release 6.14.4
This commit is contained in:
@@ -1,4 +1,4 @@
|
||||
From a1eb9a3160dc9e3cee6abdeab8e41c2265a2d7a1 Mon Sep 17 00:00:00 2001
|
||||
From 4506de20739ac4726a258faa98609a552184d2d2 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sergio=20Gonz=C3=A1lez=20Collado?=
|
||||
<sergio.collado@gmail.com>
|
||||
Date: Sun, 2 Mar 2025 23:15:18 +0100
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
From 1ff7499aaa4cec11be79e97c118978fd781073a6 Mon Sep 17 00:00:00 2001
|
||||
From b5a4b82efd19d0687a5582a58f6830bf714e34fc Mon Sep 17 00:00:00 2001
|
||||
From: Nathan Chancellor <nathan@kernel.org>
|
||||
Date: Tue, 18 Mar 2025 15:32:30 -0700
|
||||
Subject: x86/tools: Drop duplicate unlikely() definition in
|
||||
|
||||
@@ -1,29 +0,0 @@
|
||||
From 72096487bfe8ebc52731c264536418c51854d999 Mon Sep 17 00:00:00 2001
|
||||
From: Alex Deucher <alexander.deucher@amd.com>
|
||||
Date: Thu, 27 Mar 2025 17:33:49 -0400
|
||||
Subject: drm/amdgpu/mes11: optimize MES pipe FW version fetching
|
||||
|
||||
Don't fetch it again if we already have it. It seems the
|
||||
don't reliably have the proper value at resume in some
|
||||
cases.
|
||||
|
||||
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4083
|
||||
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
||||
Cherry-picked-for: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/issues/121
|
||||
---
|
||||
drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
--- a/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c
|
||||
+++ b/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c
|
||||
@@ -899,6 +899,10 @@ static void mes_v11_0_get_fw_version(str
|
||||
{
|
||||
int pipe;
|
||||
|
||||
+ /* return early if we have already fetched these */
|
||||
+ if (adev->mes.sched_version && adev->mes.kiq_version)
|
||||
+ return;
|
||||
+
|
||||
/* get MES scheduler/KIQ versions */
|
||||
mutex_lock(&adev->srbm_mutex);
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
From a1dfb99dca82ff97b00ce76f8f987ade471875d1 Mon Sep 17 00:00:00 2001
|
||||
From 762de1df7e501e019c3ae273c7e5e2d4c04b303c Mon Sep 17 00:00:00 2001
|
||||
From: Jarkko Sakkinen <jarkko@kernel.org>
|
||||
Date: Mon, 7 Apr 2025 15:28:05 +0300
|
||||
Subject: tpm: Mask TPM RC in tpm2_start_auth_session()
|
||||
@@ -1,4 +1,4 @@
|
||||
From 7b594a3c7b41db58884da466607417ca27c08a1d Mon Sep 17 00:00:00 2001
|
||||
From e3d18eed972374cfbac1e58cf109209b07c1e27e Mon Sep 17 00:00:00 2001
|
||||
From: Oleksandr Natalenko <oleksandr@natalenko.name>
|
||||
Date: Tue, 8 Apr 2025 12:02:36 +0200
|
||||
Subject: ice: mark ice_write_prof_mask_reg() as noinline
|
||||
@@ -1,4 +1,4 @@
|
||||
From 42a4f494db975d62916c73f5d637aef9be343d70 Mon Sep 17 00:00:00 2001
|
||||
From 74c95e079dc8b3c53ade90b2070458c0c69f3fdf Mon Sep 17 00:00:00 2001
|
||||
From: Oleksandr Natalenko <oleksandr@natalenko.name>
|
||||
Date: Tue, 8 Apr 2025 19:51:44 +0200
|
||||
Subject: fixes-6.14: update tpm2_start_auth_session() fix
|
||||
@@ -1,4 +1,4 @@
|
||||
From d3140c22ed2bc3c98dcf251659d78572e154a993 Mon Sep 17 00:00:00 2001
|
||||
From e56acee381a8e07edf1920fb58f3166f911b6e5c Mon Sep 17 00:00:00 2001
|
||||
From: Lingbo Kong <quic_lingbok@quicinc.com>
|
||||
Date: Wed, 26 Feb 2025 19:31:18 +0800
|
||||
Subject: wifi: ath12k: Abort scan before removing link interface to prevent
|
||||
@@ -1,4 +1,4 @@
|
||||
From fa165a32074fba27286cc9d2464a647642ad6bc7 Mon Sep 17 00:00:00 2001
|
||||
From 8d0e02f81d08c7b1e082028af0f55a22e7e1dfb2 Mon Sep 17 00:00:00 2001
|
||||
From: Christian Brauner <brauner@kernel.org>
|
||||
Date: Tue, 15 Apr 2025 10:22:04 +0200
|
||||
Subject: Kconfig: switch CONFIG_SYSFS_SYCALL default to n
|
||||
@@ -1,47 +0,0 @@
|
||||
From f1e8e30bef3757904d9e963f02ef297cd0c33240 Mon Sep 17 00:00:00 2001
|
||||
From: Alex Deucher <alexander.deucher@amd.com>
|
||||
Date: Fri, 28 Mar 2025 09:08:57 -0400
|
||||
Subject: drm/amdgpu/mes12: optimize MES pipe FW version fetching
|
||||
|
||||
Don't fetch it again if we already have it. It seems the
|
||||
registers don't reliably have the value at resume in some
|
||||
cases.
