Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 66d14f57 authored by shaohanlin's avatar shaohanlin
Browse files

Merge SPL 2021-04-05 into mp 

* tag 'mp-2021-04-05':
  mm: thp: make the THP mapcount atomic against __split_huge_pmd_locked()
  icmp: randomize the global rate limiter
  block: Fix use-after-free in blkdev_get()
Change-Id: I9db9b543b997904d6522b0355aea27ed31f4c374
parents 81bec8af c138d15d

Documentation/networking/ip-sysctl.txt

+3 −1
Original line number Diff line number Diff line
@@ -912,12 +912,14 @@ icmp_ratelimit - INTEGER 
icmp_msgs_per_sec - INTEGER

	Limit maximal number of ICMP packets sent per second from this host.

	Only messages whose type matches icmp_ratemask (see below) are

	controlled by this limit.

	controlled by this limit. For security reasons, the precise count

	of messages per second is randomized.

	Default: 1000



icmp_msgs_burst - INTEGER

	icmp_msgs_per_sec controls number of ICMP packets sent per second,

	while icmp_msgs_burst controls the burst size of these packets.

	For security reasons, the precise burst size is randomized.

	Default: 50



icmp_ratemask - INTEGER

fs/block_dev.c

+7 −5
Original line number Diff line number Diff line
@@ -1286,11 +1286,9 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) 
	 */

	if (!for_part) {

		ret = devcgroup_inode_permission(bdev->bd_inode, perm);

		if (ret != 0) {

			bdput(bdev);

		if (ret != 0)

			return ret;

	}

	}



 restart:
@@ -1361,8 +1359,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) 
				goto out_clear;

			BUG_ON(for_part);

			ret = __blkdev_get(whole, mode, 1);

			if (ret)

			if (ret) {

				bdput(whole);

				goto out_clear;

			}

			bdev->bd_contains = whole;

			bdev->bd_part = disk_get_part(disk, partno);

			if (!(disk->flags & GENHD_FL_UP) ||
@@ -1416,7 +1416,6 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) 
	put_disk(disk);

	module_put(owner);

 out:

	bdput(bdev);



	return ret;

}
@@ -1502,6 +1501,9 @@ int blkdev_get(struct block_device *bdev, fmode_t mode, void *holder) 
		bdput(whole);

	}



	if (res)

		bdput(bdev);



	return res;

}

EXPORT_SYMBOL(blkdev_get);

mm/huge_memory.c

+28 −3
Original line number Diff line number Diff line
@@ -1755,6 +1755,8 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, 
	spinlock_t *ptl;

	struct mm_struct *mm = vma->vm_mm;

	unsigned long haddr = address & HPAGE_PMD_MASK;

	bool was_locked = false;

	pmd_t _pmd;



	mmu_notifier_invalidate_range_start(mm, haddr, haddr + HPAGE_PMD_SIZE);

	ptl = pmd_lock(mm, pmd);
@@ -1764,11 +1766,32 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, 
	 * pmd against. Otherwise we can end up replacing wrong page.

	 */

	VM_BUG_ON(freeze && !page);

	if (page && page != pmd_page(*pmd))

	if (page) {

		VM_WARN_ON_ONCE(!PageLocked(page));

		was_locked = true;

		if (page != pmd_page(*pmd))

			goto out;

	}



repeat:

	if (pmd_trans_huge(*pmd)) {

		if (!page) {

			page = pmd_page(*pmd);

			if (unlikely(!trylock_page(page))) {

				get_page(page);

				_pmd = *pmd;

				spin_unlock(ptl);

				lock_page(page);

				spin_lock(ptl);

				if (unlikely(!pmd_same(*pmd, _pmd))) {

					unlock_page(page);

					put_page(page);

					page = NULL;

					goto repeat;

				}

				put_page(page);

			}

		}

		if (PageMlocked(page))

			clear_page_mlock(page);

	} else if (!pmd_devmap(*pmd))
@@ -1776,6 +1799,8 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, 
	__split_huge_pmd_locked(vma, pmd, haddr, freeze);

out:

	spin_unlock(ptl);

	if (!was_locked && page)

		unlock_page(page);

	mmu_notifier_invalidate_range_end(mm, haddr, haddr + HPAGE_PMD_SIZE);

}

net/ipv4/icmp.c

+5 −2
Original line number Diff line number Diff line
@@ -246,7 +246,7 @@ static struct { 
/**

 * icmp_global_allow - Are we allowed to send one more ICMP message ?

 *

 * Uses a token bucket to limit our ICMP messages to sysctl_icmp_msgs_per_sec.

 * Uses a token bucket to limit our ICMP messages to ~sysctl_icmp_msgs_per_sec.

 * Returns false if we reached the limit and can not send another packet.

 * Note: called with BH disabled

 */
@@ -274,7 +274,10 @@ bool icmp_global_allow(void) 
	}

	credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst);

	if (credit) {

		credit--;

		/* We want to use a credit of one in average, but need to randomize

		 * it for security reasons.

		 */

		credit = max_t(int, credit - prandom_u32_max(3), 0);

		rc = true;

	}

	WRITE_ONCE(icmp_global.credit, credit);