Skip to content
  1. May 28, 2023
  2. May 22, 2023
  3. May 15, 2023
  4. May 14, 2023
    • Linus Torvalds's avatar
      Merge tag 'locking_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 31f4104e
      Linus Torvalds authored
      Pull locking fix from Borislav Petkov:
      
       - Make sure __down_read_common() is always inlined so that the callers'
         names land in traceevents output and thus the blocked function can be
         identified
      
      * tag 'locking_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        locking/rwsem: Add __always_inline annotation to __down_read_common() and inlined callers
      31f4104e
    • Linus Torvalds's avatar
      Merge tag 'perf_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · ef21831c
      Linus Torvalds authored
      Pull perf fixes from Borislav Petkov:
      
       - Make sure the PEBS buffer is flushed before reprogramming the
         hardware so that the correct record sizes are used
      
       - Update the sample size for AMD BRS events
      
       - Fix a confusion with using the same on-stack struct with different
         events in the event processing path
      
      * tag 'perf_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf/x86/intel/ds: Flush PEBS DS when changing PEBS_DATA_CFG
        perf/x86: Fix missing sample size update on AMD BRS
        perf/core: Fix perf_sample_data not properly initialized for different swevents in perf_tp_event()
      ef21831c
    • Linus Torvalds's avatar
      Merge tag 'sched_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · f3b9e8e4
      Linus Torvalds authored
      Pull scheduler fix from Borislav Petkov:
      
       - Fix a couple of kernel-doc warnings
      
      * tag 'sched_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched: fix cid_lock kernel-doc warnings
      f3b9e8e4
    • Linus Torvalds's avatar
      Merge tag 'x86_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 011e33ee
      Linus Torvalds authored
      Pull x86 fix from Borislav Petkov:
      
       - Add the required PCI IDs so that the generic SMN accesses provided by
         amd_nb.c work for drivers which switch to them. Add a PCI device ID
         to k10temp's table so that latter is loaded on such systems too
      
      * tag 'x86_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        hwmon: (k10temp) Add PCI ID for family 19, model 78h
        x86/amd_nb: Add PCI ID for family 19h model 78h
      011e33ee
    • Linus Torvalds's avatar
      Merge tag 'timers_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 491459b5
      Linus Torvalds authored
      Pull timer fix from Borislav Petkov:
      
       - Prevent CPU state corruption when an active clockevent broadcast
         device is replaced while the system is already in oneshot mode
      
      * tag 'timers_urgent_for_v6.4_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        tick/broadcast: Make broadcast device replacement work correctly
      491459b5
    • Linus Torvalds's avatar
      Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · bb7c241f
      Linus Torvalds authored
      Pull ext4 fixes from Ted Ts'o:
       "Some ext4 bug fixes (mostly to address Syzbot reports)"
      
      * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4: bail out of ext4_xattr_ibody_get() fails for any reason
        ext4: add bounds checking in get_max_inline_xattr_value_size()
        ext4: add indication of ro vs r/w mounts in the mount message
        ext4: fix deadlock when converting an inline directory in nojournal mode
        ext4: improve error recovery code paths in __ext4_remount()
        ext4: improve error handling from ext4_dirhash()
        ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled
        ext4: check iomap type only if ext4_iomap_begin() does not fail
        ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum
        ext4: fix data races when using cached status extents
        ext4: avoid deadlock in fs reclaim with page writeback
        ext4: fix invalid free tracking in ext4_xattr_move_to_block()
        ext4: remove a BUG_ON in ext4_mb_release_group_pa()
        ext4: allow ext4_get_group_info() to fail
        ext4: fix lockdep warning when enabling MMP
        ext4: fix WARNING in mb_find_extent
      bb7c241f
    • Linus Torvalds's avatar
      Merge tag 'fbdev-for-6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev · adfbf653
      Linus Torvalds authored
      Pull fbdev fixes from Helge Deller:
      
       - use after free fix in imsttfb (Zheng Wang)
      
       - fix error handling in arcfb (Zongjie Li)
      
       - lots of whitespace cleanups (Thomas Zimmermann)
      
       - add 1920x1080 modedb entry (me)
      
