mirror of
https://github.com/LineageOS/android_kernel_fxtec_sm6115.git
synced 2026-08-19 03:01:04 +00:00
6e00a9207c70d7db8527d073cd71d4af56fdb00a
61414 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
| 4bcde29edc |
BACKPORT: xarray: Replace exceptional entries
Introduce xarray value entries and tagged pointers to replace radix tree exceptional entries. This is a slight change in encoding to allow the use of an extra bit (we can now store BITS_PER_LONG - 1 bits in a value entry). It is also a change in emphasis; exceptional entries are intimidating and different. As the comment explains, you can choose to store values or pointers in the xarray and they are both first-class citizens. Change-Id: I24a3019e30f4cfe176e5d750b3466317d62e60bc Signed-off-by: Matthew Wilcox <willy@infradead.org> Reviewed-by: Josef Bacik <jbacik@fb.com> |
|||
| 23ea704e18 |
Merge tag 'v4.19.325-cip132' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android13-4.19-kona
version 4.19.325-cip132 * tag 'v4.19.325-cip132' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip: CIP: Bump version suffix to -cip132 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.10.254. x86/CPU: Fix FPDSS on Zen1 seg6: separate dst_cache for input and output paths in seg6 lwtunnel netfilter: nft_ct: fix use-after-free in timeout object destroy apparmor: fix differential encoding verification apparmor: fix missing bounds check on DEFAULT table in verify_dfa() ext4: convert inline data to extents when truncate exceeds inline size virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl crypto: authencesn - Fix src offset when decrypting in-place crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption crypto: authenc - use memcpy_sglist() instead of null skcipher crypto: algif_aead - snapshot IV for async AEAD requests crypto: algif_aead - Revert to operating out-of-place crypto: algif_aead - use memcpy_sglist() instead of null skcipher crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c Buffer overflow in drivers/xen/sys-hypervisor.c xen/privcmd: fix double free via VMA splitting crypto: algif_aead - Fix minimum RX size check for decryption crypto: scatterwalk - Backport memcpy_sglist() batman-adv: avoid OGM aggregation when skb tailroom is insufficient device property: Check fwnode->secondary when finding properties device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint() device property: Retrieve fwnode from of_node via accessor media: device property: Return true in fwnode_device_is_available for NULL ops ext4: fix the might_sleep() warnings in kvfree() mm/huge_memory: fix folio isn't locked in softleaf_to_folio() usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop usb: gadget: f_hid: move list and spinlock inits from bind to alloc net: rfkill: prevent unlimited numbers of rfkill events from being created cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path cpufreq: governor: Free dbs_data directly when gov->init() fails xen/privcmd: unregister xenstore notifier on module exit rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) net: stmmac: fix integer underflow in chain mode net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure mmc: vub300: fix NULL-deref on disconnect net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() batman-adv: reject oversized global TT response buffers arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity wifi: brcmsmac: Fix dma_free_coherent() size tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG apparmor: fix unprivileged local user can do privileged policy management apparmor: Fix double free of ns_name in aa_replace_profiles() apparmor: fix side-effect bug in match_char() macro usage apparmor: fix: limit the number of levels of policy namespaces apparmor: replace recursive profile removal with iterative approach apparmor: fix memory leak in verify_header apparmor: validate DFA start states are in bounds in unpack_pdb mm/rmap: fix two comments related to huge_pmd_unshare() mm/hugetlb: fix two comments related to huge_pmd_unshare() mm/hugetlb: make detecting shared pte more reliable Input: uinput - take event lock when submitting FF request "event" Input: uinput - fix circular locking dependency with ff-core xfrm_user: fix info leak in build_report() wifi: rt2x00usb: fix devres lifetime usb: gadget: f_uac1_legacy: validate control request size usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer USB: dummy-hcd: Fix locking/synchronization error vxlan: validate ND option lengths in vxlan_na_create comedi: me4000: Fix potential overrun of firmware buffer comedi: me_daq: Fix potential overrun of firmware buffer comedi: ni_atmio16d: Fix invalid clean-up after failed attach comedi: Reinit dev->spinlock between attachments to low-level drivers comedi: dt2815: add hardware detection to prevent crash bridge: br_nd_send: validate ND option lengths usb: ulpi: fix double free in ulpi_register_interface() error path usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive iio: gyro: mpu3050: Fix out-of-sequence free_irq() iio: gyro: mpu3050: Move iio_device_register() to correct location iio: gyro: mpu3050: Fix irq resource leak iio: gyro: mpu3050: Fix incorrect free_irq() variable Input: xpad - add support for Razer Wolverine V3 Pro USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam USB: serial: option: add support for Rolling Wireless RW135R-GL USB: serial: io_edgeport: add support for Blackbox IC135A drm/ast: dp501: Fix initialization of SCU2C MIPS: Fix the GCC version check for `__multi3' workaround Bluetooth: SMP: force responder MITM requirements before building the pairing response Bluetooth: SMP: derive legacy responder STK authentication from MITM state ALSA: ctxfi: Fix missing SPDIFI1 index handling ALSA: caiaq: fix stack out-of-bounds read in init_card USB: serial: option: add MeiG Smart SRM825WN drm/ioc32: stop speculation on the drm_compat_ioctl path media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar Revert "media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar" drm/vmwgfx: Add seqno waiter for sync_files Revert "drm/vmwgfx: Add seqno waiter for sync_files" ipv6: avoid overflows in ip6_datagram_send_ctl() net/sched: cls_flow: fix NULL pointer dereference on shared blocks net/sched: cls_fw: fix NULL pointer dereference on shared blocks net/x25: Fix overflow when accumulating packets net/x25: Fix potential double free of skb net: macb: properly unregister fixed rate clocks net: macb: fix clk handling on PCI glue driver removal Bluetooth: MGMT: validate LTK enc_size on load netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent netfilter: nf_conntrack_helper: pass helper to expect cleanup netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr netfilter: x_tables: ensure names are nul-terminated netfilter: nfnetlink_log: account for netlink header size net: ipv6: flowlabel: defer exclusive option free until RCU teardown bpf: Fix regsafe() for pointers to packet net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec ipv6: prevent possible UaF in addrconf_permanent_addr() net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() bridge: br_nd_send: linearize skb before parsing ND options ip6_tunnel: clear skb2->cb[] in ip4ip6_err() ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() tg3: Fix race for querying speed/duplex net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak crypto: af-alg - fix NULL pointer dereference in scatterwalk HID: multitouch: Check to ensure report responses match the request atm: lec: fix use-after-free in sock_def_readable() HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA dmaengine: xilinx_dma: Program interrupt delay timeout btrfs: fix lost error when running device stats on multiple devices fs btrfs: fix super block offset in error message in btrfs_validate_super() dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA dmaengine: xilinx: xilinx_dma: Fix dma_device directions ext4: reject mount if bigalloc with s_first_data_block != 0 ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() ext4: make recently_deleted() properly work with lazy itable initialization scsi: ses: Handle positive SCSI error from ses_recv_diag() scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() alarmtimer: Fix argument order in alarm_timer_forward() cpufreq: conservative: Reset requested_freq on limits change s390/barrier: Make array_index_mask_nospec() __always_inline sysctl: fix uninitialized variable in proc_do_large_bitmap ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps ACPICA: include/acpi/acpixf.h: Fix indentation drm/i915/gmbus: fix spurious timeout on 512-byte burst reads scsi: scsi_transport_sas: Fix the maximum channel scanning issue RDMA/rw: Fall back to direct SGE on MR pool exhaustion net: macb: use the current queue number for stats netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop net: fix fanout UAF in packet_release() via NETDEV_UP race rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size openvswitch: validate MPLS set/set_masked payload length net: openvswitch: Avoid releasing netdev before teardown completes pinctrl: mediatek: common: Fix probe failure for devices without EINT Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Bluetooth: hci_ll: Fix firmware leak on error path Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() af_key: validate families in pfkey_send_migrate() xfrm: call xdo_dev_state_delete during state update dma-buf: Include ioctl.h in UAPI header xen/privcmd: restrict usage in unprivileged domU i2c: fsi: Fix a potential leak in fsi_i2c_probe() icmp: fix NULL pointer dereference in icmp_tag_validation() nfnetlink_osf: validate individual option lengths in fingerprints net: bonding: fix NULL deref in bond_debug_rlb_hash_show udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n net: macb: fix uninitialized rx_fs_lock wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom wifi: mac80211: fix NULL deref in mesh_matches_local() PM: runtime: Fix a race condition related to device removal net: bcmgenet: increase WoL poll timeout netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() netfilter: xt_time: use unsigned int for monthday bit shift netfilter: xt_CT: drop pending enqueued packets on template removal netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() netfilter: ctnetlink: remove refcounting in expectation dumpers net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect Bluetooth: HIDP: Fix possible UAF Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU staging: rtl8723bs: fix null dereference in find_network net/tcp-md5: Fix MAC comparison to be constant-time ALSA: pcm: fix wait_time calculations can: gs_usb: gs_can_open(): always configure bitrates before starting device usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling nfsd: fix heap overflow in NFSv4.0 LOCK replay cache arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation smb: client: fix iface port assignment in parse_server_interfaces iio: light: bh1780: fix PM runtime leak on error path tracing: Fix syscall events activation by ensuring refcount hits zero s390/xor: Fix xor_xc_2() inline assembly constraints drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink smb: client: Don't log plaintext credentials in cifs_set_cifscreds wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() wifi: libertas: fix use-after-free in lbs_free_adapter() ext4: fix dirtyclusters double decrement on fs shutdown ext4: drop extent cache when splitting extent fails drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() net: Handle napi_schedule() calls from non-interrupt drm/radeon: apply state adjust rules to some additional HAINAN vairants serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access net: macb: fix use-after-free access to PTP clock nvdimm/bus: Fix potential use after free in asynchronous initialization iio: chemical: bme680: Fix measurement wait duration calculation iio: potentiometer: mcp4131: fix double application of wiper shift iio: dac: ds4424: reject -128 RAW value btrfs: abort transaction on failure to update root in the received subvol ioctl x86/apic: Disable x2apic on resume if the kernel expects so drm/amdgpu: Fix use-after-free race in VM acquire net: ethernet: arc: emac: quiesce interrupts before requesting IRQ net: ncsi: fix skb leak in error paths parisc: Fix initial page table creation for boot nouveau/dpcd: return EBUSY for aux xfer if the device is asleep parisc: Increase initial mapping to 64 MB with KALLSYMS batman-adv: Avoid double-rtnl_lock ELP metric worker media: dvb-net: fix OOB access in ULE extension header tables staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() usb: image: mdc800: kill download URB on timeout usb: mdc800: handle signal and read racing usb: class: cdc-wdm: fix reordering issue in read code path USB: usbcore: Introduce usb_bulk_msg_killable() usb: misc: uss720: properly clean up reference in uss720_probe() usb: yurex: fix race in probe usb: xhci: Fix memory leak in xhci_disable_slot() usb/core/quirks: Add Huawei ME906S-device to wakeup quirk net: usb: lan78xx: skip LTM configuration for LAN7850 net: usb: lan78xx: fix silent drop of packets with checksum errors cgroup: fix race between task migration and iteration e1000/e1000e: Fix leak in DMA error cleanup i40e: fix src IP mask checks and memcpy argument names in cloud filter nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set sched: idle: Make skipping governor callbacks more consistent netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path netfilter: x_tables: guard option walkers against 1-byte tail reads can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value serial: caif: hold tty->link reference in ldisc_open and ser_release net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit powerpc: 83xx: km83xx: Fix keymile vendor prefix remoteproc: sysmon: Correct subsys_name_len type in QMI request powerpc/uaccess: Fix inline assembly for clang build on PPC32 scsi: ses: Fix devices attaching to different hosts ACPI: OSI: Add DMI quirk for Acer Aspire One D255 unshare: fix unshare_fs() handling ACPI: PM: Save NVS memory on Lenovo G70-35 scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled nfc: rawsock: cancel tx_work before socket teardown nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback nfc: nci: free skb on nci_transceive early error paths net: nfc: nci: Fix zero-length proprietary notifications amd-xgbe: fix sleep while atomic on suspend/resume xen/acpi-processor: fix _CST detection using undersized evaluation buffer wifi: wlcore: Fix a locking bug can: bcm: fix locking for bcm_op runtime updates atm: lec: fix null-ptr-deref in lec_arp_clear_vccs platform/x86: thinkpad_acpi: Fix errors reading battery thresholds drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() Squashfs: check metadata block offset is within range wifi: radiotap: reject radiotap with unknown bits ALSA: usb-audio: Use correct version for UAC3 header validation can: ucan: Fix infinite loop from zero-length messages can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message net: usb: pegasus: validate USB endpoints net: usb: kalmia: validate USB endpoints net: usb: kaweth: validate USB endpoints nfc: pn533: properly drop the usb interface reference on disconnect media: dvb-core: fix wrong reinitialization of ringbuffer on reopen net: arcnet: com20020-pci: fix support for 2.5Mbit cards ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 clk: tegra: tegra124-emc: fix device leak on set_rate() drm/tegra: dsi: fix device leak on probe ARM: omap2: Fix reference count leaks in omap_control_init() ARM: OMAP2+: add missing of_node_put before break and return ARM: clean up the memset64() C wrapper Change-Id: If58eb7898e90d049cd97232a5f2c1fc971671b1f |
|||
| 8b97111626 |
Revert "UPSTREAM: fuse: fix page stealing"
Reason for revert: Duplicated code
This reverts commit
|
|||
| b5d5701556 |
ext4: convert inline data to extents when truncate exceeds inline size
commit ed9356a30e59c7cc3198e7fc46cfedf3767b9b17 upstream. Add a check in ext4_setattr() to convert files from inline data storage to extent-based storage when truncate() grows the file size beyond the inline capacity. This prevents the filesystem from entering an inconsistent state where the inline data flag is set but the file size exceeds what can be stored inline. Without this fix, the following sequence causes a kernel BUG_ON(): 1. Mount filesystem with inode that has inline flag set and small size 2. truncate(file, 50MB) - grows size but inline flag remains set 3. sendfile() attempts to write data 4. ext4_write_inline_data() hits BUG_ON(write_size > inline_capacity) The crash occurs because ext4_write_inline_data() expects inline storage to accommodate the write, but the actual inline capacity (~60 bytes for i_block + ~96 bytes for xattrs) is far smaller than the file size and write request. The fix checks if the new size from setattr exceeds the inode's actual inline capacity (EXT4_I(inode)->i_inline_size) and converts the file to extent-based storage before proceeding with the size change. This addresses the root cause by ensuring the inline data flag and file size remain consistent during truncate operations. Reported-by: syzbot+7de5fe447862fc37576f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7de5fe447862fc37576f Tested-by: syzbot+7de5fe447862fc37576f@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com> Link: https://patch.msgid.link/20260207043607.1175976-1-kartikey406@gmail.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [uli: backport to 4.19] Signed-off-by: Ulrich Hecht <uli@kernel.org> Reviewed-by: Pavel Machek <pavel@nabladev.com> |
|||
| adb112f5a2 |
ext4: fix the might_sleep() warnings in kvfree()
[ Upstream commit 496bb99b7e66f48b178126626f47e9ba79e2d0fa ]
Use the kvfree() in the RCU read critical section can trigger
the following warnings:
EXT4-fs (vdb): unmounting filesystem cd983e5b-3c83-4f5a-a136-17b00eb9d018.
WARNING: suspicious RCU usage
./include/linux/rcupdate.h:409 Illegal context switch in RCU read-side critical section!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
Call Trace:
<TASK>
dump_stack_lvl+0xbb/0xd0
dump_stack+0x14/0x20
lockdep_rcu_suspicious+0x15a/0x1b0
__might_resched+0x375/0x4d0
? put_object.part.0+0x2c/0x50
__might_sleep+0x108/0x160
vfree+0x58/0x910
? ext4_group_desc_free+0x27/0x270
kvfree+0x23/0x40
ext4_group_desc_free+0x111/0x270
ext4_put_super+0x3c8/0xd40
generic_shutdown_super+0x14c/0x4a0
? __pfx_shrinker_free+0x10/0x10
kill_block_super+0x40/0x90
ext4_kill_sb+0x6d/0xb0
deactivate_locked_super+0xb4/0x180
deactivate_super+0x7e/0xa0
cleanup_mnt+0x296/0x3e0
__cleanup_mnt+0x16/0x20
task_work_run+0x157/0x250
? __pfx_task_work_run+0x10/0x10
? exit_to_user_mode_loop+0x6a/0x550
exit_to_user_mode_loop+0x102/0x550
do_syscall_64+0x44a/0x500
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
BUG: sleeping function called from invalid context at mm/vmalloc.c:3441
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 556, name: umount
preempt_count: 1, expected: 0
CPU: 3 UID: 0 PID: 556 Comm: umount
Call Trace:
<TASK>
dump_stack_lvl+0xbb/0xd0
dump_stack+0x14/0x20
__might_resched+0x275/0x4d0
? put_object.part.0+0x2c/0x50
__might_sleep+0x108/0x160
vfree+0x58/0x910
? ext4_group_desc_free+0x27/0x270
kvfree+0x23/0x40
ext4_group_desc_free+0x111/0x270
ext4_put_super+0x3c8/0xd40
generic_shutdown_super+0x14c/0x4a0
? __pfx_shrinker_free+0x10/0x10
kill_block_super+0x40/0x90
ext4_kill_sb+0x6d/0xb0
deactivate_locked_super+0xb4/0x180
deactivate_super+0x7e/0xa0
cleanup_mnt+0x296/0x3e0
__cleanup_mnt+0x16/0x20
task_work_run+0x157/0x250
? __pfx_task_work_run+0x10/0x10
? exit_to_user_mode_loop+0x6a/0x550
exit_to_user_mode_loop+0x102/0x550
do_syscall_64+0x44a/0x500
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The above scenarios occur in initialization failures and teardown
paths, there are no parallel operations on the resources released
by kvfree(), this commit therefore remove rcu_read_lock/unlock() and
use rcu_access_pointer() instead of rcu_dereference() operations.
Fixes: 7c990728b99e ("ext4: fix potential race between s_flex_groups online resizing and access")
Fixes: df3da4ea5a0f ("ext4: fix potential race between s_group_info online resizing and access")
Signed-off-by: Zqiang <qiang.zhang@linux.dev>
Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
Link: https://patch.msgid.link/20260319094545.19291-1-qiang.zhang@linux.dev
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
[ adapted inline rcu_read_lock/rcu_dereference/rcu_read_unlock removal ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
|
|||
| f46595727a |
btrfs: fix lost error when running device stats on multiple devices fs
[ Upstream commit 1c37d896b12dfd0d4c96e310b0033c6676933917 ]
Whenever we get an error updating the device stats item for a device in
btrfs_run_dev_stats() we allow the loop to go to the next device, and if
updating the stats item for the next device succeeds, we end up losing
the error we had from the previous device.
