* FAILED: patch "[PATCH] ata: libata-core: Fix null pointer dereference on error" failed to apply to 6.9-stable tree
@ 2024-07-01 14:31 gregkh
2024-07-01 21:50 ` Damien Le Moal
0 siblings, 1 reply; 4+ messages in thread
From: gregkh @ 2024-07-01 14:31 UTC (permalink / raw)
To: cassel, dlemoal, hare, john.g.garry; +Cc: stable
The patch below does not apply to the 6.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.9.y
git checkout FETCH_HEAD
git cherry-pick -x 5d92c7c566dc76d96e0e19e481d926bbe6631c1e
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2024070105-falsify-surrender-babc@gregkh' --subject-prefix 'PATCH 6.9.y' HEAD^..
Possible dependencies:
5d92c7c566dc ("ata: libata-core: Fix null pointer dereference on error")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 5d92c7c566dc76d96e0e19e481d926bbe6631c1e Mon Sep 17 00:00:00 2001
From: Niklas Cassel <cassel@kernel.org>
Date: Sat, 29 Jun 2024 14:42:11 +0200
Subject: [PATCH] ata: libata-core: Fix null pointer dereference on error
If the ata_port_alloc() call in ata_host_alloc() fails,
ata_host_release() will get called.
However, the code in ata_host_release() tries to free ata_port struct
members unconditionally, which can lead to the following:
BUG: unable to handle page fault for address: 0000000000003990
PGD 0 P4D 0
Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 10 PID: 594 Comm: (udev-worker) Not tainted 6.10.0-rc5 #44
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014
RIP: 0010:ata_host_release.cold+0x2f/0x6e [libata]
Code: e4 4d 63 f4 44 89 e2 48 c7 c6 90 ad 32 c0 48 c7 c7 d0 70 33 c0 49 83 c6 0e 41
RSP: 0018:ffffc90000ebb968 EFLAGS: 00010246
RAX: 0000000000000041 RBX: ffff88810fb52e78 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff88813b3218c0 RDI: ffff88813b3218c0
RBP: ffff88810fb52e40 R08: 0000000000000000 R09: 6c65725f74736f68
R10: ffffc90000ebb738 R11: 73692033203a746e R12: 0000000000000004
R13: 0000000000000000 R14: 0000000000000011 R15: 0000000000000006
FS: 00007f6cc55b9980(0000) GS:ffff88813b300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000003990 CR3: 00000001122a2000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
<TASK>
? __die_body.cold+0x19/0x27
? page_fault_oops+0x15a/0x2f0
? exc_page_fault+0x7e/0x180
? asm_exc_page_fault+0x26/0x30
? ata_host_release.cold+0x2f/0x6e [libata]
? ata_host_release.cold+0x2f/0x6e [libata]
release_nodes+0x35/0xb0
devres_release_group+0x113/0x140
ata_host_alloc+0xed/0x120 [libata]
ata_host_alloc_pinfo+0x14/0xa0 [libata]
ahci_init_one+0x6c9/0xd20 [ahci]
Do not access ata_port struct members unconditionally.
Fixes: 633273a3ed1c ("libata-pmp: hook PMP support and enable it")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Link: https://lore.kernel.org/r/20240629124210.181537-7-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index efb5195da60c..bdccf4ea251a 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -5517,6 +5517,9 @@ static void ata_host_release(struct kref *kref)
for (i = 0; i < host->n_ports; i++) {
struct ata_port *ap = host->ports[i];
+ if (!ap)
+ continue;
+
kfree(ap->pmp_link);
kfree(ap->slave_link);
kfree(ap->ncq_sense_buf);
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: FAILED: patch "[PATCH] ata: libata-core: Fix null pointer dereference on error" failed to apply to 6.9-stable tree
2024-07-01 14:31 FAILED: patch "[PATCH] ata: libata-core: Fix null pointer dereference on error" failed to apply to 6.9-stable tree gregkh
@ 2024-07-01 21:50 ` Damien Le Moal
2024-07-02 9:11 ` Greg KH
0 siblings, 1 reply; 4+ messages in thread
From: Damien Le Moal @ 2024-07-01 21:50 UTC (permalink / raw)
To: gregkh, cassel, hare, john.g.garry; +Cc: stable
On 7/1/24 23:31, gregkh@linuxfoundation.org wrote:
>
> The patch below does not apply to the 6.9-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@vger.kernel.org>.
