lp:~mjm1635/ubuntu/+source/linux/+git/xenial

Author: Lorenzo Stoakes
Author Date: 2021-04-05 20:36:00 UTC

mm: check VMA flags to avoid invalid PROT_NONE NUMA balancing

BugLink: https://bugs.launchpad.net/bugs/1921211

The NUMA balancing logic uses an arch-specific PROT_NONE page table flag
defined by pte_protnone() or pmd_protnone() to mark PTEs or huge page
PMDs respectively as requiring balancing upon a subsequent page fault.
User-defined PROT_NONE memory regions which also have this flag set will
not normally invoke the NUMA balancing code as do_page_fault() will send
a segfault to the process before handle_mm_fault() is even called.

However if access_remote_vm() is invoked to access a PROT_NONE region of
memory, handle_mm_fault() is called via faultin_page() and
__get_user_pages() without any access checks being performed, meaning
the NUMA balancing logic is incorrectly invoked on a non-NUMA memory
region.

A simple means of triggering this problem is to access PROT_NONE mmap'd
memory using /proc/self/mem which reliably results in the NUMA handling
functions being invoked when CONFIG_NUMA_BALANCING is set.

This issue was reported in bugzilla (issue 99101) which includes some
simple repro code.

There are BUG_ON() checks in do_numa_page() and do_huge_pmd_numa_page()
added at commit c0e7cad to avoid accidentally provoking strange
behaviour by attempting to apply NUMA balancing to pages that are in
fact PROT_NONE. The BUG_ON()'s are consistently triggered by the repro.

This patch moves the PROT_NONE check into mm/memory.c rather than
invoking BUG_ON() as faulting in these pages via faultin_page() is a
valid reason for reaching the NUMA check with the PROT_NONE page table
flag set and is therefore not always a bug.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=99101
Reported-by: Trevor Saunders <tbsaunde@tbsaunde.org>
Signed-off-by: Lorenzo Stoakes <lstoakes@gmail.com>
Acked-by: Rik van Riel <riel@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(backported from commit 38e088546522e1e86d2b8f401a1354ad3a9b3303)
Tested-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>
Acked-by: Guilherme G. Piccoli <gpiccoli@canonical.com>
Acked-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

Author: Stefan Bader
Author Date: 2021-04-16 09:33:09 UTC

UBUNTU: Ubuntu-4.4.0-210.242

Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

Author: Kleber Sacilotto de Souza
Author Date: 2021-04-13 08:08:11 UTC

UBUNTU: Ubuntu-hwe-4.15.0-142.146~16.04.1

Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

Author: Kleber Sacilotto de Souza
Author Date: 2021-04-13 08:08:11 UTC

UBUNTU: Ubuntu-hwe-4.15.0-142.146~16.04.1

Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

Author: Thadeu Lima de Souza Cascardo
Author Date: 2021-04-12 22:27:28 UTC

UBUNTU: Ubuntu-4.4.0-209.241

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

Author: Will Deacon
Author Date: 2018-09-05 14:34:43 UTC

arm64: compat: Provide definition for COMPAT_SIGMINSTKSZ

https://bugs.launchpad.net/bugs/1844155

arch/arm/ defines a SIGMINSTKSZ of 2k, so we should use the same value
for compat tasks.

Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Dave Martin <Dave.Martin@arm.com>
Reported-by: Steve McIntyre <steve.mcintyre@arm.com>
Tested-by: Steve McIntyre <93sam@debian.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

(cherry picked from commit 24951465cbd279f60b1fdc2421b3694405bcff42)
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Connor Kuehl <connor.kuehl@canonical.com>
Signed-off-by: Juerg Haefliger <juergh@canonical.com>

Author: Kleber Sacilotto de Souza
Author Date: 2018-05-24 09:58:35 UTC

UBUNTU: Ubuntu-hwe-4.15.0-23.25~16.04.1

Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

Author: Ursula Braun
Author Date: 2018-03-01 19:20:00 UTC

qeth: check not more than 16 SBALEs on the completion queue

BugLink: http://bugs.launchpad.net/bugs/1750568

af_iucv socket programs with HiperSockets as transport make use of the qdio
completion queue. Running such an af_iucv socket program may result in a
crash:

