May 2024 - Linux-stable-mirror

[PATCH linux-next] jff2:fix potential illegal address access in jffs2_free_inode

by xu.xin16＠zte.com.cn

From: Wang Yong <wang.yong12(a)zte.com.cn> During the stress testing of the jffs2 file system,the following abnormal printouts were found: [ 2430.649000] Unable to handle kernel paging request at virtual address 0069696969696948 [ 2430.649622] Mem abort info: [ 2430.649829] ESR = 0x96000004 [ 2430.650115] EC = 0x25: DABT (current EL), IL = 32 bits [ 2430.650564] SET = 0, FnV = 0 [ 2430.650795] EA = 0, S1PTW = 0 [ 2430.651032] FSC = 0x04: level 0 translation fault [ 2430.651446] Data abort info: [ 2430.651683] ISV = 0, ISS = 0x00000004 [ 2430.652001] CM = 0, WnR = 0 [ 2430.652558] [0069696969696948] address between user and kernel address ranges [ 2430.653265] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 2430.654512] CPU: 2 PID: 20919 Comm: cat Not tainted 5.15.25-g512f31242bf6 #33 [ 2430.655008] Hardware name: linux,dummy-virt (DT) [ 2430.655517] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 2430.656142] pc : kfree+0x78/0x348 [ 2430.656630] lr : jffs2_free_inode+0x24/0x48 [ 2430.657051] sp : ffff800009eebd10 [ 2430.657355] x29: ffff800009eebd10 x28: 0000000000000001 x27: 0000000000000000 [ 2430.658327] x26: ffff000038f09d80 x25: 0080000000000000 x24: ffff800009d38000 [ 2430.658919] x23: 5a5a5a5a5a5a5a5a x22: ffff000038f09d80 x21: ffff8000084f0d14 [ 2430.659434] x20: ffff0000bf9a6ac0 x19: 0169696969696940 x18: 0000000000000000 [ 2430.659969] x17: ffff8000b6506000 x16: ffff800009eec000 x15: 0000000000004000 [ 2430.660637] x14: 0000000000000000 x13: 00000001000820a1 x12: 00000000000d1b19 [ 2430.661345] x11: 0004000800000000 x10: 0000000000000001 x9 : ffff8000084f0d14 [ 2430.662025] x8 : ffff0000bf9a6b40 x7 : ffff0000bf9a6b48 x6 : 0000000003470302 [ 2430.662695] x5 : ffff00002e41dcc0 x4 : ffff0000bf9aa3b0 x3 : 0000000003470342 [ 2430.663486] x2 : 0000000000000000 x1 : ffff8000084f0d14 x0 : fffffc0000000000 [ 2430.664217] Call trace: [ 2430.664528] kfree+0x78/0x348 [ 2430.664855] jffs2_free_inode+0x24/0x48 [ 2430.665233] i_callback+0x24/0x50 [ 2430.665528] rcu_do_batch+0x1ac/0x448 [ 2430.665892] rcu_core+0x28c/0x3c8 [ 2430.666151] rcu_core_si+0x18/0x28 [ 2430.666473] __do_softirq+0x138/0x3cc [ 2430.666781] irq_exit+0xf0/0x110 [ 2430.667065] handle_domain_irq+0x6c/0x98 [ 2430.667447] gic_handle_irq+0xac/0xe8 [ 2430.667739] call_on_irq_stack+0x28/0x54 The parameter passed to kfree was 5a5a5a5a, which corresponds to the target field of the jffs_inode_info structure. It was found that all variables in the jffs_inode_info structure were 5a5a5a5a, except for the first member sem. It is suspected that these variables are not initialized because they were set to 5a5a5a5a during memory testing, which is meant to detect uninitialized memory.The sem variable is initialized in the function jffs2_i_init_once, while other members are initialized in the function jffs2_init_inode_info. The function jffs2_init_inode_info is called after iget_locked, but in the iget_locked function, the destroy_inode process is triggered, which releases the inode and consequently, the target member of the inode is not initialized.In concurrent high pressure scenarios, iget_locked may enter the destroy_inode branch as described in the code. Since the destroy_inode functionality of jffs2 only releases the target, the fix method is to set target to NULL in jffs2_i_init_once. Signed-off-by: Wang Yong <wang.yong12(a)zte.com.cn> Reviewed-by: Lu Zhongjun <lu.zhongjun(a)zte.com.cn> Reviewed-by: Yang Tao <yang.tao172(a)zte.com.cn> Cc: Xu Xin <xu.xin16(a)zte.com.cn> Cc: Yang Yang <yang.yang29(a)zte.com.cn> --- fs/jffs2/super.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c index 81ca58c..40cc5e6 100644 --- a/fs/jffs2/super.c +++ b/fs/jffs2/super.c @@ -58,6 +58,7 @@ static void jffs2_i_init_once(void *foo) struct jffs2_inode_info *f = foo; mutex_init(&f->sem); + f->target = NULL; inode_init_once(&f->vfs_inode); } -- 2.15.2

