FAILED: patch "[PATCH] XArray: Fix xa_find_next for large multi-index entries" failed to apply to 5.4-stable tree

PATCH [email protected] 3 participants 5 messages Apr 15, 2020 – Apr 16, 2020

Subsystems (3)

Stable branch Library code Xarray

lore

Share & tools

lore

[email protected]

author maintainer

2020-04-15 11:05 UTC #0 lore raw

The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From bd40b17ca49d7d110adf456e647701ce74de2241 Mon Sep 17 00:00:00 2001
From: "Matthew Wilcox (Oracle)" <[email protected]>
Date: Fri, 31 Jan 2020 05:07:55 -0500
Subject: [PATCH] XArray: Fix xa_find_next for large multi-index entries

Coverity pointed out that xas_sibling() was shifting xa_offset without promoting it to an unsigned long first, so the shift could cause an overflow and we'd get the wrong answer. The fix is obvious, and the new test-case provokes UBSAN to report an error:
runtime error: shift exponent 60 is too large for 32-bit type 'int'

Fixes 19c30f4dd092 ("XArray: Fix xa_find_after with multi-index entries")

Reported-by Bjorn Helgaas <[email protected]>

Reported-by Kees Cook <[email protected]>

Signed-off-by Matthew Wilcox (Oracle) <[email protected]>

Cc [email protected]

lib/test_xarray.c +18 -0

index 55c14e8c8859..8c7d7a8468b8 100644
@@ -12,6 +12,9 @@
 static unsigned int tests_run;
 static unsigned int tests_passed;
 
+static const unsigned int order_limit =
+		IS_ENABLED(CONFIG_XARRAY_MULTI) ? BITS_PER_LONG : 1;
+
 #ifndef XA_DEBUG
 # ifdef __KERNEL__
 void xa_dump(const struct xarray *xa) { }

@@ -959,6 +962,20 @@ static noinline void check_multi_find_2(struct xarray *xa)
 	}
 }
 
+static noinline void check_multi_find_3(struct xarray *xa)
+{
+	unsigned int order;
+
+	for (order = 5; order < order_limit; order++) {
+		unsigned long index = 1UL << (order - 5);
+
+		XA_BUG_ON(xa, !xa_empty(xa));
+		xa_store_order(xa, 0, order - 4, xa_mk_index(0), GFP_KERNEL);
+		XA_BUG_ON(xa, xa_find_after(xa, &index, ULONG_MAX, XA_PRESENT));
+		xa_erase_index(xa, 0);
+	}
+}
+
 static noinline void check_find_1(struct xarray *xa)
 {
 	unsigned long i, j, k;

@@ -1081,6 +1098,7 @@ static noinline void check_find(struct xarray *xa)
 	for (i = 2; i < 10; i++)
 		check_multi_find_1(xa, i);
 	check_multi_find_2(xa);
+	check_multi_find_3(xa);
 }
 
 /* See find_swap_entry() in mm/shmem.c */

lib/xarray.c +2 -1

index 1d9fab7db8da..acd1fad2e862 100644
@@ -1839,7 +1839,8 @@ static bool xas_sibling(struct xa_state *xas)
 	if (!node)
 		return false;
 	mask = (XA_CHUNK_SIZE << node->shift) - 1;
-	return (xas->xa_index & mask) > (xas->xa_offset << node->shift);
+	return (xas->xa_index & mask) >
+		((unsigned long)xas->xa_offset << node->shift);
 }
 
 /**

Matthew Wilcox

maintainer

2020-04-15 15:02 UTC #1 lore raw

Quoted 5 lines · On Wed, Apr 15, 2020 at 01:04:37PM +0200, [email protected] wrote:

The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

Quoted 7 lines

thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
Quoted 1 line
From bd40b17ca49d7d110adf456e647701ce74de2241 Mon Sep 17 00:00:00 2001

Seems like it's already there as commit
16696ee7b58101c90bf21c3ab2443c57df4af24e

Greg KH

author maintainer

2020-04-15 16:51 UTC #2 lore raw

Quoted 8 lines · Matthew Wilcox

Quoted 7 lines · On Wed, Apr 15, 2020 at 01:04:37PM +0200, [email protected] wrote:
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
thanks,

Quoted 8 lines

Quoted 5 lines
greg k-h
------------------ original commit in Linus's tree ------------------
Quoted 1 line
From bd40b17ca49d7d110adf456e647701ce74de2241 Mon Sep 17 00:00:00 2001
Seems like it's already there as commit
16696ee7b58101c90bf21c3ab2443c57df4af24e

Ugh.

Sasha, your scripts are applying patches to older kernels before newer ones for some odd reason again, which confuses mine to no end :(

thanks,

greg k-h

Sasha Levin

maintainer

2020-04-15 22:49 UTC #3 lore raw

Quoted 15 lines · Greg KH

Quoted 14 lines · Matthew Wilcox
Quoted 12 lines · On Wed, Apr 15, 2020 at 01:04:37PM +0200, [email protected] wrote:
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
Quoted 1 line
From bd40b17ca49d7d110adf456e647701ce74de2241 Mon Sep 17 00:00:00 2001

Quoted 7 lines

Quoted 2 lines
Seems like it's already there as commit
16696ee7b58101c90bf21c3ab2443c57df4af24e
Ugh.
Sasha, your scripts are applying patches to older kernels before newer ones for some odd reason again, which confuses mine to no end :(

/me scratches head

It's in 5.6, 5.5, and 5.4. I've also queued them all at the same time and you've released them all at the same time (Apr 8th).

Yes, it's tagged for stable, but I've grabbed it for the Fixes: tag.

What am I missing?

Signature · 2 lines

Thanks,
Sasha

Greg KH

author maintainer

2020-04-16 07:06 UTC #4 lore raw

Quoted 24 lines · Sasha Levin

Quoted 15 lines · Greg KH
Quoted 14 lines · Matthew Wilcox
Quoted 12 lines · On Wed, Apr 15, 2020 at 01:04:37PM +0200, [email protected] wrote:
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
Quoted 1 line
From bd40b17ca49d7d110adf456e647701ce74de2241 Mon Sep 17 00:00:00 2001
Quoted 7 lines
Quoted 2 lines
Seems like it's already there as commit
16696ee7b58101c90bf21c3ab2443c57df4af24e
Ugh.
Sasha, your scripts are applying patches to older kernels before newer ones for some odd reason again, which confuses mine to no end :(

Quoted 8 lines

/me scratches head
It's in 5.6, 5.5, and 5.4. I've also queued them all at the same time and you've released them all at the same time (Apr 8th).
Yes, it's tagged for stable, but I've grabbed it for the Fixes: tag.
What am I missing?

{sigh} nothing, my fault, it was a long day of stable patches, all is fine :)

greg k-h