mirror of
https://github.com/openwrt/openwrt.git
synced 2024-11-26 19:35:13 +08:00
kernel: bump 5.15 to 5.15.173
Removed because they are upstream: generic/backport-5.15/430-v6.3-udf-Allocate-name-buffer-in-directory-iterator-on-he.patch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.15.y&id=5ea4b73e268bf9e1d26271943f2f7c4517253395 generic/backport-5.15/431-v6.3-udf-Avoid-directory-type-conversion-failure-due-to-E.patch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.15.y&id=8b1d55e43cee631e142d46ee94c91ccd894341e9 Link: https://github.com/openwrt/openwrt/pull/16999 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit is contained in:
Hauke Mehrtens
parent
265d9112b3
commit
cafbecf853
@ -1,2 +1,2 @@
|
||||
LINUX_VERSION-5.15 = .172
|
||||
LINUX_KERNEL_HASH-5.15.172 = efa2245809c1b0c8d028b67b800fdd44c9bba7800b154ee492c2ba18ed33844d
|
||||
LINUX_VERSION-5.15 = .173
|
||||
LINUX_KERNEL_HASH-5.15.173 = 8a4b2a47ccc9b208b2b6ed9a216ea1a5eb12852c723bec1a04de9e671a1d7da8
|
||||
|
||||
@ -33,7 +33,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
|
||||
#define USB_VENDOR_ID_BELKIN 0x050d
|
||||
#define USB_DEVICE_ID_FLIP_KVM 0x3201
|
||||
|
||||
@@ -1337,6 +1340,9 @@
|
||||
@@ -1338,6 +1341,9 @@
|
||||
#define USB_VENDOR_ID_XAT 0x2505
|
||||
#define USB_DEVICE_ID_XAT_CSR 0x0220
|
||||
|
||||
|
||||
@ -414,7 +414,7 @@ Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
||||
#ifndef arch_wants_old_prefaulted_pte
|
||||
static inline bool arch_wants_old_prefaulted_pte(void)
|
||||
{
|
||||
@@ -2808,7 +2796,7 @@ static inline int cow_user_page(struct p
|
||||
@@ -2819,7 +2807,7 @@ static inline int cow_user_page(struct p
|
||||
* On architectures with software "accessed" bits, we would
|
||||
* take a double page fault, so mark it accessed here.
|
||||
*/
|
||||
|
||||
@ -612,7 +612,7 @@ Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
||||
mem_cgroup_id_remove(memcg);
|
||||
--- a/mm/memory.c
|
||||
+++ b/mm/memory.c
|
||||
@@ -4821,6 +4821,27 @@ static inline void mm_account_fault(stru
|
||||
@@ -4832,6 +4832,27 @@ static inline void mm_account_fault(stru
|
||||
perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs, address);
|
||||
}
|
||||
|
||||
@ -640,7 +640,7 @@ Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
||||
/*
|
||||
* By the time we get here, we already hold the mm semaphore
|
||||
*
|
||||
@@ -4852,11 +4873,15 @@ vm_fault_t handle_mm_fault(struct vm_are
|
||||
@@ -4863,11 +4884,15 @@ vm_fault_t handle_mm_fault(struct vm_are
|
||||
if (flags & FAULT_FLAG_USER)
|
||||
mem_cgroup_enter_user_fault();
|
||||
|
||||
|
||||
@ -82,7 +82,7 @@ Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
||||
#include <linux/sched/mm.h>
|
||||
#include <linux/sched/coredump.h>
|
||||
#include <linux/sched/numa_balancing.h>
|
||||
@@ -1353,8 +1354,7 @@ again:
|
||||
@@ -1364,8 +1365,7 @@ again:
|
||||
force_flush = 1;
|
||||
set_page_dirty(page);
|
||||
}
|
||||
@ -92,7 +92,7 @@ Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
||||
mark_page_accessed(page);
|
||||
}
|
||||
rss[mm_counter(page)]--;
|
||||
@@ -4824,8 +4824,8 @@ static inline void mm_account_fault(stru
|
||||
@@ -4835,8 +4835,8 @@ static inline void mm_account_fault(stru
|
||||
#ifdef CONFIG_LRU_GEN
|
||||
static void lru_gen_enter_fault(struct vm_area_struct *vma)
|
||||
{
|
||||
|
||||
@ -1,95 +0,0 @@
|
||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Jan Kara <jack@suse.cz>
|
||||
Date: Tue, 20 Dec 2022 12:38:45 +0100
|
||||
Subject: udf: Allocate name buffer in directory iterator on heap
|
||||
|
||||
commit 0aba4860b0d0216a1a300484ff536171894d49d8 upstream.
|
||||
|
||||
Currently we allocate name buffer in directory iterators (struct
|
||||
udf_fileident_iter) on stack. These structures are relatively large
|
||||
(some 360 bytes on 64-bit architectures). For udf_rename() which needs
|
||||
to keep three of these structures in parallel the stack usage becomes
|
||||
rather heavy - 1536 bytes in total. Allocate the name buffer in the
|
||||
iterator from heap to avoid excessive stack usage.
