linux-kernel - Re: smb cifs: Linux 6.7 pre rc-1 kernel dump in smb2_get_aead

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZUiXkPPP1TuOgmmf@fedora.fritz.box>
Date:   Mon, 6 Nov 2023 08:36:48 +0100
From:   Damian Tometzki <damian@...cv-rocks.de>
To:     Eric Biggers <ebiggers@...nel.org>, dhowells@...hat.com
Cc:     Steve French <smfrench@...il.com>,
        Damian Tometzki <damian@...cv-rocks.de>,
        John Sanpe <sanpeqf@...il.com>,
        CIFS <linux-cifs@...r.kernel.org>,
        Namjae Jeon <linkinjeon@...nel.org>,
        Paulo Alcantara <pc@...guebit.com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: smb cifs: Linux 6.7 pre rc-1 kernel dump in smb2_get_aead_req

On Sun, 05. Nov 12:15, Eric Biggers wrote:
> On Sun, Nov 05, 2023 at 08:40:03PM +0100, Damian Tometzki wrote:
> > On Sun, 05. Nov 11:36, Eric Biggers wrote:
> > > On Sun, Nov 05, 2023 at 11:05:30AM -0700, Steve French wrote:
> > > > maybe related to this recent crypto patch?
> > > > 
> > > > https://git.samba.org/?p=sfrench/cifs-2.6.git;a=commit;h=783fa2c94f4150fe1b7f7d88b3baf6d98f82b41b
> > > > 
> > > > On Sun, Nov 5, 2023, 10:32 Damian Tometzki <damian@...cv-rocks.de> wrote:
> > > > > [   83.530503] CPU: 7 PID: 4584 Comm: mount.cifs Tainted: G        W
> > > > >     6.6.0 #61
> > > > > [   83.530508] Hardware name: LENOVO 20XWCTO1WW/20XWCTO1WW, BIOS N32ET86W
> > > > > (1.62 ) 07/12/2023
> > > 
> > > The above suggests that this warning occurred on 6.6, not on 6.7 pre rc1.
> > > 
> > > - Eric
> > Hello,
> > 
> > is little bit missleading but it is 6.6 from linus mainline git with all
> > the pull request. 
> > 
> > Damian
> > 
> 
> Okay, next time please mention the actual commit ID.  Anyway, the warning is
> 'WARN_ON_ONCE(user_backed_iter(&rqst[i].rq_iter))', so maybe take a look at
> changes from 
> 
>     commit f1b4cb650b9a0eeba206d8f069fcdc532bfbcd74
>     Author: David Howells <dhowells@...hat.com>
>     Date:   Mon Sep 25 13:03:03 2023 +0100
> 
>         iov_iter: Derive user-backedness from the iterator type
>
Hello Eric,

the revert of f1b4cb650b9a0eeba206d8f069fcdc532bfbcd74 solved the issue of the kernel dump.

diff --git a/include/linux/uio.h b/include/linux/uio.h
index b6214cbf2a43..02a8e5e6c458 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -43,6 +43,7 @@ struct iov_iter {
        bool copy_mc;
        bool nofault;
        bool data_source;
+       bool user_backed;
        size_t iov_offset;
        /*
         * Hack alert: overlay ubuf_iovec with iovec + count, so
@@ -139,7 +140,7 @@ static inline unsigned char iov_iter_rw(const struct iov_iter *i)
 
 static inline bool user_backed_iter(const struct iov_iter *i)
 {
-       return iter_is_ubuf(i) || iter_is_iovec(i);
+       return i->user_backed;
 }
 
 /*
@@ -358,6 +359,7 @@ static inline void iov_iter_ubuf(struct iov_iter *i, unsigned int direction,
        *i = (struct iov_iter) {
                .iter_type = ITER_UBUF,
                .copy_mc = false,
+               .user_backed = true,
                .data_source = direction,
                .ubuf = buf,
                .count = count,
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index de7d11cf4c63..a077c15727b2 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -168,6 +168,7 @@ void iov_iter_init(struct iov_iter *i, unsigned int direction,
                .iter_type = ITER_IOVEC,
                .copy_mc = false,
                .nofault = false,
+               .user_backed = true,
                .data_source = direction,
                .__iov = iov,
                .nr_segs = nr_segs,
 
> and the pull request that contained it:
> 
>     commit df9c65b5fc7ef1caabdb7a01a2415cbb8a00908d
>     Merge: 3b3f874cc1d07 b5f0e20f444cd
>     Author: Linus Torvalds <torvalds@...ux-foundation.org>
>     Date:   Mon Oct 30 09:24:21 2023 -1000
> 
>         Merge tag 'vfs-6.7.iov_iter' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs
> 
>         Pull iov_iter updates from Christian Brauner:
>          "This contain's David's iov_iter cleanup work to convert the iov_iter
>           iteration macros to inline functions: