date:20240424

[linux-yocto] [PATCH 1/1] reiserfs: Avoid touching renamed directory if parent does not change

2024-04-24 Thread Paul Gortmaker

From: Jan Kara 

commit 49db9b1b86a82448dfaf3fcfefcf678dee56c8ed upstream.

The VFS will not be locking moved directory if its parent does not
change. Change reiserfs rename code to avoid touching renamed directory
if its parent does not change as without locking that can corrupt the
filesystem.

Signed-off-by: Jan Kara 
Signed-off-by: Al Viro 
Signed-off-by: Paul Gortmaker 
---
 fs/reiserfs/namei.c | 54 -
 1 file changed, 29 insertions(+), 25 deletions(-)

diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
index b916859992ec8..9a622bb135a80 100644
--- a/fs/reiserfs/namei.c
+++ b/fs/reiserfs/namei.c
@@ -1325,8 +1325,8 @@ static int reiserfs_rename(struct user_namespace 
*mnt_userns,
struct inode *old_inode, *new_dentry_inode;
struct reiserfs_transaction_handle th;
int jbegin_count;
-   umode_t old_inode_mode;
unsigned long savelink = 1;
+   bool update_dir_parent = false;
struct timespec64 ctime;
 
if (flags & ~RENAME_NOREPLACE)
@@ -1377,8 +1377,7 @@ static int reiserfs_rename(struct user_namespace 
*mnt_userns,
return -ENOENT;
}
 
-   old_inode_mode = old_inode->i_mode;
-   if (S_ISDIR(old_inode_mode)) {
+   if (S_ISDIR(old_inode->i_mode)) {
/*
 * make sure that directory being renamed has correct ".."
 * and that its new parent directory has not too many links
@@ -1391,24 +1390,28 @@ static int reiserfs_rename(struct user_namespace 
*mnt_userns,
}
}
 
-   /*
-* directory is renamed, its parent directory will be changed,
-* so find ".." entry
-*/
-   dot_dot_de.de_gen_number_bit_string = NULL;
-   retval =
-   reiserfs_find_entry(old_inode, "..", 2, _dot_entry_path,
+   if (old_dir != new_dir) {
+   /*
+* directory is renamed, its parent directory will be
+* changed, so find ".." entry
+*/
+   dot_dot_de.de_gen_number_bit_string = NULL;
+   retval =
+   reiserfs_find_entry(old_inode, "..", 2,
+   _dot_entry_path,
_dot_de);
-   pathrelse(_dot_entry_path);
-   if (retval != NAME_FOUND) {
-   reiserfs_write_unlock(old_dir->i_sb);
-   return -EIO;
-   }
+   pathrelse(_dot_entry_path);
+   if (retval != NAME_FOUND) {
+   reiserfs_write_unlock(old_dir->i_sb);
+   return -EIO;
+   }
 
-   /* inode number of .. must equal old_dir->i_ino */
-   if (dot_dot_de.de_objectid != old_dir->i_ino) {
-   reiserfs_write_unlock(old_dir->i_sb);
-   return -EIO;
+   /* inode number of .. must equal old_dir->i_ino */
+   if (dot_dot_de.de_objectid != old_dir->i_ino) {
+   reiserfs_write_unlock(old_dir->i_sb);
+   return -EIO;
+   }
+   update_dir_parent = true;
}
}
 
@@ -1488,7 +1491,7 @@ static int reiserfs_rename(struct user_namespace 
*mnt_userns,
 
reiserfs_prepare_for_journal(old_inode->i_sb, new_de.de_bh, 1);
 
-   if (S_ISDIR(old_inode->i_mode)) {
+   if (update_dir_parent) {
if ((retval =
 search_by_entry_key(new_dir->i_sb,
 _dot_de.de_entry_key,
@@ -1536,14 +1539,14 @@ static int reiserfs_rename(struct user_namespace 
*mnt_userns,
 new_de.de_bh);
reiserfs_restore_prepared_buffer(old_inode->i_sb,
 old_de.de_bh);
-   if (S_ISDIR(old_inode_mode))
+   if (update_dir_parent)
reiserfs_restore_prepared_buffer(old_inode->
 i_sb,
 dot_dot_de.
 de_bh);
continue;
}
-   if (S_ISDIR(old_inode_mode)) {
+   if (update_dir_parent) {
if (item_moved(_dot_ih, _dot_entry_path) ||
!entry_points_to_object("..", 2, _dot_de,
old_dir)) {
@@ -1561,7 +1564,7 @@ static int