|
||||
|
||||
Fixes: 785f0f9fe742 ("drm/amdgpu: Add mes v12_0 ip block support (v4)")
|
||||
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
||||
---
|
||||
drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 21 ++++++++++++---------
|
||||
1 file changed, 12 insertions(+), 9 deletions(-)
|
||||
|
||||
--- a/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c
|
||||
+++ b/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c
|
||||
@@ -1390,17 +1390,20 @@ static int mes_v12_0_queue_init(struct a
|
||||
mes_v12_0_queue_init_register(ring);
|
||||
}
|
||||
|
||||
- /* get MES scheduler/KIQ versions */
|
||||
- mutex_lock(&adev->srbm_mutex);
|
||||
- soc21_grbm_select(adev, 3, pipe, 0, 0);
|
||||
+ if (((pipe == AMDGPU_MES_SCHED_PIPE) && !adev->mes.sched_version) ||
|
||||
+ ((pipe == AMDGPU_MES_KIQ_PIPE) && !adev->mes.kiq_version)) {
|
||||
+ /* get MES scheduler/KIQ versions */
|
||||
+ mutex_lock(&adev->srbm_mutex);
|
||||
+ soc21_grbm_select(adev, 3, pipe, 0, 0);
|
||||
|
||||
- if (pipe == AMDGPU_MES_SCHED_PIPE)
|
||||
- adev->mes.sched_version = RREG32_SOC15(GC, 0, regCP_MES_GP3_LO);
|
||||
- else if (pipe == AMDGPU_MES_KIQ_PIPE && adev->enable_mes_kiq)
|
||||
- adev->mes.kiq_version = RREG32_SOC15(GC, 0, regCP_MES_GP3_LO);
|
||||
+ if (pipe == AMDGPU_MES_SCHED_PIPE)
|
||||
+ adev->mes.sched_version = RREG32_SOC15(GC, 0, regCP_MES_GP3_LO);
|
||||
+ else if (pipe == AMDGPU_MES_KIQ_PIPE && adev->enable_mes_kiq)
|
||||
+ adev->mes.kiq_version = RREG32_SOC15(GC, 0, regCP_MES_GP3_LO);
|
||||
|
||||
- soc21_grbm_select(adev, 0, 0, 0, 0);
|
||||
- mutex_unlock(&adev->srbm_mutex);
|
||||
+ soc21_grbm_select(adev, 0, 0, 0, 0);
|
||||
+ mutex_unlock(&adev->srbm_mutex);
|
||||
+ }
|
||||
|
||||
return 0;
|
||||
}
|
||||
80
debian/patches/patchset-pf/fixes/0008-sched-eevdf-Fix-se-slice-being-set-to-U64_MAX-and-re.patch
vendored
Normal file
80
debian/patches/patchset-pf/fixes/0008-sched-eevdf-Fix-se-slice-being-set-to-U64_MAX-and-re.patch
vendored
Normal file
@@ -0,0 +1,80 @@
|
||||
From ea3ec10cacc746176a25dbd74c8d168e1c096a62 Mon Sep 17 00:00:00 2001
|
||||
From: Omar Sandoval <osandov@fb.com>
|
||||
Date: Fri, 25 Apr 2025 01:51:24 -0700
|
||||
Subject: sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash
|
||||
|
||||
There is a code path in dequeue_entities() that can set the slice of a
|
||||
sched_entity to U64_MAX, which sometimes results in a crash.
