* [PATCH AUTOSEL 4.19 2/6] jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount
2023-09-09 0:24 [PATCH AUTOSEL 4.19 1/6] fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() Sasha Levin
@ 2023-09-09 0:24 ` Sasha Levin
2023-09-09 0:24 ` [PATCH AUTOSEL 4.19 3/6] PCI: Make quirk using inw() depend on HAS_IOPORT Sasha Levin
` (3 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: Sasha Levin @ 2023-09-09 0:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Liu Shixin via Jfs-discussion, syzbot+90a11e6b1e810785c6ff,
Liu Shixin, Dave Kleikamp, Sasha Levin, shaggy, jlayton, jack,
okanatov
From: Liu Shixin via Jfs-discussion <jfs-discussion@lists.sourceforge.net>
[ Upstream commit 6e2bda2c192d0244b5a78b787ef20aa10cb319b7 ]
syzbot found an invalid-free in diUnmount:
BUG: KASAN: double-free in slab_free mm/slub.c:3661 [inline]
BUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 mm/slub.c:3674
Free of addr ffff88806f410000 by task syz-executor131/3632
CPU: 0 PID: 3632 Comm: syz-executor131 Not tainted 6.1.0-rc7-syzkaller-00012-gca57f02295f1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106
print_address_description+0x74/0x340 mm/kasan/report.c:284
print_report+0x107/0x1f0 mm/kasan/report.c:395
kasan_report_invalid_free+0xac/0xd0 mm/kasan/report.c:460
____kasan_slab_free+0xfb/0x120
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1724 [inline]
slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1750
slab_free mm/slub.c:3661 [inline]
__kmem_cache_free+0x71/0x110 mm/slub.c:3674
diUnmount+0xef/0x100 fs/jfs/jfs_imap.c:195
jfs_umount+0x108/0x370 fs/jfs/jfs_umount.c:63
jfs_put_super+0x86/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x130/0x310 fs/super.c:492
kill_block_super+0x79/0xd0 fs/super.c:1428
deactivate_locked_super+0xa7/0xf0 fs/super.c:332
cleanup_mnt+0x494/0x520 fs/namespace.c:1186
task_work_run+0x243/0x300 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0x664/0x2070 kernel/exit.c:820
do_group_exit+0x1fd/0x2b0 kernel/exit.c:950
__do_sys_exit_group kernel/exit.c:961 [inline]
__se_sys_exit_group kernel/exit.c:959 [inline]
__x64_sys_exit_group+0x3b/0x40 kernel/exit.c:959
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
[...]
JFS_IP(ipimap)->i_imap is not setting to NULL after free in diUnmount.
If jfs_remount() free JFS_IP(ipimap)->i_imap but then failed at diMount().
JFS_IP(ipimap)->i_imap will be freed once again.
Fix this problem by setting JFS_IP(ipimap)->i_imap to NULL after free.
Reported-by: syzbot+90a11e6b1e810785c6ff@syzkaller.appspotmail.com
Signed-off-by: Liu Shixin <liushixin2@huawei.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jfs/jfs_imap.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 93e8c590ff5c0..7565e00e88182 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -208,6 +208,7 @@ int diUnmount(struct inode *ipimap, int mounterror)
* free in-memory control structure
*/
kfree(imap);
+ JFS_IP(ipimap)->i_imap = NULL;
return (0);
}
--
2.40.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH AUTOSEL 4.19 3/6] PCI: Make quirk using inw() depend on HAS_IOPORT
2023-09-09 0:24 [PATCH AUTOSEL 4.19 1/6] fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() Sasha Levin
2023-09-09 0:24 ` [PATCH AUTOSEL 4.19 2/6] jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount Sasha Levin
@ 2023-09-09 0:24 ` Sasha Levin
2023-09-09 0:24 ` [PATCH AUTOSEL 4.19 4/6] PCI: dwc: Provide deinit callback for i.MX Sasha Levin
` (2 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: Sasha Levin @ 2023-09-09 0:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Niklas Schnelle, Arnd Bergmann, Bjorn Helgaas, Sasha Levin,
linux-pci
From: Niklas Schnelle <schnelle@linux.ibm.com>
[ Upstream commit f768c75d61582b011962f9dcb9ff8eafb8da0383 ]
In the future inw() and friends will not be compiled on architectures
without I/O port support.
