linux-stable.git/fs/sysv, branch linux-6.4.y Linux kernel stable tree fs/sysv: Null check to prevent null-ptr-deref bug 2023-08-11T10:14:24+00:00 Prince Kumar Maurya princekumarmaurya06@gmail.com 2023-05-31T01:31:41+00:00 e28f376dd8dfcc4e880ac101184132bc08703f6e commit ea2b62f305893992156a798f665847e0663c9f41 upstream. sb_getblk(inode->i_sb, parent) return a null ptr and taking lock on that leads to the null-ptr-deref bug. Reported-by: syzbot+aad58150cbc64ba41bdc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=aad58150cbc64ba41bdc Signed-off-by: Prince Kumar Maurya <princekumarmaurya06@gmail.com> Message-Id: <20230531013141.19487-1-princekumarmaurya06@gmail.com> Signed-off-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit ea2b62f305893992156a798f665847e0663c9f41 upstream.

sb_getblk(inode->i_sb, parent) return a null ptr and taking lock on
that leads to the null-ptr-deref bug.

Reported-by: syzbot+aad58150cbc64ba41bdc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=aad58150cbc64ba41bdc
Signed-off-by: Prince Kumar Maurya <princekumarmaurya06@gmail.com>
Message-Id: <20230531013141.19487-1-princekumarmaurya06@gmail.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
sysv: switch to put_and_unmap_page() 2023-03-13T00:03:41+00:00 Al Viro viro@zeniv.linux.org.uk 2023-03-07T06:53:52+00:00 ede3ef5c1e0766b309a1bf087e4c50ea02d3f26f Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> 
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/sysv: Don't round down address for kunmap_flush_on_unmap() 2023-03-13T00:03:34+00:00 Fabio M. De Francesco fmdefrancesco@gmail.com 2023-03-06T12:51:50+00:00 8ad77c576721bd7f7b24bfd7fcb0a61bcfa1a1a2 The kernel virtual address passed to kunmap_flush_on_unmap() has no more any need to be rounded down. Therefore, delete the rounding down of "page_addr" when passed to kunmap_local() in dir_put_page(). Don't backport without commit 88d7b12068b9 ("highmem: round down the address passed to kunmap_flush_on_unmap()"). Cc: Ira Weiny <ira.weiny@intel.com> Suggested-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Fabio M. De Francesco <fmdefrancesco@gmail.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> 
The kernel virtual address passed to kunmap_flush_on_unmap() has no more
any need to be rounded down.

Therefore, delete the rounding down of "page_addr" when passed to
kunmap_local() in dir_put_page().

Don't backport without commit 88d7b12068b9 ("highmem: round down the
address passed to kunmap_flush_on_unmap()").

Cc: Ira Weiny <ira.weiny@intel.com>
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Fabio M. De Francesco <fmdefrancesco@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Merge branch 'work.sysv' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2023-02-25T03:03:26+00:00 Linus Torvalds torvalds@linux-foundation.org 2023-02-25T03:03:26+00:00 d6b9cf417c62601f26fa47f97d6c0681704bf0e3 Pull sysv updates from Al Viro: "Fabio's 'switch to kmap_local_page()' patchset (originally after the ext2 counterpart, with a lot of cleaning up done to it; as the matter of fact, ext2 side is in need of similar cleanups - calling conventions there are bloody awful). Plus the equivalents of minix stuff..." * 'work.sysv' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: sysv: fix handling of delete_entry and set_link failures fs/sysv: Replace kmap() with kmap_local_page() fs/sysv: Use dir_put_page() in sysv_rename() fs/sysv: Change the signature of dir_get_page() fs/sysv: Use the offset_in_page() helper sysv: don't flush page immediately for DIRSYNC directories 
Pull sysv updates from Al Viro:
 "Fabio's 'switch to kmap_local_page()' patchset (originally after the
  ext2 counterpart, with a lot of cleaning up done to it; as the matter
  of fact, ext2 side is in need of similar cleanups - calling
  conventions there are bloody awful).

  Plus the equivalents of minix stuff..."

* 'work.sysv' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  sysv: fix handling of delete_entry and set_link failures
  fs/sysv: Replace kmap() with kmap_local_page()
  fs/sysv: Use dir_put_page() in sysv_rename()
  fs/sysv: Change the signature of dir_get_page()
  fs/sysv: Use the offset_in_page() helper
  sysv: don't flush page immediately for DIRSYNC directories
sysv: fix handling of delete_entry and set_link failures 2023-01-20T04:24:42+00:00 Al Viro viro@zeniv.linux.org.uk 2023-01-20T01:05:43+00:00 abb7c742397324f8676c5b622effdce911cd52e3 similar to minixfs series - make sysv_set_link() report failures, lift dir_put_page() into the callers of sysv_set_link() and sysv_delete_entry(), make sysv_rename() handle failures in both. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> 
similar to minixfs series - make sysv_set_link() report failures,
lift dir_put_page() into the callers of sysv_set_link() and
sysv_delete_entry(), make sysv_rename() handle failures in both.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/sysv: Replace kmap() with kmap_local_page() 2023-01-20T04:24:35+00:00 Fabio M. De Francesco fmdefrancesco@gmail.com 2023-01-19T15:32:32+00:00 83005276d383387fec7e18c7a36daade579a23a7 kmap() is being deprecated in favor of kmap_local_page(). There are two main problems with kmap(): (1) It comes with an overhead as the mapping space is restricted and protected by a global lock for synchronization and (2) it also requires global TLB invalidation when the kmap’s pool wraps and it might block when the mapping space is fully utilized until a slot becomes available. With kmap_local_page() the mappings are per thread, CPU local, can take page faults, and can be called from any context (including interrupts). It is faster than kmap() in kernels with HIGHMEM enabled. Furthermore, the tasks can be preempted and, when they are scheduled to run again, the kernel virtual addresses are restored and still valid. Since kmap_local_page() would not break the strict rules of local mappings (i.e., the thread locality and the stack based nesting), this function can be easily and safely replace the deprecated API. Therefore, replace kmap() with kmap_local_page() in fs/sysv. kunmap_local() requires the mapping address, so return that address from dir_get_page() to be used in dir_put_page(). Suggested-by: Al Viro <viro@zeniv.linux.org.uk> Suggested-by: Ira Weiny <ira.weiny@intel.com> Signed-off-by: Fabio M. De Francesco <fmdefrancesco@gmail.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> 
kmap() is being deprecated in favor of kmap_local_page().

