1. 10 Nov, 2022 3 commits
    • Linus Torvalds's avatar
      Merge tag 'soundwire-6.1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire · f014699c
      Linus Torvalds authored
      Pull soundwire fixes from Vinod Koul:
       "Two qcom driver fixes for broadcast completion reinit and check for
        outanding writes. And a lone Intel driver fix for clock stop timeout"
      
      * tag 'soundwire-6.1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:
        soundwire: qcom: check for outanding writes before doing a read
        soundwire: qcom: reinit broadcast completion
        soundwire: intel: Initialize clock stop timeout
      f014699c
    • Linus Torvalds's avatar
      Merge tag 'phy-fixes-6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy · 8395ee62
      Linus Torvalds authored
      Pull phy fixes from Vinod Koul:
       "A bunch of odd driver fixes and a MAINTAINER email update:
      
         - Update Kishon's email
      
         - stms32 error code fix in driver probe
      
         - tegra: fix for checking valid pointer
      
         - qcom_qmp: null deref fix
      
         - sunplus: error check fix
      
         - ralink: add missing sentinel to table"
      
      * tag 'phy-fixes-6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:
        phy: ralink: mt7621-pci: add sentinel to quirks table
        phy: sunplus: Fix an IS_ERR() vs NULL bug in sp_usb_phy_probe
        phy: qcom-qmp-combo: fix NULL-deref on runtime resume
        phy: tegra: xusb: Fix crash during pad power on/down
        phy: stm32: fix an error code in probe
        MAINTAINERS: Update Kishon's email address in GENERIC PHY FRAMEWORK
      8395ee62
    • Linus Torvalds's avatar
      Merge tag 'hwlock-v6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux · 17922865
      Linus Torvalds authored
      Pull hwspinlock updates from Bjorn Andersson:
       "I apparently had missed tagging and sending this set of changes out
        during the 6.1 merge window. But did get the associated dts changes
        depending on this merged. The result is a regression in 6.1-rc on the
        affected, older, Qualcomm platforms - in for form of them not booting.
      
        So while these weren't regression fixes originally, they are now. It's
        not introducing new beahavior, but simply extending the existing new
        Devicetree model, to cover remaining platforms:
      
         - extend the DeviceTree binding and implementation for the Qualcomm
           hardware spinlock on some older platforms to follow the style of
           the newer ones where the DeviceTree representation does not rely on
           an intermediate syscon node"
      
      * tag 'hwlock-v6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:
        dt-bindings: hwlock: qcom-hwspinlock: add syscon to MSM8974
        hwspinlock: qcom: add support for MMIO on older SoCs
        hwspinlock: qcom: correct MMIO max register for newer SoCs
        dt-bindings: hwlock: qcom-hwspinlock: correct example indentation
        dt-bindings: hwlock: qcom-hwspinlock: add support for MMIO on older SoCs
      17922865
  2. 09 Nov, 2022 1 commit
    • Linus Torvalds's avatar
      Merge tag 'slab-for-6.1-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab · f67dd6ce
      Linus Torvalds authored
      Pull slab fixes from Vlastimil Babka:
       "Most are small fixups as described below.
      
        The !CONFIG_TRACING fix is a bit bigger and would normally be done in
        the next merge window as part of upcoming hardening changes. But we
        realized it can make the kmalloc waste tracking introduced in this
        window inaccurate, so decided to go with it now.
      
        Summary:
      
         - Remove !CONFIG_TRACING kmalloc() wrappers intended to save a
           function call, due to incompatilibity with recently introduced
           wasted space tracking and planned hardening changes.
      
         - A tracing parameter regression fix, by Kees Cook.
      
         - Two kernel-doc warning fixups, by Lukas Bulwahn and myself
      
      * tag 'slab-for-6.1-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
        mm, slab: remove duplicate kernel-doc comment for ksize()
        mm/slab_common: Restore passing "caller" for tracing
        mm/slab: remove !CONFIG_TRACING variants of kmalloc_[node_]trace()
        mm/slab_common: repair kernel-doc for __ksize()
      f67dd6ce
  3. 08 Nov, 2022 2 commits
    • Linus Torvalds's avatar
      Merge tag 'audit-pr-20221107' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit · f141df37
      Linus Torvalds authored
      Pull audit fix from Paul Moore:
       "A small audit patch to fix an instance of undefined behavior in a
        shift operator caused when shifting a signed value too far, the same
        case as the lsm patch merged previously.
      