Co-developed-by: Arnd Bergmann <arnd@kernel.org>
Link: https://lore.kernel.org/r/20230703135255.2202721-2-schnelle@linux.ibm.com
Signed-off-by: Arnd Bergmann <arnd@kernel.org>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/quirks.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index fa9d6c8f1cf89..07c6b68c763fd 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -272,6 +272,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NEC, PCI_DEVICE_ID_NEC_CBUS_1, quirk_isa_d
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NEC, PCI_DEVICE_ID_NEC_CBUS_2, quirk_isa_dma_hangs);
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NEC, PCI_DEVICE_ID_NEC_CBUS_3, quirk_isa_dma_hangs);
+#ifdef CONFIG_HAS_IOPORT
/*
* Intel NM10 "TigerPoint" LPC PM1a_STS.BM_STS must be clear
* for some HT machines to use C4 w/o hanging.
@@ -291,6 +292,7 @@ static void quirk_tigerpoint_bm_sts(struct pci_dev *dev)
}
}
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_TGP_LPC, quirk_tigerpoint_bm_sts);
+#endif
/* Chipsets where PCI->PCI transfers vanish or hang */
static void quirk_nopcipci(struct pci_dev *dev)
--
2.40.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH AUTOSEL 4.19 4/6] PCI: dwc: Provide deinit callback for i.MX
2023-09-09 0:24 [PATCH AUTOSEL 4.19 1/6] fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() Sasha Levin
2023-09-09 0:24 ` [PATCH AUTOSEL 4.19 2/6] jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount Sasha Levin
2023-09-09 0:24 ` [PATCH AUTOSEL 4.19 3/6] PCI: Make quirk using inw() depend on HAS_IOPORT Sasha Levin
@ 2023-09-09 0:24 ` Sasha Levin
2023-09-11 9:56 ` Pavel Machek
2023-09-09 0:24 ` [PATCH AUTOSEL 4.19 5/6] ARM: 9316/1: hw_breakpoint: fix single-stepping when using bpf_overflow_handler Sasha Levin
2023-09-09 0:24 ` [PATCH AUTOSEL 4.19 6/6] powerpc/pseries: fix possible memory leak in ibmebus_bus_init() Sasha Levin
4 siblings, 1 reply; 7+ messages in thread
From: Sasha Levin @ 2023-09-09 0:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mark Brown, Fabio Estevam, Lorenzo Pieralisi, Richard Zhu,
Manivannan Sadhasivam, Sasha Levin, l.stach, kw, bhelgaas,
shawnguo, linux-pci, linux-arm-kernel
From: Mark Brown <broonie@kernel.org>
[ Upstream commit fc8b24c28bec19fc0621d108b9ee81ddfdedb25a ]
The i.MX integration for the DesignWare PCI controller has a _host_exit()
operation which undoes everything that the _host_init() operation does but
does not wire this up as the host_deinit callback for the core, or call it
in any path other than suspend. This means that if we ever unwind the
initial probe of the device, for example because it fails, the regulator
core complains that the regulators for the device were left enabled:
imx6q-pcie 33800000.pcie: iATU: unroll T, 4 ob, 4 ib, align 64K, limit 16G
imx6q-pcie 33800000.pcie: Phy link never came up
imx6q-pcie 33800000.pcie: Phy link never came up
imx6q-pcie: probe of 33800000.pcie failed with error -110
------------[ cut here ]------------
WARNING: CPU: 2 PID: 46 at drivers/regulator/core.c:2396 _regulator_put+0x110/0x128
Wire up the callback so that the core can clean up after itself.
Link: https://lore.kernel.org/r/20230731-pci-imx-regulator-cleanup-v2-1-fc8fa5c9893d@kernel.org
Tested-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pci-imx6.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
index 3b2ceb5667289..c949d11f95507 100644
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -642,6 +642,7 @@ static int imx6_pcie_host_init(struct pcie_port *pp)
static const struct dw_pcie_host_ops imx6_pcie_host_ops = {
.host_init = imx6_pcie_host_init,
+ .host_deinit = imx6_pcie_host_exit,
};
static int imx6_add_pcie_port(struct imx6_pcie *imx6_pcie,
--
2.40.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH AUTOSEL 4.19 4/6] PCI: dwc: Provide deinit callback for i.MX
2023-09-09 0:24 ` [PATCH AUTOSEL 4.19 4/6] PCI: dwc: Provide deinit callback for i.MX Sasha Levin
@ 2023-09-11 9:56 ` Pavel Machek
0 siblings, 0 replies; 7+ messages in thread
From: Pavel Machek @ 2023-09-11 9:56 UTC (permalink / raw)
To: Sasha Levin
Cc: linux-kernel, stable, Mark Brown, Fabio Estevam,
Lorenzo Pieralisi, Richard Zhu, Manivannan Sadhasivam, l.stach,
kw, bhelgaas, shawnguo, linux-pci, linux-arm-kernel
[-- Attachment #1: Type: text/plain, Size: 793 bytes --]
Hi!