5 months, 2 weeks

2
1
0 0

backport of missing fs/smb patches not in 6.6.30 stable

by Steve French

6.6.30-rc1 has a large set of fs/smb (cifs.ko and ksmbd.ko) patches backported but was missing more than 30 fixes so I put together a safe backport of the remaining, leaving out patches that had dependencies on things outside of fs/smb The following changes since commit 488f7008e62890fae8c7a2d3583913c8074f1fc6: smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (2024-04-30 12:30:53 -0500) are available in the Git repository at: git://git.samba.org/ksmbd.git tags/6.6.30-rc1-full-fs-smb-backport for you to fetch changes up to 411b6f385ac2427ee9d70fae277a4ed6b9d3983f: smb: smb2pdu.h: Avoid -Wflex-array-member-not-at-end warnings (2024-05-01 02:18:25 -0500) ---------------------------------------------------------------- full backport for 6.6.30, includes all 80 (of the relevant) missing fs/smb changesets Test results look good (and better than without the patches). Here are the functional test results (they passed exhaustive set of tests to various server types): http://smb311-linux-testing.southcentralus.cloudapp.azure.com/#/builders/3/… http://smb311-linux-testing.southcentralus.cloudapp.azure.com/#/builders/5/… http://smb311-linux-testing.southcentralus.cloudapp.azure.com/#/builders/9/… http://smb311-linux-testing.southcentralus.cloudapp.azure.com/#/builders/10… Note that 22 patches had dependencies and were not appropriate to backport and are not included, but here is the list of the additional 80 fs/smb patches included, many of which fix bugs (the others reduce risk of backport, and help avoid merge conflicts): 411b6f385ac2 (HEAD -> fs-smb-backport-linux-6.6.30-rc1, tag: 6.6.30-rc1-full-fs-smb-backport, origin/fs-smb-backport-linux-6.6.30-rc1) smb: smb2pdu.h: Avoid -Wflex-array-member-not-at-end warnings e97b85914501 ksmbd: add continuous availability share parameter c52ce70edb58 cifs: Add tracing for the cifs_tcon struct refcounting 6fa6d5ed6a06 smb3: fix broken reconnect when password changing on the server by allowing password rotation d8833245b0f3 smb: client: instantiate when creating SFU files 4c8cf606bdb9 smb: client: fix NULL ptr deref in cifs_mark_open_handles_for_deleted_file() e0727528f3be smb3: add trace event for mknod b71e6511fa98 smb311: additional compression flag defined in updated protocol spec 0725c800685e smb311: correct incorrect offset field in compression header e25e2f027599 cifs: Move some extern decls from .c files to .h 0d422616d36e ksmbd: fix potencial out-of-bounds when buffer offset is invalid 3967f3e18d66 ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() aec926736509 ksmbd: Fix spelling mistake "connction" -> "connection" 43f609cc80a5 ksmbd: fix possible null-deref in smb_lazy_parent_lease_break_close 3f1a838bc984 cifs: remove redundant variable assignment 05415df6229c cifs: fixes for get_inode_info 025b6f60cccc cifs: defer close file handles having RH lease f1907205b6d3 ksmbd: add support for durable handles v1/v2 38b6f9391d64 ksmbd: mark SMB2_SESSION_EXPIRED to session when destroying previous session 5ab62e6d22d1 cifs: update internal module version number for cifs.ko 4dcd0fe0c185 smb: common: simplify compression headers 0409ad4bad2b smb: common: fix fields sizes in compression_pattern_payload_v1 25fc3d85adc6 smb: client: negotiate compression algorithms f3351838c269 smb3: add dynamic trace point for ioctls 7716c6db1c3b smb: client: return reparse type in /proc/mounts 1c3fbd8f92e9 smb: client: set correct d_type for reparse DFS/DFSR and mount point 555e4ef34991 smb: client: parse uid, gid, mode and dev from WSL reparse points 5232c56b469f smb: client: introduce SMB2_OP_QUERY_WSL_EA 2bcfc0b089f7 smb: client: Fix a NULL vs IS_ERR() check in wsl_set_xattrs() 7ef14e642141 smb: client: add support for WSL reparse points 324c9dc5ab0b smb: client: reduce number of parameters in smb2_compound_op() 8b52dc432b0a smb: client: fix potential broken compound request 8f22fd9f0396 smb: client: move most of reparse point handling code to common file 0ddb5bfd6f20 smb: client: introduce reparse mount option 370c2c605121 smb: client: retry compound request without reusing lease 6051d1b018ea smb: client: do not defer close open handles to deleted files 6a9d47b768c4 smb: client: reuse file lease key in compound operations 87eec3c54337 smb: client: get rid of smb311_posix_query_path_info() 32fab0e3e9b9 smb: client: parse owner/group when creating reparse points df9a4c3f5db4 smb3: update allocation size more accurately on write completion 4d7263b3bf67 smb: client: handle path separator of created SMB symlinks bd15b21c46c1 cifs: update the same create_guid on replay 6feda182ccf0 ksmbd: Add kernel-doc for ksmbd_extract_sharename() function a12c76c3f311 cifs: set replay flag for retries of write command e0a86c86ec5f cifs: commands that are retried should have replay flag set 207e9813ad88 smb: client: delete "true", "false" defines 6eb8a67757c6 smb: Fix some kernel-doc comments 3c21bffee62f cifs: new mount option called retrans 005892f2a944 smb: client: don't clobber ->i_rdev from cached reparse points 222edc9359a6 cifs: new nt status codes from MS-SMB2 80e719af52b9 cifs: pick channel for tcon and tdis 56c978ef1555 cifs: minor comment cleanup 6008da8e76ac cifs: remove redundant variable tcon_exist 95d9120fd9b0 cifs: update internal module version number for cifs.ko 2bbd03ad1d98 ksmbd: vfs: fix all kernel-doc warnings 0988e25500d0 ksmbd: auth: fix most kernel-doc warnings 9198cebadcef cifs: remove unneeded return statement 2b8222b46d92 cifs: get rid of dup length check in parse_reparse_point() a1975468bc0d cifs: Pass unbyteswapped eof value into SMB2_set_eof() b312f2d94a42 smb3: Improve exception handling in allocate_mr_list() b6a02523d103 cifs: fix in logging in cifs_chan_update_iface f7e60be64713 smb: client: handle special files and symlinks in SMB3 POSIX 2f68be9f5e9d smb: client: cleanup smb2_query_reparse_point() eed182ebb134 smb: client: allow creating symlinks via reparse points 95c6eac76fa5 smb: client: optimise reparse point querying 8dbc76e94b4b smb: client: allow creating special files via reparse points a5a4a5bc172b smb: client: extend smb2_compound_op() to accept more commands 778c2e03cbf4 smb: client: Fix minor whitespace errors and warnings 757f636f8fb0 smb: client: introduce cifs_sfu_make_node() 52740954fa81 cifs: fix use after free for iface while disabling secondary channels 789f47984ddf cifs: update internal module version number for cifs.ko 120608af2863 Missing field not being returned in ioctl CIFS_IOC_GET_MNT_INFO d1e9469bb4de smb3: minor cleanup of session handling code 09f7cf2bba1b smb3: more minor cleanups for session handling routines 6e19e4e86f02 smb3: minor RDMA cleanup d73d7f8d1faa cifs: print server capabilities in DebugData a88a5c2bf942 smb: use crypto_shash_digest() in symlink_hash() 56ad4435b30b Add definition for new smb3.1.1 command type 5900e9b37aa2 SMB3: clarify some of the unused CreateOption flags fdf07b15f7d7 cifs: Add client version details to NTLM authenticate message -- Thanks, Steve

5 months, 2 weeks

2
1
0 0

Re: Patch "spi: axi-spi-engine: move msg state to new struct" has been added to the 6.1-stable tree

by David Lechner

On 5/6/24 2:30 PM, Sasha Levin wrote: > This is a note to let you know that I've just added the patch titled > > spi: axi-spi-engine: move msg state to new struct > > to the 6.1-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > spi-axi-spi-engine-move-msg-state-to-new-struct.patch > and it can be found in the queue-6.1 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > > Does not meet the criteria for stable.