[90341.677709] Oops: 0038 ilc:2 [#1] SMP
[90341.677743] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.6.0-20160720.0.0e86ec7.5e62689.fc23.s390xperformance #1
[90341.677744] Hardware name: IBM 2964 N96 703 (LPAR)
[90341.677746] task: 00000000edb79f00 ti: 00000000edb84000 task.ti: 00000000edb84000
[90341.677748] Krnl PSW : 0704d00180000000 000000000075bc50 (qeth_qdio_input_handler+0x258/0x4e0)
[90341.677756] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3
Krnl GPRS: 000003d10391e900 0000000000000001 00000000e61e6000 0000000000000005
[90341.677759] 0000000000a9e6ec 5420040001a77400 0000000000000001 000000000000006f
[90341.677761] 00000000e0d83f00 0000000000000003 0000000000000010 5420040001a77400
[90341.677784] 000000007ba8b000 0000000000943fd0 000000000075bc4e 00000000ed3b3c10
[90341.677793] Krnl Code: 000000000075bc42: e320cc180004 lg %r2,3096(%r12)
           000000000075bc48: c0e5ffffc5cc brasl %r14,7547e0
          #000000000075bc4e: 1816 lr %r1,%r6
          >000000000075bc50: ba19b008 cs %r1,%r9,8(%r11)
           000000000075bc54: ec180041017e cij %r1,1,8,75bcd6
           000000000075bc5a: 5810b008 l %r1,8(%r11)
           000000000075bc5e: ec16005c027e cij %r1,2,6,75bd16
           000000000075bc64: 5090b008 st %r9,8(%r11)
[90341.677807] Call Trace:
[90341.677810] ([<000000000075bbc0>] qeth_qdio_input_handler+0x1c8/0x4e0)
[90341.677812] ([<000000000070efbc>] qdio_kick_handler+0x124/0x2a8)
[90341.677814] ([<0000000000713570>] __tiqdio_inbound_processing+0xf0/0xcd0)
[90341.677818] ([<0000000000143312>] tasklet_action+0x92/0x120)
[90341.677823] ([<00000000008b6e72>] __do_softirq+0x112/0x308)
[90341.677824] ([<0000000000142bce>] irq_exit+0xd6/0xf8)
[90341.677829] ([<000000000010b1d2>] do_IRQ+0x6a/0x88)
[90341.677830] ([<00000000008b6322>] io_int_handler+0x112/0x220)
[90341.677832] ([<0000000000102b2e>] enabled_wait+0x56/0xa8)
[90341.677833] ([<0000000000000000>] (null))
[90341.677835] ([<0000000000102e32>] arch_cpu_idle+0x32/0x48)
[90341.677838] ([<000000000018a126>] cpu_startup_entry+0x266/0x2b0)
[90341.677841] ([<0000000000113b38>] smp_start_secondary+0x100/0x110)
[90341.677843] ([<00000000008b68a6>] restart_int_handler+0x62/0x78)
[90341.677845] ([<00000000008b6588>] psw_idle+0x3c/0x40)
[90341.677846] Last Breaking-Event-Address:
[90341.677848] [<00000000007547ec>] qeth_dbf_longtext+0xc/0xc0
[90341.677849]
[90341.677850] Kernel panic - not syncing: Fatal exception in interrupt

qeth_qdio_cq_handler() analyzes SBALs on this completion queue, but does
not observe the limit of 16 SBAL elements per SBAL. This patch adds the
additional check to process not more than 16 SBAL elements.

Signed-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 903e48531e8b5d414c8f1960eacac24c31f60344)
Signed-off-by: Joseph Salisbury <joseph.salisbury@canonical.com>
Acked-by: Khalid Elmously <khalid.elmously@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

Author: Stefan Bader
Author Date: 2018-01-19 10:05:21 UTC

UBUNTU: Ubuntu-4.4.0-112.135

Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

Author: Thadeu Lima de Souza Cascardo
Author Date: 2017-12-13 14:30:19 UTC

UBUNTU: Ubuntu-hwe-4.10.0-43.47~16.04.1

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

Author: Tim Gardner
Author Date: 2017-02-20 13:31:08 UTC

UBUNTU: Ubuntu-lts-4.10.0-9.11~16.04.1

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

Author: Andy Whitcroft
Author Date: 2016-11-11 14:22:27 UTC

UBUNTU: update to master 4.4.0-47.68

Signed-off-by: Andy Whitcroft <apw@canonical.com>

Author: Tim Gardner
Author Date: 2016-10-13 15:46:56 UTC

UBUNTU: Ubuntu-lts-4.8.0-25.27~16.04.1

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

Author: Tobias Brunner
Author Date: 2016-07-29 07:57:32 UTC

xfrm: Ignore socket policies when rebuilding hash tables

BugLink: http://bugs.launchpad.net/bugs/1613787

Whenever thresholds are changed the hash tables are rebuilt. This is
done by enumerating all policies and hashing and inserting them into
the right table according to the thresholds and direction.

Because socket policies are also contained in net->xfrm.policy_all but
no hash tables are defined for their direction (dir + XFRM_POLICY_MAX)
this causes a NULL or invalid pointer dereference after returning from
policy_hash_bysel() if the rebuild is done while any socket policies
are installed.

Since the rebuild after changing thresholds is scheduled this crash
could even occur if the userland sets thresholds seemingly before
installing any socket policies.

Fixes: 53c2e285f970 ("xfrm: Do not hash socket policies")
Signed-off-by: Tobias Brunner <tobias@strongswan.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from linux-next commit 6916fb3b10b3cbe3b1f9f5b680675f53e4e299eb)
Signed-off-by: Joseph Salisbury <joseph.salisbury@canonical.com>
Acked-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>

Author: Kamal Mostafa
Author Date: 2016-04-24 19:12:29 UTC

UBUNTU: Ubuntu-4.4.0-22.38

Signed-off-by: Kamal Mostafa <kamal@canonical.com>

Author: Tim Gardner
Author Date: 2016-04-06 12:02:30 UTC

UBUNTU: [Config] CONFIG_ARCH_ROCKCHIP=y

BugLink: http://bugs.launchpad.net/bugs/1566283

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

Author: Andy Whitcroft
Author Date: 2016-02-25 16:06:37 UTC

UBUNTU: Ubuntu-flo-3.4.0-5.23

Signed-off-by: Andy Whitcroft <apw@canonical.com>

Author: Andy Whitcroft
Author Date: 2016-02-24 20:01:51 UTC

UBUNTU: Ubuntu-mako-3.4.0-7.43

Signed-off-by: Andy Whitcroft <apw@canonical.com>

Author: Andy Whitcroft
Author Date: 2016-02-24 19:21:54 UTC

UBUNTU: Ubuntu-goldfish-3.4.0-4.27

Signed-off-by: Andy Whitcroft <apw@canonical.com>