        While the fix is trivial and I can't imagine it causing a problem in a
        backport, I'm not explicitly marking it for stable on the off chance
        that there is some system out there which is relying on some wonky
        unexpected behavior which this patch could break; *if* it does break,
        IMO it's better that to happen in a minor or -rcX release and not in a
        stable backport"
      
      * tag 'audit-pr-20221107' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
        audit: fix undefined behavior in bit shift for AUDIT_BIT
      f141df37
    • Linus Torvalds's avatar
      Merge tag 'lsm-pr-20221107' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm · f49b2d89
      Linus Torvalds authored
      Pull lsm fix from Paul Moore:
       "A small capability patch to fix an instance of undefined behavior in a
        shift operator caused when shifting a signed value too far.
      
        While the fix is trivial and I can't imagine it causing a problem in a
        backport, I'm not explicitly marking it for stable on the off chance
        that there is some system out there which is relying on some wonky
        unexpected behavior which this patch could break; *if* it does break,
        IMO it's better that to happen in a minor or -rcX release and not in a
        stable backport"
      
      * tag 'lsm-pr-20221107' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
        capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
      f49b2d89
  4. 07 Nov, 2022 12 commits
  5. 06 Nov, 2022 18 commits
    • Linus Torvalds's avatar
      Linux 6.1-rc4 · f0c4d9fc
      Linus Torvalds authored
      f0c4d9fc
    • Linus Torvalds's avatar
      Merge tag 'cxl-fixes-for-6.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl · 16c7a368
      Linus Torvalds authored
      Pull cxl fixes from Dan Williams:
       "Several fixes for CXL region creation crashes, leaks and failures.
      
        This is mainly fallout from the original implementation of dynamic CXL
        region creation (instantiate new physical memory pools) that arrived
        in v6.0-rc1.
      
        Given the theme of "failures in the presence of pass-through decoders"
        this also includes new regression test infrastructure for that case.
      
        Summary:
      
         - Fix region creation crash with pass-through decoders
      
         - Fix region creation crash when no decoder allocation fails
      
         - Fix region creation crash when scanning regions to enforce the
           increasing physical address order constraint that CXL mandates
      
         - Fix a memory leak for cxl_pmem_region objects, track 1:N instead of
           1:1 memory-device-to-region associations.
      
         - Fix a memory leak for cxl_region objects when regions with active
           targets are deleted
      
         - Fix assignment of NUMA nodes to CXL regions by CFMWS (CXL Window)
           emulated proximity domains.
      
         - Fix region creation failure for switch attached devices downstream
           of a single-port host-bridge
      
         - Fix false positive memory leak of cxl_region objects by recycling
           recently used region ids rather than freeing them
      
         - Add regression test infrastructure for a pass-through decoder
           configuration
      
         - Fix some mailbox payload handling corner cases"
      
      * tag 'cxl-fixes-for-6.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl:
        cxl/region: Recycle region ids
        cxl/region: Fix 'distance' calculation with passthrough ports
        tools/testing/cxl: Add a single-port host-bridge regression config
        tools/testing/cxl: Fix some error exits
        cxl/pmem: Fix cxl_pmem_region and cxl_memdev leak
        cxl/region: Fix cxl_region leak, cleanup targets at region delete
        cxl/region: Fix region HPA ordering validation
        cxl/pmem: Use size_add() against integer overflow
        cxl/region: Fix decoder allocation crash
        ACPI: NUMA: Add CXL CFMWS 'nodes' to the possible nodes set
        cxl/pmem: Fix failure to account for 8 byte header for writes to the device LSA.
        cxl/region: Fix null pointer dereference due to pass through decoder commit
        cxl/mbox: Add a check on input payload size
      16c7a368
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-v6.1-rc4' of... · aa529949
      Linus Torvalds authored
      Merge tag 'hwmon-for-v6.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
      
      Pull hwmon fixes from Guenter Roeck:
       "Fix two regressions:
      
         - Commit 54cc3dbf ("hwmon: (pmbus) Add regulator supply into
           macro") resulted in regulator undercount when disabling regulators.
           Revert it.
      