      * tag 'fbdev-for-6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
        fbdev: stifb: Fix info entry in sti_struct on error path
        fbdev: modedb: Add 1920x1080 at 60 Hz video mode
        fbdev: imsttfb: Fix use after free bug in imsttfb_probe
        fbdev: vfb: Remove trailing whitespaces
        fbdev: valkyriefb: Remove trailing whitespaces
        fbdev: stifb: Remove trailing whitespaces
        fbdev: sa1100fb: Remove trailing whitespaces
        fbdev: platinumfb: Remove trailing whitespaces
        fbdev: p9100: Remove trailing whitespaces
        fbdev: maxinefb: Remove trailing whitespaces
        fbdev: macfb: Remove trailing whitespaces
        fbdev: hpfb: Remove trailing whitespaces
        fbdev: hgafb: Remove trailing whitespaces
        fbdev: g364fb: Remove trailing whitespaces
        fbdev: controlfb: Remove trailing whitespaces
        fbdev: cg14: Remove trailing whitespaces
        fbdev: atmel_lcdfb: Remove trailing whitespaces
        fbdev: 68328fb: Remove trailing whitespaces
        fbdev: arcfb: Fix error handling in arcfb_probe()
      adfbf653
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 046206ba
      Linus Torvalds authored
      Pull SCSI fix from James Bottomley:
       "A single small fix for the UFS driver to fix a power management
        failure"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: ufs: core: Fix I/O hang that occurs when BKOPS fails in W-LUN suspend
      046206ba
    • Helge Deller's avatar
      parisc: Fix encoding of swp_entry due to added SWP_EXCLUSIVE flag · 6f9e9884
      Helge Deller authored
      Fix the __swp_offset() and __swp_entry() macros due to commit 6d239fc7
      
      
      ("parisc/mm: support __HAVE_ARCH_PTE_SWP_EXCLUSIVE") which introduced the
      SWP_EXCLUSIVE flag by reusing the _PAGE_ACCESSED flag.
      
      Reported-by: default avatarChristoph Biedl <linux-kernel.bfrz@manchmal.in-ulm.de>
      Tested-by: default avatarChristoph Biedl <linux-kernel.bfrz@manchmal.in-ulm.de>
      Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      Fixes: 6d239fc7 ("parisc/mm: support __HAVE_ARCH_PTE_SWP_EXCLUSIVE")
      Cc: <stable@vger.kernel.org> # v6.3+
      6f9e9884
    • Theodore Ts'o's avatar
      ext4: bail out of ext4_xattr_ibody_get() fails for any reason · 2a534e1d
      Theodore Ts'o authored
      
      
      In ext4_update_inline_data(), if ext4_xattr_ibody_get() fails for any
      reason, it's best if we just fail as opposed to stumbling on,
      especially if the failure is EFSCORRUPTED.
      
      Cc: stable@kernel.org
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      2a534e1d
    • Theodore Ts'o's avatar
      ext4: add bounds checking in get_max_inline_xattr_value_size() · 2220eaf9
      Theodore Ts'o authored
      
      
      Normally the extended attributes in the inode body would have been
      checked when the inode is first opened, but if someone is writing to
      the block device while the file system is mounted, it's possible for
      the inode table to get corrupted.  Add bounds checking to avoid
      reading beyond the end of allocated memory if this happens.
      
      Reported-by: default avatar <syzbot+1966db24521e5f6e23f7@syzkaller.appspotmail.com>
      Link: https://syzkaller.appspot.com/bug?extid=1966db24521e5f6e23f7
      Cc: stable@kernel.org
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      2220eaf9
    • Theodore Ts'o's avatar
      ext4: add indication of ro vs r/w mounts in the mount message · 6dcc98fb
      Theodore Ts'o authored
      
      
      Whether the file system is mounted read-only or read/write is more
      important than the quota mode, which we are already printing.  Add the
      ro vs r/w indication since this can be helpful in debugging problems
      from the console log.
      
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      6dcc98fb
    • Theodore Ts'o's avatar
      ext4: fix deadlock when converting an inline directory in nojournal mode · f4ce24f5
      Theodore Ts'o authored
      
      
      In no journal mode, ext4_finish_convert_inline_dir() can self-deadlock
      by calling ext4_handle_dirty_dirblock() when it already has taken the
      directory lock.  There is a similar self-deadlock in
      ext4_incvert_inline_data_nolock() for data files which we'll fix at
      the same time.
      
      A simple reproducer demonstrating the problem:
      
          mke2fs -Fq -t ext2 -O inline_data -b 4k /dev/vdc 64
          mount -t ext4 -o dirsync /dev/vdc /vdc
          cd /vdc
          mkdir file0
          cd file0
          touch file0
          touch file1
          attr -s BurnSpaceInEA -V abcde .
          touch supercalifragilisticexpialidocious
      
      Cc: stable@kernel.org
      Link: https://lore.kernel.org/r/20230507021608.1290720-1-tytso@mit.edu
      Reported-by: default avatar <syzbot+91dccab7c64e2850a4e5@syzkaller.appspotmail.com>
      Link: https://syzkaller.appspot.com/bug?id=ba84cc80a9491d65416bc7877e1650c87530fe8a
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      f4ce24f5
    • Theodore Ts'o's avatar
      ext4: improve error recovery code paths in __ext4_remount() · 4c0b4818
      Theodore Ts'o authored
      
      
      If there are failures while changing the mount options in
      __ext4_remount(), we need to restore the old mount options.
      
