5.15.170-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.15.170-rc1 review
This is the start of the stable review cycle for the 5.15.170 release. There are 80 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Oct 2024 06:22:39 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.170-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.170-rc1
Zichen Xie <[email protected]>
ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
Michel Alex <[email protected]>
net: phy: dp83822: Fix reset pin definitions
Jiri Slaby (SUSE) <[email protected]>
serial: protect uart_port_dtr_rts() in uart_shutdown() too
Paul Moore <[email protected]>
selinux: improve error checking in sel_write_load()
Haiyang Zhang <[email protected]>
hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event
Petr Vaganov <[email protected]>
xfrm: fix one more kernel-infoleak in algo dumping
José Relvas <[email protected]>
ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593
Sean Christopherson <[email protected]>
KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
Aleksa Sarai <[email protected]>
openat2: explicitly return -E2BIG for (usize > PAGE_SIZE)
Ryusuke Konishi <[email protected]>
nilfs2: fix kernel bug due to missing clearing of buffer delay flag
Shubham Panwar <[email protected]>
ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue
Christian Heusel <[email protected]>
ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[]
Mario Limonciello <[email protected]>
drm/amd: Guard against bad data for ATIF ACPI method
Naohiro Aota <[email protected]>
btrfs: zoned: fix zone unusable accounting for freed reserved extent
Kailang Yang <[email protected]>
ALSA: hda/realtek: Update default depop procedure
Andrey Shumilin <[email protected]>
ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()
Jiri Olsa <[email protected]>
bpf,perf: Fix perf_event_detach_bpf_prog error handling
Jinjie Ruan <[email protected]>
posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
Heiner Kallweit <[email protected]>
r8169: avoid unsolicited interrupts
Dmitry Antipov <[email protected]>
net: sched: fix use-after-free in taprio_change()
Oliver Neukum <[email protected]>
net: usb: usbnet: fix name regression
Lin Ma <[email protected]>
net: wwan: fix global oob in wwan_rtnl_policy
Pablo Neira Ayuso <[email protected]>
netfilter: xtables: fix typo causing some targets not to load on IPv6
Peter Rashleigh <[email protected]>
net: dsa: mv88e6xxx: Fix error when setting port policy on mv88e6393x
Jakub Boehm <[email protected]>
net: plip: fix break; causing plip to never transmit
Wang Hai <[email protected]>
be2net: fix potential memory leak in be_xmit()
Wang Hai <[email protected]>
net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
Eyal Birger <[email protected]>
xfrm: respect ip protocols rules criteria when performing dst lookups
Eyal Birger <[email protected]>
xfrm: extract dst lookup parameters into a struct
Leo Yan <[email protected]>
tracing: Consider the NULL character when validating the event length
Dave Kleikamp <[email protected]>
jfs: Fix sanity check in dbMount
Crag Wang <[email protected]>
platform/x86: dell-sysman: add support for alienware products
Alexey Klimov <[email protected]>
ASoC: qcom: sm8250: add qrb4210-rb2-sndcard compatible string
junhua huang <[email protected]>
arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning
Armin Wolf <[email protected]>
platform/x86: dell-wmi: Ignore suspend notifications
Gianfranco Trad <[email protected]>
udf: fix uninit-value use in udf_get_fileshortad
Mark Rutland <[email protected]>
arm64: Force position-independent veneers
Shengjiu Wang <[email protected]>
ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit
Alexey Klimov <[email protected]>
ASoC: codecs: lpass-rx-macro: add missing CDC_RX_BCL_VBAT_RF_PROC2 to default regs values
Hans de Goede <[email protected]>
drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
Mateusz Guzik <[email protected]>
exec: don't WARN for racy path_noexec check
Yu Kuai <[email protected]>
block, bfq: fix procress reference leakage for bfqq in merge chain
