linux-stable.git, branch v6.3.2

Linux 6.3.2

2023-05-11T14:17:39+00:00

Link: https://lore.kernel.org/r/20230508094432.603705160@linuxfoundation.org
Tested-by: Ronald Warsow 
Tested-by: Shuah Khan 
Tested-by: Ron Economos 
Tested-by: Justin M. Forbes 
Tested-by: Florian Fainelli 
Tested-by: Bagas Sanjaya 
Tested-by: Markus Reichelt 
Link: https://lore.kernel.org/r/20230509030705.399628514@linuxfoundation.org
Tested-by: Rudi Heitbaum 
Tested-by: Ronald Warsow 
Tested-by: Conor Dooley 
Tested-by: Bagas Sanjaya 
Tested-by: Jon Hunter 
Tested-by: Chris Paterson (CIP) 
Tested-by: Florian Fainelli 
Tested-by: Markus Reichelt 
Tested-by: Linux Kernel Functional Testing 
Tested-by: Guenter Roeck 
Tested-by: Sudip Mukherjee 
Signed-off-by: Greg Kroah-Hartman

netfilter: nf_tables: deactivate anonymous set from preparation phase

2023-05-11T14:17:39+00:00

commit c1592a89942e9678f7d9c8030efa777c0d57edab upstream.

Toggle deleted anonymous sets as inactive in the next generation, so
users cannot perform any update on it. Clear the generation bitmask
in case the transaction is aborted.

The following KASAN splat shows a set element deletion for a bound
anonymous set that has been already removed in the same transaction.

[   64.921510] ==================================================================
[   64.923123] BUG: KASAN: wild-memory-access in nf_tables_commit+0xa24/0x1490 [nf_tables]
[   64.924745] Write of size 8 at addr dead000000000122 by task test/890
[   64.927903] CPU: 3 PID: 890 Comm: test Not tainted 6.3.0+ #253
[   64.931120] Call Trace:
[   64.932699]  
[   64.934292]  dump_stack_lvl+0x33/0x50
[   64.935908]  ? nf_tables_commit+0xa24/0x1490 [nf_tables]
[   64.937551]  kasan_report+0xda/0x120
[   64.939186]  ? nf_tables_commit+0xa24/0x1490 [nf_tables]
[   64.940814]  nf_tables_commit+0xa24/0x1490 [nf_tables]
[   64.942452]  ? __kasan_slab_alloc+0x2d/0x60
[   64.944070]  ? nf_tables_setelem_notify+0x190/0x190 [nf_tables]
[   64.945710]  ? kasan_set_track+0x21/0x30
[   64.947323]  nfnetlink_rcv_batch+0x709/0xd90 [nfnetlink]
[   64.948898]  ? nfnetlink_rcv_msg+0x480/0x480 [nfnetlink]

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Greg Kroah-Hartman

arch_topology: Remove early cacheinfo error message if -ENOENT

2023-05-11T14:17:38+00:00

commit 3522340199cc060b70f0094e3039bdb43c3f6ee1 upstream.

fetch_cache_info() tries to get the number of cache leaves/levels
for each CPU in order to pre-allocate memory for cacheinfo struct.
Allocating this memory later triggers a:
  'BUG: sleeping function called from invalid context'
in PREEMPT_RT kernels.

If there is no cache related information available in DT or ACPI,
fetch_cache_info() fails and an error message is printed:
  'Early cacheinfo failed, ret = ...'

Not having cache information should be a valid configuration.
Remove the error message if fetch_cache_info() fails with -ENOENT.

Suggested-by: Conor Dooley 
Link: https://lore.kernel.org/all/20230404-hatred-swimmer-6fecdf33b57a@spud/
Signed-off-by: Pierre Gondois 
Reviewed-by: Conor Dooley 
Link: https://lore.kernel.org/r/20230414081453.244787-4-pierre.gondois@arm.com
Signed-off-by: Sudeep Holla 
Cc: Florian Fainelli 
Signed-off-by: Greg Kroah-Hartman

debugobject: Ensure pool refill (again)

2023-05-11T14:17:38+00:00

commit 0af462f19e635ad522f28981238334620881badc upstream.

The recent fix to ensure atomicity of lookup and allocation inadvertently
broke the pool refill mechanism.

Prior to that change debug_objects_activate() and debug_objecs_assert_init()
invoked debug_objecs_init() to set up the tracking object for statically
initialized objects. That's not longer the case and debug_objecs_init() is
now the only place which does pool refills.

Depending on the number of statically initialized objects this can be
enough to actually deplete the pool, which was observed by Ido via a
debugobjects OOM warning.