         - The thermal subsystem rework caused the scmi driver to no longer
           register with the thermal subsystem because index values no longer
           match. To fix the problem, the scmi driver now directly registers
           with the thermal subsystem, no longer through the hwmon core"
      
      * tag 'hwmon-for-v6.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        Revert "hwmon: (pmbus) Add regulator supply into macro"
        hwmon: (scmi) Register explicitly with Thermal Framework
      aa529949
    • Linus Torvalds's avatar
      Merge tag 'perf_urgent_for_v6.1_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 727ea09e
      Linus Torvalds authored
      Pull perf fixes from Borislav Petkov:
      
       - Add Cooper Lake's stepping to the PEBS guest/host events isolation
         fixed microcode revisions checking quirk
      
       - Update Icelake and Sapphire Rapids events constraints
      
       - Use the standard energy unit for Sapphire Rapids in RAPL
      
       - Fix the hw_breakpoint test to fail more graciously on !SMP configs
      
      * tag 'perf_urgent_for_v6.1_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[]
        perf/x86/intel: Fix pebs event constraints for SPR
        perf/x86/intel: Fix pebs event constraints for ICL
        perf/x86/rapl: Use standard Energy Unit for SPR Dram RAPL domain
        perf/hw_breakpoint: test: Skip the test if dependencies unmet
      727ea09e
    • Linus Torvalds's avatar
      Merge tag 'x86_urgent_for_v6.1_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · f6f52047
      Linus Torvalds authored
      Pull x86 fixes from Borislav Petkov:
      
       - Add new Intel CPU models
      
       - Enforce that TDX guests are successfully loaded only on TDX hardware
         where virtualization exception (#VE) delivery on kernel memory is
         disabled because handling those in all possible cases is "essentially
         impossible"
      
       - Add the proper include to the syscall wrappers so that BTF can see
         the real pt_regs definition and not only the forward declaration
      
      * tag 'x86_urgent_for_v6.1_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/cpu: Add several Intel server CPU model numbers
        x86/tdx: Panic on bad configs that #VE on "private" memory access
        x86/tdx: Prepare for using "INFO" call for a second purpose
        x86/syscall: Include asm/ptrace.h in syscall_wrapper header
      f6f52047
    • Linus Torvalds's avatar
      Merge tag 'kbuild-fixes-v6.1-2' of... · 35697d81
      Linus Torvalds authored
      Merge tag 'kbuild-fixes-v6.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
      
      Pull Kbuild fixes from Masahiro Yamada:
      
       - Use POSIX-compatible grep options
      
       - Document git-related tips for reproducible builds
      
       - Fix a typo in the modpost rule
      
       - Suppress SIGPIPE error message from gcc-ar and llvm-ar
      
       - Fix segmentation fault in the menuconfig search
      
      * tag 'kbuild-fixes-v6.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
        kconfig: fix segmentation fault in menuconfig search
        kbuild: fix SIGPIPE error message for AR=gcc-ar and AR=llvm-ar
        kbuild: fix typo in modpost
        Documentation: kbuild: Add description of git for reproducible builds
        kbuild: use POSIX-compatible grep option
      35697d81
    • Kees Cook's avatar
      mm/slab_common: Restore passing "caller" for tracing · 32868715
      Kees Cook authored
      The "caller" argument was accidentally being ignored in a few places
      that were recently refactored. Restore these "caller" arguments, instead
      of _RET_IP_.
      
      Fixes: 11e9734b ("mm/slab_common: unify NUMA and UMA version of tracepoints")
      Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Cc: Christoph Lameter <cl@linux.com>
      Cc: Pekka Enberg <penberg@kernel.org>
      Cc: David Rientjes <rientjes@google.com>
      Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Roman Gushchin <roman.gushchin@linux.dev>
      Cc: linux-mm@kvack.org
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      Acked-by: default avatarHyeonggon Yoo <42.hyeyoo@gmail.com>
      Signed-off-by: default avatarVlastimil Babka <vbabka@suse.cz>
      32868715
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 089d1c31
      Linus Torvalds authored
      Pull kvm fixes from Paolo Bonzini:
      "ARM:
      
         - Fix the pKVM stage-1 walker erronously using the stage-2 accessor
      
         - Correctly convert vcpu->kvm to a hyp pointer when generating an
           exception in a nVHE+MTE configuration
      