Roger Quadros <[email protected]>
usb: dwc3: core: Fix system suspend on TI AM62 platforms
Frank Li <[email protected]>
XHCI: Separate PORT and CAPs macros into dedicated file
Elson Roy Serrao <[email protected]>
usb: gadget: Add function wakeup support
Nico Boehr <[email protected]>
KVM: s390: gaccess: Check if guest address is in memslot
Janis Schoetterl-Glausch <[email protected]>
KVM: s390: gaccess: Cleanup access to guest pages
Janis Schoetterl-Glausch <[email protected]>
KVM: s390: gaccess: Refactor access address range check
Janis Schoetterl-Glausch <[email protected]>
KVM: s390: gaccess: Refactor gpa and length calculation
Mark Rutland <[email protected]>
arm64: probes: Fix uprobes for big-endian kernels
junhua huang <[email protected]>
arm64:uprobe fix the uprobe SWBP_INSN in big-endian
Ye Bin <[email protected]>
Bluetooth: bnep: fix wild-memory-access in proto_unregister
Heiko Carstens <[email protected]>
s390: Initialize psw mask in perf_arch_fetch_caller_regs()
Thadeu Lima de Souza Cascardo <[email protected]>
usb: typec: altmode should keep reference to parent
Paulo Alcantara <[email protected]>
smb: client: fix OOBs when building SMB2_IOCTL request
Wang Hai <[email protected]>
scsi: target: core: Fix null-ptr-deref in target_alloc_device()
Eric Dumazet <[email protected]>
genetlink: hold RCU in genlmsg_mcast()
Kuniyuki Iwashima <[email protected]>
tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
Wang Hai <[email protected]>
net: systemport: fix potential memory leak in bcm_sysport_xmit()
Wang Hai <[email protected]>
net: xilinx: axienet: fix potential memory leak in axienet_start_xmit()
Li RongQing <[email protected]>
net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid
Wang Hai <[email protected]>
net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit()
Sabrina Dubroca <[email protected]>
macsec: don't increment counters for an unrelated SA
Colin Ian King <[email protected]>
octeontx2-af: Fix potential integer overflows on integer shifts
Oliver Neukum <[email protected]>
net: usb: usbnet: fix race in probe failure
Douglas Anderson <[email protected]>
drm/msm: Allocate memory for disp snapshot with kvzalloc()
Douglas Anderson <[email protected]>
drm/msm: Avoid NULL dereference in msm_disp_state_print_regs()
Jonathan Marek <[email protected]>
drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation
Bhargava Chenna Marreddy <[email protected]>
RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
Kalesh AP <[email protected]>
RDMA/bnxt_re: Return more meaningful error
Xin Long <[email protected]>
ipv4: give an IPv4 dev to blackhole_netdev
Alexander Zubkov <[email protected]>
RDMA/irdma: Fix misspelling of "accept*"
Anumula Murali Mohan Reddy <[email protected]>
RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP
Murad Masimov <[email protected]>
ALSA: hda/cs8409: Fix possible NULL dereference
Florian Klink <[email protected]>
ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin
Martin Kletzander <[email protected]>
x86/resctrl: Avoid overflow in MB settings in bw_validate()
Kalesh AP <[email protected]>
RDMA/bnxt_re: Add a check for memory allocation
Saravanan Vajravel <[email protected]>
RDMA/bnxt_re: Fix incorrect AVID type in WQE structure
Florian Kauer <[email protected]>
bpf: devmap: provide rxq after redirect
Toke Høiland-Jørgensen <[email protected]>
bpf: Make sure internal and UAPI bpf_redirect flags don't overlap
-------------
Diffstat:
