c8/0xd40 [vmw_vsock_virtio_transport_common]
[ 463.718999] lr : virtio_transport_recv_pkt+0x1fc/0xd40 [vmw_vsock_virtio_transport_common]
[ 463.719000] sp : ffff80002dbe3c40
[...]
[ 463.719025] Call trace:
[ 463.719030] virtio_transport_recv_pkt+0x4c8/0xd40 [vmw_vsock_virtio_transport_common]
[ 463.719034] vhost_vsock_handle_tx_kick+0x360/0x408 [vhost_vsock]
[ 463.719041] vhost_worker+0x100/0x1a0 [vhost]
[ 463.719048] kthread+0x128/0x130
[ 463.719052] ret_from_fork+0x10/0x18
The race condition is as follows:
Task1 Task2
===== =====
__sock_release virtio_transport_recv_pkt
__vsock_release vsock_find_bound_socket (found sk)
lock_sock_nested
vsock_remove_sock
sock_orphan
sk_set_socket(sk, NULL)
sk->sk_shutdown = SHUTDOWN_MASK
...
release_sock
lock_sock
virtio_transport_recv_connecting
sk->sk_socket->state (panic!)
The root cause is that vsock_find_bound_socket can't hold the lock_sock,
so there is a small race window between vsock_find_bound_socket() and
lock_sock(). If __vsock_release() is running in another task,
sk->sk_socket will be set to NULL inadvertently.
Thus check the data structure member “sk_shutdown” (suggested by Stefano)
after a call of the function “lock_sock” since this field is set to
“SHUTDOWN_MASK” under the protection of “lock_sock_nested”.
Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko")
Signed-off-by: Jia He <justin.he(a)arm.com>
Cc: stable(a)vger.kernel.org
Cc: Asias He <asias(a)redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare(a)redhat.com>
---
v4: refine the commit msg (from Markus)
net/vmw_vsock/virtio_transport_common.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
index 69efc891885f..0edda1edf988 100644
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -1132,6 +1132,14 @@ void virtio_transport_recv_pkt(struct virtio_transport *t,
lock_sock(sk);
+ /* Check if sk has been released before lock_sock */
+ if (sk->sk_shutdown == SHUTDOWN_MASK) {
+ (void)virtio_transport_reset_no_sock(t, pkt);
+ release_sock(sk);
+ sock_put(sk);
+ goto free_pkt;
+ }
+
/* Update CID in case it has changed after a transport reset event */
vsk->local_addr.svm_cid = dst.svm_cid;
--
2.17.1
Hi
[This is an automated email]
This commit has been processed because it contains a "Fixes:" tag
fixing commit: c83f6bf98dc1 ("block: add partition resize function to blkpg ioctl").
The bot has tested the following trees: v5.6.15, v5.4.43, v4.19.125, v4.14.182, v4.9.225, v4.4.225.
