Intel OpenBMC Linux kernel source tree (mirror) https://git.radix-linux.su/BMC/Intel-BMC/linux.git/atom?h=dev-5.15-intel 2022-04-08T12:24:15+00:00 2022-04-08T12:24:15+00:00 Zhihao Cheng chengzhihao1@huawei.com 2021-12-27T03:22:42+00:00 urn:sha1:ba8260872dd50fc058f7d489794c9c8cf84668fa commit c3c07fc25f37c157fde041b3a0c3dfcb1590cbce upstream. Abort fastmap scanning and return error code if memory allocation fails in add_aeb(). Otherwise ubi will get wrong peb statistics information after scanning. Fixes: dbb7d2a88d2a7b ("UBI: Add fastmap core") Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2022-04-08T12:24:11+00:00 Baokun Li libaokun1@huawei.com 2021-11-05T09:30:22+00:00 urn:sha1:1a3f1cf87054833242fcd0218de0481cf855f888 commit 3cbf0e392f173ba0ce425968c8374a6aa3e90f2e upstream. Hulk Robot reported a KASAN report about use-after-free: ================================================================== BUG: KASAN: use-after-free in __list_del_entry_valid+0x13d/0x160 Read of size 8 at addr ffff888035e37d98 by task ubiattach/1385 [...] Call Trace: klist_dec_and_del+0xa7/0x4a0 klist_put+0xc7/0x1a0 device_del+0x4d4/0xed0 cdev_device_del+0x1a/0x80 ubi_attach_mtd_dev+0x2951/0x34b0 [ubi] ctrl_cdev_ioctl+0x286/0x2f0 [ubi] Allocated by task 1414: device_add+0x60a/0x18b0 cdev_device_add+0x103/0x170 ubi_create_volume+0x1118/0x1a10 [ubi] ubi_cdev_ioctl+0xb7f/0x1ba0 [ubi] Freed by task 1385: cdev_device_del+0x1a/0x80 ubi_remove_volume+0x438/0x6c0 [ubi] ubi_cdev_ioctl+0xbf4/0x1ba0 [ubi] [...] ================================================================== The lock held by ctrl_cdev_ioctl is ubi_devices_mutex, but the lock held by ubi_cdev_ioctl is ubi->device_mutex. Therefore, the two locks can be concurrent. ctrl_cdev_ioctl contains two operations: ubi_attach and ubi_detach. ubi_detach is bug-free because it uses reference counting to prevent concurrency. However, uif_init and uif_close in ubi_attach may race with ubi_cdev_ioctl. uif_init will race with ubi_cdev_ioctl as in the following stack. cpu1 cpu2 cpu3 _______________________|________________________|______________________ ctrl_cdev_ioctl ubi_attach_mtd_dev uif_init ubi_cdev_ioctl ubi_create_volume cdev_device_add ubi_add_volume // sysfs exist kill_volumes ubi_cdev_ioctl ubi_remove_volume cdev_device_del // first free ubi_free_volume cdev_del // double free cdev_device_del And uif_close will race with ubi_cdev_ioctl as in the following stack. cpu1 cpu2 cpu3 _______________________|________________________|______________________ ctrl_cdev_ioctl ubi_attach_mtd_dev uif_init ubi_cdev_ioctl ubi_create_volume cdev_device_add ubi_debugfs_init_dev //error goto out_uif; uif_close kill_volumes ubi_cdev_ioctl ubi_remove_volume cdev_device_del // first free ubi_free_volume // double free The cause of this problem is that commit 714fb87e8bc0 make device "available" before it becomes accessible via sysfs. Therefore, we roll back the modification. We will fix the race condition between ubi device creation and udev by removing ubi_get_device in vol_attribute_show and dev_attribute_show.This avoids accessing uninitialized ubi_devices[ubi_num]. ubi_get_device is used to prevent devices from being deleted during sysfs execution. However, now kernfs ensures that devices will not be deleted before all reference counting are released. The key process is shown in the following stack. device_del device_remove_attrs device_remove_groups sysfs_remove_groups sysfs_remove_group remove_files kernfs_remove_by_name kernfs_remove_by_name_ns __kernfs_remove kernfs_drain Fixes: 714fb87e8bc0 ("ubi: Fix race condition between ubi device creation and udev") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Baokun Li <libaokun1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2021-07-09T17:10:47+00:00 Linus Torvalds torvalds@linux-foundation.org 2021-07-09T17:10:47+00:00 urn:sha1:7a400bf28334fc7734639db3566394e1fc80670c Pull UBIFS updates from Richard Weinberger: - Fix for a race xattr list and modification - Various minor fixes (spelling, return codes, ...) * tag 'for-linus-5.