There are two main problems with kmap(): (1) It comes with an overhead as
the mapping space is restricted and protected by a global lock for
synchronization and (2) it also requires global TLB invalidation when the
kmap’s pool wraps and it might block when the mapping space is fully
utilized until a slot becomes available.

With kmap_local_page() the mappings are per thread, CPU local, can take
page faults, and can be called from any context (including interrupts).
It is faster than kmap() in kernels with HIGHMEM enabled. Furthermore,
the tasks can be preempted and, when they are scheduled to run again, the
kernel virtual addresses are restored and still valid.

Since kmap_local_page() would not break the strict rules of local mappings
(i.e., the thread locality and the stack based nesting), this function can
be easily and safely replace the deprecated API.

Therefore, replace kmap() with kmap_local_page() in fs/sysv. kunmap_local()
requires the mapping address, so return that address from dir_get_page()
to be used in dir_put_page().

Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Suggested-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Fabio M. De Francesco <fmdefrancesco@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/sysv: Use dir_put_page() in sysv_rename() 2023-01-20T00:45:43+00:00 Fabio M. De Francesco fmdefrancesco@gmail.com 2023-01-19T15:32:31+00:00 c26ddc49c9080975cc03cf3bd6917c3fb37d808b Use the dir_put_page() helper in sysv_rename() instead of open-coding two kunmap() + put_page(). Cc: Al Viro <viro@zeniv.linux.org.uk> Suggested-by: Ira Weiny <ira.weiny@intel.com> Signed-off-by: Fabio M. De Francesco <fmdefrancesco@gmail.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> 
Use the dir_put_page() helper in sysv_rename() instead of open-coding two
kunmap() + put_page().

Cc: Al Viro <viro@zeniv.linux.org.uk>
Suggested-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Fabio M. De Francesco <fmdefrancesco@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/sysv: Change the signature of dir_get_page() 2023-01-20T00:45:40+00:00 Fabio M. De Francesco fmdefrancesco@gmail.com 2023-01-19T15:32:30+00:00 8dd6c7b2944ce349f06db763d7a2a90a0b83ba0d Change the signature of dir_get_page() in order to prepare this function to the conversion to the use of kmap_local_page(). Change also those call sites which are required to adjust to the new signature. Cc: Ira Weiny <ira.weiny@intel.com> Suggested-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Fabio M. De Francesco <fmdefrancesco@gmail.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> 
Change the signature of dir_get_page() in order to prepare this function
to the conversion to the use of kmap_local_page(). Change also those call
sites which are required to adjust to the new signature.

Cc: Ira Weiny <ira.weiny@intel.com>
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Fabio M. De Francesco <fmdefrancesco@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/sysv: Use the offset_in_page() helper 2023-01-20T00:45:38+00:00 Fabio M. De Francesco fmdefrancesco@gmail.com 2023-01-19T15:32:29+00:00 4bb1a1375ac33950385d17321c546aeb520ba152 Use the offset_in_page() helper because it is more suitable than doing explicit subtractions between pointers to directory entries and kernel virtual addresses of mapped pages. Cc: Ira Weiny <ira.weiny@intel.com> Suggested-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Fabio M. De Francesco <fmdefrancesco@gmail.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> 
Use the offset_in_page() helper because it is more suitable than doing
explicit subtractions between pointers to directory entries and kernel
virtual addresses of mapped pages.

Cc: Ira Weiny <ira.weiny@intel.com>
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Fabio M. De Francesco <fmdefrancesco@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
sysv: don't flush page immediately for DIRSYNC directories 2023-01-20T00:38:30+00:00 Christoph Hellwig hch@lst.de 2023-01-18T17:30:25+00:00 4309093ecb841bbd27fcd23525dd41b9a6b437ea We do not need to writeout modified directory blocks immediately when modifying them while the page is locked. It is enough to do the flush somewhat later which has the added benefit that inode times can be flushed as well. It also allows us to stop depending on write_one_page() function. Ported from an ext2 patch by Jan Kara. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> 
We do not need to writeout modified directory blocks immediately when
modifying them while the page is locked. It is enough to do the flush
somewhat later which has the added benefit that inode times can be
flushed as well. It also allows us to stop depending on
write_one_page() function.

Ported from an ext2 patch by Jan Kara.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>