         - Check that KVM_CAP_DIRTY_LOG_* are valid before enabling them
      
         - Fix SMPRI_EL1/TPIDR2_EL0 trapping on VHE
      
         - Document the boot requirements for FGT when entering the kernel at
           EL1
      
        x86:
      
         - Use SRCU to protect zap in __kvm_set_or_clear_apicv_inhibit()
      
         - Make argument order consistent for kvcalloc()
      
         - Userspace API fixes for DEBUGCTL and LBRs"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: x86: Fix a typo about the usage of kvcalloc()
        KVM: x86: Use SRCU to protect zap in __kvm_set_or_clear_apicv_inhibit()
        KVM: VMX: Ignore guest CPUID for host userspace writes to DEBUGCTL
        KVM: VMX: Fold vmx_supported_debugctl() into vcpu_supported_debugctl()
        KVM: VMX: Advertise PMU LBRs if and only if perf supports LBRs
        arm64: booting: Document our requirements for fine grained traps with SME
        KVM: arm64: Fix SMPRI_EL1/TPIDR2_EL0 trapping on VHE
        KVM: Check KVM_CAP_DIRTY_LOG_{RING, RING_ACQ_REL} prior to enabling them
        KVM: arm64: Fix bad dereference on MTE-enabled systems
        KVM: arm64: Use correct accessor to parse stage-1 PTEs
      089d1c31
    • Linus Torvalds's avatar
      Merge tag 'for-linus-6.1-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · 6e8c78d3
      Linus Torvalds authored
      Pull xen fixes from Juergen Gross:
       "One fix for silencing a smatch warning, and a small cleanup patch"
      
      * tag 'for-linus-6.1-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        x86/xen: simplify sysenter and syscall setup
        x86/xen: silence smatch warning in pmu_msr_chk_emulated()
      6e8c78d3
    • Linus Torvalds's avatar
      Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · 9761070d
      Linus Torvalds authored
      Pull ext4 fixes from Ted Ts'o:
       "Fix a number of bugs, including some regressions, the most serious of
        which was one which would cause online resizes to fail with file
        systems with metadata checksums enabled.
      
        Also fix a warning caused by the newly added fortify string checker,
        plus some bugs that were found using fuzzed file systems"
      
      * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4: fix fortify warning in fs/ext4/fast_commit.c:1551
        ext4: fix wrong return err in ext4_load_and_init_journal()
        ext4: fix warning in 'ext4_da_release_space'
        ext4: fix BUG_ON() when directory entry has invalid rec_len
        ext4: update the backup superblock's at the end of the online resize
      9761070d
    • Linus Torvalds's avatar
      Merge tag '6.1-rc4-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 · 90153f92
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
       "One symlink handling fix and two fixes foir multichannel issues with
        iterating channels, including for oplock breaks when leases are
        disabled"
      
      * tag '6.1-rc4-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: fix use-after-free on the link name
        cifs: avoid unnecessary iteration of tcp sessions
        cifs: always iterate smb sessions using primary channel
      90153f92
    • Linus Torvalds's avatar
      Merge tag 'trace-v6.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace · 8391aa4b
      Linus Torvalds authored
      Pull `lTracing fixes for 6.1-rc3:
      
       - Fixed NULL pointer dereference in the ring buffer wait-waiters code
         for machines that have less CPUs than what nr_cpu_ids returns.
      
         The buffer array is of size nr_cpu_ids, but only the online CPUs get
         initialized.
      
       - Fixed use after free call in ftrace_shutdown.
      
       - Fix accounting of if a kprobe is enabled
      
       - Fix NULL pointer dereference on error path of fprobe rethook_alloc().
      