Makefile | 4 +- arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts | 2 +- arch/arm64/Makefile | 2 +- arch/arm64/include/asm/uprobes.h | 12 +- arch/arm64/kernel/probes/uprobes.c | 4 +- arch/s390/include/asm/perf_event.h | 1 + arch/s390/kvm/gaccess.c | 162 +++++++------ arch/s390/kvm/gaccess.h | 14 +- arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 23 +- arch/x86/kvm/svm/nested.c | 6 +- block/bfq-iosched.c | 37 ++- drivers/acpi/button.c | 11 + drivers/acpi/resource.c | 7 + drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 15 +- drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 19 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +- drivers/gpu/drm/vboxvideo/hgsmi_base.c | 10 +- drivers/gpu/drm/vboxvideo/vboxvideo.h | 4 +- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 +- drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 2 +- drivers/infiniband/hw/bnxt_re/qplib_res.c | 21 +- drivers/infiniband/hw/cxgb4/cm.c | 9 +- drivers/infiniband/hw/irdma/cm.c | 2 +- drivers/net/dsa/mv88e6xxx/port.c | 1 + drivers/net/ethernet/aeroflex/greth.c | 3 +- drivers/net/ethernet/broadcom/bcmsysport.c | 1 + drivers/net/ethernet/emulex/benet/be_main.c | 10 +- drivers/net/ethernet/i825xx/sun3_82586.c | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 +- drivers/net/ethernet/realtek/r8169_main.c | 4 +- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 + drivers/net/hyperv/netvsc_drv.c | 30 +++ drivers/net/macsec.c | 18 -- drivers/net/phy/dp83822.c | 4 +- drivers/net/plip/plip.c | 2 +- drivers/net/usb/usbnet.c | 4 +- drivers/net/wwan/wwan_core.c | 2 +- drivers/platform/x86/dell/dell-wmi-base.c | 9 + drivers/platform/x86/dell/dell-wmi-sysman/sysman.c | 1 + drivers/target/target_core_device.c | 2 +- drivers/target/target_core_user.c | 2 +- drivers/tty/serial/serial_core.c | 16 +- drivers/usb/dwc3/core.c | 19 ++ drivers/usb/dwc3/core.h | 3 + drivers/usb/gadget/composite.c | 40 ++++ drivers/usb/host/xhci-caps.h | 85 +++++++ drivers/usb/host/xhci-port.h | 176 ++++++++++++++ drivers/usb/host/xhci.h | 262 +-------------------- drivers/usb/typec/class.c | 3 + fs/btrfs/block-group.c | 2 + fs/cifs/smb2pdu.c | 9 + fs/exec.c | 21 +- fs/jfs/jfs_dmap.c | 2 +- fs/nilfs2/page.c | 6 +- fs/open.c | 2 + fs/udf/inode.c | 9 +- include/linux/usb/composite.h | 6 + include/linux/usb/gadget.h | 1 + include/net/genetlink.h | 3 +- include/net/xfrm.h | 28 ++- include/uapi/linux/bpf.h | 13 +- kernel/bpf/devmap.c | 11 +- kernel/time/posix-clock.c | 6 +- kernel/trace/bpf_trace.c | 2 - kernel/trace/trace_probe.c | 2 +- net/bluetooth/bnep/core.c | 3 +- net/core/filter.c | 8 +- net/ipv4/devinet.c | 35 ++- net/ipv4/inet_connection_sock.c | 21 +- net/ipv4/xfrm4_policy.c | 38 ++- net/ipv6/xfrm6_policy.c | 31 +-- net/l2tp/l2tp_netlink.c | 4 +- net/netfilter/xt_NFLOG.c | 2 +- net/netfilter/xt_TRACE.c | 1 + net/netfilter/xt_mark.c | 2 +- net/netlink/genetlink.c | 28 +-- net/sched/sch_taprio.c | 3 +- net/smc/smc_pnet.c | 2 +- net/wireless/nl80211.c | 8 +- net/xfrm/xfrm_device.c | 11 +- net/xfrm/xfrm_policy.c | 50 +++- net/xfrm/xfrm_user.c | 4 +- security/selinux/selinuxfs.c | 27 ++- sound/firewire/amdtp-stream.c | 3 + sound/pci/hda/patch_cs8409.c | 5 +- sound/pci/hda/patch_realtek.c | 48 ++-- sound/soc/codecs/lpass-rx-macro.c | 2 +- sound/soc/fsl/fsl_sai.c | 5 +- sound/soc/fsl/fsl_sai.h | 1 + sound/soc/qcom/lpass-cpu.c | 2 + sound/soc/qcom/sm8250.c | 1 + 91 files changed, 900 insertions(+), 643 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/80 bpf: Make sure internal and UAPI bpf_redirect flags dont overlap
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 09d88791c7cd888d5195c84733caf9183dcfbd16 ]
The bpf_redirect_info is shared between the SKB and XDP redirect paths, and the two paths use the same numeric flag values in the ri->flags field (specifically, BPF_F_BROADCAST == BPF_F_NEXTHOP). This means that if skb bpf_redirect_neigh() is used with a non-NULL params argument and, subsequently, an XDP redirect is performed using the same bpf_redirect_info struct, the XDP path will get confused and end up crashing, which syzbot managed to trigger.
With the stack-allocated bpf_redirect_info, the structure is no longer shared between the SKB and XDP paths, so the crash doesn't happen anymore. However, different code paths using identically-numbered flag values in the same struct field still seems like a bit of a mess, so this patch cleans that up by moving the flag definitions together and redefining the three flags in BPF_F_REDIRECT_INTERNAL to not overlap with the flags used for XDP. It also adds a BUILD_BUG_ON() check to make sure the overlap is not re-introduced by mistake.
--- include/uapi/linux/bpf.h | 13 +++++-------- net/core/filter.c | 8 +++++--- 2 files changed, 10 insertions(+), 11 deletions(-)
include/uapi/linux/bpf.h +5 -8
@@ -5108,11 +5108,6 @@ enum { BPF_F_MARK_ENFORCE = (1ULL << 6), }; -/* BPF_FUNC_clone_redirect and BPF_FUNC_redirect flags. */ -enum { -BPF_F_INGRESS = (1ULL <<0 ), -}; -/* BPF_FUNC_skb_set_tunnel_key and BPF_FUNC_skb_get_tunnel_key flags. */ enum {BPF_F_TUNINFO_IPV6 = (1ULL <<0 ),
@@ -5251,10 +5246,12 @@ enum { BPF_F_BPRM_SECUREEXEC = (1ULL << 0), }; -/* Flags for bpf_redirect_map helper */ +/* Flags for bpf_redirect and bpf_redirect_map helpers */ enum { -BPF_F_BROADCAST = (1ULL <<3 ), -BPF_F_EXCLUDE_INGRESS = (1ULL <<4 ), +BPF_F_INGRESS = (1ULL <<0 ),/* used for skb path */ +BPF_F_BROADCAST = (1ULL <<3 ),/* used for XDP path */ +BPF_F_EXCLUDE_INGRESS = (1ULL <<4 ),/* used for XDP path */ +#define BPF_F_REDIRECT_FLAGS (BPF_F_INGRESS | BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS) };#define __bpf_md_ptr (type, name) \
net/core/filter.c +5 -3
@@ -2405,9 +2405,9 @@ static int __bpf_redirect_neigh(struct sk_buff *skb, struct net_device *dev,/* Internal, non-exposed redirect flags. */ enum { -BPF_F_NEIGH = (1ULL <<1 ), -BPF_F_PEER = (1ULL <<2 ), -BPF_F_NEXTHOP = (1ULL <<3 ), +BPF_F_NEIGH = (1ULL <<16 ), +BPF_F_PEER = (1ULL <<17 ), +BPF_F_NEXTHOP = (1ULL <<18 ),#define BPF_F_REDIRECT_INTERNAL (BPF_F_NEIGH | BPF_F_PEER | BPF_F_NEXTHOP) };
@@ -2417,6 +2417,8 @@ BPF_CALL_3(bpf_clone_redirect, struct sk_buff *, skb, u32, ifindex, u64, flags)struct sk_buff *clone;int ret; +BUILD_BUG_ON (BPF_F_REDIRECT_INTERNAL &BPF_F_REDIRECT_FLAGS ); +if (unlikely (flags & (~(BPF_F_INGRESS ) |BPF_F_REDIRECT_INTERNAL )))return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/80 bpf: devmap: provide rxq after redirect
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Kauer <[email protected]>
[ Upstream commit ca9984c5f0ab3690d98b13937b2485a978c8dd73 ]
rxq contains a pointer to the device from where the redirect happened. Currently, the BPF program that was executed after a redirect via BPF_MAP_TYPE_DEVMAP* does not have it set.
This is particularly bad since accessing ingress_ifindex, e.g.