|
||||
|
||||
The offending case is when dequeue_entities() is called to dequeue a
|
||||
delayed group entity, and then the entity's parent's dequeue is delayed.
|
||||
In that case:
|
||||
|
||||
1. In the if (entity_is_task(se)) else block at the beginning of
|
||||
dequeue_entities(), slice is set to
|
||||
cfs_rq_min_slice(group_cfs_rq(se)). If the entity was delayed, then
|
||||
it has no queued tasks, so cfs_rq_min_slice() returns U64_MAX.
|
||||
2. The first for_each_sched_entity() loop dequeues the entity.
|
||||
3. If the entity was its parent's only child, then the next iteration
|
||||
tries to dequeue the parent.
|
||||
4. If the parent's dequeue needs to be delayed, then it breaks from the
|
||||
first for_each_sched_entity() loop _without updating slice_.
|
||||
5. The second for_each_sched_entity() loop sets the parent's ->slice to
|
||||
the saved slice, which is still U64_MAX.
|
||||
|
||||
This throws off subsequent calculations with potentially catastrophic
|
||||
results. A manifestation we saw in production was:
|
||||
|
||||
6. In update_entity_lag(), se->slice is used to calculate limit, which
|
||||
ends up as a huge negative number.
|
||||
7. limit is used in se->vlag = clamp(vlag, -limit, limit). Because limit
|
||||
is negative, vlag > limit, so se->vlag is set to the same huge
|
||||
negative number.
|
||||
8. In place_entity(), se->vlag is scaled, which overflows and results in
|
||||
another huge (positive or negative) number.
|
||||
9. The adjusted lag is subtracted from se->vruntime, which increases or
|
||||
decreases se->vruntime by a huge number.
|
||||
10. pick_eevdf() calls entity_eligible()/vruntime_eligible(), which
|
||||
incorrectly returns false because the vruntime is so far from the
|
||||
other vruntimes on the queue, causing the
|
||||
(vruntime - cfs_rq->min_vruntime) * load calulation to overflow.
|
||||
11. Nothing appears to be eligible, so pick_eevdf() returns NULL.
|
||||
12. pick_next_entity() tries to dereference the return value of
|
||||
pick_eevdf() and crashes.
|
||||
|
||||
Dumping the cfs_rq states from the core dumps with drgn showed tell-tale
|
||||
huge vruntime ranges and bogus vlag values, and I also traced se->slice
|
||||
being set to U64_MAX on live systems (which was usually "benign" since
|
||||
the rest of the runqueue needed to be in a particular state to crash).
|
||||
|
||||
Fix it in dequeue_entities() by always setting slice from the first
|
||||
non-empty cfs_rq.
|
||||
|
||||
Fixes: aef6987d8954 ("sched/eevdf: Propagate min_slice up the cgroup hierarchy")
|
||||
Signed-off-by: Omar Sandoval <osandov@fb.com>
|
||||
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
|
||||
Link: https://lkml.kernel.org/r/f0c2d1072be229e1bdddc73c0703919a8b00c652.1745570998.git.osandov@fb.com
|
||||
---
|
||||
kernel/sched/fair.c | 4 +---
|
||||
1 file changed, 1 insertion(+), 3 deletions(-)
|
||||
|
||||
--- a/kernel/sched/fair.c
|
||||
+++ b/kernel/sched/fair.c
|
||||
@@ -7096,9 +7096,6 @@ static int dequeue_entities(struct rq *r
|
||||
h_nr_idle = task_has_idle_policy(p);
|
||||
if (task_sleep || task_delayed || !se->sched_delayed)
|
||||
h_nr_runnable = 1;
|
||||
- } else {
|
||||
- cfs_rq = group_cfs_rq(se);
|
||||
- slice = cfs_rq_min_slice(cfs_rq);
|
||||
}
|
||||
|
||||
for_each_sched_entity(se) {
|
||||
@@ -7108,6 +7105,7 @@ static int dequeue_entities(struct rq *r
|
||||
if (p && &p->se == se)
|
||||
return -1;
|
||||
|
||||
+ slice = cfs_rq_min_slice(cfs_rq);
|
||||
break;
|
||||
}
|
||||
|
||||
@@ -1,50 +0,0 @@
|
||||
From 81c23adad48324b73fe0993f332407c5be050bb5 Mon Sep 17 00:00:00 2001
|
||||
From: Johannes Berg <johannes.berg@intel.com>
|
||||
Date: Thu, 3 Apr 2025 11:04:37 +0000
|
||||
Subject: wifi: iwlwifi: pcie: set state to no-FW before reset handshake
|
||||
|
||||
The reset handshake attempts to kill the firmware, and it'll go
|
||||
into a pretty much dead state once we do that. However, if it
|
||||
times out, then we'll attempt to dump the firmware to be able
|
||||
to see why it didn't respond. During this dump, we cannot treat
|
||||
it as if it was still running, since we just tried to kill it,
|
||||
otherwise dumping will attempt to send a DBGC stop command. As
|
||||
this command will time out, we'll go into a reset loop.