[linux-yocto] [PATCH v5.15/v6.1 0/1] reiserfs namei.c backport for CVE-2023-52591

2024-04-24 Thread Paul Gortmaker

From: Paul Gortmaker 

I was ready to put this CVE in the ignore pile, since IMHO the reiserfs
only continues to exist as a curiousity and possibly as a back
compatibility test for the VFS layer.  Pretty sure nobody has used it in
earnest in the last 15-ish years?

However, the "conflict" was a trivial one in the variable declaration
block (from addition of struct timespec64 ctime) and the same "fixed up"
commit applies to both v5.15 and v6.1 kernels.  So we might as well take
the easy ones, I guess.  Nothing for v6.6.x as it already has a backport.

Build tested only.  Obviously zero rush to merge this, given the subject
matter and essentially zero user base.  It can sit for a month+ if there
are other things going on, and nobody will care (including me).

Paul.
--

Jan Kara (1):
  reiserfs: Avoid touching renamed directory if parent does not change

 fs/reiserfs/namei.c | 54 -
 1 file changed, 29 insertions(+), 25 deletions(-)

-- 
2.25.1


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#13867): 
https://lists.yoctoproject.org/g/linux-yocto/message/13867
Mute This Topic: https://lists.yoctoproject.org/mt/105724660/21656
Group Owner: linux-yocto+ow...@lists.yoctoproject.org
Unsubscribe: https://lists.yoctoproject.org/g/linux-yocto/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[linux-yocto] [PATCH 1/2] ipv6: annotate some data-races around sk->sk_prot

2024-04-24 Thread Paul Gortmaker

From: Eric Dumazet 

commit 086d49058cd8471046ae9927524708820f5fd1c7 upstream.

IPv6 has this hack changing sk->sk_prot when an IPv6 socket
is 'converted' to an IPv4 one with IPV6_ADDRFORM option.

This operation is only performed for TCP and UDP, knowing
their 'struct proto' for the two network families are populated
in the same way, and can not disappear while a reader
might use and dereference sk->sk_prot.

If we think about it all reads of sk->sk_prot while
either socket lock or RTNL is not acquired should be using READ_ONCE().

Also note that other layers like MPTCP, XFRM, CHELSIO_TLS also
write over sk->sk_prot.

BUG: KCSAN: data-race in inet6_recvmsg / ipv6_setsockopt

write to 0x8881386f7aa8 of 8 bytes by task 26932 on cpu 0:
 do_ipv6_setsockopt net/ipv6/ipv6_sockglue.c:492 [inline]
 ipv6_setsockopt+0x3758/0x3910 net/ipv6/ipv6_sockglue.c:1019
 udpv6_setsockopt+0x85/0x90 net/ipv6/udp.c:1649
 sock_common_setsockopt+0x5d/0x70 net/core/sock.c:3489
 __sys_setsockopt+0x209/0x2a0 net/socket.c:2180
 __do_sys_setsockopt net/socket.c:2191 [inline]
 __se_sys_setsockopt net/socket.c:2188 [inline]
 __x64_sys_setsockopt+0x62/0x70 net/socket.c:2188
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0x8881386f7aa8 of 8 bytes by task 26911 on cpu 1:
 inet6_recvmsg+0x7a/0x210 net/ipv6/af_inet6.c:659
 sys_recvmsg+0x16c/0x320
 ___sys_recvmsg net/socket.c:2674 [inline]
 do_recvmmsg+0x3f5/0xae0 net/socket.c:2768
 __sys_recvmmsg net/socket.c:2847 [inline]
 __do_sys_recvmmsg net/socket.c:2870 [inline]
 __se_sys_recvmmsg net/socket.c:2863 [inline]
 __x64_sys_recvmmsg+0xde/0x160 net/socket.c:2863
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x85e0e980 -> 0x85e01580

