FAILED: patch "[PATCH] dm-verity: restart or panic on an I/O error" failed to apply to 6.1-stable tree

FAILED: patch "[PATCH] dm-verity: restart or panic on an I/O error" failed to apply to 6.1-stable tree

[gregkh]

The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x e6a3531dd542cb127c8de32ab1e54a48ae19962b
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2024100247-friction-answering-6c42@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^..

Possible dependencies:

e6a3531dd542 ("dm-verity: restart or panic on an I/O error")

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From e6a3531dd542cb127c8de32ab1e54a48ae19962b Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Tue, 24 Sep 2024 15:18:29 +0200
Subject: [PATCH] dm-verity: restart or panic on an I/O error

Maxim Suhanov reported that dm-verity doesn't crash if an I/O error
happens. In theory, this could be used to subvert security, because an
attacker can create sectors that return error with the Write Uncorrectable
command. Some programs may misbehave if they have to deal with EIO.

This commit fixes dm-verity, so that if "panic_on_corruption" or
"restart_on_corruption" was specified and an I/O error happens, the
machine will panic or restart.

This commit also changes kernel_restart to emergency_restart -
kernel_restart calls reboot notifiers and these reboot notifiers may wait
for the bio that failed. emergency_restart doesn't call the notifiers.

Reported-by: Maxim Suhanov <dfirblog@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org

diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
index cf659c8feb29..a95c1b9cc5b5 100644
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -272,8 +272,10 @@ static int verity_handle_err(struct dm_verity *v, enum verity_block_type type,
 	if (v->mode == DM_VERITY_MODE_LOGGING)
 		return 0;
 
-	if (v->mode == DM_VERITY_MODE_RESTART)
-		kernel_restart("dm-verity device corrupted");
+	if (v->mode == DM_VERITY_MODE_RESTART) {
+		pr_emerg("dm-verity device corrupted\n");
+		emergency_restart();
+	}
 
 	if (v->mode == DM_VERITY_MODE_PANIC)
 		panic("dm-verity device corrupted");
@@ -596,6 +598,23 @@ static void verity_finish_io(struct dm_verity_io *io, blk_status_t status)
 	if (!static_branch_unlikely(&use_bh_wq_enabled) || !io->in_bh)
 		verity_fec_finish_io(io);
 
+	if (unlikely(status != BLK_STS_OK) &&
+	    unlikely(!(bio->bi_opf & REQ_RAHEAD)) &&
+	    !verity_is_system_shutting_down()) {
+		if (v->mode == DM_VERITY_MODE_RESTART ||
+		    v->mode == DM_VERITY_MODE_PANIC)
+			DMERR_LIMIT("%s has error: %s", v->data_dev->name,
+					blk_status_to_str(status));
+
+		if (v->mode == DM_VERITY_MODE_RESTART) {
+			pr_emerg("dm-verity device corrupted\n");
+			emergency_restart();
+		}
+
+		if (v->mode == DM_VERITY_MODE_PANIC)
+			panic("dm-verity device corrupted");
+	}
+
 	bio_endio(bio);
 }
 

Re: FAILED: patch "[PATCH] dm-verity: restart or panic on an I/O error" failed to apply to 6.1-stable tree

[Mikulas Patocka]

Hi Greg

I would like to as you to drop this patch (drop it also from from 6.6, 
6.11 and others, if you already apllied it there).

Google engineeres said that they do not want to change the default 
behavior.

Mikulas



On Wed, 2 Oct 2024, gregkh@linuxfoundation.org wrote:

> 
> The patch below does not apply to the 6.1-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@vger.kernel.org>.
> 
> To reproduce the conflict and resubmit, you may use the following commands:
> 
> git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
> git checkout FETCH_HEAD
> git cherry-pick -x e6a3531dd542cb127c8de32ab1e54a48ae19962b
> # <resolve conflicts, build, test, etc.>
> git commit -s
> git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2024100247-friction-answering-6c42@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^..
> 
> Possible dependencies:
> 
> e6a3531dd542 ("dm-verity: restart or panic on an I/O error")
> 
> thanks,
> 
> greg k-h
> 
> ------------------ original commit in Linus's tree ------------------
> 
> >From e6a3531dd542cb127c8de32ab1e54a48ae19962b Mon Sep 17 00:00:00 2001
> From: Mikulas Patocka <mpatocka@redhat.com>
> Date: Tue, 24 Sep 2024 15:18:29 +0200
> Subject: [PATCH] dm-verity: restart or panic on an I/O error
> 
> Maxim Suhanov reported that dm-verity doesn't crash if an I/O error
> happens. In theory, this could be used to subvert security, because an
> attacker can create sectors that return error with the Write Uncorrectable
> command. Some programs may misbehave if they have to deal with EIO.
> 
> This commit fixes dm-verity, so that if "panic_on_corruption" or
> "restart_on_corruption" was specified and an I/O error happens, the
> machine will panic or restart.
> 
> This commit also changes kernel_restart to emergency_restart -
> kernel_restart calls reboot notifiers and these reboot notifiers may wait
> for the bio that failed. emergency_restart doesn't call the notifiers.
> 
> Reported-by: Maxim Suhanov <dfirblog@gmail.com>
> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
> Cc: stable@vger.kernel.org
> 
> diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
> index cf659c8feb29..a95c1b9cc5b5 100644
> --- a/drivers/md/dm-verity-target.c
> +++ b/drivers/md/dm-verity-target.c
> @@ -272,8 +272,10 @@ static int verity_handle_err(struct dm_verity *v, enum verity_block_type type,
>  	if (v->mode == DM_VERITY_MODE_LOGGING)
>  		return 0;
>  
> -	if (v->mode == DM_VERITY_MODE_RESTART)
> -		kernel_restart("dm-verity device corrupted");
> +	if (v->mode == DM_VERITY_MODE_RESTART) {
> +		pr_emerg("dm-verity device corrupted\n");
> +		emergency_restart();
> +	}
>  
>  	if (v->mode == DM_VERITY_MODE_PANIC)
>  		panic("dm-verity device corrupted");
> @@ -596,6 +598,23 @@ static void verity_finish_io(struct dm_verity_io *io, blk_status_t status)
>  	if (!static_branch_unlikely(&use_bh_wq_enabled) || !io->in_bh)
>  		verity_fec_finish_io(io);
>  
> +	if (unlikely(status != BLK_STS_OK) &&
> +	    unlikely(!(bio->bi_opf & REQ_RAHEAD)) &&
> +	    !verity_is_system_shutting_down()) {
> +		if (v->mode == DM_VERITY_MODE_RESTART ||
> +		    v->mode == DM_VERITY_MODE_PANIC)
> +			DMERR_LIMIT("%s has error: %s", v->data_dev->name,
> +					blk_status_to_str(status));
> +
> +		if (v->mode == DM_VERITY_MODE_RESTART) {
> +			pr_emerg("dm-verity device corrupted\n");
> +			emergency_restart();
> +		}
> +
> +		if (v->mode == DM_VERITY_MODE_PANIC)
> +			panic("dm-verity device corrupted");
> +	}
> +
>  	bio_endio(bio);
>  }
>  
> 

Re: FAILED: patch "[PATCH] dm-verity: restart or panic on an I/O error" failed to apply to 6.1-stable tree

[Greg KH]

On Wed, Oct 02, 2024 at 12:25:11PM +0200, Mikulas Patocka wrote:
> Hi Greg
> 
> I would like to as you to drop this patch (drop it also from from 6.6, 
> 6.11 and others, if you already apllied it there).
> 
> Google engineeres said that they do not want to change the default 
> behavior.

Is it reverted somewhere?  I'd prefer to take the revert otherwise our
scripts will continue to want to apply this over time.

If there is no revert, well, we are just mirroring what is in Linus's
tree :)

thanks,

greg k-h

Re: FAILED: patch "[PATCH] dm-verity: restart or panic on an I/O error" failed to apply to 6.1-stable tree

[Mikulas Patocka]

On Wed, 2 Oct 2024, Greg KH wrote:

> On Wed, Oct 02, 2024 at 12:25:11PM +0200, Mikulas Patocka wrote:
> > Hi Greg
> > 
> > I would like to as you to drop this patch (drop it also from from 6.6, 
> > 6.11 and others, if you already apllied it there).
> > 
> > Google engineeres said that they do not want to change the default 
> > behavior.
> 
> Is it reverted somewhere?  I'd prefer to take the revert otherwise our
> scripts will continue to want to apply this over time.
> 
> If there is no revert, well, we are just mirroring what is in Linus's
> tree :)
> 
> thanks,
> 
> greg k-h

I've just sent a revert pull request to Linus - see 
https://marc.info/?l=dm-devel&m=172788030731700&w=2

The revert's commit ID is 462763212dd71c41f092b48eaa352bc1f5ed5d66.

I've seen that you already applied the commit 
e6a3531dd542cb127c8de32ab1e54a48ae19962b ("dm-verity: restart or panic on 
an I/O error") to 6.6, 6.10 and 6.11.

So, please apply the revert to 6.6, 6.10 and 6.11 as well, before you 
release them.

Mikulas