|
||||
|
||||
For now, fix this by setting the trans->state to say firmware
|
||||
isn't running before doing the reset handshake. In the longer
|
||||
term, we should clean up the way this state is handled.
|
||||
|
||||
It's not entirely clear but it seems likely that this issue was
|
||||
introduced by my rework of the error handling, prior to that it
|
||||
would've been synchronous at that point and (I think) not have
|
||||
attempted to reset since it was already doing down.
|
||||
|
||||
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219967
|
||||
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219968
|
||||
Closes: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/issues/128
|
||||
Fixes: 7391b2a4f7db ("wifi: iwlwifi: rework firmware error handling")
|
||||
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
||||
Signed-off-by: Oleksandr Natalenko <oleksandr@natalenko.name>
|
||||
---
|
||||
drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c | 8 +++++++-
|
||||
1 file changed, 7 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
|
||||
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
|
||||
@@ -147,8 +147,14 @@ static void _iwl_trans_pcie_gen2_stop_de
|
||||
return;
|
||||
|
||||
if (trans->state >= IWL_TRANS_FW_STARTED &&
|
||||
- trans_pcie->fw_reset_handshake)
|
||||
+ trans_pcie->fw_reset_handshake) {
|
||||
+ /*
|
||||
+ * Reset handshake can dump firmware on timeout, but that
|
||||
+ * should assume that the firmware is already dead.
|
||||
+ */
|
||||
+ trans->state = IWL_TRANS_NO_FW;
|
||||
iwl_trans_pcie_fw_reset_handshake(trans);
|
||||
+ }
|
||||
|
||||
trans_pcie->is_down = true;
|
||||
|
||||
@@ -1,30 +0,0 @@
|
||||
From bd6633c0e527dbcf6b52d3b34b49a980b125c866 Mon Sep 17 00:00:00 2001
|
||||
From: Xiangsheng Hou <xiangsheng.hou@mediatek.com>
|
||||
Date: Mon, 7 Apr 2025 19:50:49 +0800
|
||||
Subject: virtiofs: add filesystem context source name check
|
||||
|
||||
In certain scenarios, for example, during fuzz testing, the source
|
||||
name may be NULL, which could lead to a kernel panic. Therefore, an
|
||||
extra check for the source name should be added.
|
||||
|
||||
Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem")
|
||||
Cc: <stable@vger.kernel.org> # all LTS kernels
|
||||
Signed-off-by: Xiangsheng Hou <xiangsheng.hou@mediatek.com>
|
||||
Link: https://lore.kernel.org/20250407115111.25535-1-xiangsheng.hou@mediatek.com
|
||||
Signed-off-by: Christian Brauner <brauner@kernel.org>
|
||||
---
|
||||
fs/fuse/virtio_fs.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
--- a/fs/fuse/virtio_fs.c
|
||||
+++ b/fs/fuse/virtio_fs.c
|
||||
@@ -1670,6 +1670,9 @@ static int virtio_fs_get_tree(struct fs_
|
||||
unsigned int virtqueue_size;
|
||||
int err = -EIO;
|
||||
|
||||
+ if (!fsc->source)
|
||||
+ return invalf(fsc, "No source specified");
|
||||
+
|
||||
/* This gets a reference on virtio_fs object. This ptr gets installed
|
||||
* in fc->iq->priv. Once fuse_conn is going away, it calls ->put()
|
||||
* to drop the reference to this object.
