From 7cf5d82154dcd64ff75b69f3dc8dbff4ed2d2816 Mon Sep 17 00:00:00 2001 From: Lee Jones Date: Tue, 18 Apr 2023 10:35:38 +0100 Subject: [PATCH 1/4] Revert "Revert "mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse"" This reverts commit 4f35cec76058557d9eaec0d501d03c7657eb56b4 and does so in an abi-safe way. This is done by adding the new fields only to the end of the structure and this structure is only passed around to other functions as a pointer, the internal structure layout is only touched by the core kernel, so adding it to the end is safe. ABI differences manually updated: Leaf changes summary: 1 artifact changed Changed leaf types summary: 1 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 0 Added function Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable 'struct anon_vma at rmap.h:29:1' changed: type size changed from 704 to 832 (in bits) 2 data member insertions: 'unsigned long int num_children', at offset 704 (in bits) at rmap.h:70:1 'unsigned long int num_active_vmas', at offset 768 (in bits) at rmap.h:72:1 761 impacted interfaces Bug: 260678056 Bug: 253167854 Change-Id: Ib1d45625cbc2e0b21330ca3dc2aa7aff34666d31 Signed-off-by: Lee Jones Signed-off-by: Greg Kroah-Hartman (cherry picked from commit d3e1a50cba092fa9c56fc642ee74f360c4b40a17) --- android/abi_gki_aarch64.xml | 3452 ++++++++++++++++++----------------- include/linux/rmap.h | 27 +- mm/rmap.c | 32 +- 3 files changed, 1766 insertions(+), 1745 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index 4c410fd1a030..4afc5a832200 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -2903,7 +2903,7 @@ - + @@ -2914,13 +2914,19 @@ - + - + - + + + + + + + @@ -4479,75 +4485,75 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -16680,7 +16686,7 @@ - + @@ -16688,7 +16694,7 @@ - + @@ -16777,7 +16783,7 @@ - + @@ -18101,405 +18107,405 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -22508,12 +22514,12 @@ - + - + - + @@ -22681,7 +22687,7 @@ - + @@ -22690,7 +22696,7 @@ - + @@ -22868,21 +22874,21 @@ - + - + - + - + - + - + @@ -23183,12 +23189,12 @@ - + - + - + @@ -23830,91 +23836,91 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -24746,12 +24752,12 @@ - + - + - + @@ -24978,7 +24984,7 @@ - + @@ -25776,27 +25782,27 @@ - + - + - + - + - + - + - + - + @@ -26113,222 +26119,222 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -26369,21 +26375,21 @@ - + - + - + - + - + - + @@ -27828,26 +27834,26 @@ - + - + - + - + - + - + - + - + @@ -29323,18 +29329,18 @@ - + - + - + - + - + @@ -29801,15 +29807,15 @@ - + - + - + - + @@ -31637,11 +31643,7 @@ - - - - - + @@ -33494,8 +33496,8 @@ - - + + @@ -33515,12 +33517,12 @@ - - + + - - + + @@ -33873,7 +33875,7 @@ - + @@ -36156,421 +36158,421 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -36645,222 +36647,222 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -37265,7 +37267,7 @@ - + @@ -37611,7 +37613,7 @@ - + @@ -37714,23 +37716,23 @@ - + - + - + - + - + - + - + @@ -37744,69 +37746,69 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -38749,27 +38751,27 @@ - + - + - + - + - + - + - + - + @@ -38800,66 +38802,66 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -38876,63 +38878,63 @@ - - - + + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -38976,29 +38978,29 @@ - + - + - + - + - + - + - + - + - + @@ -39007,7 +39009,7 @@ - + @@ -39018,48 +39020,48 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -42425,10 +42427,10 @@ - - - - + + + + @@ -42494,34 +42496,34 @@ - - + + - - - - - + + + + + - - - - + + + + - - + + - - + + - - - + + + @@ -44790,42 +44792,42 @@ - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - + + - - + + @@ -46945,7 +46947,7 @@ - + @@ -46995,12 +46997,12 @@ - + - + @@ -47783,69 +47785,69 @@ - - + + - - + + - - + + - - + + - - + + - - - + + + - - + + - - + + - - - - - + - - + + - - - + + + + + + + - - - + + + - - - + + + - - - + + + @@ -47854,61 +47856,61 @@ - - - + + + - - - + + + - - - + + + - - + + - - - + + + - - - + + + - - + + - - - + + + - - - + + + - - - + + + - - + + - - - + + + @@ -48836,9 +48838,9 @@ - + - + @@ -48870,7 +48872,7 @@ - + @@ -50265,17 +50267,17 @@ - - + + - - + + - - - + + + @@ -50570,45 +50572,45 @@ - + - - - - - - - - - - + + + + + + + + + + - - + + - - + + - - + + - - - - - + + + + + - - - - - + + + + + @@ -52069,7 +52071,7 @@ - + @@ -52089,222 +52091,222 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -52479,86 +52481,86 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -52593,28 +52595,28 @@ - + - + - + - + - + - + - + - + @@ -53034,45 +53036,45 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -53561,18 +53563,18 @@ - + - + - + - + - + @@ -54002,33 +54004,33 @@ - + - + - + - + - + - + - + - + - + - + @@ -54580,18 +54582,18 @@ - + - + - + - + - + @@ -56694,21 +56696,21 @@ - - + + - - + + - - - + + + - - + + @@ -56734,17 +56736,17 @@ - - + + - + - + - + @@ -57150,222 +57152,222 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -59632,45 +59634,45 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -59840,33 +59842,33 @@ - + - + - + - + - + - + - + - + - + - + @@ -59880,18 +59882,18 @@ - + - + - + - + - + @@ -60143,28 +60145,28 @@ - + - + - + - + - + - + - + - + @@ -60212,48 +60214,48 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -60279,42 +60281,42 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -60324,26 +60326,26 @@ - + - + - + - + - + - + - + - + @@ -60595,11 +60597,11 @@ - + - + @@ -60687,21 +60689,21 @@ - + - + - + - + - + - + @@ -64298,7 +64300,7 @@ - + @@ -64396,7 +64398,7 @@ - + @@ -66831,7 +66833,7 @@ - + @@ -80116,7 +80118,7 @@ - + @@ -80129,11 +80131,11 @@ - + - + @@ -80143,7 +80145,7 @@ - + @@ -80152,11 +80154,11 @@ - + - + @@ -80391,7 +80393,7 @@ - + @@ -80575,21 +80577,21 @@ - + - + - + - + @@ -80617,23 +80619,23 @@ - + - + - + - + @@ -80641,7 +80643,7 @@ - + @@ -80655,18 +80657,18 @@ - + - + - + @@ -80691,7 +80693,7 @@ - + @@ -84182,62 +84184,62 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -84248,7 +84250,7 @@ - + @@ -84554,16 +84556,16 @@ - + - + - + @@ -84591,7 +84593,7 @@ - + @@ -84606,27 +84608,27 @@ - + - + - + - + - + - + @@ -85483,7 +85485,7 @@ - + @@ -86101,25 +86103,25 @@ - - - + + + - - - + + + - - - + + + - - - - + + + + @@ -86443,7 +86445,7 @@ - + @@ -88566,35 +88568,35 @@ - - - + + + - - - + + + - - + + - - - + + + - - + + - - + + - - + + @@ -88603,50 +88605,50 @@ - - - - + + + + - - - + + + - - + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - - + + + + @@ -88654,20 +88656,20 @@ - - + + - - + + - - + + - - + + @@ -90232,23 +90234,23 @@ - - - + + + - - - - + + + + - - + + @@ -92650,7 +92652,7 @@ - + @@ -106007,7 +106009,7 @@ - + @@ -106052,7 +106054,7 @@ - + @@ -106235,7 +106237,7 @@ - + @@ -106254,15 +106256,15 @@ - - + + - - - - - + + + + + @@ -107003,8 +107005,8 @@ - - + + @@ -107263,7 +107265,7 @@ - + @@ -107546,12 +107548,6 @@ - - - - - - @@ -107879,7 +107875,7 @@ - + @@ -107913,7 +107909,7 @@ - + @@ -108087,7 +108083,7 @@ - + @@ -109287,11 +109283,11 @@ - - - - - + + + + + @@ -109325,30 +109321,30 @@ - - - - + + + + - - - - - - - + + + + + + + - - - - + + + + - - - + + + @@ -109553,10 +109549,10 @@ - - - - + + + + @@ -109569,17 +109565,6 @@ - - - - - - - - - - - @@ -109708,15 +109693,19 @@ + + + + - - - + + + @@ -109787,6 +109776,17 @@ + + + + + + + + + + + @@ -109961,39 +109961,39 @@ - - - + + + - - - - - - - + + + + + + + - - - - - - - + + + + + + + - - - - + + + + - - - - + + + + @@ -110293,12 +110293,12 @@ - - - - - - + + + + + + @@ -110377,27 +110377,27 @@ - + - + - + - + - + - + - - - + + + @@ -110406,14 +110406,20 @@ - - + + - + + + + + + + @@ -110449,7 +110455,7 @@ - + @@ -110704,7 +110710,7 @@ - + @@ -110872,192 +110878,192 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -111545,50 +111551,50 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -111629,15 +111635,15 @@ - + - + - + - + @@ -111707,7 +111713,7 @@ - + @@ -111722,25 +111728,25 @@ - - - + + + - - - - + + + + - - - + + + - - - + + + @@ -111756,6 +111762,11 @@ + + + + + @@ -125320,13 +125331,6 @@ - - - - - - - @@ -125814,28 +125818,28 @@ - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + @@ -125973,7 +125977,7 @@ - + @@ -127121,7 +127125,7 @@ - + @@ -127129,12 +127133,12 @@ - - + + - - + + @@ -127153,17 +127157,17 @@ - - + + - - - + + + @@ -127207,7 +127211,7 @@ - + @@ -127438,15 +127442,15 @@ - + - + - + - + @@ -127463,23 +127467,23 @@ - - + + - - - + + + - - - + + + - - - + + + @@ -127519,79 +127523,79 @@ - - - - + + + + - - + + - - + + - - - - + + + + - - - + + + - - + + - + - - - - + + + + - - - - - - + + + + + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - - - + + + + @@ -128188,7 +128192,7 @@ - + @@ -128245,35 +128249,35 @@ - - + + - - - - - - + + + + + + - - - - - + + + + + - - - - - + + + + + - - - + + + @@ -128292,7 +128296,7 @@ - + @@ -128554,15 +128558,15 @@ - + - + - + - + @@ -128693,47 +128697,6 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -129294,6 +129257,47 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -129511,7 +129515,7 @@ - + @@ -129965,7 +129969,7 @@ - + @@ -130001,7 +130005,7 @@ - + @@ -130655,7 +130659,7 @@ - + @@ -130709,27 +130713,27 @@ - - - - - + + + + + - - - - - - - + + + + + + + - - - - - + + + + + @@ -136088,50 +136092,50 @@ - - - + + + - - - + + + - - - - - - - - + + + + + + + + - - - - - - - - - - - + + + + + + + + + + + - - - - - - + + + + + + - - - + + + @@ -136238,25 +136242,25 @@ - - - - + + + + - - - - + + + + - - - - - - - + + + + + + + @@ -136345,37 +136349,37 @@ - - - + + + - - - + + + - - - + + + - - - + + + - - - - - + + + + + - - - - + + + + @@ -136416,7 +136420,7 @@ - + @@ -142423,31 +142427,31 @@ - - - + + + - - - + + + - - - + + + - - - + + + - - - - - + + + + + diff --git a/include/linux/rmap.h b/include/linux/rmap.h index 91ccae946716..6ae8fb134aea 100644 --- a/include/linux/rmap.h +++ b/include/linux/rmap.h @@ -38,13 +38,7 @@ struct anon_vma { */ atomic_t refcount; - /* - * Count of child anon_vmas and VMAs which points to this anon_vma. - * - * This counter is used for making decision about reusing anon_vma - * instead of forking new one. See comments in function anon_vma_clone. - */ - unsigned degree; + unsigned degree; /* ANDROID: KABI preservation, DO NOT USE! */ struct anon_vma *parent; /* Parent of this anon_vma */ @@ -59,6 +53,25 @@ struct anon_vma { /* Interval tree of private "related" vmas */ struct rb_root_cached rb_root; + + /* + * ANDROID: KABI preservation, it's safe to put these at the end of this structure as it's + * only passed by a pointer everywhere, the size and internal structures are local to the + * core kernel. + */ +#ifndef __GENKSYMS__ + /* + * Count of child anon_vmas. Equals to the count of all anon_vmas that + * have ->parent pointing to this one, including itself. + * + * This counter is used for making decision about reusing anon_vma + * instead of forking new one. See comments in function anon_vma_clone. + */ + unsigned long num_children; + /* Count of VMAs whose ->anon_vma pointer points to this object. */ + unsigned long num_active_vmas; +#endif + }; /* diff --git a/mm/rmap.c b/mm/rmap.c index e578eb942317..795bda5e3693 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -82,7 +82,8 @@ static inline struct anon_vma *anon_vma_alloc(void) anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL); if (anon_vma) { atomic_set(&anon_vma->refcount, 1); - anon_vma->degree = 1; /* Reference for first vma */ + anon_vma->num_children = 0; + anon_vma->num_active_vmas = 0; anon_vma->parent = anon_vma; /* * Initialise the anon_vma root to point to itself. If called @@ -190,6 +191,7 @@ int __anon_vma_prepare(struct vm_area_struct *vma) anon_vma = anon_vma_alloc(); if (unlikely(!anon_vma)) goto out_enomem_free_avc; + anon_vma->num_children++; /* self-parent link for new root */ allocated = anon_vma; } @@ -199,8 +201,7 @@ int __anon_vma_prepare(struct vm_area_struct *vma) if (likely(!vma->anon_vma)) { vma->anon_vma = anon_vma; anon_vma_chain_link(vma, avc, anon_vma); - /* vma reference or self-parent link for new root */ - anon_vma->degree++; + anon_vma->num_active_vmas++; allocated = NULL; avc = NULL; } @@ -279,19 +280,19 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src) anon_vma_chain_link(dst, avc, anon_vma); /* - * Reuse existing anon_vma if its degree lower than two, - * that means it has no vma and only one anon_vma child. + * Reuse existing anon_vma if it has no vma and only one + * anon_vma child. * - * Do not chose parent anon_vma, otherwise first child - * will always reuse it. Root anon_vma is never reused: + * Root anon_vma is never reused: * it has self-parent reference and at least one child. */ - if (!dst->anon_vma && anon_vma != src->anon_vma && - anon_vma->degree < 2) + if (!dst->anon_vma && src->anon_vma && + anon_vma->num_children < 2 && + anon_vma->num_active_vmas == 0) dst->anon_vma = anon_vma; } if (dst->anon_vma) - dst->anon_vma->degree++; + dst->anon_vma->num_active_vmas++; unlock_anon_vma_root(root); return 0; @@ -341,6 +342,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) anon_vma = anon_vma_alloc(); if (!anon_vma) goto out_error; + anon_vma->num_active_vmas++; avc = anon_vma_chain_alloc(GFP_KERNEL); if (!avc) goto out_error_free_anon_vma; @@ -361,7 +363,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) vma->anon_vma = anon_vma; anon_vma_lock_write(anon_vma); anon_vma_chain_link(vma, avc, anon_vma); - anon_vma->parent->degree++; + anon_vma->parent->num_children++; anon_vma_unlock_write(anon_vma); return 0; @@ -393,7 +395,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma) * to free them outside the lock. */ if (RB_EMPTY_ROOT(&anon_vma->rb_root.rb_root)) { - anon_vma->parent->degree--; + anon_vma->parent->num_children--; continue; } @@ -401,7 +403,8 @@ void unlink_anon_vmas(struct vm_area_struct *vma) anon_vma_chain_free(avc); } if (vma->anon_vma) - vma->anon_vma->degree--; + vma->anon_vma->num_active_vmas--; + unlock_anon_vma_root(root); /* @@ -412,7 +415,8 @@ void unlink_anon_vmas(struct vm_area_struct *vma) list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) { struct anon_vma *anon_vma = avc->anon_vma; - VM_WARN_ON(anon_vma->degree); + VM_WARN_ON(anon_vma->num_children); + VM_WARN_ON(anon_vma->num_active_vmas); put_anon_vma(anon_vma); list_del(&avc->same_vma); From 544f39d369f61897cfcc0fcc676bd71033ff2793 Mon Sep 17 00:00:00 2001 From: Paul Lawrence Date: Thu, 23 Feb 2023 08:59:38 -0800 Subject: [PATCH 2/4] ANDROID: incremental fs: Evict inodes before freeing mount data Since evicting inodes triggers writes to the backing file, which uses the mi_owner field from the mount_info struct, make sure inodes are evicted before we free the mount_info data Test: incfs_test Bug: 270117845 Change-Id: I673b2e0e04b5adc3998caf6f22443598a30338af Signed-off-by: Paul Lawrence (cherry picked from commit 7899985277527b29c47929a6d6a89c5c89b406ad) (cherry picked from commit faf3626b8e34df3dfff3a99e6582a9abd24410ce) Signed-off-by: Lee Jones --- fs/incfs/main.c | 10 ++++++++++ fs/incfs/vfs.c | 8 +++++++- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/fs/incfs/main.c b/fs/incfs/main.c index aac87b105b5d..6f8c4dd6e042 100644 --- a/fs/incfs/main.c +++ b/fs/incfs/main.c @@ -30,6 +30,15 @@ static ssize_t corefs_show(struct kobject *kobj, static struct kobj_attribute corefs_attr = __ATTR_RO(corefs); +static ssize_t bugfix_inode_eviction_show(struct kobject *kobj, + struct kobj_attribute *attr, char *buff) +{ + return snprintf(buff, PAGE_SIZE, "supported\n"); +} + +static struct kobj_attribute bugfix_inode_eviction_attr = + __ATTR_RO(bugfix_inode_eviction); + static ssize_t mounter_context_for_backing_rw_show(struct kobject *kobj, struct kobj_attribute *attr, char *buff) { @@ -41,6 +50,7 @@ static struct kobj_attribute mounter_context_for_backing_rw_attr = static struct attribute *attributes[] = { &corefs_attr.attr, + &bugfix_inode_eviction_attr.attr, &mounter_context_for_backing_rw_attr.attr, NULL, }; diff --git a/fs/incfs/vfs.c b/fs/incfs/vfs.c index 96981c63cdfe..ac221619f19b 100644 --- a/fs/incfs/vfs.c +++ b/fs/incfs/vfs.c @@ -2309,6 +2309,13 @@ void incfs_kill_sb(struct super_block *sb) pr_debug("incfs: unmount\n"); + /* + * We must kill the super before freeing mi, since killing the super + * triggers inode eviction, which triggers the final update of the + * backing file, which uses certain information for mi + */ + kill_anon_super(sb); + if (mi) { if (mi->mi_backing_dir_path.dentry) dinode = d_inode(mi->mi_backing_dir_path.dentry); @@ -2320,7 +2327,6 @@ void incfs_kill_sb(struct super_block *sb) incfs_free_mount_info(mi); sb->s_fs_info = NULL; } - kill_anon_super(sb); } static int show_options(struct seq_file *m, struct dentry *root) From 04fe40ae010b10bbd11de521c29617c1b9f60a66 Mon Sep 17 00:00:00 2001 From: Theodore Ts'o Date: Sun, 30 Apr 2023 03:04:13 -0400 Subject: [PATCH 3/4] UPSTREAM: ext4: fix invalid free tracking in ext4_xattr_move_to_block() commit b87c7cdf2bed4928b899e1ce91ef0d147017ba45 upstream. In ext4_xattr_move_to_block(), the value of the extended attribute which we need to move to an external block may be allocated by kvmalloc() if the value is stored in an external inode. So at the end of the function the code tried to check if this was the case by testing entry->e_value_inum. However, at this point, the pointer to the xattr entry is no longer valid, because it was removed from the original location where it had been stored. So we could end up calling kvfree() on a pointer which was not allocated by kvmalloc(); or we could also potentially leak memory by not freeing the buffer when it should be freed. Fix this by storing whether it should be freed in a separate variable. Cc: stable@kernel.org Link: https://lore.kernel.org/r/20230430160426.581366-1-tytso@mit.edu Link: https://syzkaller.appspot.com/bug?id=5c2aee8256e30b55ccf57312c16d88417adbd5e1 Link: https://syzkaller.appspot.com/bug?id=41a6b5d4917c0412eb3b3c3c604965bed7d7420b Reported-by: syzbot+64b645917ce07d89bde5@syzkaller.appspotmail.com Reported-by: syzbot+0d042627c4f2ad332195@syzkaller.appspotmail.com Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman Bug: 281332515 Bug: 281333738 Change-Id: Id1fbcc337821d66df53c2826bf3158963f8b0673 Signed-off-by: Tudor Ambarus --- fs/ext4/xattr.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index 1b73a7f8189d..700822c9851a 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -2573,6 +2573,7 @@ static int ext4_xattr_move_to_block(handle_t *handle, struct inode *inode, .in_inode = !!entry->e_value_inum, }; struct ext4_xattr_ibody_header *header = IHDR(inode, raw_inode); + int needs_kvfree = 0; int error; is = kzalloc(sizeof(struct ext4_xattr_ibody_find), GFP_NOFS); @@ -2595,7 +2596,7 @@ static int ext4_xattr_move_to_block(handle_t *handle, struct inode *inode, error = -ENOMEM; goto out; } - + needs_kvfree = 1; error = ext4_xattr_inode_get(inode, entry, buffer, value_size); if (error) goto out; @@ -2634,7 +2635,7 @@ static int ext4_xattr_move_to_block(handle_t *handle, struct inode *inode, out: kfree(b_entry_name); - if (entry->e_value_inum && buffer) + if (needs_kvfree && buffer) kvfree(buffer); if (is) brelse(is->iloc.bh); From fee4b79c4cbab8a2322b92474b85f4bcbd940505 Mon Sep 17 00:00:00 2001 From: Tudor Ambarus Date: Thu, 4 May 2023 12:15:25 +0000 Subject: [PATCH 4/4] UPSTREAM: ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum commit 4f04351888a83e595571de672e0a4a8b74f4fb31 upstream. When modifying the block device while it is mounted by the filesystem, syzbot reported the following: BUG: KASAN: slab-out-of-bounds in crc16+0x206/0x280 lib/crc16.c:58 Read of size 1 at addr ffff888075f5c0a8 by task syz-executor.2/15586 CPU: 1 PID: 15586 Comm: syz-executor.2 Not tainted 6.2.0-rc5-syzkaller-00205-gc96618275234 