|
||||
|
||||
Link: https://lore.kernel.org/all/202212200558.lK9x1KW0-lkp@intel.com
|
||||
Reported-by: kernel test robot <lkp@intel.com>
|
||||
Signed-off-by: Jan Kara <jack@suse.cz>
|
||||
[Add extra include linux/slab.h]
|
||||
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
|
||||
---
|
||||
fs/udf/directory.c | 24 ++++++++++++++++--------
|
||||
fs/udf/udfdecl.h | 2 +-
|
||||
2 files changed, 17 insertions(+), 9 deletions(-)
|
||||
|
||||
--- a/fs/udf/directory.c
|
||||
+++ b/fs/udf/directory.c
|
||||
@@ -19,6 +19,7 @@
|
||||
#include <linux/bio.h>
|
||||
#include <linux/crc-itu-t.h>
|
||||
#include <linux/iversion.h>
|
||||
+#include <linux/slab.h>
|
||||
|
||||
static int udf_verify_fi(struct udf_fileident_iter *iter)
|
||||
{
|
||||
@@ -248,9 +249,14 @@ int udf_fiiter_init(struct udf_fileident
|
||||
iter->elen = 0;
|
||||
iter->epos.bh = NULL;
|
||||
iter->name = NULL;
|
||||
+ iter->namebuf = kmalloc(UDF_NAME_LEN_CS0, GFP_KERNEL);
|
||||
+ if (!iter->namebuf)
|
||||
+ return -ENOMEM;
|
||||
|
||||
- if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB)
|
||||
- return udf_copy_fi(iter);
|
||||
+ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
|
||||
+ err = udf_copy_fi(iter);
|
||||
+ goto out;
|
||||
+ }
|
||||
|
||||
if (inode_bmap(dir, iter->pos >> dir->i_blkbits, &iter->epos,
|
||||
&iter->eloc, &iter->elen, &iter->loffset) !=
|
||||
@@ -260,17 +266,17 @@ int udf_fiiter_init(struct udf_fileident
|
||||
udf_err(dir->i_sb,
|
||||
"position %llu not allocated in directory (ino %lu)\n",
|
||||
(unsigned long long)pos, dir->i_ino);
|
||||
- return -EFSCORRUPTED;
|
||||
+ err = -EFSCORRUPTED;
|
||||
+ goto out;
|
||||
}
|
||||
err = udf_fiiter_load_bhs(iter);
|
||||
if (err < 0)
|
||||
- return err;
|
||||
+ goto out;
|
||||
err = udf_copy_fi(iter);
|
||||
- if (err < 0) {
|
||||
+out:
|
||||
+ if (err < 0)
|
||||
udf_fiiter_release(iter);
|
||||
- return err;
|
||||
- }
|
||||
- return 0;
|
||||
+ return err;
|
||||
}
|
||||
|
||||
int udf_fiiter_advance(struct udf_fileident_iter *iter)
|
||||
@@ -307,6 +313,8 @@ void udf_fiiter_release(struct udf_filei
|
||||
brelse(iter->bh[0]);
|
||||
brelse(iter->bh[1]);
|
||||
iter->bh[0] = iter->bh[1] = NULL;
|
||||
+ kfree(iter->namebuf);
|
||||
+ iter->namebuf = NULL;
|
||||
}
|
||||
|
||||
static void udf_copy_to_bufs(void *buf1, int len1, void *buf2, int len2,
|
||||
--- a/fs/udf/udfdecl.h
|
||||
+++ b/fs/udf/udfdecl.h
|
||||
@@ -99,7 +99,7 @@ struct udf_fileident_iter {
|
||||
struct extent_position epos; /* Position after the above extent */
|
||||
struct fileIdentDesc fi; /* Copied directory entry */
|
||||
uint8_t *name; /* Pointer to entry name */
|
||||
- uint8_t namebuf[UDF_NAME_LEN_CS0]; /* Storage for entry name in case
|
||||
+ uint8_t *namebuf; /* Storage for entry name in case
|
||||
* the name is split between two blocks
|
||||
*/
|
||||
};
|
||||
@ -1,40 +0,0 @@
|
||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Jan Kara <jack@suse.cz>
|
||||
Date: Thu, 9 Feb 2023 10:33:09 +0100
|
||||
Subject: udf: Avoid directory type conversion failure due to ENOMEM
|
||||
|
||||
commit df97f64dfa317a5485daf247b6c043a584ef95f9 upstream.
|
||||
|
||||
When converting directory from in-ICB to normal format, the last
|
||||
iteration through the directory fixing up directory enteries can fail
|
||||
due to ENOMEM. We do not expect this iteration to fail since the
|
||||
directory is already verified to be correct and it is difficult to undo
|
||||
the conversion at this point. So just use GFP_NOFAIL to make sure the
|
||||
small allocation cannot fail.
|
||||
|
||||
Reported-by: syzbot+111eaa994ff74f8d440f@syzkaller.appspotmail.com
|
||||
Fixes: 0aba4860b0d0 ("udf: Allocate name buffer in directory iterator on heap")
|
||||
Signed-off-by: Jan Kara <jack@suse.cz>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
fs/udf/directory.c | 9 ++++++---
|
||||
1 file changed, 6 insertions(+), 3 deletions(-)
|
||||
|
||||
--- a/fs/udf/directory.c
|
||||
+++ b/fs/udf/directory.c
|
||||
@@ -249,9 +249,12 @@ int udf_fiiter_init(struct udf_fileident
|
||||
iter->elen = 0;
|
||||
iter->epos.bh = NULL;
|
||||
iter->name = NULL;
|
||||
- iter->namebuf = kmalloc(UDF_NAME_LEN_CS0, GFP_KERNEL);
|
||||
- if (!iter->namebuf)
|
||||
- return -ENOMEM;
|
||||
+ /*
|
||||
+ * When directory is verified, we don't expect directory iteration to
|
||||
+ * fail and it can be difficult to undo without corrupting filesystem.
|
||||
+ * So just do not allow memory allocation failures here.
|
||||
+ */
|
||||
+ iter->namebuf = kmalloc(UDF_NAME_LEN_CS0, GFP_KERNEL | __GFP_NOFAIL);
|
||||
|
||||
if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
|
||||
err = udf_copy_fi(iter);
|
||||
Loading…
Reference in New Issue
Block a user