6.10.7-rc1 review

PATCH In review Greg Kroah-Hartman 13 participants 287 messages Aug 27, 2024 – Aug 29, 2024 Page 3 of 3

Subsystems (11)

Stable branch Memory management VFS NFS client +7 more subsystems

lore

Share & tools

lore

Greg Kroah-Hartman

author maintainer

2024-08-27 15:15 UTC #275 lore raw

PATCH 272/273 ksmbd: fix race condition between destroy_previous_session() and smb2 operations()

In reply to Greg Kroah-Hartman

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Namjae Jeon <[email protected]>

[ Upstream commit 76e98a158b207771a6c9a0de0a60522a446a3447 ]

If there is ->PreviousSessionId field in the session setup request, The session of the previous connection should be destroyed. During this, if the smb2 operation requests in the previous session are being processed, a racy issue could happen with ksmbd_destroy_file_table(). This patch sets conn->status to KSMBD_SESS_NEED_RECONNECT to block incoming operations and waits until on-going operations are complete (i.e. idle) before desctorying the previous session.

Fixes c8efcc786146 ("ksmbd: add support for durable handles v1/v2")

Cc [email protected] # v6.6+

Reported-by [email protected] # ZDI-CAN-25040

Signed-off-by Namjae Jeon <[email protected]>

Signed-off-by Steve French <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/smb/server/connection.c        |   34 +++++++++++++++++++++++++++++++++-
 fs/smb/server/connection.h        |    3 ++-
 fs/smb/server/mgmt/user_session.c |    8 ++++++++
 fs/smb/server/smb2pdu.c           |    2 +-
 4 files changed, 44 insertions(+), 3 deletions(-)

fs/smb/server/connection.c +33 -1

@@ -165,11 +165,43 @@ void ksmbd_all_conn_set_status(u64 sess_
 	up_read(&conn_list_lock);
 }
 
-void ksmbd_conn_wait_idle(struct ksmbd_conn *conn, u64 sess_id)
+void ksmbd_conn_wait_idle(struct ksmbd_conn *conn)
 {
 	wait_event(conn->req_running_q, atomic_read(&conn->req_running) < 2);
 }
 
+int ksmbd_conn_wait_idle_sess_id(struct ksmbd_conn *curr_conn, u64 sess_id)
+{
+	struct ksmbd_conn *conn;
+	int rc, retry_count = 0, max_timeout = 120;
+	int rcount = 1;
+
+retry_idle:
+	if (retry_count >= max_timeout)
+		return -EIO;
+
+	down_read(&conn_list_lock);
+	list_for_each_entry(conn, &conn_list, conns_list) {
+		if (conn->binding || xa_load(&conn->sessions, sess_id)) {
+			if (conn == curr_conn)
+				rcount = 2;
+			if (atomic_read(&conn->req_running) >= rcount) {
+				rc = wait_event_timeout(conn->req_running_q,
+					atomic_read(&conn->req_running) < rcount,
+					HZ);
+				if (!rc) {
+					up_read(&conn_list_lock);
+					retry_count++;
+					goto retry_idle;
+				}
+			}
+		}
+	}
+	up_read(&conn_list_lock);
+
+	return 0;
+}
+
 int ksmbd_conn_write(struct ksmbd_work *work)
 {
 	struct ksmbd_conn *conn = work->conn;

fs/smb/server/connection.h +2 -1

@@ -145,7 +145,8 @@ extern struct list_head conn_list;
 extern struct rw_semaphore conn_list_lock;
 
 bool ksmbd_conn_alive(struct ksmbd_conn *conn);
-void ksmbd_conn_wait_idle(struct ksmbd_conn *conn, u64 sess_id);
+void ksmbd_conn_wait_idle(struct ksmbd_conn *conn);
+int ksmbd_conn_wait_idle_sess_id(struct ksmbd_conn *curr_conn, u64 sess_id);
 struct ksmbd_conn *ksmbd_conn_alloc(void);
 void ksmbd_conn_free(struct ksmbd_conn *conn);
 bool ksmbd_conn_lookup_dialect(struct ksmbd_conn *c);

fs/smb/server/mgmt/user_session.c +8 -0

@@ -310,6 +310,7 @@ void destroy_previous_session(struct ksm
 {
 	struct ksmbd_session *prev_sess;
 	struct ksmbd_user *prev_user;
+	int err;
 
 	down_write(&sessions_table_lock);
 	down_write(&conn->session_lock);

