* [PATCH AUTOSEL 5.4 2/4] hfs: Sanity check the root record
2025-01-13 18:36 [PATCH AUTOSEL 5.4 1/4] mac802154: check local interfaces before deleting sdata list Sasha Levin
@ 2025-01-13 18:36 ` Sasha Levin
2025-01-13 18:36 ` [PATCH AUTOSEL 5.4 3/4] kheaders: Ignore silly-rename files Sasha Levin
2025-01-13 18:36 ` [PATCH AUTOSEL 5.4 4/4] poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll() Sasha Levin
2 siblings, 0 replies; 4+ messages in thread
From: Sasha Levin @ 2025-01-13 18:36 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Leo Stone, syzbot+2db3c7526ba68f4ea776, Jan Kara,
Christian Brauner, Sasha Levin, quic_jjohnson, viro, sandeen,
linux-fsdevel
From: Leo Stone <leocstone@gmail.com>
[ Upstream commit b905bafdea21a75d75a96855edd9e0b6051eee30 ]
In the syzbot reproducer, the hfs_cat_rec for the root dir has type
HFS_CDR_FIL after being read with hfs_bnode_read() in hfs_super_fill().
This indicates it should be used as an hfs_cat_file, which is 102 bytes.
Only the first 70 bytes of that struct are initialized, however,
because the entrylength passed into hfs_bnode_read() is still the length of
a directory record. This causes uninitialized values to be used later on,
when the hfs_cat_rec union is treated as the larger hfs_cat_file struct.
Add a check to make sure the retrieved record has the correct type
for the root directory (HFS_CDR_DIR), and make sure we load the correct
number of bytes for a directory record.
Reported-by: syzbot+2db3c7526ba68f4ea776@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2db3c7526ba68f4ea776
Tested-by: syzbot+2db3c7526ba68f4ea776@syzkaller.appspotmail.com
Tested-by: Leo Stone <leocstone@gmail.com>
Signed-off-by: Leo Stone <leocstone@gmail.com>
Link: https://lore.kernel.org/r/20241201051420.77858-1-leocstone@gmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/hfs/super.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index bcf820ce0e02..f82444fbbedc 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -419,11 +419,13 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent)
goto bail_no_root;
res = hfs_cat_find_brec(sb, HFS_ROOT_CNID, &fd);
if (!res) {
- if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) {
+ if (fd.entrylength != sizeof(rec.dir)) {
res = -EIO;
goto bail_hfs_find;
}
hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength);
+ if (rec.type != HFS_CDR_DIR)
+ res = -EIO;
}
if (res)
goto bail_hfs_find;
--
2.39.5
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH AUTOSEL 5.4 3/4] kheaders: Ignore silly-rename files
2025-01-13 18:36 [PATCH AUTOSEL 5.4 1/4] mac802154: check local interfaces before deleting sdata list Sasha Levin
2025-01-13 18:36 ` [PATCH AUTOSEL 5.4 2/4] hfs: Sanity check the root record Sasha Levin
@ 2025-01-13 18:36 ` Sasha Levin
2025-01-13 18:36 ` [PATCH AUTOSEL 5.4 4/4] poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll() Sasha Levin
2 siblings, 0 replies; 4+ messages in thread
From: Sasha Levin @ 2025-01-13 18:36 UTC (permalink / raw)
To: linux-kernel, stable
Cc: David Howells, Masahiro Yamada, Marc Dionne, linux-afs, linux-nfs,
Christian Brauner, Sasha Levin, ojeda, maennich
From: David Howells <dhowells@redhat.com>
[ Upstream commit 973b710b8821c3401ad7a25360c89e94b26884ac ]
Tell tar to ignore silly-rename files (".__afs*" and ".nfs*") when building
the header archive. These occur when a file that is open is unlinked
locally, but hasn't yet been closed. Such files are visible to the user
via the getdents() syscall and so programs may want to do things with them.
During the kernel build, such files may be made during the processing of
header files and the cleanup may get deferred by fput() which may result in
tar seeing these files when it reads the directory, but they may have
disappeared by the time it tries to open them, causing tar to fail with an
error. Further, we don't want to include them in the tarball if they still
exist.
With CONFIG_HEADERS_INSTALL=y, something like the following may be seen:
find: './kernel/.tmp_cpio_dir/include/dt-bindings/reset/.__afs2080': No such file or directory
tar: ./include/linux/greybus/.__afs3C95: File removed before we read it
The find warning doesn't seem to cause a problem.
Fix this by telling tar when called from in gen_kheaders.sh to exclude such
files. This only affects afs and nfs; cifs uses the Windows Hidden
attribute to prevent the file from being seen.
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://lore.kernel.org/r/20241213135013.2964079-2-dhowells@redhat.com
cc: Masahiro Yamada <masahiroy@kernel.org>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
cc: linux-nfs@vger.kernel.org
cc: linux-kernel@vger.kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
| 1 +
1 file changed, 1 insertion(+)
--git a/kernel/gen_kheaders.sh b/kernel/gen_kheaders.sh
index 206ab3d41ee7..7fc44d8da205 100755
--- a/kernel/gen_kheaders.sh
+++ b/kernel/gen_kheaders.sh
@@ -84,6 +84,7 @@ find $cpio_dir -type f -print0 |
# Create archive and try to normalize metadata for reproducibility.
tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \
+ --exclude=".__afs*" --exclude=".nfs*" \
--owner=0 --group=0 --sort=name --numeric-owner --mode=u=rw,go=r,a+X \
-I $XZ -cf $tarfile -C $cpio_dir/ . > /dev/null
--
2.39.5
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH AUTOSEL 5.4 4/4] poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll()
2025-01-13 18:36 [PATCH AUTOSEL 5.4 1/4] mac802154: check local interfaces before deleting sdata list Sasha Levin
2025-01-13 18:36 ` [PATCH AUTOSEL 5.4 2/4] hfs: Sanity check the root record Sasha Levin
2025-01-13 18:36 ` [PATCH AUTOSEL 5.4 3/4] kheaders: Ignore silly-rename files Sasha Levin
@ 2025-01-13 18:36 ` Sasha Levin
2 siblings, 0 replies; 4+ messages in thread
From: Sasha Levin @ 2025-01-13 18:36 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Oleg Nesterov, Christian Brauner, Sasha Levin, kees, arnd, ak
From: Oleg Nesterov <oleg@redhat.com>
[ Upstream commit cacd9ae4bf801ff4125d8961bb9a3ba955e51680 ]
As the comment above waitqueue_active() explains, it can only be used
if both waker and waiter have mb()'s that pair with each other. However
__pollwait() is broken in this respect.
This is not pipe-specific, but let's look at pipe_poll() for example:
poll_wait(...); // -> __pollwait() -> add_wait_queue()
LOAD(pipe->head);
LOAD(pipe->head);
In theory these LOAD()'s can leak into the critical section inside
add_wait_queue() and can happen before list_add(entry, wq_head), in this
case pipe_poll() can race with wakeup_pipe_readers/writers which do
smp_mb();
if (waitqueue_active(wq_head))
wake_up_interruptible(wq_head);
There are more __pollwait()-like functions (grep init_poll_funcptr), and
it seems that at least ep_ptable_queue_proc() has the same problem, so the
patch adds smp_mb() into poll_wait().
Link: https://lore.kernel.org/all/20250102163320.GA17691@redhat.com/
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Link: https://lore.kernel.org/r/20250107162717.GA18922@redhat.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/poll.h | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/include/linux/poll.h b/include/linux/poll.h
index 7e0fdcf905d2..a4af5e14dffe 100644
--- a/include/linux/poll.h
+++ b/include/linux/poll.h
@@ -43,8 +43,16 @@ typedef struct poll_table_struct {
static inline void poll_wait(struct file * filp, wait_queue_head_t * wait_address, poll_table *p)
{
- if (p && p->_qproc && wait_address)
+ if (p && p->_qproc && wait_address) {
p->_qproc(filp, wait_address, p);
+ /*
+ * This memory barrier is paired in the wq_has_sleeper().
+ * See the comment above prepare_to_wait(), we need to
+ * ensure that subsequent tests in this thread can't be
+ * reordered with __add_wait_queue() in _qproc() paths.
+ */
+ smp_mb();
+ }
}
/*
--
2.39.5
^ permalink raw reply related [flat|nested] 4+ messages in thread