       - Fix unregistering of fprobe_kprobe_handler
      
       - Fix memory leak in kprobe test module
      
      * tag 'trace-v6.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
        tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd()
        tracing/fprobe: Fix to check whether fprobe is registered correctly
        fprobe: Check rethook_alloc() return in rethook initialization
        kprobe: reverse kp->flags when arm_kprobe failed
        ftrace: Fix use-after-free for dynamic ftrace_ops
        ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters()
      8391aa4b
    • Paolo Bonzini's avatar
      Merge tag 'kvmarm-fixes-6.1-3' of... · f4298cac
      Paolo Bonzini authored
      Merge tag 'kvmarm-fixes-6.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD
      
      * Fix the pKVM stage-1 walker erronously using the stage-2 accessor
      
      * Correctly convert vcpu->kvm to a hyp pointer when generating
        an exception in a nVHE+MTE configuration
      
      * Check that KVM_CAP_DIRTY_LOG_* are valid before enabling them
      
      * Fix SMPRI_EL1/TPIDR2_EL0 trapping on VHE
      
      * Document the boot requirements for FGT when entering the kernel
        at EL1
      f4298cac
    • Paolo Bonzini's avatar
      Merge branch 'kvm-master' into HEAD · 14620149
      Paolo Bonzini authored
      x86:
      * Use SRCU to protect zap in __kvm_set_or_clear_apicv_inhibit()
      
      * Make argument order consistent for kvcalloc()
      
      * Userspace API fixes for DEBUGCTL and LBRs
      14620149
    • Theodore Ts'o's avatar
      ext4: fix fortify warning in fs/ext4/fast_commit.c:1551 · 0d043351
      Theodore Ts'o authored
      With the new fortify string system, rework the memcpy to avoid this
      warning:
      
      memcpy: detected field-spanning write (size 60) of single field "&raw_inode->i_generation" at fs/ext4/fast_commit.c:1551 (size 4)
      
      Cc: stable@kernel.org
      Fixes: 54d9469b ("fortify: Add run-time WARN for cross-field memcpy()")
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      0d043351
    • Jason Yan's avatar
      ext4: fix wrong return err in ext4_load_and_init_journal() · 9f2a1d9f
      Jason Yan authored
      The return value is wrong in ext4_load_and_init_journal(). The local
      variable 'err' need to be initialized before goto out. The original code
      in __ext4_fill_super() is fine because it has two return values 'ret'
      and 'err' and 'ret' is initialized as -EINVAL. After we factor out
      ext4_load_and_init_journal(), this code is broken. So fix it by directly
      returning -EINVAL in the error handler path.
      
      Cc: stable@kernel.org
      Fixes: 9c1dd22d ("ext4: factor out ext4_load_and_init_journal()")
      Signed-off-by: default avatarJason Yan <yanaijie@huawei.com>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Link: https://lore.kernel.org/r/20221025040206.3134773-1-yanaijie@huawei.comSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      9f2a1d9f
    • Ye Bin's avatar
      ext4: fix warning in 'ext4_da_release_space' · 1b8f787e
      Ye Bin authored
      Syzkaller report issue as follows:
      EXT4-fs (loop0): Free/Dirty block details
      EXT4-fs (loop0): free_blocks=0
      EXT4-fs (loop0): dirty_blocks=0
      EXT4-fs (loop0): Block reservation details
      EXT4-fs (loop0): i_reserved_data_blocks=0
      EXT4-fs warning (device loop0): ext4_da_release_space:1527: ext4_da_release_space: ino 18, to_free 1 with only 0 reserved data blocks
      ------------[ cut here ]------------
      WARNING: CPU: 0 PID: 92 at fs/ext4/inode.c:1528 ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1524
      Modules linked in:
      CPU: 0 PID: 92 Comm: kworker/u4:4 Not tainted 6.0.0-syzkaller-09423-g493ffd66 #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
      Workqueue: writeback wb_workfn (flush-7:0)
      RIP: 0010:ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1528
      RSP: 0018:ffffc900015f6c90 EFLAGS: 00010296
      RAX: 42215896cd52ea00 RBX: 0000000000000000 RCX: 42215896cd52ea00
      RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000
      RBP: 1ffff1100e907d96 R08: ffffffff816aa79d R09: fffff520002bece5
      R10: fffff520002bece5 R11: 1ffff920002bece4 R12: ffff888021fd2000
      R13: ffff88807483ecb0 R14: 0000000000000001 R15: ffff88807483e740
      FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00005555569ba628 CR3: 000000000c88e000 CR4: 00000000003506f0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
       <TASK>
       ext4_es_remove_extent+0x1ab/0x260 fs/ext4/extents_status.c:1461
       mpage_release_unused_pages+0x24d/0xef0 fs/ext4/inode.c:1589
       ext4_writepages+0x12eb/0x3be0 fs/ext4/inode.c:2852
       do_writepages+0x3c3/0x680 mm/page-writeback.c:2469
       __writeback_single_inode+0xd1/0x670 fs/fs-writeback.c:1587
       writeback_sb_inodes+0xb3b/0x18f0 fs/fs-writeback.c:1870
       wb_writeback+0x41f/0x7b0 fs/fs-writeback.c:2044
       wb_do_writeback fs/fs-writeback.c:2187 [inline]
       wb_workfn+0x3cb/0xef0 fs/fs-writeback.c:2227
       process_one_work+0x877/0xdb0 kernel/workqueue.c:2289
       worker_thread+0xb14/0x1330 kernel/workqueue.c:2436
       kthread+0x266/0x300 kernel/kthread.c:376
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
       </TASK>
      
      Above issue may happens as follows:
      ext4_da_write_begin
        ext4_create_inline_data
          ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
          ext4_set_inode_flag(inode, EXT4_INODE_INLINE_DATA);
      __ext4_ioctl
        ext4_ext_migrate -> will lead to eh->eh_entries not zero, and set extent flag
      ext4_da_write_begin
        ext4_da_convert_inline_data_to_extent
          ext4_da_write_inline_data_begin
            ext4_da_map_blocks
              ext4_insert_delayed_block
      	  if (!ext4_es_scan_clu(inode, &ext4_es_is_delonly, lblk))
      	    if (!ext4_es_scan_clu(inode, &ext4_es_is_mapped, lblk))
      	      ext4_clu_mapped(inode, EXT4_B2C(sbi, lblk)); -> will return 1
      	       allocated = true;
                ext4_es_insert_delayed_block(inode, lblk, allocated);
      ext4_writepages
        mpage_map_and_submit_extent(handle, &mpd, &give_up_on_write); -> return -ENOSPC
        mpage_release_unused_pages(&mpd, give_up_on_write); -> give_up_on_write == 1
          ext4_es_remove_extent
            ext4_da_release_space(inode, reserved);
              if (unlikely(to_free > ei->i_reserved_data_blocks))
      	  -> to_free == 1  but ei->i_reserved_data_blocks == 0
      	  -> then trigger warning as above
      
      To solve above issue, forbid inode do migrate which has inline data.
      
      Cc: stable@kernel.org
      Reported-by: syzbot+c740bb18df70ad00952e@syzkaller.appspotmail.com
      Signed-off-by: default avatarYe Bin <yebin10@huawei.com>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Link: https://lore.kernel.org/r/20221018022701.683489-1-yebin10@huawei.comSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      1b8f787e
    • Luís Henriques's avatar
      ext4: fix BUG_ON() when directory entry has invalid rec_len · 17a0bc9b
      Luís Henriques authored
      The rec_len field in the directory entry has to be a multiple of 4.  A
      corrupted filesystem image can be used to hit a BUG() in
      ext4_rec_len_to_disk(), called from make_indexed_dir().
      
       ------------[ cut here ]------------
       kernel BUG at fs/ext4/ext4.h:2413!
       ...
       RIP: 0010:make_indexed_dir+0x53f/0x5f0
       ...
       Call Trace:
        <TASK>
        ? add_dirent_to_buf+0x1b2/0x200
        ext4_add_entry+0x36e/0x480
        ext4_add_nondir+0x2b/0xc0
        ext4_create+0x163/0x200
        path_openat+0x635/0xe90
        do_filp_open+0xb4/0x160
        ? __create_object.isra.0+0x1de/0x3b0
        ? _raw_spin_unlock+0x12/0x30
        do_sys_openat2+0x91/0x150
        __x64_sys_open+0x6c/0xa0
        do_syscall_64+0x3c/0x80
        entry_SYSCALL_64_after_hwframe+0x46/0xb0
      
      The fix simply adds a call to ext4_check_dir_entry() to validate the
      directory entry, returning -EFSCORRUPTED if the entry is invalid.
      
      CC: stable@kernel.org
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=216540Signed-off-by: default avatarLuís Henriques <lhenriques@suse.de>
      Link: https://lore.kernel.org/r/20221012131330.32456-1-lhenriques@suse.deSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      17a0bc9b
  6. 05 Nov, 2022 4 commits