>
> To reproduce the conflict and resubmit, you may use the following commands:
>
> git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.9.y
> git checkout FETCH_HEAD
> git cherry-pick -x 5d92c7c566dc76d96e0e19e481d926bbe6631c1e
> # <resolve conflicts, build, test, etc.>
> git commit -s
> git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2024070105-falsify-surrender-babc@gregkh' --subject-prefix 'PATCH 6.9.y' HEAD^..
>
> Possible dependencies:
>
> 5d92c7c566dc ("ata: libata-core: Fix null pointer dereference on error")
Greg,
I am confused... This patch applies cleanly to linux-6.9.y. The procedure above
also works just fine. And the "Possible dependencies" on itself does not make
sense. Bot problem ?
>
> thanks,
>
> greg k-h
>
> ------------------ original commit in Linus's tree ------------------
>
> From 5d92c7c566dc76d96e0e19e481d926bbe6631c1e Mon Sep 17 00:00:00 2001
> From: Niklas Cassel <cassel@kernel.org>
> Date: Sat, 29 Jun 2024 14:42:11 +0200
> Subject: [PATCH] ata: libata-core: Fix null pointer dereference on error
>
> If the ata_port_alloc() call in ata_host_alloc() fails,
> ata_host_release() will get called.
>
> However, the code in ata_host_release() tries to free ata_port struct
> members unconditionally, which can lead to the following:
>
> BUG: unable to handle page fault for address: 0000000000003990
> PGD 0 P4D 0
> Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
> CPU: 10 PID: 594 Comm: (udev-worker) Not tainted 6.10.0-rc5 #44
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014
> RIP: 0010:ata_host_release.cold+0x2f/0x6e [libata]
> Code: e4 4d 63 f4 44 89 e2 48 c7 c6 90 ad 32 c0 48 c7 c7 d0 70 33 c0 49 83 c6 0e 41
> RSP: 0018:ffffc90000ebb968 EFLAGS: 00010246
> RAX: 0000000000000041 RBX: ffff88810fb52e78 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: ffff88813b3218c0 RDI: ffff88813b3218c0
> RBP: ffff88810fb52e40 R08: 0000000000000000 R09: 6c65725f74736f68
> R10: ffffc90000ebb738 R11: 73692033203a746e R12: 0000000000000004
> R13: 0000000000000000 R14: 0000000000000011 R15: 0000000000000006
> FS: 00007f6cc55b9980(0000) GS:ffff88813b300000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000003990 CR3: 00000001122a2000 CR4: 0000000000750ef0
> PKRU: 55555554
> Call Trace:
> <TASK>
> ? __die_body.cold+0x19/0x27
> ? page_fault_oops+0x15a/0x2f0
> ? exc_page_fault+0x7e/0x180
> ? asm_exc_page_fault+0x26/0x30
> ? ata_host_release.cold+0x2f/0x6e [libata]
> ? ata_host_release.cold+0x2f/0x6e [libata]
> release_nodes+0x35/0xb0
> devres_release_group+0x113/0x140
> ata_host_alloc+0xed/0x120 [libata]
> ata_host_alloc_pinfo+0x14/0xa0 [libata]
> ahci_init_one+0x6c9/0xd20 [ahci]
>
> Do not access ata_port struct members unconditionally.
>
> Fixes: 633273a3ed1c ("libata-pmp: hook PMP support and enable it")
> Cc: stable@vger.kernel.org
> Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
> Reviewed-by: Hannes Reinecke <hare@suse.de>
> Reviewed-by: John Garry <john.g.garry@oracle.com>
> Link: https://lore.kernel.org/r/20240629124210.181537-7-cassel@kernel.org
> Signed-off-by: Niklas Cassel <cassel@kernel.org>
>
> diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
> index efb5195da60c..bdccf4ea251a 100644
> --- a/drivers/ata/libata-core.c
> +++ b/drivers/ata/libata-core.c
> @@ -5517,6 +5517,9 @@ static void ata_host_release(struct kref *kref)
> for (i = 0; i < host->n_ports; i++) {
> struct ata_port *ap = host->ports[i];
>
> + if (!ap)
> + continue;
> +
> kfree(ap->pmp_link);
> kfree(ap->slave_link);
> kfree(ap->ncq_sense_buf);
>
--
Damien Le Moal
Western Digital Research
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: FAILED: patch "[PATCH] ata: libata-core: Fix null pointer dereference on error" failed to apply to 6.9-stable tree
2024-07-01 21:50 ` Damien Le Moal
@ 2024-07-02 9:11 ` Greg KH
2024-07-02 11:51 ` Sasha Levin
0 siblings, 1 reply; 4+ messages in thread
From: Greg KH @ 2024-07-02 9:11 UTC (permalink / raw)
To: Damien Le Moal; +Cc: cassel, hare, john.g.garry, stable
On Tue, Jul 02, 2024 at 06:50:05AM +0900, Damien Le Moal wrote:
> On 7/1/24 23:31, gregkh@linuxfoundation.org wrote:
> >
> > The patch below does not apply to the 6.9-stable tree.
> > If someone wants it applied there, or to any other stable or longterm
> > tree, then please email the backport, including the original git commit
> > id to <stable@vger.kernel.org>.
> >
> > To reproduce the conflict and resubmit, you may use the following commands:
> >
> > git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.9.y
> > git checkout FETCH_HEAD
> > git cherry-pick -x 5d92c7c566dc76d96e0e19e481d926bbe6631c1e
> > # <resolve conflicts, build, test, etc.>
> > git commit -s
> > git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2024070105-falsify-surrender-babc@gregkh' --subject-prefix 'PATCH 6.9.y' HEAD^..
> >
> > Possible dependencies:
> >
> > 5d92c7c566dc ("ata: libata-core: Fix null pointer dereference on error")
>
> Greg,
>
> I am confused... This patch applies cleanly to linux-6.9.y. The procedure above
> also works just fine. And the "Possible dependencies" on itself does not make
> sense. Bot problem ?
Odd, this seems to already be in the tree, sorry for the noise.
greg k-h
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: FAILED: patch "[PATCH] ata: libata-core: Fix null pointer dereference on error" failed to apply to 6.9-stable tree
2024-07-02 9:11 ` Greg KH
@ 2024-07-02 11:51 ` Sasha Levin
0 siblings, 0 replies; 4+ messages in thread
From: Sasha Levin @ 2024-07-02 11:51 UTC (permalink / raw)
To: Greg KH; +Cc: Damien Le Moal, cassel, hare, john.g.garry, stable
On Tue, Jul 02, 2024 at 11:11:22AM +0200, Greg KH wrote:
>On Tue, Jul 02, 2024 at 06:50:05AM +0900, Damien Le Moal wrote:
>> On 7/1/24 23:31, gregkh@linuxfoundation.org wrote:
>> >
>> > The patch below does not apply to the 6.9-stable tree.
>> > If someone wants it applied there, or to any other stable or longterm
>> > tree, then please email the backport, including the original git commit
>> > id to <stable@vger.kernel.org>.
>> >
>> > To reproduce the conflict and resubmit, you may use the following commands:
>> >
>> > git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.9.y
>> > git checkout FETCH_HEAD
>> > git cherry-pick -x 5d92c7c566dc76d96e0e19e481d926bbe6631c1e
>> > # <resolve conflicts, build, test, etc.>
>> > git commit -s
>> > git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2024070105-falsify-surrender-babc@gregkh' --subject-prefix 'PATCH 6.9.y' HEAD^..
>> >
>> > Possible dependencies:
>> >
>> > 5d92c7c566dc ("ata: libata-core: Fix null pointer dereference on error")
>>
>> Greg,
>>
>> I am confused... This patch applies cleanly to linux-6.9.y. The procedure above
>> also works just fine. And the "Possible dependencies" on itself does not make
>> sense. Bot problem ?
>
>Odd, this seems to already be in the tree, sorry for the noise.
Sorry, I didn't expect something like this would happen, but it went in
as a dependency for a different patch.
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-07-02 14:34 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-07-01 14:31 FAILED: patch "[PATCH] ata: libata-core: Fix null pointer dereference on error" failed to apply to 6.9-stable tree gregkh
2024-07-01 21:50 ` Damien Le Moal
2024-07-02 9:11 ` Greg KH
2024-07-02 11:51 ` Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox