FAILED: patch "[PATCH] cifs: fix oops during encryption" failed to apply to 6.0-stable tree
[email protected]
maintainerThe patch below does not apply to the 6.0-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
Possible dependencies:
f7f291e14dde ("cifs: fix oops during encryption")76894f3e2f71 ("cifs: improve symlink handling for smb2+") a4e430c8c8ba ("cifs: replace kfree() with kfree_sensitive() for sensitive data")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From f7f291e14dde32a07b1f0aa06921d28f875a7b54 Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <[email protected]>
Date: Sun, 11 Dec 2022 18:18:55 -0300
Subject: [PATCH] cifs: fix oops during encryption
When running xfstests against Azure the following oops occurred on an arm64 system
Unable to handle kernel write to read-only memory at virtual address
ffff0001221cf000
Mem abort info:
ESR = 0x9600004f
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x0f: level 3 permission fault
Data abort info:
ISV = 0, ISS = 0x0000004f
CM = 0, WnR = 1
swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000294f3000
[ffff0001221cf000] pgd=18000001ffff8003, p4d=18000001ffff8003,
pud=18000001ff82e003, pmd=18000001ff71d003, pte=00600001221cf787
Internal error: Oops: 9600004f [#1] PREEMPT SMP
...
pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)
pc : __memcpy+0x40/0x230
lr : scatterwalk_copychunks+0xe0/0x200
sp : ffff800014e92de0
x29: ffff800014e92de0 x28: ffff000114f9de80 x27: 0000000000000008
x26: 0000000000000008 x25: ffff800014e92e78 x24: 0000000000000008
x23: 0000000000000001 x22: 0000040000000000 x21: ffff000000000000
x20: 0000000000000001 x19: ffff0001037c4488 x18: 0000000000000014
x17: 235e1c0d6efa9661 x16: a435f9576b6edd6c x15: 0000000000000058
x14: 0000000000000001 x13: 0000000000000008 x12: ffff000114f2e590
x11: ffffffffffffffff x10: 0000040000000000 x9 : ffff8000105c3580
x8 : 2e9413b10000001a x7 : 534b4410fb86b005 x6 : 534b4410fb86b005
x5 : ffff0001221cf008 x4 : ffff0001037c4490 x3 : 0000000000000001
x2 : 0000000000000008 x1 : ffff0001037c4488 x0 : ffff0001221cf000
Call trace:
__memcpy+0x40/0x230
scatterwalk_map_and_copy+0x98/0x100
crypto_ccm_encrypt+0x150/0x180
crypto_aead_encrypt+0x2c/0x40
crypt_message+0x750/0x880
smb3_init_transform_rq+0x298/0x340
smb_send_rqst.part.11+0xd8/0x180
smb_send_rqst+0x3c/0x100
compound_send_recv+0x534/0xbc0
smb2_query_info_compound+0x32c/0x440
smb2_set_ea+0x438/0x4c0
cifs_xattr_set+0x5d4/0x7c0This is because in scatterwalk_copychunks(), we attempted to write to a buffer (@sign) that was allocated in the stack (vmalloc area) by crypt_message() and thus accessing its remaining 8 (x2) bytes ended up crossing a page boundary.
To simply fix it, we could just pass @sign kmalloc'd from crypt_message() and then we're done. Luckily, we don't seem to pass any other vmalloc'd buffers in smb_rqst::rq_iov...
Instead, let's map the correct pages and offsets from vmalloc buffers as well in cifs_sg_set_buf() and then avoiding such oopses.
fs/cifs/cifsglob.h +68 -0
@@ -13,6 +13,8 @@#include <linux/in6.h> #include <linux/inet.h> #include <linux/slab.h> +#include <linux/scatterlist.h> +#include <linux/mm.h> #include <linux/mempool.h> #include <linux/workqueue.h> #include <linux/utsname.h>
@@ -2140,4 +2142,70 @@ static inline void move_cifs_info_to_smb2(struct smb2_file_all_info *dst, const dst->FileNameLength = src->FileNameLength; } +static inline unsigned int cifs_get_num_sgs (const struct smb_rqst *rqst, +int num_rqst, +const u8 *sig) +{ +unsigned int len, skip; +unsigned int nents =0 ; +unsigned long addr; +int i, j; + +/* Assumes the first rqst has a transform header as the first iov. +* I.e. +* rqst[0].rq_iov[0] is transform header +* rqst[0].rq_iov[1+] data to be encrypted/decrypted +* rqst[1+].rq_iov[0+] data to be encrypted/decrypted +*/ +for (i =0 ; i < num_rqst; i++) { +/* +* The first rqst has a transform header where the +* first 20 bytes are not part of the encrypted blob. +*/ +for (j =0 ; j < rqst[i].rq_nvec; j++) { +struct kvec *iov = &rqst[i].rq_iov[j]; + + skip = (i ==0 ) && (j ==0 ) ?20 :0 ; + addr = (unsigned long )iov->iov_base + skip; +if (unlikely (is_vmalloc_addr ((void *)addr))) { + len = iov->iov_len - skip; + nents +=DIV_ROUND_UP (offset_in_page (addr) + len, +PAGE_SIZE ); + }else { + nents++; + } + } + nents += rqst[i].rq_npages; + } + nents +=DIV_ROUND_UP (offset_in_page (sig) +SMB2_SIGNATURE_SIZE ,PAGE_SIZE ); +return nents; +} + +/* We can not use the normal sg_set_buf() as we will sometimes pass a +* stack object as buf. +*/ +static inline struct scatterlist *cifs_sg_set_buf (struct scatterlist *sg, +const void *buf, +unsigned int buflen) +{ +unsigned long addr = (unsigned long )buf; +unsigned int off =offset_in_page (addr); + + addr &=PAGE_MASK ; +if (unlikely (is_vmalloc_addr ((void *)addr))) { +do { + unsigned int len = min_t(unsigned int, buflen, PAGE_SIZE - off); + +sg_set_page (sg++,vmalloc_to_page ((void *)addr), len, off); + + off =0 ; + addr +=PAGE_SIZE ; + buflen -= len; + }while (buflen); + }else { +sg_set_page (sg++,virt_to_page (addr), buflen, off); + } +return sg; +} +#endif /* _CIFS_GLOB_H */
fs/cifs/cifsproto.h +2 -2
@@ -600,8 +600,8 @@ int setup_aio_ctx_iter(struct cifs_aio_ctx *ctx, struct iov_iter *iter, int rw);int cifs_alloc_hash (const char *name,struct shash_desc **sdesc);void cifs_free_hash (struct shash_desc **sdesc); -extern void rqst_page_get_length (struct smb_rqst *rqst,unsigned int page, -unsigned int *len,unsigned int *offset); +void rqst_page_get_length (const struct smb_rqst *rqst,unsigned int page, +unsigned int *len,unsigned int *offset);struct cifs_chan *cifs_ses_find_chan (struct cifs_ses *ses,struct TCP_Server_Info *server);int cifs_try_adding_channels (struct cifs_sb_info *cifs_sb,struct cifs_ses *ses);
fs/cifs/misc.c +2 -2
@@ -1136,8 +1136,8 @@ cifs_free_hash(struct shash_desc **sdesc)* @len: Where to store the length for this page: * @offset: Where to store the offset for this page */ -void rqst_page_get_length (struct smb_rqst *rqst,unsigned int page, -unsigned int *len,unsigned int *offset) +void rqst_page_get_length (const struct smb_rqst *rqst,unsigned int page, +unsigned int *len,unsigned int *offset) { *len = rqst->rq_pagesz; *offset = (page ==0 ) ? rqst->rq_offset :0 ;
fs/cifs/smb2ops.c +68 -75
197 lines not on this page · raw message