v5.6.15: Failed to apply! Possible dependencies:
1a9fba3a77a5 ("block: unexport read_dev_sector and put_dev_sector")
2b8bd423614c ("block/diskstats: more accurate approximation of io_ticks for slow disks")
387048bf67ee ("block: merge partition-generic.c and check.c")
3ad5cee5cd00 ("block: move sysfs methods shared by disks and partitions to genhd.c")
581e26004a09 ("block: move block layer internals out of include/linux/genhd.h")
74cc979c3c7f ("block: cleanup how md_autodetect_dev is called")
f17c21c1ecb8 ("block: remove alloc_part_info and free_part_info")
ffa9ed647aa4 ("block: remove warn_no_part")
v5.4.43: Failed to apply! Possible dependencies:
387048bf67ee ("block: merge partition-generic.c and check.c")
3ad5cee5cd00 ("block: move sysfs methods shared by disks and partitions to genhd.c")
581e26004a09 ("block: move block layer internals out of include/linux/genhd.h")
5eac3eb30c9a ("block: Remove partition support for zoned block devices")
6c1b1da58f8c ("block: add zone open, close and finish operations")
74cc979c3c7f ("block: cleanup how md_autodetect_dev is called")
b68663186577 ("block: add iostat counters for flush requests")
c7a1d926dc40 ("block: Simplify REQ_OP_ZONE_RESET_ALL handling")
ceeb373aa6b9 ("block: Simplify report zones execution")
f902b0260002 ("block: refactor rescan_partitions")
v4.19.125: Failed to apply! Possible dependencies:
2268c0feb0ff ("blkcg: introduce common blkg association logic")
27e6fa996c53 ("blkcg: fix ref count issue with bio_blkcg using task_css")
43b729bfe9cf ("block: move integrity_req_gap_{back,front}_merge to blk.h")
49f4c2dc2b50 ("blkcg: update blkg_lookup_create to do locking")
581e26004a09 ("block: move block layer internals out of include/linux/genhd.h")
5bf9a1f3b4ef ("blkcg: consolidate bio_issue_init to be a part of core")
6f70fb66182b ("blkcg: remove bio_disassociate_task()")
a7b39b4e961c ("blkcg: always associate a bio with a blkg")
b5f2954d30c7 ("blkcg: revert blkcg cleanups series")
bdc2491708c4 ("blkcg: associate writeback bios with a blkg")
beea9da07d8a ("blkcg: convert blkg_lookup_create() to find closest blkg")
c839e7a03f92 ("blkcg: remove bio->bi_css and instead use bio->bi_blkg")
d459d853c2ed ("blkcg: reassociate bios when make_request() is called recursively")
ece841abbed2 ("block: fix memleak of bio integrity data")
v4.14.182: Failed to apply! Possible dependencies:
055f6e18e08f ("block: Make q_usage_counter also track legacy requests")
1b6d65a0bfb5 ("block: Introduce BLK_MQ_REQ_PREEMPT")
2268c0feb0ff ("blkcg: introduce common blkg association logic")
359f642700f2 ("block: move bio_integrity_{intervals,bytes} into blkdev.h")
37f9579f4c31 ("blk-mq: Avoid that submitting a bio concurrently with device removal triggers a crash")
3a0a529971ec ("block, scsi: Make SCSI quiesce and resume work reliably")
43b729bfe9cf ("block: move integrity_req_gap_{back,front}_merge to blk.h")
581e26004a09 ("block: move block layer internals out of include/linux/genhd.h")
6a15674d1e90 ("block: Introduce blk_get_request_flags()")
6f70fb66182b ("blkcg: remove bio_disassociate_task()")
9a95e4ef7095 ("block, nvme: Introduce blk_mq_req_flags_t")
c9254f2ddb19 ("block: Add the QUEUE_FLAG_PREEMPT_ONLY request queue flag")
d459d853c2ed ("blkcg: reassociate bios when make_request() is called recursively")
ece841abbed2 ("block: fix memleak of bio integrity data")
f421e1d9ade4 ("block: provide a direct_make_request helper")
v4.9.225: Failed to apply! Possible dependencies:
297e3d854784 ("blk-throttle: make throtl_slice tunable")
43b729bfe9cf ("block: move integrity_req_gap_{back,front}_merge to blk.h")
4e4cbee93d56 ("block: switch bios to blk_status_t")
581e26004a09 ("block: move block layer internals out of include/linux/genhd.h")
7c20f11680a4 ("bio-integrity: stop abusing bi_end_io")
87760e5eef35 ("block: hook up writeback throttling")
9e234eeafbe1 ("blk-throttle: add a simple idle detection")
cf43e6be865a ("block: add scalable completion tracking of requests")
e806402130c9 ("block: split out request-only flags into a new namespace")
fbbaf700e7b1 ("block: trace completion of all bios.")