> From: Mark Brown <broonie@kernel.org>
>
> [ Upstream commit fc8b24c28bec19fc0621d108b9ee81ddfdedb25a ]
>
> The i.MX integration for the DesignWare PCI controller has a _host_exit()
> operation which undoes everything that the _host_init() operation does but
> does not wire this up as the host_deinit callback for the core, or call it
> in any path other than suspend. This means that if we ever unwind the
> initial probe of the device, for example because it fails, the regulator
> core complains that the regulators for the device were left enabled:
This is somehow not queued for 5.10. Mistake?
BR,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Erika Unter
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH AUTOSEL 4.19 5/6] ARM: 9316/1: hw_breakpoint: fix single-stepping when using bpf_overflow_handler
2023-09-09 0:24 [PATCH AUTOSEL 4.19 1/6] fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() Sasha Levin
` (2 preceding siblings ...)
2023-09-09 0:24 ` [PATCH AUTOSEL 4.19 4/6] PCI: dwc: Provide deinit callback for i.MX Sasha Levin
@ 2023-09-09 0:24 ` Sasha Levin
2023-09-09 0:24 ` [PATCH AUTOSEL 4.19 6/6] powerpc/pseries: fix possible memory leak in ibmebus_bus_init() Sasha Levin
4 siblings, 0 replies; 7+ messages in thread
From: Sasha Levin @ 2023-09-09 0:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Tomislav Novak, Samuel Gosselin, Catalin Marinas,
Alexei Starovoitov, Russell King, Sasha Levin, will, mark.rutland,
linux, peterz, mingo, acme, linux-arm-kernel, linux-perf-users,
bpf
From: Tomislav Novak <tnovak@fb.com>
[ Upstream commit e6b51532d5273eeefba84106daea3d392c602837 ]
Arm platforms use is_default_overflow_handler() to determine if the
hw_breakpoint code should single-step over the breakpoint trigger or
let the custom handler deal with it.
Since bpf_overflow_handler() currently isn't recognized as a default
handler, attaching a BPF program to a PERF_TYPE_BREAKPOINT event causes
it to keep firing (the instruction triggering the data abort exception
is never skipped). For example:
# bpftrace -e 'watchpoint:0x10000:4:w { print("hit") }' -c ./test
Attaching 1 probe...
hit
hit
[...]
^C
(./test performs a single 4-byte store to 0x10000)
This patch replaces the check with uses_default_overflow_handler(),
which accounts for the bpf_overflow_handler() case by also testing
if one of the perf_event_output functions gets invoked indirectly,
via orig_default_handler.
Link: https://lore.kernel.org/linux-arm-kernel/20220923203644.2731604-1-tnovak@fb.com/
Signed-off-by: Tomislav Novak <tnovak@fb.com>
Tested-by: Samuel Gosselin <sgosselin@google.com> # arm64
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/kernel/hw_breakpoint.c | 8 ++++----
arch/arm64/kernel/hw_breakpoint.c | 4 ++--
include/linux/perf_event.h | 22 +++++++++++++++++++---
3 files changed, 25 insertions(+), 9 deletions(-)
diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
index 2ee5b7f5e7ad0..c71ecd06131ca 100644
--- a/arch/arm/kernel/hw_breakpoint.c
+++ b/arch/arm/kernel/hw_breakpoint.c
@@ -631,7 +631,7 @@ int hw_breakpoint_arch_parse(struct perf_event *bp,
hw->address &= ~alignment_mask;
hw->ctrl.len <<= offset;
- if (is_default_overflow_handler(bp)) {
+ if (uses_default_overflow_handler(bp)) {
/*
* Mismatch breakpoints are required for single-stepping
* breakpoints.
@@ -803,7 +803,7 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr,
* Otherwise, insert a temporary mismatch breakpoint so that
* we can single-step over the watchpoint trigger.