Fix this by breaking out of the loop once we get an error and make sure
it's returned to the caller. Since we are in the transaction commit path
(and in the critical section actually), returning the error will result
in a transaction abort.
Fixes:
|
|||
| 1363a021b7 |
btrfs: fix super block offset in error message in btrfs_validate_super()
[ Upstream commit b52fe51f724385b3ed81e37e510a4a33107e8161 ]
Fix the superblock offset mismatch error message in
btrfs_validate_super(): we changed it so that it considers all the
superblocks, but the message still assumes we're only looking at the
first one.
The change from %u to %llu is because we're changing from a constant to
a u64.
Fixes:
|
|||
| 432839a5bd |
ext4: reject mount if bigalloc with s_first_data_block != 0
commit 3822743dc20386d9897e999dbb990befa3a5b3f8 upstream. bigalloc with s_first_data_block != 0 is not supported, reject mounting it. Signed-off-by: Helen Koike <koike@igalia.com> Suggested-by: Theodore Ts'o <tytso@mit.edu> Reported-by: syzbot+b73703b873a33d8eb8f6@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b73703b873a33d8eb8f6 Link: https://patch.msgid.link/20260317142325.135074-1-koike@igalia.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
|||
| 2b6e9a2707 |
ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
commit 46066e3a06647c5b186cc6334409722622d05c44 upstream.
There's issue as follows:
...
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2243 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2239 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): error count since last fsck: 1
EXT4-fs (mmcblk0p1): initial error at time 1765597433: ext4_mb_generate_buddy:760
EXT4-fs (mmcblk0p1): last error at time 1765597433: ext4_mb_generate_buddy:760
...
According to the log analysis, blocks are always requested from the
corrupted block group. This may happen as follows:
ext4_mb_find_by_goal
ext4_mb_load_buddy
ext4_mb_load_buddy_gfp
ext4_mb_init_cache
ext4_read_block_bitmap_nowait
ext4_wait_block_bitmap
ext4_validate_block_bitmap
if (!grp || EXT4_MB_GRP_BBITMAP_CORRUPT(grp))
return -EFSCORRUPTED; // There's no logs.
if (err)
return err; // Will return error
ext4_lock_group(ac->ac_sb, group);
if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) // Unreachable
goto out;
After commit
|
|||
| 8ab000a3fe |
ext4: make recently_deleted() properly work with lazy itable initialization
commit bd060afa7cc3e0ad30afa9ecc544a78638498555 upstream. recently_deleted() checks whether inode has been used in the near past. However this can give false positive result when inode table is not initialized yet and we are in fact comparing to random garbage (or stale itable block of a filesystem before mkfs). Ultimately this results in uninitialized inodes being skipped during inode allocation and possibly they are never initialized and thus e2fsck complains. Verify if the inode has been initialized before checking for dtime. Signed-off-by: Jan Kara <jack@suse.cz> Reviewed-by: Zhang Yi <yi.zhang@huawei.com> Link: https://patch.msgid.link/20260216164848.3074-3-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
|||
| f36a69cd4f |
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
[ Upstream commit 5133b61aaf437e5f25b1b396b14242a6bb0508e2 ]
The NFSv4.0 replay cache uses a fixed 112-byte inline buffer
(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.
This size was calculated based on OPEN responses and does not account
for LOCK denied responses, which include the conflicting lock owner as
a variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).
When a LOCK operation is denied due to a conflict with an existing lock
that has a large owner, nfsd4_encode_operation() copies the full encoded
response into the undersized replay buffer via read_bytes_from_xdr_buf()
with no bounds check. This results in a slab-out-of-bounds write of up
to 944 bytes past the end of the buffer, corrupting adjacent heap memory.
This can be triggered remotely by an unauthenticated attacker with two
cooperating NFSv4.0 clients: one sets a lock with a large owner string,
then the other requests a conflicting lock to provoke the denial.
We could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full
opaque, but that would increase the size of every stateowner, when most
lockowners are not that large.
Instead, fix this by checking the encoded response length against
NFSD4_REPLAY_ISIZE before copying into the replay buffer. If the
response is too large, set rp_buflen to 0 to skip caching the replay
payload. The status is still cached, and the client already received the
correct response on the original request.
Fixes:
|
|||
| c987919323 |
smb: client: fix iface port assignment in parse_server_interfaces
[ Upstream commit d4c7210d2f3ea481a6481f03040a64d9077a6172 ]
parse_server_interfaces() initializes interface socket addresses with
CIFS_PORT. When the mount uses a non-default port this overwrites the
configured destination port.
Later, cifs_chan_update_iface() copies this sockaddr into server->dstaddr,
causing reconnect attempts to use the wrong port after server interface
updates.
Use the existing port from server->dstaddr instead.
Cc: stable@vger.kernel.org
Fixes:
|
|||
| c35cfe3f6c |
smb: client: Don't log plaintext credentials in cifs_set_cifscreds
[ Upstream commit 2f37dc436d4e61ff7ae0b0353cf91b8c10396e4d ]
When debug logging is enabled, cifs_set_cifscreds() logs the key
payload and exposes the plaintext username and password. Remove the
debug log to avoid exposing credentials.
Fixes:
|
|||
| 1c3cc44f4b |
ext4: fix dirtyclusters double decrement on fs shutdown
[ Upstream commit 94a8cea54cd935c54fa2fba70354757c0fc245e3 ]
fstests test generic/388 occasionally reproduces a warning in
ext4_put_super() associated with the dirty clusters count:
WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4]
Tracing the failure shows that the warning fires due to an
s_dirtyclusters_counter value of -1. IOW, this appears to be a
spurious decrement as opposed to some sort of leak. Further tracing
of the dirty cluster count deltas and an LLM scan of the resulting
output identified the cause as a double decrement in the error path
between ext4_mb_mark_diskspace_used() and the caller
ext4_mb_new_blocks().
First, note that generic/388 is a shutdown vs. fsstress test and so
produces a random set of operations and shutdown injections. In the
problematic case, the shutdown triggers an error return from the
ext4_handle_dirty_metadata() call(s) made from
ext4_mb_mark_context(). The changed value is non-zero at this point,
so ext4_mb_mark_diskspace_used() does not exit after the error
bubbles up from ext4_mb_mark_context(). Instead, the former
decrements both cluster counters and returns the error up to
ext4_mb_new_blocks(). The latter falls into the !ar->len out path
which decrements the dirty clusters counter a second time, creating
the inconsistency.
To avoid this problem and simplify ownership of the cluster
reservation in this codepath, lift the counter reduction to a single
place in the caller. This makes it more clear that
ext4_mb_new_blocks() is responsible for acquiring cluster
reservation (via ext4_claim_free_clusters()) in the !delalloc case
as well as releasing it, regardless of whether it ends up consumed
or returned due to failure.
Fixes:
|
|||
| cc24452e86 |
ext4: drop extent cache when splitting extent fails
[ Upstream commit 79b592e8f1b435796cbc2722190368e3e8ffd7a1 ] When the split extent fails, we might leave some extents still being processed and return an error directly, which will result in stale extent entries remaining in the extent status tree. So drop all of the remaining potentially stale extents if the splitting fails. Signed-off-by: Zhang Yi <yi.zhang@huawei.com> Reviewed-by: Baokun Li <libaokun1@huawei.com> Cc: stable@kernel.org Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com> Message-ID: <20251129103247.686136-8-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu> [ bring error handling pattern closer to upstream ] Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
|||
| dab2e0a89c |
btrfs: abort transaction on failure to update root in the received subvol ioctl
commit 0f475ee0ebce5c9492b260027cd95270191675fa upstream.
If we failed to update the root we don't abort the transaction, which is
wrong since we already used the transaction to remove an item from the
uuid tree.
Fixes:
|
|||
| 897297f8c6 |
Squashfs: check metadata block offset is within range
commit fdb24a820a5832ec4532273282cbd4f22c291a0d upstream.
Syzkaller reports a "general protection fault in squashfs_copy_data"
This is ultimately caused by a corrupted index look-up table, which
produces a negative metadata block offset.
This is subsequently passed to squashfs_copy_data (via
squashfs_read_metadata) where the negative offset causes an out of bounds
access.
The fix is to check that the offset is within range in
squashfs_read_metadata. This will trap this and other cases.
