updates
diff --git a/sched-fair-don-t-assign-runtime-for-throttled-cfs_rq.patch b/sched-fair-don-t-assign-runtime-for-throttled-cfs_rq.patch deleted file mode 100644 index 288f6cd..0000000 --- a/sched-fair-don-t-assign-runtime-for-throttled-cfs_rq.patch +++ /dev/null
@@ -1,73 +0,0 @@ -From 5e2d2cc2588bd3307ce3937acbc2ed03c830a861 Mon Sep 17 00:00:00 2001 -From: Liangyan <liangyan.peng@linux.alibaba.com> -Date: Mon, 26 Aug 2019 20:16:33 +0800 -Subject: sched/fair: Don't assign runtime for throttled cfs_rq - -From: Liangyan <liangyan.peng@linux.alibaba.com> - -commit 5e2d2cc2588bd3307ce3937acbc2ed03c830a861 upstream. - -do_sched_cfs_period_timer() will refill cfs_b runtime and call -distribute_cfs_runtime to unthrottle cfs_rq, sometimes cfs_b->runtime -will allocate all quota to one cfs_rq incorrectly, then other cfs_rqs -attached to this cfs_b can't get runtime and will be throttled. - -We find that one throttled cfs_rq has non-negative -cfs_rq->runtime_remaining and cause an unexpetced cast from s64 to u64 -in snippet: - - distribute_cfs_runtime() { - runtime = -cfs_rq->runtime_remaining + 1; - } - -The runtime here will change to a large number and consume all -cfs_b->runtime in this cfs_b period. - -According to Ben Segall, the throttled cfs_rq can have -account_cfs_rq_runtime called on it because it is throttled before -idle_balance, and the idle_balance calls update_rq_clock to add time -that is accounted to the task. - -This commit prevents cfs_rq to be assgined new runtime if it has been -throttled until that distribute_cfs_runtime is called. - -Signed-off-by: Liangyan <liangyan.peng@linux.alibaba.com> -Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> -Reviewed-by: Valentin Schneider <valentin.schneider@arm.com> -Reviewed-by: Ben Segall <bsegall@google.com> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Cc: Peter Zijlstra <peterz@infradead.org> -Cc: Thomas Gleixner <tglx@linutronix.de> -Cc: shanpeic@linux.alibaba.com -Cc: stable@vger.kernel.org -Cc: xlpang@linux.alibaba.com -Fixes: d3d9dc330236 ("sched: Throttle entities exceeding their allowed bandwidth") -Link: https://lkml.kernel.org/r/20190826121633.6538-1-liangyan.peng@linux.alibaba.com -Signed-off-by: Ingo Molnar <mingo@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> - ---- - kernel/sched/fair.c | 5 +++++ - 1 file changed, 5 insertions(+) - ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -3348,6 +3348,8 @@ static void __account_cfs_rq_runtime(str - if (likely(cfs_rq->runtime_remaining > 0)) - return; - -+ if (cfs_rq->throttled) -+ return; - /* - * if we're unable to extend our runtime we resched so that the active - * hierarchy can be throttled -@@ -3537,6 +3539,9 @@ static u64 distribute_cfs_runtime(struct - if (!cfs_rq_throttled(cfs_rq)) - goto next; - -+ /* By the above check, this should never be true */ -+ SCHED_WARN_ON(cfs_rq->runtime_remaining > 0); -+ - runtime = -cfs_rq->runtime_remaining + 1; - if (runtime > remaining) - runtime = remaining;
diff --git a/series b/series index bf3767b..869e158 100644 --- a/series +++ b/series
@@ -1,3 +1,4 @@ alsa-hda-fix-potential-endless-loop-at-applying-quirks.patch alsa-hda-realtek-fix-overridden-device-specific-initialization.patch -sched-fair-don-t-assign-runtime-for-throttled-cfs_rq.patch +xfrm-clean-up-xfrm-protocol-checks.patch +vhost-make-sure-log_num-in_num.patch
diff --git a/vhost-make-sure-log_num-in_num.patch b/vhost-make-sure-log_num-in_num.patch new file mode 100644 index 0000000..8e10b22 --- /dev/null +++ b/vhost-make-sure-log_num-in_num.patch
@@ -0,0 +1,52 @@ +From 060423bfdee3f8bc6e2c1bac97de24d5415e2bc4 Mon Sep 17 00:00:00 2001 +From: yongduan <yongduan@tencent.com> +Date: Wed, 11 Sep 2019 17:44:24 +0800 +Subject: vhost: make sure log_num < in_num + +From: yongduan <yongduan@tencent.com> + +commit 060423bfdee3f8bc6e2c1bac97de24d5415e2bc4 upstream. + +The code assumes log_num < in_num everywhere, and that is true as long as +in_num is incremented by descriptor iov count, and log_num by 1. However +this breaks if there's a zero sized descriptor. + +As a result, if a malicious guest creates a vring desc with desc.len = 0, +it may cause the host kernel to crash by overflowing the log array. This +bug can be triggered during the VM migration. + +There's no need to log when desc.len = 0, so just don't increment log_num +in this case. + +Fixes: 3a4d5c94e959 ("vhost_net: a kernel-level virtio server") +Cc: stable@vger.kernel.org +Reviewed-by: Lidong Chen <lidongchen@tencent.com> +Signed-off-by: ruippan <ruippan@tencent.com> +Signed-off-by: yongduan <yongduan@tencent.com> +Acked-by: Michael S. Tsirkin <mst@redhat.com> +Reviewed-by: Tyler Hicks <tyhicks@canonical.com> +Signed-off-by: Michael S. Tsirkin <mst@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> + +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 34ea219936e3..acabf20b069e 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -2180,7 +2180,7 @@ static int get_indirect(struct vhost_virtqueue *vq, + /* If this is an input descriptor, increment that count. */ + if (access == VHOST_ACCESS_WO) { + *in_num += ret; +- if (unlikely(log)) { ++ if (unlikely(log && ret)) { + log[*log_num].addr = vhost64_to_cpu(vq, desc.addr); + log[*log_num].len = vhost32_to_cpu(vq, desc.len); + ++*log_num; +@@ -2321,7 +2321,7 @@ int vhost_get_vq_desc(struct vhost_virtqueue *vq, + /* If this is an input descriptor, + * increment that count. */ + *in_num += ret; +- if (unlikely(log)) { ++ if (unlikely(log && ret)) { + log[*log_num].addr = vhost64_to_cpu(vq, desc.addr); + log[*log_num].len = vhost32_to_cpu(vq, desc.len); + ++*log_num;
diff --git a/xfrm-clean-up-xfrm-protocol-checks.patch b/xfrm-clean-up-xfrm-protocol-checks.patch new file mode 100644 index 0000000..b88c6cb --- /dev/null +++ b/xfrm-clean-up-xfrm-protocol-checks.patch
@@ -0,0 +1,116 @@ +From dbb2483b2a46fbaf833cfb5deb5ed9cace9c7399 Mon Sep 17 00:00:00 2001 +From: Cong Wang <xiyou.wangcong@gmail.com> +Date: Fri, 22 Mar 2019 16:26:19 -0700 +Subject: xfrm: clean up xfrm protocol checks + +From: Cong Wang <xiyou.wangcong@gmail.com> + +commit dbb2483b2a46fbaf833cfb5deb5ed9cace9c7399 upstream. + +In commit 6a53b7593233 ("xfrm: check id proto in validate_tmpl()") +I introduced a check for xfrm protocol, but according to Herbert +IPSEC_PROTO_ANY should only be used as a wildcard for lookup, so +it should be removed from validate_tmpl(). + +And, IPSEC_PROTO_ANY is expected to only match 3 IPSec-specific +protocols, this is why xfrm_state_flush() could still miss +IPPROTO_ROUTING, which leads that those entries are left in +net->xfrm.state_all before exit net. Fix this by replacing +IPSEC_PROTO_ANY with zero. + +This patch also extracts the check from validate_tmpl() to +xfrm_id_proto_valid() and uses it in parse_ipsecrequest(). +With this, no other protocols should be added into xfrm. + +Fixes: 6a53b7593233 ("xfrm: check id proto in validate_tmpl()") +Reported-by: syzbot+0bf0519d6e0de15914fe@syzkaller.appspotmail.com +Cc: Steffen Klassert <steffen.klassert@secunet.com> +Cc: Herbert Xu <herbert@gondor.apana.org.au> +Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> +Acked-by: Herbert Xu <herbert@gondor.apana.org.au> +Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> +Signed-off-by: Zubin Mithra <zsm@chromium.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> + +--- + include/net/xfrm.h | 17 +++++++++++++++++ + net/key/af_key.c | 4 +++- + net/xfrm/xfrm_state.c | 2 +- + net/xfrm/xfrm_user.c | 14 +------------- + 4 files changed, 22 insertions(+), 15 deletions(-) + +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -1301,6 +1301,23 @@ static inline int xfrm_state_kern(const + return atomic_read(&x->tunnel_users); + } + ++static inline bool xfrm_id_proto_valid(u8 proto) ++{ ++ switch (proto) { ++ case IPPROTO_AH: ++ case IPPROTO_ESP: ++ case IPPROTO_COMP: ++#if IS_ENABLED(CONFIG_IPV6) ++ case IPPROTO_ROUTING: ++ case IPPROTO_DSTOPTS: ++#endif ++ return true; ++ default: ++ return false; ++ } ++} ++ ++/* IPSEC_PROTO_ANY only matches 3 IPsec protocols, 0 could match all. */ + static inline int xfrm_id_proto_match(u8 proto, u8 userproto) + { + return (!userproto || proto == userproto || +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -1967,8 +1967,10 @@ parse_ipsecrequest(struct xfrm_policy *x + + if (rq->sadb_x_ipsecrequest_mode == 0) + return -EINVAL; ++ if (!xfrm_id_proto_valid(rq->sadb_x_ipsecrequest_proto)) ++ return -EINVAL; + +- t->id.proto = rq->sadb_x_ipsecrequest_proto; /* XXX check proto */ ++ t->id.proto = rq->sadb_x_ipsecrequest_proto; + if ((mode = pfkey_mode_to_xfrm(rq->sadb_x_ipsecrequest_mode)) < 0) + return -EINVAL; + t->mode = mode; +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -2136,7 +2136,7 @@ void xfrm_state_fini(struct net *net) + unsigned int sz; + + flush_work(&net->xfrm.state_hash_work); +- xfrm_state_flush(net, IPSEC_PROTO_ANY, false); ++ xfrm_state_flush(net, 0, false); + flush_work(&net->xfrm.state_gc_work); + + WARN_ON(!list_empty(&net->xfrm.state_all)); +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -1410,20 +1410,8 @@ static int validate_tmpl(int nr, struct + return -EINVAL; + } + +- switch (ut[i].id.proto) { +- case IPPROTO_AH: +- case IPPROTO_ESP: +- case IPPROTO_COMP: +-#if IS_ENABLED(CONFIG_IPV6) +- case IPPROTO_ROUTING: +- case IPPROTO_DSTOPTS: +-#endif +- case IPSEC_PROTO_ANY: +- break; +- default: ++ if (!xfrm_id_proto_valid(ut[i].id.proto)) + return -EINVAL; +- } +- + } + + return 0;