|
||||
@@ -1,33 +0,0 @@
|
||||
From c3eedd3e0d50a748c6c520ba00377aba8150c713 Mon Sep 17 00:00:00 2001
|
||||
From: Sean Heelan <seanheelan@gmail.com>
|
||||
Date: Mon, 7 Apr 2025 11:26:50 +0000
|
||||
Subject: ksmbd: Fix dangling pointer in krb_authenticate
|
||||
|
||||
krb_authenticate frees sess->user and does not set the pointer
|
||||
to NULL. It calls ksmbd_krb5_authenticate to reinitialise
|
||||
sess->user but that function may return without doing so. If
|
||||
that happens then smb2_sess_setup, which calls krb_authenticate,
|
||||
will be accessing free'd memory when it later uses sess->user.
|
||||
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Sean Heelan <seanheelan@gmail.com>
|
||||
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
|
||||
Signed-off-by: Steve French <stfrench@microsoft.com>
|
||||
---
|
||||
fs/smb/server/smb2pdu.c | 4 +++-
|
||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/fs/smb/server/smb2pdu.c
|
||||
+++ b/fs/smb/server/smb2pdu.c
|
||||
@@ -1602,8 +1602,10 @@ static int krb5_authenticate(struct ksmb
|
||||
if (prev_sess_id && prev_sess_id != sess->id)
|
||||
destroy_previous_session(conn, sess->user, prev_sess_id);
|
||||
|
||||
- if (sess->state == SMB2_SESSION_VALID)
|
||||
+ if (sess->state == SMB2_SESSION_VALID) {
|
||||
ksmbd_free_user(sess->user);
|
||||
+ sess->user = NULL;
|
||||
+ }
|
||||
|
||||
retval = ksmbd_krb5_authenticate(sess, in_blob, in_len,
|
||||
out_blob, &out_len);
|
||||
@@ -1,76 +0,0 @@
|
||||
From 1932e1bb8624ec520da5f61e3f5bbdd16b9f320d Mon Sep 17 00:00:00 2001
|
||||
From: Namjae Jeon <linkinjeon@kernel.org>
|
||||
Date: Fri, 11 Apr 2025 15:19:46 +0900
|
||||
Subject: ksmbd: fix use-after-free in __smb2_lease_break_noti()
|
||||
|
||||
Move tcp_transport free to ksmbd_conn_free. If ksmbd connection is
|
||||
referenced when ksmbd server thread terminates, It will not be freed,
|
||||
but conn->tcp_transport is freed. __smb2_lease_break_noti can be performed
|
||||
asynchronously when the connection is disconnected. __smb2_lease_break_noti
|
||||
calls ksmbd_conn_write, which can cause use-after-free
|
||||
when conn->ksmbd_transport is already freed.
|
||||
|
||||
Cc: stable@vger.kernel.org
|
||||
Reported-by: Norbert Szetei <norbert@doyensec.com>
|
||||
Tested-by: Norbert Szetei <norbert@doyensec.com>
|
||||
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
||||
Signed-off-by: Steve French <stfrench@microsoft.com>
|
||||
---
|
||||
fs/smb/server/connection.c | 4 +++-
|
||||
fs/smb/server/transport_tcp.c | 14 +++++++++-----
|
||||
fs/smb/server/transport_tcp.h | 1 +
|
||||
3 files changed, 13 insertions(+), 6 deletions(-)
|
||||
|
||||
--- a/fs/smb/server/connection.c
|
||||
+++ b/fs/smb/server/connection.c
|
||||
@@ -39,8 +39,10 @@ void ksmbd_conn_free(struct ksmbd_conn *
|
||||
xa_destroy(&conn->sessions);
|
||||
kvfree(conn->request_buf);
|
||||
kfree(conn->preauth_info);
|
||||
- if (atomic_dec_and_test(&conn->refcnt))
|
||||
+ if (atomic_dec_and_test(&conn->refcnt)) {
|
||||
+ ksmbd_free_transport(conn->transport);
|
||||
kfree(conn);
|
||||
+ }
|
||||
}
|
||||
|
||||
/**
|
||||
--- a/fs/smb/server/transport_tcp.c
|
||||
+++ b/fs/smb/server/transport_tcp.c
|
||||
@@ -93,17 +93,21 @@ static struct tcp_transport *alloc_trans
|
||||
return t;
|
||||
}
|
||||
|
||||
-static void free_transport(struct tcp_transport *t)
|
||||
+void ksmbd_free_transport(struct ksmbd_transport *kt)
|
||||
{
|
||||
- kernel_sock_shutdown(t->sock, SHUT_RDWR);
|
||||
- sock_release(t->sock);
|
||||
- t->sock = NULL;
|
||||
+ struct tcp_transport *t = TCP_TRANS(kt);
|
||||
|
||||
- ksmbd_conn_free(KSMBD_TRANS(t)->conn);
|
||||
+ sock_release(t->sock);
|
||||
kfree(t->iov);
|
||||
kfree(t);
|
||||
}
|
||||
|
||||
+static void free_transport(struct tcp_transport *t)
|
||||
+{
|
||||
+ kernel_sock_shutdown(t->sock, SHUT_RDWR);
|
||||
+ ksmbd_conn_free(KSMBD_TRANS(t)->conn);
|
||||
+}
|
||||
+
|
||||
/**
|
||||
* kvec_array_init() - initialize a IO vector segment
|
||||
* @new: IO vector to be initialized
|
||||
--- a/fs/smb/server/transport_tcp.h
|
||||
+++ b/fs/smb/server/transport_tcp.h
|
||||
@@ -8,6 +8,7 @@
|
||||
|
||||
int ksmbd_tcp_set_interfaces(char *ifc_list, int ifc_list_sz);
|
||||
struct interface *ksmbd_find_netdev_name_iface_list(char *netdev_name);
|
||||
+void ksmbd_free_transport(struct ksmbd_transport *kt);
|
||||
int ksmbd_tcp_init(void);
|
||||
void ksmbd_tcp_destroy(void);
|
||||
|
||||
@@ -1,124 +0,0 @@
|
||||
From 67437a4c66847a82ab538705b932144d4af28f4b Mon Sep 17 00:00:00 2001
|
||||
From: Namjae Jeon <linkinjeon@kernel.org>
|
||||
Date: Tue, 15 Apr 2025 09:30:21 +0900
|
||||
Subject: ksmbd: fix use-after-free in smb_break_all_levII_oplock()
|
||||
|
||||
There is a room in smb_break_all_levII_oplock that can cause racy issues
|
||||
when unlocking in the middle of the loop. This patch use read lock
|
||||
to protect whole loop.
|
||||
|
||||
Cc: stable@vger.kernel.org
|
||||
Reported-by: Norbert Szetei <norbert@doyensec.com>
|
||||
Tested-by: Norbert Szetei <norbert@doyensec.com>
|
||||
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
||||
Signed-off-by: Steve French <stfrench@microsoft.com>
|
||||
---
|
||||
fs/smb/server/oplock.c | 29 +++++++++--------------------
|
||||
fs/smb/server/oplock.h | 1 -
|
||||
2 files changed, 9 insertions(+), 21 deletions(-)
|
||||
|
||||
--- a/fs/smb/server/oplock.c
|
||||
+++ b/fs/smb/server/oplock.c
|
||||
@@ -129,14 +129,6 @@ static void free_opinfo(struct oplock_in
|
||||
kfree(opinfo);
|
||||
}
|
||||
|
||||
-static inline void opinfo_free_rcu(struct rcu_head *rcu_head)
|
||||
-{
|
||||
- struct oplock_info *opinfo;
|
||||
-
|
||||
- opinfo = container_of(rcu_head, struct oplock_info, rcu_head);