      This commit fixes two problem.  The first is there is a chance that we
      will free the old quota file names before a potential failure leading
      to a use-after-free.  The second problem addressed in this commit is
      if there is a failed read/write to read-only transition, if the quota
      has already been suspended, we need to renable quota handling.
      
      Cc: stable@kernel.org
      Link: https://lore.kernel.org/r/20230506142419.984260-2-tytso@mit.edu
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      4c0b4818
    • Theodore Ts'o's avatar
      ext4: improve error handling from ext4_dirhash() · 4b3cb1d1
      Theodore Ts'o authored
      
      
      The ext4_dirhash() will *almost* never fail, especially when the hash
      tree feature was first introduced.  However, with the addition of
      support of encrypted, casefolded file names, that function can most
      certainly fail today.
      
      So make sure the callers of ext4_dirhash() properly check for
      failures, and reflect the errors back up to their callers.
      
      Cc: stable@kernel.org
      Link: https://lore.kernel.org/r/20230506142419.984260-1-tytso@mit.edu
      Reported-by: default avatar <syzbot+394aa8a792cb99dbc837@syzkaller.appspotmail.com>
      Reported-by: default avatar <syzbot+344aaa8697ebd232bfc8@syzkaller.appspotmail.com>
      Link: https://syzkaller.appspot.com/bug?id=db56459ea4ac4a676ae4b4678f633e55da005a9b
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      4b3cb1d1
    • Theodore Ts'o's avatar
      ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled · a44be64b
      Theodore Ts'o authored
      
      
      When a file system currently mounted read/only is remounted
      read/write, if we clear the SB_RDONLY flag too early, before the quota
      is initialized, and there is another process/thread constantly
      attempting to create a directory, it's possible to trigger the
      
      	WARN_ON_ONCE(dquot_initialize_needed(inode));
      
      in ext4_xattr_block_set(), with the following stack trace:
      
         WARNING: CPU: 0 PID: 5338 at fs/ext4/xattr.c:2141 ext4_xattr_block_set+0x2ef2/0x3680
         RIP: 0010:ext4_xattr_block_set+0x2ef2/0x3680 fs/ext4/xattr.c:2141
         Call Trace:
          ext4_xattr_set_handle+0xcd4/0x15c0 fs/ext4/xattr.c:2458
          ext4_initxattrs+0xa3/0x110 fs/ext4/xattr_security.c:44
          security_inode_init_security+0x2df/0x3f0 security/security.c:1147
          __ext4_new_inode+0x347e/0x43d0 fs/ext4/ialloc.c:1324
          ext4_mkdir+0x425/0xce0 fs/ext4/namei.c:2992
          vfs_mkdir+0x29d/0x450 fs/namei.c:4038
          do_mkdirat+0x264/0x520 fs/namei.c:4061
          __do_sys_mkdirat fs/namei.c:4076 [inline]
          __se_sys_mkdirat fs/namei.c:4074 [inline]
          __x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4074
      
      Cc: stable@kernel.org
      Link: https://lore.kernel.org/r/20230506142419.984260-1-tytso@mit.edu
      Reported-by: default avatar <syzbot+6385d7d3065524c5ca6d@syzkaller.appspotmail.com>
      Link: https://syzkaller.appspot.com/bug?id=6513f6cb5cd6b5fc9f37e3bb70d273b94be9c34c
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      a44be64b
    • Baokun Li's avatar
      ext4: check iomap type only if ext4_iomap_begin() does not fail · fa83c34e
      Baokun Li authored
      
      
      When ext4_iomap_overwrite_begin() calls ext4_iomap_begin() map blocks may
      fail for some reason (e.g. memory allocation failure, bare disk write), and
      later because "iomap->type ! = IOMAP_MAPPED" triggers WARN_ON(). When ext4
      iomap_begin() returns an error, it is normal that the type of iomap->type
      may not match the expectation. Therefore, we only determine if iomap->type
      is as expected when ext4_iomap_begin() is executed successfully.
      
      Cc: stable@kernel.org
      Reported-by: default avatar <syzbot+08106c4b7d60702dbc14@syzkaller.appspotmail.com>
      Link: https://lore.kernel.org/all/00000000000015760b05f9b4eee9@google.com
      Signed-off-by: default avatarBaokun Li <libaokun1@huawei.com>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Link: https://lore.kernel.org/r/20230505132429.714648-1-libaokun1@huawei.com
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      fa83c34e
    • Tudor Ambarus's avatar
      ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum · 4f043518
      Tudor Ambarus authored
      
      
      When modifying the block device while it is mounted by the filesystem,
      syzbot reported the following:
      
      BUG: KASAN: slab-out-of-bounds in crc16+0x206/0x280 lib/crc16.c:58
      Read of size 1 at addr ffff888075f5c0a8 by task syz-executor.2/15586
      
      CPU: 1 PID: 15586 Comm: syz-executor.2 Not tainted 6.2.0-rc5-syzkaller-00205-gc96618275234 #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
      Call Trace:
       <TASK>
       __dump_stack lib/dump_stack.c:88 [inline]
       dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106
       print_address_description+0x74/0x340 mm/kasan/report.c:306
       print_report+0x107/0x1f0 mm/kasan/report.c:417
       kasan_report+0xcd/0x100 mm/kasan/report.c:517
       crc16+0x206/0x280 lib/crc16.c:58
       ext4_group_desc_csum+0x81b/0xb20 fs/ext4/super.c:3187
       ext4_group_desc_csum_set+0x195/0x230 fs/ext4/super.c:3210
       ext4_mb_clear_bb fs/ext4/mballoc.c:6027 [inline]
       ext4_free_blocks+0x191a/0x2810 fs/ext4/mballoc.c:6173
       ext4_remove_blocks fs/ext4/extents.c:2527 [inline]
       ext4_ext_rm_leaf fs/ext4/extents.c:2710 [inline]
       ext4_ext_remove_space+0x24ef/0x46a0 fs/ext4/extents.c:2958
       ext4_ext_truncate+0x177/0x220 fs/ext4/extents.c:4416
       ext4_truncate+0xa6a/0xea0 fs/ext4/inode.c:4342
       ext4_setattr+0x10c8/0x1930 fs/ext4/inode.c:5622
       notify_change+0xe50/0x1100 fs/attr.c:482
       do_truncate+0x200/0x2f0 fs/open.c:65
       handle_truncate fs/namei.c:3216 [inline]
       do_open fs/namei.c:3561 [inline]
       path_openat+0x272b/0x2dd0 fs/namei.c:3714
       do_filp_open+0x264/0x4f0 fs/namei.c:3741
       do_sys_openat2+0x124/0x4e0 fs/open.c:1310
       do_sys_open fs/open.c:1326 [inline]
       __do_sys_creat fs/open.c:1402 [inline]
       __se_sys_creat fs/open.c:1396 [inline]
       __x64_sys_creat+0x11f/0x160 fs/open.c:1396
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x63/0xcd
      RIP: 0033:0x7f72f8a8c0c9
      Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
      RSP: 002b:00007f72f97e3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
      RAX: ffffffffffffffda RBX: 00007f72f8bac050 RCX: 00007f72f8a8c0c9
      RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000280
      RBP: 00007f72f8ae7ae9 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
      R13: 00007ffd165348bf R14: 00007f72f97e3300 R15: 0000000000022000
      
      Replace
      	le16_to_cpu(sbi->s_es->s_desc_size)
      with
      	sbi->s_desc_size
      
      It reduces ext4's compiled text size, and makes the code more efficient
      (we remove an extra indirect reference and a potential byte
      swap on big endian systems), and there is no downside. It also avoids the
      potential KASAN / syzkaller failure, as a bonus.
      
      Reported-by: default avatar <syzbot+fc51227e7100c9294894@syzkaller.appspotmail.com>
      Reported-by: default avatar <syzbot+8785e41224a3afd04321@syzkaller.appspotmail.com>
      Link: https://syzkaller.appspot.com/bug?id=70d28d11ab14bd7938f3e088365252aa923cff42
      Link: https://syzkaller.appspot.com/bug?id=b85721b38583ecc6b5e72ff524c67302abbc30f3
      Link: https://lore.kernel.org/all/000000000000ece18705f3b20934@google.com/
      Fixes: 717d50e4
      
       ("Ext4: Uninitialized Block Groups")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarTudor Ambarus <tudor.ambarus@linaro.org>
      Link: https://lore.kernel.org/r/20230504121525.3275886-1-tudor.ambarus@linaro.org
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      4f043518