Restore the old behaviour by adding explicit refill opportunities to
debug_objects_activate() and debug_objecs_assert_init().

Fixes: 63a759694eed ("debugobject: Prevent init race with static objects")
Reported-by: Ido Schimmel 
Signed-off-by: Thomas Gleixner 
Tested-by: Ido Schimmel 
Link: https://lore.kernel.org/r/871qk05a9d.ffs@tglx
Signed-off-by: Greg Kroah-Hartman

cifs: avoid potential races when handling multiple dfs tcons

2023-05-11T14:17:38+00:00

commit 6be2ea33a4093402252724a00c4af8033725184c upstream.

Now that a DFS tcon manages its own list of DFS referrals and
sessions, there is no point in having a single worker to refresh
referrals of all DFS tcons.  Make it faster and less prone to race
conditions when having several mounts by queueing a worker per DFS
tcon that will take care of refreshing only the DFS referrals related
to it.

Cc: stable@vger.kernel.org # v6.2+
Signed-off-by: Paulo Alcantara (SUSE) 
Signed-off-by: Steve French 
Signed-off-by: Greg Kroah-Hartman

cifs: protect access of TCP_Server_Info::{origin,leaf}_fullpath

2023-05-11T14:17:38+00:00

commit 3dc9c433c9dde15477d02b609ccb4328e2adb6dc upstream.

Protect access of TCP_Server_Info::{origin,leaf}_fullpath when
matching DFS connections, and get rid of
TCP_Server_Info::current_fullpath while we're at it.

Cc: stable@vger.kernel.org # v6.2+
Signed-off-by: Paulo Alcantara (SUSE) 
Signed-off-by: Steve French 
Signed-off-by: Greg Kroah-Hartman

cifs: fix potential race when tree connecting ipc

2023-05-11T14:17:38+00:00

commit ee20d7c6100752eaf2409d783f4f1449c29ea33d upstream.

Protect access of TCP_Server_Info::hostname when building the ipc tree
name as it might get freed in cifsd thread and thus causing an
use-after-free bug in __tree_connect_dfs_target().  Also, while at it,
update status of IPC tcon on success and then avoid any extra tree
connects.

Cc: stable@vger.kernel.org # v6.2+
Signed-off-by: Paulo Alcantara (SUSE) 
Signed-off-by: Steve French 
Signed-off-by: Greg Kroah-Hartman

cifs: fix sharing of DFS connections

2023-05-11T14:17:38+00:00

commit 8e3554150d6c80a84b3cb046615d1a0e943811dc upstream.

When matching DFS connections, we can't rely on the values set in
cifs_sb_info::prepath and cifs_tcon::tree_name as they might change
during DFS failover.  The DFS referrals related to a specific DFS tcon
are already matched earlier in match_server(), therefore we can safely
skip those checks altogether as the connection is guaranteed to be
unique for the DFS tcon.

Besides, when creating or finding an SMB session, make sure to also
refcount any DFS root session related to it (cifs_ses::dfs_root_ses),
so if a new DFS mount ends up reusing the connection from the old
mount while there was an umount(2) still in progress (e.g. umount(2)
-> cifs_umount() -> reconnect -> cifs_put_tcon()), the connection
could potentially be put right after the umount(2) finished.

Patch has minor update to include fix for unused variable issue
noted by the kernel test robot

Reported-by: kernel test robot 
Link: https://lore.kernel.org/oe-kbuild-all/202305041040.j7W2xQSy-lkp@intel.com/
Cc: stable@vger.kernel.org # v6.2+
Signed-off-by: Paulo Alcantara (SUSE) 
Signed-off-by: Steve French 
Signed-off-by: Greg Kroah-Hartman

cifs: protect session status check in smb2_reconnect()

2023-05-11T14:17:38+00:00

commit 5bff9f741af60b143a5ae73417a8ec47fd5ff2f4 upstream.

Use @ses->ses_lock to protect access of @ses->ses_status.

Cc: stable@vger.kernel.org
Signed-off-by: Paulo Alcantara (SUSE) 
Signed-off-by: Steve French 
Signed-off-by: Greg Kroah-Hartman

cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname

2023-05-11T14:17:38+00:00

commit 90c49fce1c43e1cc152695e20363ff5087897c09 upstream.

TCP_Server_Info::hostname may be updated once or many times during
reconnect, so protect its access outside reconnect path as well and
then prevent any potential use-after-free bugs.

Cc: stable@vger.kernel.org
Signed-off-by: Paulo Alcantara (SUSE) 
Signed-off-by: Steve French 
Signed-off-by: Greg Kroah-Hartman