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:306 print_report+0x107/0x1f0 mm/kasan/report.c:417 kasan_report+0xcd/0x100 mm/kasan/report.c:517 crc16+0x206/0x280 lib/crc16.c:58 ext4_group_desc_csum+0x81b/0xb20 fs/ext4/super.c:3187 ext4_group_desc_csum_set+0x195/0x230 fs/ext4/super.c:3210 ext4_mb_clear_bb fs/ext4/mballoc.c:6027 [inline] ext4_free_blocks+0x191a/0x2810 fs/ext4/mballoc.c:6173 ext4_remove_blocks fs/ext4/extents.c:2527 [inline] ext4_ext_rm_leaf fs/ext4/extents.c:2710 [inline] ext4_ext_remove_space+0x24ef/0x46a0 fs/ext4/extents.c:2958 ext4_ext_truncate+0x177/0x220 fs/ext4/extents.c:4416 ext4_truncate+0xa6a/0xea0 fs/ext4/inode.c:4342 ext4_setattr+0x10c8/0x1930 fs/ext4/inode.c:5622 notify_change+0xe50/0x1100 fs/attr.c:482 do_truncate+0x200/0x2f0 fs/open.c:65 handle_truncate fs/namei.c:3216 [inline] do_open fs/namei.c:3561 [inline] path_openat+0x272b/0x2dd0 fs/namei.c:3714 do_filp_open+0x264/0x4f0 fs/namei.c:3741 do_sys_openat2+0x124/0x4e0 fs/open.c:1310 do_sys_open fs/open.c:1326 [inline] __do_sys_creat fs/open.c:1402 [inline] __se_sys_creat fs/open.c:1396 [inline] __x64_sys_creat+0x11f/0x160 fs/open.c:1396 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f72f8a8c0c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f72f97e3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 00007f72f8bac050 RCX: 00007f72f8a8c0c9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000280 RBP: 00007f72f8ae7ae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd165348bf R14: 00007f72f97e3300 R15: 0000000000022000 Replace le16_to_cpu(sbi->s_es->s_desc_size) with sbi->s_desc_size It reduces ext4's compiled text size, and makes the code more efficient (we remove an extra indirect reference and a potential byte swap on big endian systems), and there is no downside. It also avoids the potential KASAN / syzkaller failure, as a bonus. Reported-by: syzbot+fc51227e7100c9294894@syzkaller.appspotmail.com Reported-by: syzbot+8785e41224a3afd04321@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=70d28d11ab14bd7938f3e088365252aa923cff42 Link: https://syzkaller.appspot.com/bug?id=b85721b38583ecc6b5e72ff524c67302abbc30f3 Link: https://lore.kernel.org/all/000000000000ece18705f3b20934@google.com/ Fixes: 717d50e4971b ("Ext4: Uninitialized Block Groups") Cc: stable@vger.kernel.org Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20230504121525.3275886-1-tudor.ambarus@linaro.org Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman Bug: 269155298 Bug: 270466805 Change-Id: Id14192ab0905c36e154d07d461afb56af7b61488 Signed-off-by: Tudor Ambarus --- fs/ext4/super.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index e07a29c7425a..705122f3fd5b 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -2530,11 +2530,9 @@ static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group, crc = crc16(crc, (__u8 *)gdp, offset); offset += sizeof(gdp->bg_checksum); /* skip checksum */ /* for checksum of struct ext4_group_desc do the rest...*/ - if (ext4_has_feature_64bit(sb) && - offset < le16_to_cpu(sbi->s_es->s_desc_size)) + if (ext4_has_feature_64bit(sb) && offset < sbi->s_desc_size) crc = crc16(crc, (__u8 *)gdp + offset, - le16_to_cpu(sbi->s_es->s_desc_size) - - offset); + sbi->s_desc_size - offset); out: return cpu_to_le16(crc);