*/
- if (!is_default_overflow_handler(wp))
+ if (!uses_default_overflow_handler(wp))
continue;
step:
enable_single_step(wp, instruction_pointer(regs));
@@ -816,7 +816,7 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr,
info->trigger = addr;
pr_debug("watchpoint fired: address = 0x%x\n", info->trigger);
perf_bp_event(wp, regs);
- if (is_default_overflow_handler(wp))
+ if (uses_default_overflow_handler(wp))
enable_single_step(wp, instruction_pointer(regs));
}
@@ -891,7 +891,7 @@ static void breakpoint_handler(unsigned long unknown, struct pt_regs *regs)
info->trigger = addr;
pr_debug("breakpoint fired: address = 0x%x\n", addr);
perf_bp_event(bp, regs);
- if (is_default_overflow_handler(bp))
+ if (uses_default_overflow_handler(bp))
enable_single_step(bp, addr);
goto unlock;
}
diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c
index 9f105fe58595d..5d120e39bf61a 100644
--- a/arch/arm64/kernel/hw_breakpoint.c
+++ b/arch/arm64/kernel/hw_breakpoint.c
@@ -661,7 +661,7 @@ static int breakpoint_handler(unsigned long unused, unsigned int esr,
perf_bp_event(bp, regs);
/* Do we need to handle the stepping? */
- if (is_default_overflow_handler(bp))
+ if (uses_default_overflow_handler(bp))
step = 1;
unlock:
rcu_read_unlock();
@@ -740,7 +740,7 @@ static u64 get_distance_from_watchpoint(unsigned long addr, u64 val,
static int watchpoint_report(struct perf_event *wp, unsigned long addr,
struct pt_regs *regs)
{
- int step = is_default_overflow_handler(wp);
+ int step = uses_default_overflow_handler(wp);
struct arch_hw_breakpoint *info = counter_arch_bp(wp);
info->trigger = addr;
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index efe30b9b11908..f17e08bd294c2 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -998,15 +998,31 @@ extern void perf_event_output(struct perf_event *event,
struct pt_regs *regs);
static inline bool
-is_default_overflow_handler(struct perf_event *event)
+__is_default_overflow_handler(perf_overflow_handler_t overflow_handler)
{
- if (likely(event->overflow_handler == perf_event_output_forward))
+ if (likely(overflow_handler == perf_event_output_forward))
return true;
- if (unlikely(event->overflow_handler == perf_event_output_backward))
+ if (unlikely(overflow_handler == perf_event_output_backward))
return true;
return false;
}
+#define is_default_overflow_handler(event) \
+ __is_default_overflow_handler((event)->overflow_handler)
+
+#ifdef CONFIG_BPF_SYSCALL
+static inline bool uses_default_overflow_handler(struct perf_event *event)
+{
+ if (likely(is_default_overflow_handler(event)))
+ return true;
+
+ return __is_default_overflow_handler(event->orig_overflow_handler);
+}
+#else
+#define uses_default_overflow_handler(event) \
+ is_default_overflow_handler(event)
+#endif
+
extern void
perf_event_header__init_id(struct perf_event_header *header,
struct perf_sample_data *data,
--
2.40.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH AUTOSEL 4.19 6/6] powerpc/pseries: fix possible memory leak in ibmebus_bus_init()
2023-09-09 0:24 [PATCH AUTOSEL 4.19 1/6] fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() Sasha Levin
` (3 preceding siblings ...)
2023-09-09 0:24 ` [PATCH AUTOSEL 4.19 5/6] ARM: 9316/1: hw_breakpoint: fix single-stepping when using bpf_overflow_handler Sasha Levin
@ 2023-09-09 0:24 ` Sasha Levin
4 siblings, 0 replies; 7+ messages in thread
From: Sasha Levin @ 2023-09-09 0:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: ruanjinjie, Michael Ellerman, Sasha Levin, gregkh, sfr, idryomov,
ira.weiny, robh, linuxppc-dev
From: ruanjinjie <ruanjinjie@huawei.com>
[ Upstream commit afda85b963c12947e298ad85d757e333aa40fd74 ]
If device_register() returns error in ibmebus_bus_init(), name of kobject
which is allocated in dev_set_name() called in device_add() is leaked.
As comment of device_add() says, it should call put_device() to drop
the reference count that was set in device_initialize() when it fails,
so the name can be freed in kobject_cleanup().
Signed-off-by: ruanjinjie <ruanjinjie@huawei.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20221110011929.3709774-1-ruanjinjie@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/ibmebus.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/powerpc/platforms/pseries/ibmebus.c b/arch/powerpc/platforms/pseries/ibmebus.c
index c7c1140c13b6c..3fce7508a4fc6 100644
--- a/arch/powerpc/platforms/pseries/ibmebus.c
+++ b/arch/powerpc/platforms/pseries/ibmebus.c
@@ -452,6 +452,7 @@ static int __init ibmebus_bus_init(void)
if (err) {
printk(KERN_WARNING "%s: device_register returned %i\n",
__func__, err);
+ put_device(&ibmebus_bus_device);
bus_unregister(&ibmebus_bus_type);
return err;
--
2.40.1
^ permalink raw reply related [flat|nested] 7+ messages in thread