|
||||
- free_opinfo(opinfo);
|
||||
-}
|
||||
-
|
||||
struct oplock_info *opinfo_get(struct ksmbd_file *fp)
|
||||
{
|
||||
struct oplock_info *opinfo;
|
||||
@@ -157,8 +149,8 @@ static struct oplock_info *opinfo_get_li
|
||||
if (list_empty(&ci->m_op_list))
|
||||
return NULL;
|
||||
|
||||
- rcu_read_lock();
|
||||
- opinfo = list_first_or_null_rcu(&ci->m_op_list, struct oplock_info,
|
||||
+ down_read(&ci->m_lock);
|
||||
+ opinfo = list_first_entry(&ci->m_op_list, struct oplock_info,
|
||||
op_entry);
|
||||
if (opinfo) {
|
||||
if (opinfo->conn == NULL ||
|
||||
@@ -171,8 +163,7 @@ static struct oplock_info *opinfo_get_li
|
||||
}
|
||||
}
|
||||
}
|
||||
-
|
||||
- rcu_read_unlock();
|
||||
+ up_read(&ci->m_lock);
|
||||
|
||||
return opinfo;
|
||||
}
|
||||
@@ -185,7 +176,7 @@ void opinfo_put(struct oplock_info *opin
|
||||
if (!atomic_dec_and_test(&opinfo->refcount))
|
||||
return;
|
||||
|
||||
- call_rcu(&opinfo->rcu_head, opinfo_free_rcu);
|
||||
+ free_opinfo(opinfo);
|
||||
}
|
||||
|
||||
static void opinfo_add(struct oplock_info *opinfo)
|
||||
@@ -193,7 +184,7 @@ static void opinfo_add(struct oplock_inf
|
||||
struct ksmbd_inode *ci = opinfo->o_fp->f_ci;
|
||||
|
||||
down_write(&ci->m_lock);
|
||||
- list_add_rcu(&opinfo->op_entry, &ci->m_op_list);
|
||||
+ list_add(&opinfo->op_entry, &ci->m_op_list);
|
||||
up_write(&ci->m_lock);
|
||||
}
|
||||
|
||||
@@ -207,7 +198,7 @@ static void opinfo_del(struct oplock_inf
|
||||
write_unlock(&lease_list_lock);
|
||||
}
|
||||
down_write(&ci->m_lock);
|
||||
- list_del_rcu(&opinfo->op_entry);
|
||||
+ list_del(&opinfo->op_entry);
|
||||
up_write(&ci->m_lock);
|
||||
}
|
||||
|
||||
@@ -1347,8 +1338,8 @@ void smb_break_all_levII_oplock(struct k
|
||||
ci = fp->f_ci;
|
||||
op = opinfo_get(fp);
|
||||
|
||||
- rcu_read_lock();
|
||||
- list_for_each_entry_rcu(brk_op, &ci->m_op_list, op_entry) {
|
||||
+ down_read(&ci->m_lock);
|
||||
+ list_for_each_entry(brk_op, &ci->m_op_list, op_entry) {
|
||||
if (brk_op->conn == NULL)
|
||||
continue;
|
||||
|
||||
@@ -1358,7 +1349,6 @@ void smb_break_all_levII_oplock(struct k
|
||||
if (ksmbd_conn_releasing(brk_op->conn))
|
||||
continue;
|
||||
|
||||
- rcu_read_unlock();
|
||||
if (brk_op->is_lease && (brk_op->o_lease->state &
|
||||
(~(SMB2_LEASE_READ_CACHING_LE |
|
||||
SMB2_LEASE_HANDLE_CACHING_LE)))) {
|
||||
@@ -1388,9 +1378,8 @@ void smb_break_all_levII_oplock(struct k
|
||||
oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE, NULL);
|
||||
next:
|
||||
opinfo_put(brk_op);
|
||||
- rcu_read_lock();
|
||||
}
|
||||
- rcu_read_unlock();
|
||||
+ up_read(&ci->m_lock);
|
||||
|
||||
if (op)
|
||||
opinfo_put(op);
|
||||
--- a/fs/smb/server/oplock.h
|
||||
+++ b/fs/smb/server/oplock.h
|
||||
@@ -71,7 +71,6 @@ struct oplock_info {
|
||||
struct list_head lease_entry;
|
||||
wait_queue_head_t oplock_q; /* Other server threads */
|
||||
wait_queue_head_t oplock_brk; /* oplock breaking wait */
|
||||
- struct rcu_head rcu_head;
|
||||
};
|
||||
|
||||
struct lease_break_info {
|
||||
@@ -1,31 +0,0 @@
|
||||
From d9f3fc321672406f959334509a88296187994c5a Mon Sep 17 00:00:00 2001
|
||||
From: Namjae Jeon <linkinjeon@kernel.org>
|
||||
Date: Tue, 15 Apr 2025 09:31:08 +0900
|
||||
Subject: ksmbd: fix the warning from __kernel_write_iter
|
||||
|
||||
[ 2110.972290] ------------[ cut here ]------------
|
||||
[ 2110.972301] WARNING: CPU: 3 PID: 735 at fs/read_write.c:599 __kernel_write_iter+0x21b/0x280
|
||||
|
||||
This patch doesn't allow writing to directory.