SEC("xdp")
int prog(struct xdp_md *pkt)
{
return bpf_redirect_map(&dev_redirect_map, 0, 0);
}SEC("xdp/devmap")
int prog_after_redirect(struct xdp_md *pkt)
{
bpf_printk("ifindex %i", pkt->ingress_ifindex);
return XDP_PASS;
}depends on access to rxq, so a NULL pointer gets dereferenced:
<1>[ 574.475170] BUG: kernel NULL pointer dereference, address: 0000000000000000 <1>[ 574.475188] #PF: supervisor read access in kernel mode <1>[ 574.475194] #PF: error_code(0x0000) - not-present page <6>[ 574.475199] PGD 0 P4D 0 <4>[ 574.475207] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI <4>[ 574.475217] CPU: 4 UID: 0 PID: 217 Comm: kworker/4:1 Not tainted 6.11.0-rc5-reduced-00859-g780801200300 #23 <4>[ 574.475226] Hardware name: Intel(R) Client Systems NUC13ANHi7/NUC13ANBi7, BIOS ANRPL357.0026.2023.0314.1458 03/14/2023 <4>[ 574.475231] Workqueue: mld mld_ifc_work <4>[ 574.475247] RIP: 0010:bpf_prog_5e13354d9cf5018a_prog_after_redirect+0x17/0x3c <4>[ 574.475257] Code: cc cc cc cc cc cc cc 80 00 00 00 cc cc cc cc cc cc cc cc f3 0f 1e fa 0f 1f 44 00 00 66 90 55 48 89 e5 f3 0f 1e fa 48 8b 57 20 <48> 8b 52 00 8b 92 e0 00 00 00 48 bf f8 a6 d5 c4 5d a0 ff ff be 0b <4>[ 574.475263] RSP: 0018:ffffa62440280c98 EFLAGS: 00010206 <4>[ 574.475269] RAX: ffffa62440280cd8 RBX: 0000000000000001 RCX: 0000000000000000 <4>[ 574.475274] RDX: 0000000000000000 RSI: ffffa62440549048 RDI: ffffa62440280ce0 <4>[ 574.475278] RBP: ffffa62440280c98 R08: 0000000000000002 R09: 0000000000000001 <4>[ 574.475281] R10: ffffa05dc8b98000 R11: ffffa05f577fca40 R12: ffffa05dcab24000 <4>[ 574.475285] R13: ffffa62440280ce0 R14: ffffa62440549048 R15: ffffa62440549000 <4>[ 574.475289] FS: 0000000000000000(0000) GS:ffffa05f4f700000(0000) knlGS:0000000000000000 <4>[ 574.475294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 574.475298] CR2: 0000000000000000 CR3: 000000025522e000 CR4: 0000000000f50ef0 <4>[ 574.475303] PKRU: 55555554 <4>[ 574.475306] Call Trace: <4>[ 574.475313] <IRQ> <4>[ 574.475318] ? __die+0x23/0x70 <4>[ 574.475329] ? page_fault_oops+0x180/0x4c0 <4>[ 574.475339] ? skb_pp_cow_data+0x34c/0x490 <4>[ 574.475346] ? kmem_cache_free+0x257/0x280 <4>[ 574.475357] ? exc_page_fault+0x67/0x150 <4>[ 574.475368] ? asm_exc_page_fault+0x26/0x30 <4>[ 574.475381] ? bpf_prog_5e13354d9cf5018a_prog_after_redirect+0x17/0x3c <4>[ 574.475386] bq_xmit_all+0x158/0x420 <4>[ 574.475397] __dev_flush+0x30/0x90 <4>[ 574.475407] veth_poll+0x216/0x250 [veth] <4>[ 574.475421] __napi_poll+0x28/0x1c0 <4>[ 574.475430] net_rx_action+0x32d/0x3a0 <4>[ 574.475441] handle_softirqs+0xcb/0x2c0 <4>[ 574.475451] do_softirq+0x40/0x60 <4>[ 574.475458] </IRQ> <4>[ 574.475461] <TASK> <4>[ 574.475464] __local_bh_enable_ip+0x66/0x70 <4>[ 574.475471] __dev_queue_xmit+0x268/0xe40 <4>[ 574.475480] ? selinux_ip_postroute+0x213/0x420 <4>[ 574.475491] ? alloc_skb_with_frags+0x4a/0x1d0 <4>[ 574.475502] ip6_finish_output2+0x2be/0x640 <4>[ 574.475512] ? nf_hook_slow+0x42/0xf0 <4>[ 574.475521] ip6_finish_output+0x194/0x300 <4>[ 574.475529] ? __pfx_ip6_finish_output+0x10/0x10 <4>[ 574.475538] mld_sendpack+0x17c/0x240 <4>[ 574.475548] mld_ifc_work+0x192/0x410 <4>[ 574.475557] process_one_work+0x15d/0x380 <4>[ 574.475566] worker_thread+0x29d/0x3a0 <4>[ 574.475573] ? __pfx_worker_thread+0x10/0x10 <4>[ 574.475580] ? __pfx_worker_thread+0x10/0x10 <4>[ 574.475587] kthread+0xcd/0x100 <4>[ 574.475597] ? __pfx_kthread+0x10/0x10 <4>[ 574.475606] ret_from_fork+0x31/0x50 <4>[ 574.475615] ? __pfx_kthread+0x10/0x10 <4>[ 574.475623] ret_from_fork_asm+0x1a/0x30 <4>[ 574.475635] </TASK> <4>[ 574.475637] Modules linked in: veth br_netfilter bridge stp llc iwlmvm x86_pkg_temp_thermal iwlwifi efivarfs nvme nvme_core <4>[ 574.475662] CR2: 0000000000000000 <4>[ 574.475668] ---[ end trace 0000000000000000 ]---
Therefore, provide it to the program by setting rxq properly.
--- kernel/bpf/devmap.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
kernel/bpf/devmap.c +7 -4
@@ -325,9 +325,11 @@ static int dev_map_hash_get_next_key(struct bpf_map *map, void *key,static int dev_map_bpf_prog_run (struct bpf_prog *xdp_prog,struct xdp_frame **frames,int n, -struct net_device *dev) +struct net_device *tx_dev, +struct net_device *rx_dev) { -struct xdp_txq_info txq = { .dev = dev }; +struct xdp_txq_info txq = { .dev = tx_dev }; +struct xdp_rxq_info rxq = { .dev = rx_dev };struct xdp_buff xdp;int i, nframes =0 ;
@@ -338,6 +340,7 @@ static int dev_map_bpf_prog_run(struct bpf_prog *xdp_prog,xdp_convert_frame_to_buff (xdpf, &xdp); xdp.txq = &txq; + xdp.rxq = &rxq; act =bpf_prog_run_xdp (xdp_prog, &xdp);switch (act) {
@@ -352,7 +355,7 @@ static int dev_map_bpf_prog_run(struct bpf_prog *xdp_prog,bpf_warn_invalid_xdp_action (act); fallthrough;case XDP_ABORTED : -trace_xdp_exception (dev, xdp_prog, act); +trace_xdp_exception (tx_dev, xdp_prog, act); fallthrough;case XDP_DROP :xdp_return_frame_rx_napi (xdpf);
@@ -380,7 +383,7 @@ static void bq_xmit_all(struct xdp_dev_bulk_queue *bq, u32 flags) }if (bq->xdp_prog) { - to_send =dev_map_bpf_prog_run (bq->xdp_prog, bq->q, cnt, dev); + to_send =dev_map_bpf_prog_run (bq->xdp_prog, bq->q, cnt, dev, bq->dev_rx);if (!to_send) goto out; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/80 RDMA/bnxt_re: Fix incorrect AVID type in WQE structure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saravanan Vajravel <[email protected]>
[ Upstream commit 9ab20f76ae9fad55ebaf36bdff04aea1c2552374 ]
Driver uses internal data structure to construct WQE frame. It used avid type as u16 which can accommodate up to 64K AVs. When outstanding AVID crosses 64K, driver truncates AVID and hence it uses incorrect AVID to WR. This leads to WR failure due to invalid AV ID and QP is moved to error state with reason set to 19 (INVALID AVID). When RDMA CM path is used, this issue hits QP1 and it is moved to error state
--- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/bnxt_re/qplib_fp.h +1 -1
@@ -169,7 +169,7 @@ struct bnxt_qplib_swqe { };u32 q_key;u32 dst_qp; -u16 avid; +u32 avid; } send;/* Send Raw Ethernet and QP1 */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/80 RDMA/bnxt_re: Add a check for memory allocation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <[email protected]>
[ Upstream commit c5c1ae73b7741fa3b58e6e001b407825bb971225 ]
__alloc_pbl() can return error when memory allocation fails. Driver is not checking the status on one of the instances.
--- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/infiniband/hw/bnxt_re/qplib_res.c +2 -0
@@ -243,6 +243,8 @@ int bnxt_qplib_alloc_init_hwq(struct bnxt_qplib_hwq *hwq, sginfo.pgsize = npde * pg_size; sginfo.npages =1 ; rc =__alloc_pbl (res, &hwq->pbl[PBL_LVL_0 ], &sginfo); +if (rc) + goto fail;/* Alloc PBL pages */ sginfo.npages = npbl;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/80 x86/resctrl: Avoid overflow in MB settings in bw_validate()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kletzander <[email protected]>
[ Upstream commit 2b5648416e47933939dc310c4ea1e29404f35630 ]
The resctrl schemata file supports specifying memory bandwidth associated with the Memory Bandwidth Allocation (MBA) feature via a percentage (this is the default) or bandwidth in MiBps (when resctrl is mounted with the "mba_MBps" option).