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 26911 Comm: syz-executor.3 Not tainted 
5.17.0-rc2-syzkaller-00316-g0457e5153e0e-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 
01/01/2011

Reported-by: syzbot 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Paul Gortmaker 
---
 net/ipv6/af_inet6.c  | 24 ++--
 net/ipv6/ipv6_sockglue.c |  6 --
 2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 8e0c33b683010..bbfa5d3a16f01 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -452,11 +452,14 @@ int inet6_bind(struct socket *sock, struct sockaddr 
*uaddr, int addr_len)
 {
struct sock *sk = sock->sk;
u32 flags = BIND_WITH_LOCK;
+   const struct proto *prot;
int err = 0;
 
+   /* IPV6_ADDRFORM can change sk->sk_prot under us. */
+   prot = READ_ONCE(sk->sk_prot);
/* If the socket has its own bind function then use it. */
-   if (sk->sk_prot->bind)
-   return sk->sk_prot->bind(sk, uaddr, addr_len);
+   if (prot->bind)
+   return prot->bind(sk, uaddr, addr_len);
 
if (addr_len < SIN6_LEN_RFC2133)
return -EINVAL;
@@ -572,6 +575,7 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, 
unsigned long arg)
void __user *argp = (void __user *)arg;
struct sock *sk = sock->sk;
struct net *net = sock_net(sk);
+   const struct proto *prot;
 
switch (cmd) {
case SIOCADDRT:
@@ -589,9 +593,11 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, 
unsigned long arg)
case SIOCSIFDSTADDR:
return addrconf_set_dstaddr(net, argp);
default:
-   if (!sk->sk_prot->ioctl)
+   /* IPV6_ADDRFORM can change sk->sk_prot under us. */
+   prot = READ_ONCE(sk->sk_prot);
+   if (!prot->ioctl)
return -ENOIOCTLCMD;
-   return sk->sk_prot->ioctl(sk, cmd, arg);
+   return prot->ioctl(sk, cmd, arg);
}
/*NOTREACHED*/
return 0;
@@ -653,11 +659,14 @@ INDIRECT_CALLABLE_DECLARE(int udpv6_sendmsg(struct sock 
*, struct msghdr *,
 int inet6_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 {
struct sock *sk = sock->sk;
+   const struct proto *prot;
 
if (unlikely(inet_send_prepare(sk)))
return -EAGAIN;
 
-   return INDIRECT_CALL_2(sk->sk_prot->sendmsg, tcp_sendmsg, udpv6_sendmsg,
+   /* IPV6_ADDRFORM can change sk->sk_prot under us. */
+   prot = READ_ONCE(sk->sk_prot);
+   return INDIRECT_CALL_2(prot->sendmsg, tcp_sendmsg, udpv6_sendmsg,
   sk, msg, size);
 }
 
@@ -667,13 +676,16 @@ int inet6_recvmsg(struct socket *sock, struct msghdr 
*msg, size_t size,
  int flags)
 {
struct sock *sk = sock->sk;
+   const struct proto *prot;
int addr_len = 0;
int err;

[linux-yocto] [PATCH v5.15 0/2] Backports for IPv6 CVE-2022-3567

2024-04-24 Thread Paul Gortmaker

From: Paul Gortmaker 

The commit log of "the fix" identifies an earlier commit as "part 1" of
of the fix.  But when we go back as far as v5.15, we find neither are
there.  So this CVE has two commits.

Built and boot tested on top of CVE-2022-3566 fix sent yesterday:

https://lists.yoctoproject.org/g/linux-yocto/message/13856

Once again, v6.1+ kernels have both commits by default, so nothing
for us to do there.

No rush for integration of these - they have been lingering since 2022.