Link: https://lkml.kernel.org/r/20260217050955.138351-1-phillip@squashfs.org.uk
Fixes:
|
|||
| b0da80ea68 |
Merge tag 'v4.19.325-cip131' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android13-4.19-kona
version 4.19.325-cip131 * tag 'v4.19.325-cip131' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip: CIP: Bump version suffix to -cip131 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.10.252. nfsd: fix return error code for nfsd_map_name_to_[ug]id net: usb: pegasus: enable basic endpoint checking Bluetooth: L2CAP: Fix not checking l2cap_chan security level Bluetooth: Enforce key size of 16 bytes on FIPS level xfrm6: fix uninitialized saddr in xfrm6_get_saddr() netfilter: nf_conntrack: Add allow_clash to generic protocol handler ext4: don't cache extent during splitting extent NTB: ntb_transport: Fix too small buffer for debugfs_name net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle fbdev: ffb: fix corrupted video output on Sun FFB1 fbdev: of: display_timing: fix refcount leak in of_get_display_timings() atm: fore200e: fix use-after-free in tasklets during device removal net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() net: ethernet: marvell: skge: remove incorrect conflicting PCI ID ceph: supply snapshot context in ceph_zero_partial_object() MIPS: rb532: Fix MMIO UART resource registration parisc: kernel: replace kfree() with put_device() in create_tree_node() drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() usb: dwc2: fix resume failure if dr_mode is host btrfs: continue trimming remaining devices on failure kexec: derive purgatory entry from symbol ocfs2: fix reflink preserve cleanup issue ocfs2: fix xattr array entry __counted_by error rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() iio: gyro: itg3200: Fix unchecked return value in read_raw dm mpath: make pg_init_delay_msecs settable bus: fsl-mc: fix an error handling in fsl_mc_device_add() md/bitmap: fix GPF in write_page caused by resize race xfs: fix remote xattr valuelblk check xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs: delete attr leaf freemap entries when empty xfs: mark data structures corrupt on EIO and ENODATA mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations drm: of: drm_of_panel_bridge_remove(): fix device_node leak dm-unstripe: fix mapping bug when there are multiple targets in a table clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() dm: clear cloned request bio pointer when last clone bio completes media: i2c/tw9906: Fix potential memory leak in tw9906_probe() media: i2c/tw9903: Fix potential memory leak in tw9903_probe() media: cx25821: Add missing unmap in snd_cx25821_hw_params() media: cx23885: Add missing unmap in snd_cx23885_hw_params() media: cx88: Add missing unmap in snd_cx88_hw_params() media: radio-keene: fix memory leak in error path HID: prodikeys: Check presence of pm->input_ep82 HID: magicmouse: Do not crash on missing msc->input HID: hid-pl: handle probe errors media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() dm-verity: correctly handle dm_bufio_client_create() failure fpga: dfl: use subsys_initcall to allow built-in drivers to be added rpmsg: core: fix race in driver_override_show() and use core helper netfilter: nf_conntrack_h323: fix OOB read in decode_choice() net: consume xmit errors of GSO frames Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ Bluetooth: l2cap: Check encryption key size on incoming connection wifi: cfg80211: wext: fix IGTK key ID off-by-one net: usb: lan78xx: scan all MDIO addresses on LAN7801 lan78xx: Fix memory allocation bug lan78xx: Fix race condition in disconnect handling lan78xx: Remove unused pause frame queue net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access drm/radeon: Add HAINAN clock adjustment drm/amdgpu: Add HAINAN clock adjustment ARM: 9467/1: mm: Don't use %pK through printk include: uapi: netfilter_bridge.h: Cover for musl libc iio: magnetometer: Remove IRQF_ONESHOT Revert "mfd: da9052-spi: Change read-mask to write-mask" binder: don't use %pK through printk serial: 8250_dw: handle clock enable errors in runtime_resume m68k: nommu: fix memmove() with differently aligned src and dest for 68000 clk: microchip: core: correct return value on *_get_parent() nfc: nxp-nci: remove interrupt trigger type myri10ge: avoid uninitialized variable use PCI: Mark Nvidia GB10 to avoid bus reset PCI: Fix pci_slot_lock () device locking PCI: Mark ASM1164 SATA controller to avoid bus reset net/rds: Clear reconnect pending bit vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 net: usb: sr9700: remove code to drive nonexistent multicast filter Bluetooth: btusb: Add device ID for Realtek RTL8761BU Bluetooth: hci_conn: use mod_delayed_work for active mode timeout ipv4: fib: Annotate access to struct fib_alias.fa_state. wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() net/rds: No shortcut out of RDS_CONN_ERROR net: usb: r8152: fix transmit queue timeout openrisc: define arch-specific version of nop() netfilter: xt_tcpmss: check remaining length before reading optlen wifi: libertas: fix WARNING in usb_tx_block jfs: nlink overflow in jfs_rename jfs: Add missing set_freezable() for freezable kthread modpost: Amend ppc64 save/restfpr symnames for -Os build ASoC: es8328: Add error unwind in resume HID: multitouch: add eGalaxTouch EXC3188 support drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback virt: vbox: uapi: Mark inner unions in packed structs as packed hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed drm: Account property blob allocations to memcg media: cx25821: Fix a resource leak in cx25821_dev_setup() media: solo6x10: Check for out of bounds chip_id media: pvrusb2: fix URB leak in pvr2_send_request_ex media: adv7180: fix frame interval in progressive mode ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask media: omap3isp: set initial format media: omap3isp: isppreview: always clamp in preview_try_format() media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes media: dvb-core: dmxdevfilter must always flush bufs parisc: Prevent interrupts during reboot arm64: tegra: smaug: Add usb-role-switch support pstore: ram_core: fix incorrect success return when vmap() fails mailbox: bcm-ferxrm-mailbox: Use default primary handler clocksource/drivers/sh_tmu: Always leave device running after probe sparc: don't reference obsolete termio struct for TC* constants xenbus: Use .freeze/.thaw to handle xenbus devices ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP EFI/CPER: don't go past the ARM processor CPER record buffer x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS tools/power cpupower: Reset errno before strtoull() minix: Add required sanity checking to minix_check_superblock() hfsplus: pretend special inodes as regular files audit: add missing syscalls to read class hfsplus: fix volume corruption issue for generic/498 audit: add fchmodat2() to change attributes class rtc: interface: Alarm race handling should not discard preceding error SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths ata: pata_ftide010: Fix some DMA timings ext4: fix memory leak in ext4_ext_shift_extents() MIPS: Work around LLVM bug when gp is used as global register variable apparmor: fix invalid deref of rawdata when export_binary is unset apparmor: fix rlimit for posix cpu timers apparmor: fix NULL sock in aa_sock_file_perm bonding: alb: fix UAF in rlb_arp_recv during bond up/down macvlan: observe an RCU grace period in macvlan_common_newlink() error path netfilter: nf_conntrack_h323: don't pass uninitialised l3num value net/rds: rds_sendmsg should not discard payload_len xen-netback: reject zero-queue configuration from guest net: usb: catc: enable basic endpoint checking usbb: catc: use correct API for MAC addresses cpuidle: Skip governor when only one idle state is available pinctrl: single: fix refcount leak in pcs_add_gpio_func() iio: sca3000: Fix a resource leak in sca3000_probe() ovl: Fix uninit-value in ovl_fill_real drivers: iio: mpu3050: use dev_err_probe for regulator request mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms mmc: core: Initial support for SD express card/host serial: SH_SCI: improve "DMA support" prompt staging: greybus: lights: avoid NULL deref fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros scsi: csiostor: Fix dereference of null pointer rn pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN svcrdma: Remove queue-shortening warnings RDMA/core: Fix a couple of obvious typos in comments power: supply: wm97xx_battery: Convert to GPIO descriptor power: supply: bq27xxx: fix wrong errno when bus ops are unsupported power: supply: sbs-battery: Fix use-after-free in power_supply_changed() power: supply: rt9455: Fix use-after-free in power_supply_changed() power: supply: act8945a: Fix use-after-free in power_supply_changed() serial: caif: fix use-after-free in caif_serial ldisc_close() net: atm: fix crash due to unvalidated vcc pointer in sigd_send() procfs: fix missing RCU protection when reading real_parent in do_task_stat() netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets netfilter: nft_set_hash: fix get operation on big endian bonding: only set speed/duplex to unknown, if getting speed failed ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() tcp: tcp_tx_timestamp() must look at the rtx queue fat: avoid parent link count underflow in rmdir PCI: Mark 3ware-9650SA Root Port Extended Tags as broken netfilter: nf_conncount: fix tracking of connections from localhost netfilter: nf_conncount: increase the connection clean up limit to 64 netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH wifi: cfg80211: stop NAN and P2P in cfg80211_leave PCI/portdrv: Fix potential resource leak PCI: Do not attempt to set ExtTag for VFs PCI: mediatek: Fix IRQ domain leak when MSI allocation fails Revert "hwmon: (ibmpex) fix use-after-free in high/low store" spi: tools: Add include folder to .gitignore regulator: Flag uncontrollable regulators as always_on regulator: core: Respect off_on_delay at startup smack: /smack/doi: accept previously used values smack: /smack/doi must be > 0 arm64: dts: amlogic: gx: assign the MMC signal clocks ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() pstore/ram: fix buffer overflow in persistent_ram_save_old() sched/rt: Skip currently executing CPU in rto_next_cpu() mfd: wm8350-core: Use IRQF_ONESHOT EDAC/altera: Remove IRQF_ONESHOT hrtimer: Fix trace oddity crypto: cavium - fix dma_free_coherent() size s390/cio: Fix device lifecycle handling in css_alloc_subchannel() PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races md/raid10: fix any_working flag handling in raid10_sync_request tpm: st33zp24: Fix missing cleanup on get_burstcount() error tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure gfs2: Add metapath_dibh helper gfs2: Add wrapper for iomap_file_buffered_write fs: add <linux/init_task.h> for 'init_fs' hfsplus: return error when node already exists in hfs_bnode_create auxdisplay: arm-charlcd: fix release_mem_region() size RDMA/umad: Reject negative data_len in ib_umad_write Change-Id: Ice1efa8b2faaaab14d1d1563e5aa6ae36549682b |
|||
| 4f08164da0 |
fixup! BACKPORT: fuse: name fs_context consistently
This is a follow-up to commit
|
|||
| 5e7cd3d01b |
nfsd: fix return error code for nfsd_map_name_to_[ug]id
[ Upstream commit 404d779466646bf1461f2090ff137e99acaecf42 ]
idmap lookups can time out while the cache is waiting for a userspace
upcall reply. In that case cache_check() returns -ETIMEDOUT to callers.