v4.4.225: Failed to apply! Possible dependencies:
005411ea7ee7 ("doc: update block/queue-sysfs.txt entries")
27489a3c827b ("blk-mq: turn hctx->run_work into a regular work struct")
297e3d854784 ("blk-throttle: make throtl_slice tunable")
38f8baae8905 ("block: factor out chained bio completion")
43b729bfe9cf ("block: move integrity_req_gap_{back,front}_merge to blk.h")
4e4cbee93d56 ("block: switch bios to blk_status_t")
511cbce2ff8b ("irq_poll: make blk-iopoll available outside the block layer")
581e26004a09 ("block: move block layer internals out of include/linux/genhd.h")
7c20f11680a4 ("bio-integrity: stop abusing bi_end_io")
87760e5eef35 ("block: hook up writeback throttling")
8d354f133e86 ("blk-mq: improve layout of blk_mq_hw_ctx")
9467f85960a3 ("blk-mq/cpu-notif: Convert to new hotplug state machine")
9e234eeafbe1 ("blk-throttle: add a simple idle detection")
af3e3a5259e3 ("block: don't unecessarily clobber bi_error for chained bios")
ba8c6967b739 ("block: cleanup bio_endio")
cf43e6be865a ("block: add scalable completion tracking of requests")
e57690fe009b ("blk-mq: don't overwrite rq->mq_ctx")
e6a40b096e28 ("block: prepare request creation/destruction code to use REQ_OPs")
e806402130c9 ("block: split out request-only flags into a new namespace")
fbbaf700e7b1 ("block: trace completion of all bios.")
NOTE: The patch will not be queued to stable trees until it is upstream.
How should we proceed with this patch?
--
Thanks
Sasha
Use kvfree() to free the pages and vmas, since they are allocated by
kvmalloc_array() in a loop.
Fixes: d4ef647510b1 ("io_uring: avoid page allocation warnings")
Cc: stable(a)vger.kernel.org
Signed-off-by: Denis Efremov <efremov(a)linux.com>
---
I checked the v1 d4ef647510b1 discussion and these lines are using
kvfree() https://lkml.org/lkml/2019/5/1/254. This was somehow missed
in v2.
fs/io_uring.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 9d4bd0d3a080..defb8a3538fc 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -7160,8 +7160,8 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, void __user *arg,
ret = 0;
if (!pages || nr_pages > got_pages) {
- kfree(vmas);
- kfree(pages);
+ kvfree(vmas);
+ kvfree(pages);
pages = kvmalloc_array(nr_pages, sizeof(struct page *),
GFP_KERNEL);
vmas = kvmalloc_array(nr_pages,
--
2.26.2
From: Fredrik Strupe <fredrik(a)strupe.net>
[ Upstream commit 3866f217aaa81bf7165c7f27362eee5d7919c496 ]
call_undef_hook() in traps.c applies the same instr_mask for both 16-bit
and 32-bit thumb instructions. If instr_mask then is only 16 bits wide
(0xffff as opposed to 0xffffffff), the first half-word of 32-bit thumb
instructions will be masked out. This makes the function match 32-bit
thumb instructions where the second half-word is equal to instr_val,
regardless of the first half-word.
The result in this case is that all undefined 32-bit thumb instructions
with the second half-word equal to 0xde01 (udf #1) work as breakpoints
and will raise a SIGTRAP instead of a SIGILL, instead of just the one
intended 16-bit instruction. An example of such an instruction is
0xeaa0de01, which is unallocated according to Arm ARM and should raise a
SIGILL, but instead raises a SIGTRAP.
This patch fixes the issue by setting all the bits in instr_mask, which
will still match the intended 16-bit thumb instruction (where the
upper half is always 0), but not any 32-bit thumb instructions.