Paul.
--

Eric Dumazet (1):
  ipv6: annotate some data-races around sk->sk_prot

Kuniyuki Iwashima (1):
  ipv6: Fix data races around sk->sk_prot.

 net/core/sock.c  |  6 --
 net/ipv4/af_inet.c   | 23 ---
 net/ipv6/af_inet6.c  | 24 ++--
 net/ipv6/ipv6_sockglue.c |  6 --
 4 files changed, 42 insertions(+), 17 deletions(-)

-- 
2.25.1


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#13865): 
https://lists.yoctoproject.org/g/linux-yocto/message/13865
Mute This Topic: https://lists.yoctoproject.org/mt/105709263/21656
Group Owner: linux-yocto+ow...@lists.yoctoproject.org
Unsubscribe: https://lists.yoctoproject.org/g/linux-yocto/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[linux-yocto] [PATCH 2/2] ipv6: Fix data races around sk->sk_prot.

2024-04-24 Thread Paul Gortmaker

From: Kuniyuki Iwashima 

commit 364f997b5cfe1db0d63a390fe7c801fa2b3115f6 upstream.

Commit 086d49058cd8 ("ipv6: annotate some data-races around sk->sk_prot")
fixed some data-races around sk->sk_prot but it was not enough.

Some functions in inet6_(stream|dgram)_ops still access sk->sk_prot
without lock_sock() or rtnl_lock(), so they need READ_ONCE() to avoid
load tearing.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kuniyuki Iwashima 
Signed-off-by: Jakub Kicinski 
Signed-off-by: Paul Gortmaker 
---
 net/core/sock.c  |  6 --
 net/ipv4/af_inet.c   | 23 ---
 net/ipv6/ipv6_sockglue.c |  4 ++--
 3 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/net/core/sock.c b/net/core/sock.c
index 6f761f3c272aa..b41d5e6953c7f 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -3413,7 +3413,8 @@ int sock_common_getsockopt(struct socket *sock, int 
level, int optname,
 {
struct sock *sk = sock->sk;
 
-   return sk->sk_prot->getsockopt(sk, level, optname, optval, optlen);
+   /* IPV6_ADDRFORM can change sk->sk_prot under us. */
+   return READ_ONCE(sk->sk_prot)->getsockopt(sk, level, optname, optval, 
optlen);
 }
 EXPORT_SYMBOL(sock_common_getsockopt);
 
@@ -3440,7 +3441,8 @@ int sock_common_setsockopt(struct socket *sock, int 
level, int optname,
 {
struct sock *sk = sock->sk;
 
-   return sk->sk_prot->setsockopt(sk, level, optname, optval, optlen);
+   /* IPV6_ADDRFORM can change sk->sk_prot under us. */
+   return READ_ONCE(sk->sk_prot)->setsockopt(sk, level, optname, optval, 
optlen);
 }
 EXPORT_SYMBOL(sock_common_setsockopt);
 
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 487f75993bf4f..110ac22d3ce20 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -565,22 +565,27 @@ int inet_dgram_connect(struct socket *sock, struct 
sockaddr *uaddr,
   int addr_len, int flags)
 {
struct sock *sk = sock->sk;
+   const struct proto *prot;
int err;
 
if (addr_len < sizeof(uaddr->sa_family))
return -EINVAL;
+
+   /* IPV6_ADDRFORM can change sk->sk_prot under us. */
+   prot = READ_ONCE(sk->sk_prot);
+
if (uaddr->sa_family == AF_UNSPEC)
-   return sk->sk_prot->disconnect(sk, flags);
+   return prot->disconnect(sk, flags);
 
if (BPF_CGROUP_PRE_CONNECT_ENABLED(sk)) {
-   err = sk->sk_prot->pre_connect(sk, uaddr, addr_len);
+   err = prot->pre_connect(sk, uaddr, addr_len);
if (err)
return err;
}
 
if (data_race(!inet_sk(sk)->inet_num) && inet_autobind(sk))
return -EAGAIN;
-   return sk->sk_prot->connect(sk, uaddr, addr_len);
+   return prot->connect(sk, uaddr, addr_len);
 }
 EXPORT_SYMBOL(inet_dgram_connect);
 
@@ -743,10 +748,11 @@ EXPORT_SYMBOL(inet_stream_connect);
 int inet_accept(struct socket *sock, struct socket *newsock, int flags,
bool kern)
 {
-   struct sock *sk1 = sock->sk;
+   struct sock *sk1 = sock->sk, *sk2;
int err = -EINVAL;
-   struct sock *sk2 = sk1->sk_prot->accept(sk1, flags, , kern);
 
