1. 28 Feb, 2018 2 commits
    • Max Filippov's avatar
      xtensa: fix high memory/reserved memory collision · a5ecf56c
      Max Filippov authored
      commit 6ac5a11d upstream.
      
      Xtensa memory initialization code frees high memory pages without
      checking whether they are in the reserved memory regions or not. That
      results in invalid value of totalram_pages and duplicate page usage by
      CMA and highmem. It produces a bunch of BUGs at startup looking like
      this:
      
      BUG: Bad page state in process swapper  pfn:70800
      page:be60c000 count:0 mapcount:-127 mapping:  (null) index:0x1
      flags: 0x80000000()
      raw: 80000000 00000000 00000001 ffffff80 00000000 be60c014 be60c014 0000000a
      page dumped because: nonzero mapcount
      Modules linked in:
      CPU: 0 PID: 1 Comm: swapper Tainted: G    B            4.16.0-rc1-00015-g7928b2cb-dirty #23
      Stack:
       bd839d33 00000000 00000018 ba97b64c a106578c bd839d70 be60c000 00000000
       a1378054 bd86a000 00000003 ba97b64c a1066166 bd839da0 be60c000 ffe00000
       a1066b58 bd839dc0 be504000 00000000 000002f4 bd838000 00000000 0000001e
      Call Trace:
       [<a1065734>] bad_page+0xac/0xd0
       [<a106578c>] free_pages_check_bad+0x34/0x4c
       [<a1066166>] __free_pages_ok+0xae/0x14c
       [<a1066b58>] __free_pages+0x30/0x64
       [<a1365de5>] init_cma_reserved_pageblock+0x35/0x44
       [<a13682dc>] cma_init_reserved_areas+0xf4/0x148
       [<a10034b8>] do_one_initcall+0x80/0xf8
       [<a1361c16>] kernel_init_freeable+0xda/0x13c
       [<a125b59d>] kernel_init+0x9/0xd0
       [<a1004304>] ret_from_kernel_thread+0xc/0x18
      
      Only free high memory pages that are not reserved.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMax Filippov <jcmvbkbc@gmail.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      a5ecf56c
    • Paolo Abeni's avatar
      netfilter: drop outermost socket lock in getsockopt() · d58d78c2
      Paolo Abeni authored
      commit 01ea306f upstream.
      
      The Syzbot reported a possible deadlock in the netfilter area caused by
      rtnl lock, xt lock and socket lock being acquired with a different order
      on different code paths, leading to the following backtrace:
      Reviewed-by: default avatarXin Long <lucien.xin@gmail.com>
      
      ======================================================
      WARNING: possible circular locking dependency detected
      4.15.0+ #301 Not tainted
      ------------------------------------------------------
      syzkaller233489/4179 is trying to acquire lock:
        (rtnl_mutex){+.+.}, at: [<0000000048e996fd>] rtnl_lock+0x17/0x20
      net/core/rtnetlink.c:74
      
      but task is already holding lock:
        (&xt[i].mutex){+.+.}, at: [<00000000328553a2>]
      xt_find_table_lock+0x3e/0x3e0 net/netfilter/x_tables.c:1041
      
      which lock already depends on the new lock.
      ===
      
      Since commit 3f34cfae1230 ("netfilter: on sockopt() acquire sock lock
      only in the required scope"), we already acquire the socket lock in
      the innermost scope, where needed. In such commit I forgot to remove
      the outer-most socket lock from the getsockopt() path, this commit
      addresses the issues dropping it now.
      
      v1 -> v2: fix bad subj, added relavant 'fixes' tag
      
      Fixes: 22265a5c ("netfilter: xt_TEE: resolve oif using netdevice notifiers")
      Fixes: 202f59af ("netfilter: ipt_CLUSTERIP: do not hold dev")
      Fixes: 3f34cfae1230 ("netfilter: on sockopt() acquire sock lock only in the required scope")
      Reported-by: syzbot+ddde1c7b7ff7442d7f2d@syzkaller.appspotmail.com
      Suggested-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      Tested-by: default avatarKrzysztof Piotr Oledzki <ole@ans.pl>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d58d78c2
  2. 25 Feb, 2018 38 commits