@@ -324,8 +325,15 @@ void destroy_previous_session(struct ksm
 	    memcmp(user->passkey, prev_user->passkey, user->passkey_sz))
 		goto out;
 
+	ksmbd_all_conn_set_status(id, KSMBD_SESS_NEED_RECONNECT);
+	err = ksmbd_conn_wait_idle_sess_id(conn, id);
+	if (err) {
+		ksmbd_all_conn_set_status(id, KSMBD_SESS_NEED_NEGOTIATE);
+		goto out;
+	}
 	ksmbd_destroy_file_table(&prev_sess->file_table);
 	prev_sess->state = SMB2_SESSION_EXPIRED;
+	ksmbd_all_conn_set_status(id, KSMBD_SESS_NEED_NEGOTIATE);
 out:
 	up_write(&conn->session_lock);
 	up_write(&sessions_table_lock);

fs/smb/server/smb2pdu.c +1 -1

@@ -2210,7 +2210,7 @@ int smb2_session_logoff(struct ksmbd_wor
 	ksmbd_conn_unlock(conn);
 
 	ksmbd_close_session_fds(work);
-	ksmbd_conn_wait_idle(conn, sess_id);
+	ksmbd_conn_wait_idle(conn);
 
 	/*
 	 * Re-lookup session to validate if session is deleted

Greg Kroah-Hartman

author maintainer

2024-08-27 15:15 UTC #276 lore raw

PATCH 273/273 Input: MT - limit max slots

In reply to Greg Kroah-Hartman

6.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tetsuo Handa <[email protected]>

commit 99d3bf5f7377d42f8be60a6b9cb60fb0be34dceb upstream.

syzbot is reporting too large allocation at input_mt_init_slots(), for num_slots is supplied from userspace using ioctl(UI_DEV_CREATE).

Since nobody knows possible max slots, this patch chose 1024.

Reported-by syzbot <[email protected]>

Closes https://syzkaller.appspot.com/bug?extid=0122fa359a69694395d5

Signed-off-by Tetsuo Handa <[email protected]>

Signed-off-by Linus Torvalds <[email protected]>

Cc George Kennedy <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/input/input-mt.c |    3 +++
 1 file changed, 3 insertions(+)

drivers/input/input-mt.c +3 -0

@@ -46,6 +46,9 @@ int input_mt_init_slots(struct input_dev
 		return 0;
 	if (mt)
 		return mt->num_slots != num_slots ? -EINVAL : 0;
+	/* Arbitrary limit for avoiding too large memory allocation. */
+	if (num_slots > 1024)
+		return -EINVAL;
 
 	mt = kzalloc(struct_size(mt, slots, num_slots), GFP_KERNEL);
 	if (!mt)

Florian Fainelli

Tested-by on the v1 series

2024-08-27 18:03 UTC #277 lore raw

In reply to Greg Kroah-Hartman

Quoted 9 lines · Greg Kroah-Hartman

Quoted 8 lines

On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:

Tested-by Florian Fainelli <[email protected]>

o--
Florian

SeongJae Park

maintainer Tested-by on the v1 series

2024-08-28 01:02 UTC #278 lore raw

In reply to Greg Kroah-Hartman

Hello,

Quoted 5 lines · On Tue, 27 Aug 2024 16:35:24 +0200 Greg Kroah-Hartman…

Quoted 8 lines

This rc kernel passes DAMON functionality test[1] on my test machine. Attaching the test results summary below. Please note that I retrieved the kernel from linux-stable-rc tree[2].

Tested-by SeongJae Park <[email protected]>

[1] https://github.com/awslabs/damon-tests/tree/next/corr
[2] b49f2df929ba ("Linux 6.10.7-rc1")

Thanks,
SJ

[...]

---

ok 7 selftests: damon: damos_quota_goal.py
ok 8 selftests: damon: damos_apply_interval.py
ok 9 selftests: damon: reclaim.sh
ok 10 selftests: damon: lru_sort.sh
ok 11 selftests: damon: debugfs_empty_targets.sh
ok 12 selftests: damon: debugfs_huge_count_read_write.sh
ok 13 selftests: damon: debugfs_duplicate_context_creation.sh ok 14 selftests: damon: debugfs_rm_non_contexts.sh
ok 15 selftests: damon: debugfs_target_ids_read_before_terminate_race.sh ok 16 selftests: damon: debugfs_target_ids_pid_leak.sh
ok 17 selftests: damon: sysfs_update_removed_scheme_dir.sh
ok 18 selftests: damon: sysfs_update_schemes_tried_regions_hang.py ok 1 selftests: damon-tests: kunit.sh
ok 2 selftests: damon-tests: huge_count_read_write.sh
ok 3 selftests: damon-tests: buffer_overflow.sh
ok 4 selftests: damon-tests: rm_contexts.sh
ok 5 selftests: damon-tests: record_null_deref.sh
ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh
ok 8 selftests: damon-tests: damo_tests.sh
ok 9 selftests: damon-tests: masim-record.sh
ok 10 selftests: damon-tests: build_i386.sh
ok 11 selftests: damon-tests: build_arm64.sh
ok 12 selftests: damon-tests: build_m68k.sh
ok 13 selftests: damon-tests: build_i386_idle_flag.sh
ok 14 selftests: damon-tests: build_i386_highpte.sh
ok 15 selftests: damon-tests: build_nomemcg.sh
[33m
[92mPASS [39m

Peter Schneider

Tested-by on the v1 series

2024-08-28 04:24 UTC #279 lore raw

In reply to Greg Kroah-Hartman

Am 27.08.2024 um 16:35 schrieb Greg Kroah-Hartman:

Quoted 4 lines

Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.

Tested-by Peter Schneider <[email protected]>

Beste Grüße,
Peter Schneider

Signature · 8 lines

Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you.                    -- David McCullough Jr.

OpenPGP:  0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
https://keys.mailvelope.com/pks/lookup?op=get&[email protected]

Mark Brown

Tested-by on the v1 series

2024-08-28 11:34 UTC #280 lore raw

In reply to Greg Kroah-Hartman

Quoted 4 lines · Greg Kroah-Hartman

Tested-by Mark Brown <[email protected]>

Naresh Kamboju

Tested-by Linux Kernel Functional Testing on the v1 series

2024-08-28 13:17 UTC #281 lore raw

In reply to Greg Kroah-Hartman

Quoted 10 lines · Greg Kroah-Hartman

Quoted 8 lines

Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.

Tested-by Linux Kernel Functional Testing <[email protected]>

## Build
* kernel: 6.10.7-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: aa78b3c4e7eeb94e23ce019c419141739613862e
* git describe: v6.10.6-274-gaa78b3c4e7ee
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.10.y/build/v6.10.6-274-gaa78b3c4e7ee

## Test Regressions (compared to v6.10.5-26-ga522cad06418)

## Metric Regressions (compared to v6.10.5-26-ga522cad06418)

## Test Fixes (compared to v6.10.5-26-ga522cad06418)

## Metric Fixes (compared to v6.10.5-26-ga522cad06418)

## Test result summary
total: 171554, pass: 150636, fail: 1805, skip: 18905, xfail: 208

## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 129 total, 127 passed, 2 failed
* arm64: 41 total, 41 passed, 0 failed
* i386: 28 total, 26 passed, 2 failed
* mips: 26 total, 25 passed, 1 failed
* parisc: 4 total, 3 passed, 1 failed
* powerpc: 36 total, 35 passed, 1 failed
* riscv: 19 total, 19 passed, 0 failed
* s390: 14 total, 13 passed, 1 failed
* sh: 10 total, 10 passed, 0 failed
* sparc: 7 total, 6 passed, 1 failed
* x86_64: 33 total, 33 passed, 0 failed

## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-x86
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture

--
Linaro LKFT
https://lkft.linaro.org

Miguel Ojeda

Tested-by on the v1 series

2024-08-28 16:03 UTC #282 lore raw

In reply to Greg Kroah-Hartman

Quoted 1,147 lines · On Tue, 27 Aug 2024 16:35:24 +0200 Greg Kroah-Hartman…

Quoted 8 lines

tools/testing/selftests/mm/run_vmtests.sh          |   3 +
tools/testing/selftests/net/af_unix/msg_oob.c      |   2 +-
tools/testing/selftests/net/lib.sh                 |  11 +-
tools/testing/selftests/net/mptcp/mptcp_join.sh    |  28 +++-
tools/testing/selftests/net/udpgro.sh              |  53 +++---
tools/testing/selftests/tc-testing/tdc.py          |   1 -
tools/tracing/rtla/src/osnoise_top.c               |  11 +-
305 files changed, 3476 insertions(+), 1744 deletions(-)

Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested for loongarch64:

Tested-by Miguel Ojeda <[email protected]>

Thanks!

Cheers,
Miguel

Justin Forbes

Tested-by on the v1 series

2024-08-28 18:04 UTC #283 lore raw

In reply to Greg Kroah-Hartman

Quoted 9 lines · Greg Kroah-Hartman

Quoted 8 lines

Tested rc1 against the Fedora build system (aarch64, ppc64le, s390x, x86_64), and boot tested x86_64. No regressions noted.

Tested-by Justin M. Forbes <[email protected]>

Ron Economos

Tested-by on the v1 series

2024-08-28 18:08 UTC #284 lore raw

In reply to Greg Kroah-Hartman

Quoted 9 lines · Greg Kroah-Hartman

Quoted 8 lines

Built and booted successfully on RISC-V RV64 (HiFive Unmatched).

Tested-by Ron Economos <[email protected]>

Jon Hunter

maintainer Tested-by on the v1 series

2024-08-29 10:27 UTC #285 lore raw

In reply to Greg Kroah-Hartman

Quoted 9 lines · Greg Kroah-Hartman

Quoted 8 lines

All tests passing for Tegra ...

Test results for stable-v6.10:

    10 builds:	10 pass, 0 fail
    26 boots:	26 pass, 0 fail
    116 tests:	116 pass, 0 fail

Linux version: 6.10.7-rc1-gaa78b3c4e7ee
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,

                tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
                tegra20-ventana, tegra210-p2371-2180,
                tegra210-p3450-0000, tegra30-cardhu-a04

Tested-by Jon Hunter <[email protected]>

Jon

Shreeya Patel

Tested-by kernelci.org bot on the v1 series

2024-08-29 12:00 UTC #286 lore raw

In reply to Greg Kroah-Hartman

---- On Tue, 27 Aug 2024 20:05:24 +0530 Greg Kroah-Hartman wrote ---

Quoted 5 lines

Quoted 9 lines

Hi,

Please find the KernelCI report below :-

OVERVIEW

Builds: 30 passed, 0 failed

Boot tests: 334 passed, 0 failed

CI systems: broonie, maestro

REVISION

    Commit
        name: v6.10.6-273-gb49f2df929ba
        hash: b49f2df929ba1bbf4ef3b81d88f8118cfbd8b936
    Checked out from
        https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.10.y

BUILDS

No new build failures found

BOOT TESTS

No new boot failures found

See complete and up-to-date report at:

    https://kcidb.kernelci.org/d/revision/revision?orgId=1&var-git_commit_hash=b49f2df929ba1bbf4ef3b81d88f8118cfbd8b936&var-patchset_hash=

Tested-by kernelci.org bot <[email protected]>

Thanks,
KernelCI team