+   /* IPV6_ADDRFORM can change sk->sk_prot under us. */
+   sk2 = READ_ONCE(sk1->sk_prot)->accept(sk1, flags, , kern);
if (!sk2)
goto do_err;
 
@@ -834,12 +840,15 @@ ssize_t inet_sendpage(struct socket *sock, struct page 
*page, int offset,
  size_t size, int flags)
 {
struct sock *sk = sock->sk;
+   const struct proto *prot;
 
if (unlikely(inet_send_prepare(sk)))
return -EAGAIN;
 
-   if (sk->sk_prot->sendpage)
-   return sk->sk_prot->sendpage(sk, page, offset, size, flags);
+   /* IPV6_ADDRFORM can change sk->sk_prot under us. */
+   prot = READ_ONCE(sk->sk_prot);
+   if (prot->sendpage)
+   return prot->sendpage(sk, page, offset, size, flags);
return sock_no_sendpage(sock, page, offset, size, flags);
 }
 EXPORT_SYMBOL(inet_sendpage);
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 6d08ebf753b36..a1a92480e935f 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -475,7 +475,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, 
int optname,
sock_prot_inuse_add(net, sk->sk_prot, -1);
sock_prot_inuse_add(net, _prot, 1);
local_bh_enable();
-   /* Paired with READ_ONCE(sk->sk_prot) in 
net/ipv6/af_inet6.c */
+   /* Paired with READ_ONCE(sk->sk_prot) in 
inet6_stream_ops */
WRITE_ONCE(sk->sk_prot, _prot);
/* Paired with READ_ONCE() in 
tcp_(get|set)sockopt() */
WRITE_ONCE(icsk->icsk_af_ops, _specific);
@@ -491,7 +491,7 @@ static int

Re: [linux-yocto] Seeking information on use of linux-yocto-dev

2024-04-24 Thread Ross Burton

On 23 Apr 2024, at 17:33, Sourabh Banerjee (QUIC)  
wrote:

2. Is linux-yocto-dev tested by the autobuilder or a similar CI?

We've had adding it to the autobuilder CI on the wishlist for quite a while. I
thought
Ross added something a few months ago, but I can't recall the details. We do
need
to decide on exactly what to test, making sure it is lighter than what is run
against
the release kernels that I generate.

If it was in CI there might be some breakage due to the bleeding edge nature of
the updates. We just wouldn't want it to block any project milestones if run as
part of CI.


Added Ross to get a bit more clarity on autobuilder setup to linux-yocto-dev.

The public autobuilder doesn’t -- yet -- do linux-yocto-dev builds.  Mainly 
because it would need to be ran separately as it does break more than the 
stable kernels so would need to be monitored by a human but not impact the 
existing builds, and the extra load on the AB would ideally be balanced out by 
some other changes so the net change is zero.

Our meta-arm CI does do builds with linux-yocto-dev, and we find new 
regressions or failures every few weeks or so. It fails enough due to upstream 
churn that we tell it to consider failures in linux-yocto-dev to be warnings 
not errors…

Ross

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#13863): 
https://lists.yoctoproject.org/g/linux-yocto/message/13863
Mute This Topic: https://lists.yoctoproject.org/mt/105677861/21656
Group Owner: linux-yocto+ow...@lists.yoctoproject.org
Unsubscribe: https://lists.yoctoproject.org/g/linux-yocto/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[linux-yocto] [PATCH 1/1] reiserfs: Avoid touching renamed directory if parent does not change

[linux-yocto] [PATCH v5.15/v6.1 0/1] reiserfs namei.c backport for CVE-2023-52591

[linux-yocto] [PATCH 1/2] ipv6: annotate some data-races around sk->sk_prot

[linux-yocto] [PATCH v5.15 0/2] Backports for IPv6 CVE-2022-3567

[linux-yocto] [PATCH 2/2] ipv6: Fix data races around sk->sk_prot.

Re: [linux-yocto] Seeking information on use of linux-yocto-dev

6 matches

Site Navigation

Mail list logo

Footer information