The nfsd_map_name_to_[ug]id functions currently proceed with attempting
to map the id to a kuid despite a potentially temporary failure to
perform the idmap lookup. This results in the code returning the error
NFSERR_BADOWNER which can cause client operations to return to userspace
with failure.
Fix this by returning the failure status before attempting kuid mapping.
This will return NFSERR_JUKEBOX on idmap lookup timeout so that clients
can retry the operation instead of aborting it.
Fixes:
|
|||
| 3656ec552a |
ext4: don't cache extent during splitting extent
commit 8b4b19a2f96348d70bfa306ef7d4a13b0bcbea79 upstream. Caching extents during the splitting process is risky, as it may result in stale extents remaining in the status tree. Moreover, in most cases, the corresponding extent block entries are likely already cached before the split happens, making caching here not particularly useful. Assume we have an unwritten extent, and then DIO writes the first half. [UUUUUUUUUUUUUUUU] on-disk extent U: unwritten extent [UUUUUUUUUUUUUUUU] extent status tree |<- ->| ----> dio write this range First, when ext4_split_extent_at() splits this extent, it truncates the existing extent and then inserts a new one. During this process, this extent status entry may be shrunk, and calls to ext4_find_extent() and ext4_cache_extents() may occur, which could potentially insert the truncated range as a hole into the extent status tree. After the split is completed, this hole is not replaced with the correct status. [UUUUUUU|UUUUUUUU] on-disk extent U: unwritten extent [UUUUUUU|HHHHHHHH] extent status tree H: hole Then, the outer calling functions will not correct this remaining hole extent either. Finally, if we perform a delayed buffer write on this latter part, it will re-insert the delayed extent and cause an error in space accounting. In adition, if the unwritten extent cache is not shrunk during the splitting, ext4_cache_extents() also conflicts with existing extents when caching extents. In the future, we will add checks when caching extents, which will trigger a warning. Therefore, Do not cache extents that are being split. Signed-off-by: Zhang Yi <yi.zhang@huawei.com> Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com> Reviewed-by: Baokun Li <libaokun1@huawei.com> Cc: stable@kernel.org Message-ID: <20251129103247.686136-6-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [uli: backport to 4.19] Signed-off-by: Ulrich Hecht <uli@kernel.org> Reviewed-by: Pavel Machek <pavel@nabladev.com> |
|||
| c4a52ea236 |
ceph: supply snapshot context in ceph_zero_partial_object()
[ Upstream commit f16bd3fa74a2084ee7e16a8a2be7e7399b970907 ]
The ceph_zero_partial_object function was missing proper snapshot
context for its OSD write operations, which could lead to data
inconsistencies in snapshots.
Reproducer:
../src/vstart.sh --new -x --localhost --bluestore
./bin/ceph auth caps client.fs_a mds 'allow rwps fsname=a' mon 'allow r fsname=a' osd 'allow rw tag cephfs data=a'
mount -t ceph fs_a@.a=/ /mnt/mycephfs/ -o conf=./ceph.conf
dd if=/dev/urandom of=/mnt/mycephfs/foo bs=64K count=1
mkdir /mnt/mycephfs/.snap/snap1
md5sum /mnt/mycephfs/.snap/snap1/foo
fallocate -p -o 0 -l 4096 /mnt/mycephfs/foo
echo 3 > /proc/sys/vm/drop/caches
md5sum /mnt/mycephfs/.snap/snap1/foo # get different md5sum!!
Cc: stable@vger.kernel.org
Fixes:
|
|||
| e2312f99fe |
btrfs: continue trimming remaining devices on failure
[ Upstream commit 912d1c6680bdb40b72b1b9204706f32b6eb842c3 ]
Commit 93bba24d4b5a ("btrfs: Enhance btrfs_trim_fs function to handle
error better") intended to make device trimming continue even if one
device fails, tracking failures and reporting them at the end. However,
it used 'break' instead of 'continue', causing the loop to exit on the
first device failure.
Fix this by replacing 'break' with 'continue'.
Fixes: 93bba24d4b5a ("btrfs: Enhance btrfs_trim_fs function to handle error better")
CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Robbie Ko <robbieko@synology.com>
Signed-off-by: jinbaohong <jinbaohong@synology.com>
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
|
|||
| ba34e08ef0 |
ocfs2: fix reflink preserve cleanup issue
[ Upstream commit 5138c936c2c82c9be8883921854bc6f7e1177d8c ]
commit c06c303832ec ("ocfs2: fix xattr array entry __counted_by error")
doesn't handle all cases and the cleanup job for preserved xattr entries
still has bug:
- the 'last' pointer should be shifted by one unit after cleanup
an array entry.
- current code logic doesn't cleanup the first entry when xh_count is 1.
Note, commit c06c303832ec is also a bug fix for
|
|||
| 4a42c92c99 |
ocfs2: fix xattr array entry __counted_by error
[ Upstream commit c06c303832ecd5edef90c6817a6eb0eb7fed7a64 ]
Commit 2f26f58df041 ("ocfs2: annotate flexible array members with
__counted_by_le()") started annotating the flexible arrays used by
ocfs2, and now gcc complains about ocfs2_reflink_xattr_header():
In function ‘fortify_memset_chk’,
inlined from ‘ocfs2_reflink_xattr_header’ at fs/ocfs2/xattr.c:6365:5:
include/linux/fortify-string.h:480:25: error: call to ‘__write_overflow_field’ declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
and it looks like the complaint is valid - even if the actual error
message is somewhat confusing.
The 'last' pointer points to past the end of the counted flex array, but
is used as an actual 'last' entry rather than a 'one-past-last'.
It looks like the code copied and cleared an extra entry (which is
likely harmless in practice), but I don't know ocfs2 at all. Because
it's also possible that the counted-by annotations are off-by-one, and
so this needs checking by somebody who actually knows ocfs2.
But in the meantime this fixes the build error, and certainly _looks_
sane.
Cc: Dmitry Antipov <dmantipov@yandex.ru>
Cc: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
|
|||
| a1d55bf1b4 |
xfs: fix remote xattr valuelblk check
[ Upstream commit bd3138e8912c9db182eac5fed1337645a98b7a4f ]
In debugging other problems with generic/753, it turns out that it's
possible for the system go to down in the middle of a remote xattr set
operation such that the leaf block entry is marked incomplete and
valueblk is set to zero. Make this no longer a failure.
Cc: <stable@vger.kernel.org> # v4.15
Fixes:
|
|||
| fc63b764bd |
xfs: fix freemap adjustments when adding xattrs to leaf blocks
[ Upstream commit 3eefc0c2b78444b64feeb3783c017d6adc3cd3ce ]
xfs/592 and xfs/794 both trip this assertion in the leaf block freemap
adjustment code after ~20 minutes of running on my test VMs:
ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t)
+ xfs_attr3_leaf_hdr_size(leaf));
Upon enabling quite a lot more debugging code, I narrowed this down to
fsstress trying to set a local extended attribute with namelen=3 and
valuelen=71. This results in an entry size of 80 bytes.
At the start of xfs_attr3_leaf_add_work, the freemap looks like this:
i 0 base 448 size 0 rhs 448 count 46
i 1 base 388 size 132 rhs 448 count 46
i 2 base 2120 size 4 rhs 448 count 46
firstused = 520
where "rhs" is the first byte past the end of the leaf entry array.
This is inconsistent -- the entries array ends at byte 448, but
freemap[1] says there's free space starting at byte 388!
By the end of the function, the freemap is in worse shape:
i 0 base 456 size 0 rhs 456 count 47
i 1 base 388 size 52 rhs 456 count 47
i 2 base 2120 size 4 rhs 456 count 47
firstused = 440
Important note: 388 is not aligned with the entries array element size
of 8 bytes.
Based on the incorrect freemap, the name area starts at byte 440, which
is below the end of the entries array! That's why the assertion
triggers and the filesystem shuts down.
How did we end up here? First, recall from the previous patch that the
freemap array in an xattr leaf block is not intended to be a
comprehensive map of all free space in the leaf block. In other words,
it's perfectly legal to have a leaf block with:
* 376 bytes in use by the entries array
* freemap[0] has [base = 376, size = 8]
* freemap[1] has [base = 388, size = 1500]
* the space between 376 and 388 is free, but the freemap stopped
tracking that some time ago
If we add one xattr, the entries array grows to 384 bytes, and
freemap[0] becomes [base = 384, size = 0]. So far, so good. But if we
add a second xattr, the entries array grows to 392 bytes, and freemap[0]
gets pushed up to [base = 392, size = 0]. This is bad, because
freemap[1] hasn't been updated, and now the entries array and the free
space claim the same space.
The fix here is to adjust all freemap entries so that none of them
collide with the entries array. Note that this fix relies on commit
2a2b5932db6758 ("xfs: fix attr leaf header freemap.size underflow") and
the previous patch that resets zero length freemap entries to have
base = 0.
Cc: <stable@vger.kernel.org> # v2.6.12
Fixes:
|
|||
| d5b375ee6c |
xfs: delete attr leaf freemap entries when empty
[ Upstream commit 6f13c1d2a6271c2e73226864a0e83de2770b6f34 ]
Back in commit 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size
underflow"), Brian Foster observed that it's possible for a small
freemap at the end of the end of the xattr entries array to experience
a size underflow when subtracting the space consumed by an expansion of
the entries array. There are only three freemap entries, which means
that it is not a complete index of all free space in the leaf block.
This code can leave behind a zero-length freemap entry with a nonzero
base. Subsequent setxattr operations can increase the base up to the
point that it overlaps with another freemap entry. This isn't in and of
itself a problem because the code in _leaf_add that finds free space
ignores any freemap entry with zero size.
However, there's another bug in the freemap update code in _leaf_add,
which is that it fails to update a freemap entry that begins midway
through the xattr entry that was just appended to the array. That can
result in the freemap containing two entries with the same base but
different sizes (0 for the "pushed-up" entry, nonzero for the entry
that's actually tracking free space). A subsequent _leaf_add can then
allocate xattr namevalue entries on top of the entries array, leading to
data loss. But fixing that is for later.
For now, eliminate the possibility of confusion by zeroing out the base
of any freemap entry that has zero size. Because the freemap is not
intended to be a complete index of free space, a subsequent failure to
find any free space for a new xattr will trigger block compaction, which
regenerates the freemap.
It looks like this bug has been in the codebase for quite a long time.
Cc: <stable@vger.kernel.org> # v2.6.12
Fixes:
|
|||
| 12f14c9aba |
xfs: mark data structures corrupt on EIO and ENODATA
[ Upstream commit f39854a3fb2f06dc69b81ada002b641ba5b4696b ]
I learned a few things this year: first, blk_status_to_errno can return
ENODATA for critical media errors; and second, the scrub code doesn't
mark data structures as corrupt on ENODATA or EIO.
Currently, scrub failing to capture these errors isn't all that
impactful -- the checking code will exit to userspace with EIO/ENODATA,
and xfs_scrub will log a complaint and exit with nonzero status. Most
people treat fsck tools failing as a sign that the fs is corrupt, but
online fsck should mark the metadata bad and keep moving.
Cc: stable@vger.kernel.org # v4.15
Fixes:
|
|||
| 6ccc288f1f |
jfs: nlink overflow in jfs_rename
[ Upstream commit 9218dc26fd922b09858ecd3666ed57dfd8098da8 ] If nlink is maximal for a directory (-1) and inside that directory you perform a rename for some child directory (not moving from the parent), then the nlink of the first directory is first incremented and later decremented. Normally this is fine, but when nlink = -1 this causes a wrap around to 0, and then drop_nlink issues a warning. After applying the patch syzbot no longer issues any warnings. I also ran some basic fs tests to look for any regressions. Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl> Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com Closes: https://syzbot.org/bug?extid=9131ddfd7870623b719f Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
|||
| 88a9b8a2d6 |
jfs: Add missing set_freezable() for freezable kthread
[ Upstream commit eb0cfcf265714b419cc3549895a00632e76732ae ] The jfsIOWait() thread calls try_to_freeze() but lacks set_freezable(), causing it to remain non-freezable by default. This prevents proper freezing during system suspend. Add set_freezable() to make the thread freezable as intended. Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn> Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
|||
| eaeeb2132c |
pstore: ram_core: fix incorrect success return when vmap() fails
[ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ] In persistent_ram_vmap(), vmap() may return NULL on failure. If offset is non-zero, adding offset_in_page(start) causes the function to return a non-NULL pointer even though the mapping failed. persistent_ram_buffer_map() therefore incorrectly returns success. Subsequent access to prz->buffer may dereference an invalid address and cause crashes. Add proper NULL checking for vmap() failures. Signed-off-by: Ruipeng Qi <ruipengqi3@gmail.com> Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com Signed-off-by: Kees Cook <kees@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
|||
| aed06b0e7d |
minix: Add required sanity checking to minix_check_superblock()
[ Upstream commit 8c97a6ddc95690a938ded44b4e3202f03f15078c ] The fs/minix implementation of the minix filesystem does not currently support any other value for s_log_zone_size than 0. This is also the only value supported in util-linux; see mkfs.minix.c line 511. In addition, this patch adds some sanity checking for the other minix superblock fields, and moves the minix_blocks_needed() checks for the zmap and imap also to minix_check_super_block(). This also closes a related syzbot bug report. Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl> Link: https://patch.msgid.link/20251208153947.108343-1-jkoolstra@xs4all.nl Reviewed-by: Jan Kara <jack@suse.cz> Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2 Signed-off-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
|||
| cd9ce69578 |
hfsplus: pretend special inodes as regular files
[ Upstream commit ed8889ca21b6ab37bc1435c4009ce37a79acb9e6 ]
Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/
S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes.
Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/d0a07b1b-8b73-4002-8e29-e2bd56871262@I-love.SAKURA.ne.jp
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
|
|||
| 753b564530 |
hfsplus: fix volume corruption issue for generic/498
[ Upstream commit 9a8c4ad44721da4c48e1ff240ac76286c82837fe ] The xfstests' test-case generic/498 leaves HFS+ volume in corrupted state: sudo ./check generic/498 FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/498 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent (see XFSTESTS-2/xfstests-dev/results//generic/498.full for details) Ran: generic/498 Failures: generic/498 Failed 1 of 1 tests sudo fsck.hfsplus -d /dev/loop51 ** /dev/loop51 Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. Executing fsck_hfs (version 540.1-Linux). ** Checking non-journaled HFS Plus Volume. The volume name is untitled ** Checking extents overflow file. ** Checking catalog file. Invalid leaf record count (It should be 16 instead of 2) ** Checking multi-linked files. CheckHardLinks: found 1 pre-Leopard file inodes. ** Checking catalog hierarchy. ** Checking extended attributes file. ** Checking volume bitmap. ** Checking volume information. Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000 CBTStat = 0x8000 CatStat = 0x00000000 ** Repairing volume. ** Rechecking volume. ** Checking non-journaled HFS Plus Volume. The volume name is untitled ** Checking extents overflow file. ** Checking catalog file. ** Checking multi-linked files. CheckHardLinks: found 1 pre-Leopard file inodes. ** Checking catalog hierarchy. ** Checking extended attributes file. ** Checking volume bitmap. ** Checking volume information. ** The volume untitled was repaired successfully. The generic/498 test executes such steps on final phase: mkdir $SCRATCH_MNT/A mkdir $SCRATCH_MNT/B mkdir $SCRATCH_MNT/A/C touch $SCRATCH_MNT/B/foo $XFS_IO_PROG -c "fsync" $SCRATCH_MNT/B/foo ln $SCRATCH_MNT/B/foo $SCRATCH_MNT/A/C/foo $XFS_IO_PROG -c "fsync" $SCRATCH_MNT/A "Simulate a power failure and mount the filesystem to check that what we explicitly fsync'ed exists." _flakey_drop_and_remount The FSCK tool complains about "Invalid leaf record count". HFS+ b-tree header contains leaf_count field is updated by hfs_brec_insert() and hfs_brec_remove(). The hfs_brec_insert() is involved into hard link creation process. However, modified in-core leaf_count field is stored into HFS+ b-tree header by hfs_btree_write() method. But, unfortunately, hfs_btree_write() hasn't been called by hfsplus_cat_write_inode() and hfsplus_file_fsync() stores not fully consistent state of the Catalog File's b-tree. This patch adds calling hfs_btree_write() method in the hfsplus_cat_write_inode() with the goal of storing consistent state of Catalog File's b-tree. Finally, it makes FSCK tool happy. sudo ./check generic/498 FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #22 SMP PREEMPT_DYNAMIC Sat Dec 6 17:01:31 PST 2025 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/498 33s ... 31s Ran: generic/498 Passed all 1 tests Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com> cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> cc: Yangtao Li <frank.li@vivo.com> cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/20251207035821.3863657-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
|||
| 6894a6cdec |
ext4: fix memory leak in ext4_ext_shift_extents()
commit ca81109d4a8f192dc1cbad4a1ee25246363c2833 upstream.
In ext4_ext_shift_extents(), if the extent is NULL in the while loop, the
function returns immediately without releasing the path obtained via
ext4_find_extent(), leading to a memory leak.
Fix this by jumping to the out label to ensure the path is properly
released.
Fixes:
|
|||
| a775115f3b |
ovl: Fix uninit-value in ovl_fill_real
[ Upstream commit 1992330d90dd766fcf1730fd7bf2d6af65370ac4 ]
Syzbot reported a KMSAN uninit-value issue in ovl_fill_real.
This iusse's call chain is:
__do_sys_getdents64()
-> iterate_dir()
...
-> ext4_readdir()
-> fscrypt_fname_alloc_buffer() // alloc
-> fscrypt_fname_disk_to_usr // write without tail '\0'
-> dir_emit()
-> ovl_fill_real() // read by strcmp()
The string is used to store the decrypted directory entry name for an
encrypted inode. As shown in the call chain, fscrypt_fname_disk_to_usr()
write it without null-terminate. However, ovl_fill_real() uses strcmp() to
compare the name against "..", which assumes a null-terminated string and
may trigger a KMSAN uninit-value warning when the buffer tail contains
uninit data.
Reported-by: syzbot+d130f98b2c265fae5297@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d130f98b2c265fae5297
Fixes:
|
|||
| b90efb6f00 |
pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN
[ Upstream commit 5248d8474e594d156bee1ed10339cc16e207a28b ] It is possible to have a task get stuck on waiting on the NFS_LAYOUT_DRAIN in the following scenario 1. cpu a: waiter test NFS_LAYOUT_DRAIN (1) and plh_outstanding (1) 2. cpu b: atomic_dec_and_test() -> clear bit -> wake up 3. cpu c: sets NFS_LAYOUT_DRAIN again 4. cpu a: calls wait_on_bit() sleeps forever. To expand on this we have say 2 outstanding pnfs write IO that get ESTALE which causes both to call pnfs_destroy_layout() and set the NFS_LAYOUT_DRAIN bit but the 1st one doesn't call the pnfs_put_layout_hdr() yet (as that would prevent the 2nd ESTALE write from trying to call pnfs_destroy_layout()). If the 1st ESTALE write is the one that initially sets the NFS_LAYOUT_DRAIN so that new IO on this file initiates new LAYOUTGET. Another new write would find NFS_LAYOUT_DRAIN set and phl_outstanding>0 (step 1) and would wait_on_bit(). LAYOUTGET completes doing step 2. Now, the 2nd of ESTALE writes is calling pnfs_destory_layout() and set the NFS_LAYOUT_DRAIN bit (step 3). Finally, the waiting write wakes up to check the bit and goes back to sleep. The problem revolves around the fact that if NFS_LAYOUT_INVALID_STID was already set, it should not do the work of pnfs_mark_layout_stateid_invalid(), thus NFS_LAYOUT_DRAIN will not be set more than once for an invalid layout. Suggested-by: Trond Myklebust <trond.myklebust@hammerspace.com> Fixes: 880265c77ac4 ("pNFS: Avoid a live lock condition in pnfs_update_layout()") Signed-off-by: Olga Kornievskaia <okorniev@redhat.com> Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
|||
| dc487ccdbe |
procfs: fix missing RCU protection when reading real_parent in do_task_stat()
[ Upstream commit 76149d53502cf17ef3ae454ff384551236fba867 ]
When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent
without proper RCU protection, which leads to:
cpu 0 cpu 1
----- -----
do_task_stat
var = task->real_parent
release_task
call_rcu(delayed_put_task_struct)
task_tgid_nr_ns(var)
rcu_read_lock <--- Too late to protect task->real_parent!
task_pid_ptr <--- UAF!
rcu_read_unlock
This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add
proper RCU protection for accessing task->real_parent.
Link: https://lkml.kernel.org/r/20260128083007.3173016-1-alexjlzheng@tencent.com
Fixes:
|
|||
| 31e8035b62 |
fat: avoid parent link count underflow in rmdir
[ Upstream commit 8cafcb881364af5ef3a8b9fed4db254054033d8a ]
Corrupted FAT images can leave a directory inode with an incorrect
i_nlink (e.g. 2 even though subdirectories exist). rmdir then
unconditionally calls drop_nlink(dir) and can drive i_nlink to 0,
triggering the WARN_ON in drop_nlink().
Add a sanity check in vfat_rmdir() and msdos_rmdir(): only drop the
parent link count when it is at least 3, otherwise report a filesystem
error.
Link: https://lkml.kernel.org/r/20260101111148.1437-1-zhiyuzhang999@gmail.com
Fixes:
|
|||
| ac13d7ba72 |
pstore/ram: fix buffer overflow in persistent_ram_save_old()
[ Upstream commit 5669645c052f235726a85f443769b6fc02f66762 ]
persistent_ram_save_old() can be called multiple times for the same
persistent_ram_zone (e.g., via ramoops_pstore_read -> ramoops_get_next_prz
for PSTORE_TYPE_DMESG records).
Currently, the function only allocates prz->old_log when it is NULL,
but it unconditionally updates prz->old_log_size to the current buffer
size and then performs memcpy_fromio() using this new size. If the
buffer size has grown since the first allocation (which can happen
across different kernel boot cycles), this leads to:
1. A heap buffer overflow (OOB write) in the memcpy_fromio() calls
2. A subsequent OOB read when ramoops_pstore_read() accesses the buffer
using the incorrect (larger) old_log_size
The KASAN splat would look similar to:
BUG: KASAN: slab-out-of-bounds in ramoops_pstore_read+0x...
Read of size N at addr ... by task ...
The conditions are likely extremely hard to hit:
0. Crash with a ramoops write of less-than-record-max-size bytes.
1. Reboot: ramoops registers, pstore_get_records(0) reads old crash,
allocates old_log with size X
2. Crash handler registered, timer started (if pstore_update_ms >= 0)
3. Oops happens (non-fatal, system continues)
4. pstore_dump() writes oops via ramoops_pstore_write() size Y (>X)
5. pstore_new_entry = 1, pstore_timer_kick() called
6. System continues running (not a panic oops)
7. Timer fires after pstore_update_ms milliseconds
8. pstore_timefunc() → schedule_work() → pstore_dowork() → pstore_get_records(1)
9. ramoops_get_next_prz() → persistent_ram_save_old()
10. buffer_size() returns Y, but old_log is X bytes
11. Y > X: memcpy_fromio() overflows heap
Requirements:
- a prior crash record exists that did not fill the record size
(almost impossible since the crash handler writes as much as it
can possibly fit into the record, capped by max record size and
the kmsg buffer almost always exceeds the max record size)
- pstore_update_ms >= 0 (disabled by default)
- Non-fatal oops (system survives)
Free and reallocate the buffer when the new size differs from the
previously allocated size. This ensures old_log always has sufficient
space for the data being copied.
Fixes:
|
|||
| b44f18478d |
gfs2: Add metapath_dibh helper
[ Upstream commit 92099f0c92270c8c7a79e6bc6e0312ad248ea331 ] Add a metapath_dibh() helper for extracting the inode's buffer head from a metapath. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> Stable-dep-of: faddeb848305 ("gfs2: Fix use-after-free in iomap inline data write path") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
|||
| 282ee00be7 |
gfs2: Add wrapper for iomap_file_buffered_write
[ Upstream commit 2eb7509a05443048fb4df60b782de3f03c6c298b ] Add a wrapper around iomap_file_buffered_write. We'll add code for when the operation needs to be retried here later. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> Stable-dep-of: faddeb848305 ("gfs2: Fix use-after-free in iomap inline data write path") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
|||
| 7b51f06ac2 |
fs: add <linux/init_task.h> for 'init_fs'
[ Upstream commit 589cff4975afe1a4eaaa1d961652f50b1628d78d ]
The init_fs symbol is defined in <linux/init_task.h> but was
not included in fs/fs_struct.c so fix by adding the include.
Fixes the following sparse warning:
fs/fs_struct.c:150:18: warning: symbol 'init_fs' was not declared. Should it be static?
Fixes:
|
|||
| f159703caf |
hfsplus: return error when node already exists in hfs_bnode_create
[ Upstream commit d8a73cc46c8462a969a7516131feb3096f4c49d3 ]
When hfs_bnode_create() finds that a node is already hashed (which should
not happen in normal operation), it currently returns the existing node
without incrementing its reference count. This causes a reference count
inconsistency that leads to a kernel panic when the node is later freed
in hfs_bnode_put():
kernel BUG at fs/hfsplus/bnode.c:676!
BUG_ON(!atomic_read(&node->refcnt))
This scenario can occur when hfs_bmap_alloc() attempts to allocate a node
that is already in use (e.g., when node 0's bitmap bit is incorrectly
unset), or due to filesystem corruption.
Returning an existing node from a create path is not normal operation.
Fix this by returning ERR_PTR(-EEXIST) instead of the node when it's
already hashed. This properly signals the error condition to callers,
which already check for IS_ERR() return values.
Reported-by: syzbot+1c8ff72d0cd8a50dfeaa@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=1c8ff72d0cd8a50dfeaa
Link: https://lore.kernel.org/all/784415834694f39902088fa8946850fc1779a318.camel@ibm.com/
Fixes:
|
|||
| f69557e492 |
BACKPORT: treewide: remove redundant IS_ERR() before error code check
'PTR_ERR(p) == -E*' is a stronger condition than IS_ERR(p). Hence, IS_ERR(p) is unneeded. The semantic patch that generates this commit is as follows: // <smpl> @@ expression ptr; constant error_code; @@ -IS_ERR(ptr) && (PTR_ERR(ptr) == - error_code) +PTR_ERR(ptr) == - error_code // </smpl> Link: http://lkml.kernel.org/r/20200106045833.1725-1-masahiroy@kernel.org Change-Id: I1d46dd54246dc9e43dc903c0f4dbd279947afe42 Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> Cc: Julia Lawall <julia.lawall@lip6.fr> Acked-by: Stephen Boyd <sboyd@kernel.org> [drivers/clk/clk.c] Acked-by: Bartosz Golaszewski <bgolaszewski@baylibre.com> [GPIO] Acked-by: Wolfram Sang <wsa@the-dreams.de> [drivers/i2c] Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> [acpi/scan.c] Acked-by: Rob Herring <robh@kernel.org> Cc: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
|||
| dea3a5dbe1 |
UPSTREAM: f2fs: fix to truncate preallocated blocks in f2fs_file_open()
chenyuwen reports a f2fs bug as below:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000011
fscrypt_set_bio_crypt_ctx+0x78/0x1e8
f2fs_grab_read_bio+0x78/0x208
f2fs_submit_page_read+0x44/0x154
f2fs_get_read_data_page+0x288/0x5f4
f2fs_get_lock_data_page+0x60/0x190
truncate_partial_data_page+0x108/0x4fc
f2fs_do_truncate_blocks+0x344/0x5f0
f2fs_truncate_blocks+0x6c/0x134
f2fs_truncate+0xd8/0x200
f2fs_iget+0x20c/0x5ac
do_garbage_collect+0x5d0/0xf6c
f2fs_gc+0x22c/0x6a4
f2fs_disable_checkpoint+0xc8/0x310
f2fs_fill_super+0x14bc/0x1764
mount_bdev+0x1b4/0x21c
f2fs_mount+0x20/0x30
legacy_get_tree+0x50/0xbc
vfs_get_tree+0x5c/0x1b0
do_new_mount+0x298/0x4cc
path_mount+0x33c/0x5fc
__arm64_sys_mount+0xcc/0x15c
invoke_syscall+0x60/0x150
el0_svc_common+0xb8/0xf8
do_el0_svc+0x28/0xa0
el0_svc+0x24/0x84
el0t_64_sync_handler+0x88/0xec
It is because inode.i_crypt_info is not initialized during below path:
- mount
- f2fs_fill_super
- f2fs_disable_checkpoint
- f2fs_gc
- f2fs_iget
- f2fs_truncate
So, let's relocate truncation of preallocated blocks to f2fs_file_open(),
after fscrypt_file_open().