|
||||
|
||||
Cc: stable@vger.kernel.org
|
||||
Reported-by: Norbert Szetei <norbert@doyensec.com>
|
||||
Tested-by: Norbert Szetei <norbert@doyensec.com>
|
||||
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
||||
Signed-off-by: Steve French <stfrench@microsoft.com>
|
||||
---
|
||||
fs/smb/server/vfs.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/fs/smb/server/vfs.c
|
||||
+++ b/fs/smb/server/vfs.c
|
||||
@@ -496,7 +496,8 @@ int ksmbd_vfs_write(struct ksmbd_work *w
|
||||
int err = 0;
|
||||
|
||||
if (work->conn->connection_type) {
|
||||
- if (!(fp->daccess & (FILE_WRITE_DATA_LE | FILE_APPEND_DATA_LE))) {
|
||||
+ if (!(fp->daccess & (FILE_WRITE_DATA_LE | FILE_APPEND_DATA_LE)) ||
|
||||
+ S_ISDIR(file_inode(fp->filp)->i_mode)) {
|
||||
pr_err("no right to write(%pD)\n", fp->filp);
|
||||
err = -EACCES;
|
||||
goto out;
|
||||
@@ -1,43 +0,0 @@
|
||||
From adbf65091f5ac103ae5339bd49549b147906a0c0 Mon Sep 17 00:00:00 2001
|
||||
From: Denis Arefev <arefev@swemel.ru>
|
||||
Date: Wed, 9 Apr 2025 12:04:49 +0300
|
||||
Subject: ksmbd: Prevent integer overflow in calculation of deadtime
|
||||
|
||||
The user can set any value for 'deadtime'. This affects the arithmetic
|
||||
expression 'req->deadtime * SMB_ECHO_INTERVAL', which is subject to
|
||||
overflow. The added check makes the server behavior more predictable.
|
||||
|
||||
Found by Linux Verification Center (linuxtesting.org) with SVACE.
|
||||
|
||||
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Denis Arefev <arefev@swemel.ru>
|
||||
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
|
||||
Signed-off-by: Steve French <stfrench@microsoft.com>
|
||||
---
|
||||
fs/smb/server/transport_ipc.c | 7 ++++++-
|
||||
1 file changed, 6 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/fs/smb/server/transport_ipc.c
|
||||
+++ b/fs/smb/server/transport_ipc.c
|
||||
@@ -310,7 +310,11 @@ static int ipc_server_config_on_startup(
|
||||
server_conf.signing = req->signing;
|
||||
server_conf.tcp_port = req->tcp_port;
|
||||
server_conf.ipc_timeout = req->ipc_timeout * HZ;
|
||||
- server_conf.deadtime = req->deadtime * SMB_ECHO_INTERVAL;
|
||||
+ if (check_mul_overflow(req->deadtime, SMB_ECHO_INTERVAL,
|
||||
+ &server_conf.deadtime)) {
|
||||
+ ret = -EINVAL;
|
||||
+ goto out;
|
||||
+ }
|
||||
server_conf.share_fake_fscaps = req->share_fake_fscaps;
|
||||
ksmbd_init_domain(req->sub_auth);
|
||||
|
||||
@@ -337,6 +341,7 @@ static int ipc_server_config_on_startup(
|
||||
server_conf.bind_interfaces_only = req->bind_interfaces_only;
|
||||
ret |= ksmbd_tcp_set_interfaces(KSMBD_STARTUP_CONFIG_INTERFACES(req),
|
||||
req->ifc_list_sz);
|
||||
+out:
|
||||
if (ret) {
|
||||
pr_err("Server configuration error: %s %s %s\n",
|
||||
req->netbios_name, req->server_string,
|
||||
Reference in New Issue
Block a user