Cc: Oleg Nesterov <oleg(a)redhat.com>
Signed-off-by: Fredrik Strupe <fredrik(a)strupe.net>
Signed-off-by: Russell King <rmk+kernel(a)armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
arch/arm/kernel/ptrace.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index d54c53b7ab63..711d854ea13a 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -227,8 +227,8 @@ static struct undef_hook arm_break_hook = {
};
static struct undef_hook thumb_break_hook = {
- .instr_mask = 0xffff,
- .instr_val = 0xde01,
+ .instr_mask = 0xffffffff,
+ .instr_val = 0x0000de01,
.cpsr_mask = PSR_T_BIT,
.cpsr_val = PSR_T_BIT,
.fn = break_trap,
--
2.25.1
From: Fredrik Strupe <fredrik(a)strupe.net>
[ Upstream commit 3866f217aaa81bf7165c7f27362eee5d7919c496 ]
call_undef_hook() in traps.c applies the same instr_mask for both 16-bit
and 32-bit thumb instructions. If instr_mask then is only 16 bits wide
(0xffff as opposed to 0xffffffff), the first half-word of 32-bit thumb
instructions will be masked out. This makes the function match 32-bit
thumb instructions where the second half-word is equal to instr_val,
regardless of the first half-word.
The result in this case is that all undefined 32-bit thumb instructions
with the second half-word equal to 0xde01 (udf #1) work as breakpoints
and will raise a SIGTRAP instead of a SIGILL, instead of just the one
intended 16-bit instruction. An example of such an instruction is
0xeaa0de01, which is unallocated according to Arm ARM and should raise a
SIGILL, but instead raises a SIGTRAP.
This patch fixes the issue by setting all the bits in instr_mask, which
will still match the intended 16-bit thumb instruction (where the
upper half is always 0), but not any 32-bit thumb instructions.
Cc: Oleg Nesterov <oleg(a)redhat.com>
Signed-off-by: Fredrik Strupe <fredrik(a)strupe.net>
Signed-off-by: Russell King <rmk+kernel(a)armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
arch/arm/kernel/ptrace.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index ae738a6319f6..364985c96a92 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -227,8 +227,8 @@ static struct undef_hook arm_break_hook = {
};
static struct undef_hook thumb_break_hook = {
- .instr_mask = 0xffff,
- .instr_val = 0xde01,
+ .instr_mask = 0xffffffff,
+ .instr_val = 0x0000de01,
.cpsr_mask = PSR_T_BIT,
.cpsr_val = PSR_T_BIT,
.fn = break_trap,
--
2.25.1
From: Fredrik Strupe <fredrik(a)strupe.net>
[ Upstream commit 3866f217aaa81bf7165c7f27362eee5d7919c496 ]
call_undef_hook() in traps.c applies the same instr_mask for both 16-bit
and 32-bit thumb instructions. If instr_mask then is only 16 bits wide
(0xffff as opposed to 0xffffffff), the first half-word of 32-bit thumb
instructions will be masked out. This makes the function match 32-bit
thumb instructions where the second half-word is equal to instr_val,
regardless of the first half-word.
The result in this case is that all undefined 32-bit thumb instructions
with the second half-word equal to 0xde01 (udf #1) work as breakpoints
and will raise a SIGTRAP instead of a SIGILL, instead of just the one
intended 16-bit instruction. An example of such an instruction is
0xeaa0de01, which is unallocated according to Arm ARM and should raise a
SIGILL, but instead raises a SIGTRAP.
This patch fixes the issue by setting all the bits in instr_mask, which
will still match the intended 16-bit thumb instruction (where the
upper half is always 0), but not any 32-bit thumb instructions.
Cc: Oleg Nesterov <oleg(a)redhat.com>
Signed-off-by: Fredrik Strupe <fredrik(a)strupe.net>
Signed-off-by: Russell King <rmk+kernel(a)armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
arch/arm/kernel/ptrace.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 58e3771e4c5b..368b4b404985 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -228,8 +228,8 @@ static struct undef_hook arm_break_hook = {
};
static struct undef_hook thumb_break_hook = {
- .instr_mask = 0xffff,
- .instr_val = 0xde01,
+ .instr_mask = 0xffffffff,
+ .instr_val = 0x0000de01,
.cpsr_mask = PSR_T_BIT,
.cpsr_val = PSR_T_BIT,
.fn = break_trap,
--
2.25.1