5 months, 2 weeks

1
0
0 0

Re: Patch "spi: axi-spi-engine: use devm_spi_alloc_host()" has been added to the 6.1-stable tree

by David Lechner

On 5/6/24 2:30 PM, Sasha Levin wrote: > This is a note to let you know that I've just added the patch titled > > spi: axi-spi-engine: use devm_spi_alloc_host() > > to the 6.1-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > spi-axi-spi-engine-use-devm_spi_alloc_host.patch > and it can be found in the queue-6.1 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > > Does not meet the criteria for stable.

5 months, 2 weeks

1
0
0 0

Re: Patch "spi: axi-spi-engine: simplify driver data allocation" has been added to the 6.1-stable tree

by David Lechner

On 5/6/24 2:30 PM, Sasha Levin wrote: > This is a note to let you know that I've just added the patch titled > > spi: axi-spi-engine: simplify driver data allocation > > to the 6.1-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > spi-axi-spi-engine-simplify-driver-data-allocation.patch > and it can be found in the queue-6.1 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > > Does not meet the criteria for stable.

5 months, 2 weeks

1
0
0 0

Re: Patch "spi: spi-axi-spi-engine: Use helper function devm_clk_get_enabled()" has been added to the 6.1-stable tree

by David Lechner

On 5/6/24 2:30 PM, Sasha Levin wrote: > This is a note to let you know that I've just added the patch titled > > spi: spi-axi-spi-engine: Use helper function devm_clk_get_enabled() > > to the 6.1-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > spi-spi-axi-spi-engine-use-helper-function-devm_clk_.patch > and it can be found in the queue-6.1 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > Does not meet the criteria for stable.

5 months, 2 weeks

1
0
0 0

Re: Patch "spi: spi-axi-spi-engine: switch to use modern name" has been added to the 6.1-stable tree

by David Lechner

On 5/6/24 2:30 PM, Sasha Levin wrote: > This is a note to let you know that I've just added the patch titled > > spi: spi-axi-spi-engine: switch to use modern name > > to the 6.1-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > spi-spi-axi-spi-engine-switch-to-use-modern-name.patch > and it can be found in the queue-6.1 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > > Does not meet the criteria for stable.

5 months, 2 weeks

1
0
0 0

Re: Patch "spi: axi-spi-engine: fix version format string" has been added to the 6.6-stable tree

by David Lechner

On 5/6/24 2:27 PM, Sasha Levin wrote: > This is a note to let you know that I've just added the patch titled > > spi: axi-spi-engine: fix version format string > > to the 6.6-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > spi-axi-spi-engine-fix-version-format-string.patch > and it can be found in the queue-6.6 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > > Does not meet the criteria for stable. (only fixes theoretical problem)

5 months, 2 weeks

1
0
0 0

Re: Patch "spi: axi-spi-engine: use common AXI macros" has been added to the 6.6-stable tree

by David Lechner

On 5/6/24 2:27 PM, Sasha Levin wrote: > This is a note to let you know that I've just added the patch titled > > spi: axi-spi-engine: use common AXI macros > > to the 6.6-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > spi-axi-spi-engine-use-common-axi-macros.patch > and it can be found in the queue-6.6 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > > Does not meet the criteria for stable.

5 months, 2 weeks

1
0
0 0

Re: Patch "spi: axi-spi-engine: move msg state to new struct" has been added to the 6.6-stable tree

by David Lechner

On 5/6/24 2:27 PM, Sasha Levin wrote: > This is a note to let you know that I've just added the patch titled > > spi: axi-spi-engine: move msg state to new struct > > to the 6.6-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > spi-axi-spi-engine-move-msg-state-to-new-struct.patch > and it can be found in the queue-6.6 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > > Does not meet the criteria for stable.

5 months, 2 weeks

1
0
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror May 2024