Bug: 455892000
Fixes: d4dd19ec1ea0 ("f2fs: do not expose unwritten blocks to user by DIO")
Reported-by: chenyuwen <yuwen.chen@xjmz.com>
Closes: https://lore.kernel.org/linux-kernel/20240517085327.1188515-1-yuwen.chen@xjmz.com
Change-Id: I0ea53cf13eb9b96b943977cca512fe684ef45001
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 298b1e4182d657c3e388adcc29477904e9600ed5)
Signed-off-by: Sandeep Dhavale <dhavale@google.com>
|
|||
| a984488d32 |
Merge tag 'v4.19.325-cip130' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android13-4.19-kona
version 4.19.325-cip130 * tag 'v4.19.325-cip130' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip: CIP: Bump version suffix to -cip130 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.10.251. f2fs: fix out-of-bounds access in sysfs attribute read/write USB: serial: option: add Telit FN920C04 RNDIS compositions f2fs: fix to avoid UAF in f2fs_write_end_io() fbdev: rivafb: fix divide error in nv3_arb() scsi: qla2xxx: Fix bsg_done() causing double free scsi: qla2xxx: Validate sp before freeing associated memory scsi: qla2xxx: Free sp in error path to fix system crash crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req fs: dlm: fix invalid derefence of sb_lvbptr gpiolib: acpi: Fix gpio count with string references platform/x86: classmate-laptop: Add missing NULL pointer checks drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used gpio: sprd: Change sprd_gpio lock to raw_spin_lock gpio: omap: do not register driver in probe() scsi: qla2xxx: Query FW again before proceeding with login scsi: qla2xxx: Delay module unload while fabric scan in progress nilfs2: Fix potential block overflow that cause system hang crypto: virtio - Add spinlock protection with virtqueue notification crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly CIP: Bump version suffix to -cip129 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.10.250. fbdev: ssd1307fb: fix build failure macvlan: fix possible UAF in macvlan_forward_source() HID: uclogic: Correct devm device reference for hidinput input_dev name xfs: set max_agbno to allow sparse alloc of last full inode chunk l2tp: avoid one data-race in l2tp_tunnel_del_work() platform/x86: intel_telemetry: Fix swapped arrays in PSS output macvlan: fix error recovery in macvlan_common_newlink() net: liquidio: Initialize netdev pointer before queue setup platform/x86: intel_telemetry: Fix PSS event register mask platform/x86: toshiba_haps: Fix memory leaks in add/remove routines scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() wifi: cfg80211: Fix bitrate calculation overflow for HE rates wifi: mac80211: collect station statistics earlier when disconnect ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list HID: intel-ish-hid: Reset enum_devices_done before enumeration HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL net: usb: sr9700: support devices with virtual driver CD wifi: wlcore: ensure skb headroom before skb_push wifi: mac80211: ocb: skip rx_no_sta when interface is not joined ARM: 9468/1: fix memset64() on big-endian pinctrl: meson: mark the GPIO controller as sleeping writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 netfilter: nf_tables: typo NULL check in _clone() function ipv6: sr: Fix MAC comparison to be constant-time of: platform: Use default match table for /firmware can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak driver core: fix potential null-ptr-deref in device_add() mei: trace: treat reg parameter as string iio: adc: exynos_adc: fix OF populate on driver rebind scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() dmaengine: stm32: dmamux: fix device leak on route allocation nvme-fc: rename free_ctrl callback to match name pattern net/sched: act_ife: convert comma to semicolon scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() nfc: nci: Fix race between rfkill and nci_unregister_device(). net/mlx5e: Report rx_discards_phy via rx_dropped rocker: fix memory leak in rocker_world_port_post_fini() Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak perf/x86/intel: Do not enable BTS for guests netrom: fix double-free in nr_route_frame() slimbus: core: fix device reference leak on report present slimbus: core: fix runtime PM imbalance on report present wifi: rsi: Fix memory corruption due to not set vif driver data size wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() wifi: ath10k: fix dma_free_coherent() pointer mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() ALSA: ctxfi: Fix potential OOB access in audio mixer handling iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver of: fix reference count leak in of_alias_scan() leds: led-class: Only Add LED to leds_list when it is fully ready net/sched: act_ife: avoid possible NULL deref be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) drm/amd/pm: Don't clear SI SMC table when setting power limit usbnet: limit max_mtu based on device's hard_mtu mISDN: annotate data-race around dev->work ALSA: usb: Increase volume range that triggers a warning regmap: Fix race condition in hwspinlock irqsave routine iio: adc: ad7280a: handle spi_setup() errors in probe() Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA w1: fix redundant counter decrement in w1_attach_slave_device() comedi: dmm32at: serialize use of paged registers crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec net/sched: Enforce that teql can only be used as root qdisc ipvlan: Make the addrs_lock be per port net: fou: rename the source for linking netlink: add a proto specification for FOU gue: Fix skb memleak with inner IP protocol 0. amd-xgbe: avoid misleading per-packet error log sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT sctp: sm_statefuns: Fix spelling mistakes net: usb: dm9601: remove broken SR9700 support macvlan: Fix leaking skb in source mode with nodst option btrfs: fix deadlock in wait_current_trans() due to ignored transaction type dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation dmaengine: lpc18xx-dmamux: fix device leak on route allocation dmaengine: bcm-sba-raid: fix device leak on probe dmaengine: at_hdmac: fix device leak on of_dma_xlate() drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare EDAC/i3200: Fix a resource leak in i3200_probe1() EDAC/x38: Fix a resource leak in x38_probe1() USB: serial: ftdi_sio: add support for PICAXE AXE027 cable USB: serial: option: add Telit LE910 MBIM composition USB: OHCI/UHCI: Add soft dependencies on ehci_platform ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer HID: usbhid: paper over wrong bNumDescriptor field dmaengine: omap-dma: fix dma_pool resource leak in error paths phy: stm32-usphyc: Fix off by one in probe() dmaengine: tegra-adma: Fix use-after-free textsearch: describe @list member in ts_ops search net/sched: sch_qfq: do not free existing class in qfq_change_class() ipv4: ip_gre: make ipgre_header() robust macvlan: Use 'hash' iterators to simplify code macvlan: Add nodst option to macvlan type source pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() Change-Id: I4b06f63aef42258de0c0415a055c47d8e60bba88 |
|||
| ae59d71384 |
f2fs: fix out-of-bounds access in sysfs attribute read/write
[ Upstream commit 98ea0039dbfdd00e5cc1b9a8afa40434476c0955 ]
Some f2fs sysfs attributes suffer from out-of-bounds memory access and
incorrect handling of integer values whose size is not 4 bytes.
For example:
vm:~# echo 65537 > /sys/fs/f2fs/vde/carve_out
vm:~# cat /sys/fs/f2fs/vde/carve_out
65537
vm:~# echo 4294967297 > /sys/fs/f2fs/vde/atgc_age_threshold
vm:~# cat /sys/fs/f2fs/vde/atgc_age_threshold
1
carve_out maps to {struct f2fs_sb_info}->carve_out, which is a 8-bit
integer. However, the sysfs interface allows setting it to a value
larger than 255, resulting in an out-of-range update.
atgc_age_threshold maps to {struct atgc_management}->age_threshold,
which is a 64-bit integer, but its sysfs interface cannot correctly set
values larger than UINT_MAX.
The root causes are:
1. __sbi_store() treats all default values as unsigned int, which
prevents updating integers larger than 4 bytes and causes out-of-bounds
writes for integers smaller than 4 bytes.
2. f2fs_sbi_show() also assumes all default values are unsigned int,
leading to out-of-bounds reads and incorrect access to integers larger
than 4 bytes.
This patch introduces {struct f2fs_attr}->size to record the actual size
of the integer associated with each sysfs attribute. With this
information, sysfs read and write operations can correctly access and
update values according to their real data size, avoiding memory
corruption and truncation.
Fixes:
|
|||
| d6d8cd14b8 |
f2fs: fix to avoid UAF in f2fs_write_end_io()
[ Upstream commit ce2739e482bce8d2c014d76c4531c877f382aa54 ]
As syzbot reported an use-after-free issue in f2fs_write_end_io().
It is caused by below race condition:
loop device umount
- worker_thread
- loop_process_work
- do_req_filebacked
- lo_rw_aio
- lo_rw_aio_complete
- blk_mq_end_request
- blk_update_request
- f2fs_write_end_io
- dec_page_count
- folio_end_writeback
- kill_f2fs_super
- kill_block_super
- f2fs_put_super
: free(sbi)
: get_pages(, F2FS_WB_CP_DATA)
accessed sbi which is freed
In kill_f2fs_super(), we will drop all page caches of f2fs inodes before
call free(sbi), it guarantee that all folios should end its writeback, so
it should be safe to access sbi before last folio_end_writeback().
Let's relocate ckpt thread wakeup flow before folio_end_writeback() to
resolve this issue.
Cc: stable@kernel.org
Fixes:
|