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs: ubifs: Set/Clear I_LINKABLE under i_lock for whiteout inode ubifs: Fix spelling mistakes ubifs: Remove ui_mutex in ubifs_xattr_get and change_xattr ubifs: Fix races between xattr_{set|get} and listxattr operations ubifs: fix snprintf() checking ubifs: journal: Fix error return code in ubifs_jnl_write_inode() 2021-06-18T20:04:47+00:00 Dan Carpenter dan.carpenter@oracle.com 2021-05-11T07:12:00+00:00 urn:sha1:be076fdf8369f3b4842362c64cd681f3d498f3dd The snprintf() function returns the number of characters (not counting the NUL terminator) that it would have printed if we had space. This buffer has UBIFS_DFS_DIR_LEN characters plus one extra for the terminator. Printing UBIFS_DFS_DIR_LEN is okay but anything higher will result in truncation. Thus the comparison needs to be change from == to >. These strings are compile time constants so this patch doesn't affect runtime. Fixes: ae380ce04731 ("UBIFS: lessen the size of debugging info data structure") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Alexander Dahl <ada@thorsis.com> Signed-off-by: Richard Weinberger <richard@nod.at> 2021-06-11T17:54:43+00:00 Christoph Hellwig hch@lst.de 2021-06-02T06:53:41+00:00 urn:sha1:77567b25ab9f06c6477a153e58ace6897c6794d1 Use blk_mq_alloc_disk and blk_cleanup_disk to simplify the gendisk and request_queue allocation. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com> Link: https://lore.kernel.org/r/20210602065345.355274-27-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk> 2021-04-15T20:01:25+00:00 Wan Jiabing wanjiabing@vivo.com 2021-04-06T07:16:18+00:00 urn:sha1:9a29f7f020e06f14eb126bcb84a7f0d166415824 struct ubi_wl_entry is defined at 178th line. The declaration here is unnecessary. Remove it. Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com> Signed-off-by: Wan Jiabing <wanjiabing@vivo.com> Signed-off-by: Richard Weinberger <richard@nod.at> 2021-04-15T20:00:43+00:00 Gustavo A. R. Silva gustavoars@kernel.org 2021-03-05T08:28:32+00:00 urn:sha1:8aa058d79b6d491778836626ba94a5165589acaf In preparation to enable -Wimplicit-fallthrough for Clang, fix a warning by explicitly adding a break statement instead of letting the code fall through to the next case. Link: https://github.com/KSPP/linux/issues/115 Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Richard Weinberger <richard@nod.at> 2021-02-12T20:53:22+00:00 Zheng Yongjun zhengyongjun3@huawei.com 2020-12-16T13:07:28+00:00 urn:sha1:3b638f997a3551b922dee5d8371208c9017ab7f9 The parameter of kfree function is NULL, so kfree code is useless, delete it. Signed-off-by: Zheng Yongjun <zhengyongjun3@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at> 2021-02-12T20:53:22+00:00 Jubin Zhong zhongjubin@huawei.com 2020-12-19T12:49:10+00:00 urn:sha1:cf0838dfa3f9337229bbb7837c24b985539bf37d data_size is already checked against zero when vol_type matches UBI_VID_STATIC. Remove the following dead code. Signed-off-by: Jubin Zhong <zhongjubin@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at> 2020-12-18T01:46:34+00:00 Linus Torvalds torvalds@linux-foundation.org 2020-12-18T01:46:34+00:00 urn:sha1:787fec8ac15cc693b9a7bc1b4a338b92483d993c Pull jffs2, ubi and ubifs updates from Richard Weinberger: "JFFS2: - Fix for a remount regression - Fix for an abnormal GC exit - Fix for a possible NULL pointer issue while mounting UBI: - Add support ECC-ed NOR flash - Removal of dead code UBIFS: - Make node dumping debug code more reliable - Various cleanups: less ifdefs, less typos - Fix for an info leak" * tag 'for-linus-5.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs: ubifs: ubifs_dump_node: Dump all branches of the index node ubifs: ubifs_dump_sleb: Remove unused function ubifs: Pass node length in all node dumping callers Revert "ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len" ubifs: Limit dumping length by size of memory which is allocated for the node ubifs: Remove the redundant return in dbg_check_nondata_nodes_order jffs2: Fix NULL pointer dereference in rp_size fs option parsing ubifs: Fixed print foramt mismatch in ubifs ubi: Do not zero out EC and VID on ECC-ed NOR flashes jffs2: remove trailing semicolon in macro definition ubifs: Fix error return code in ubifs_init_authentication() ubifs: wbuf: Don't leak kernel memory to flash ubi: Remove useless code in bytes_str_to_int ubifs: Fix the printing type of c->big_lpt jffs2: Allow setting rp_size to zero during remounting jffs2: Fix ignoring mounting options problem during remounting jffs2: Fix GC exit abnormally ubifs: Code cleanup by removing ifdef macro surrounding jffs2: Fix if/else empty body warnings ubifs: Delete duplicated words + other fixes