The allowed range for the bandwidth percentage is from /sys/fs/resctrl/info/MB/min_bandwidth to 100, using a granularity of /sys/fs/resctrl/info/MB/bandwidth_gran. The supported range for the MiBps bandwidth is 0 to U32_MAX.
There are two issues with parsing of MiBps memory bandwidth:
* The user provided MiBps is mistakenly rounded up to the granularity that is unique to percentage input.
* The user provided MiBps is parsed using unsigned long (thus accepting values up to ULONG_MAX), and then assigned to u32 that could result in overflow.
Do not round up the MiBps value and parse user provided bandwidth as the u32 it is intended to be. Use the appropriate kstrtou32() that can detect out of range values.
--- arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
arch/x86/kernel/cpu/resctrl/ctrlmondata.c +14 -9
@@ -27,10 +27,10 @@* hardware. The allocated bandwidth percentage is rounded to the next * control step available on the hardware. */ -static bool bw_validate (char *buf,unsigned long *data,struct rdt_resource *r) +static bool bw_validate (char *buf,u32 *data,struct rdt_resource *r) { -unsigned long bw;int ret; +u32 bw;/* * Only linear delay values is supported for current Intel SKUs.
@@ -40,16 +40,21 @@ static bool bw_validate(char *buf, unsigned long *data, struct rdt_resource *r)return false; } - ret =kstrtoul (buf,10 , &bw); + ret =kstrtou32 (buf,10 , &bw);if (ret) { -rdt_last_cmd_printf ("Non-decimal digit in MB value %s\n" , buf); +rdt_last_cmd_printf ("Invalid MB value %s\n" , buf);return false; } -if ((bw < r->membw.min_bw || bw > r->default_ctrl) && - !is_mba_sc (r)) { -rdt_last_cmd_printf ("MB value %ld out of range [%d,%d]\n" , bw, - r->membw.min_bw, r->default_ctrl); +/* Nothing else to do if software controller is enabled. */ +if (is_mba_sc (r)) { + *data = bw; +return true; + } + +if (bw < r->membw.min_bw || bw > r->default_ctrl) { +rdt_last_cmd_printf ("MB value %u out of range [%d,%d]\n" , + bw, r->membw.min_bw, r->default_ctrl);return false; }
@@ -62,7 +67,7 @@ int parse_bw(struct rdt_parse_data *data, struct resctrl_schema *s, {struct resctrl_staged_config *cfg;struct rdt_resource *r = s->res; -unsigned long bw_val; +u32 bw_val; cfg = &d->staged_config[s->conf_type];if (cfg->have_new_ctrl) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/80 ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Klink <[email protected]>
[ Upstream commit dc7785e4723510616d776862ddb4c08857a1bdb2 ]
HDMI_HPD_N_1V8 is connected to GPIO pin 0, not 1.
This fixes HDMI hotplug/output detection.
See https://datasheets.raspberrypi.com/cm/cm3-schematics.pdf
--- arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts +1 -1
@@ -77,7 +77,7 @@ }; &hdmi { - hpd-gpios = <&expgpio 1 GPIO_ACTIVE_LOW>; + hpd-gpios = <&expgpio 0 GPIO_ACTIVE_LOW>; power-domains = <&power RPI_POWER_DOMAIN_HDMI>; status = "okay"; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/80 ALSA: hda/cs8409: Fix possible NULL dereference
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murad Masimov <[email protected]>
[ Upstream commit c9bd4a82b4ed32c6d1c90500a52063e6e341517f ]
If snd_hda_gen_add_kctl fails to allocate memory and returns NULL, then NULL pointer dereference will occur in the next line.
Since dolphin_fixups function is a hda_fixup function which is not supposed to return any errors, add simple check before dereference, ignore the fail.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- sound/pci/hda/patch_cs8409.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/pci/hda/patch_cs8409.c +3 -2
@@ -1237,8 +1237,9 @@ void dolphin_fixups(struct hda_codec *codec, const struct hda_fixup *fix, int ac kctrl =snd_hda_gen_add_kctl (&spec->gen,"Line Out Playback Volume" , &cs42l42_dac_volume_mixer);/* Update Line Out kcontrol template */ - kctrl->private_value =HDA_COMPOSE_AMP_VAL_OFS (DOLPHIN_HP_PIN_NID ,3 ,CS8409_CODEC1 , -HDA_OUTPUT ,CS42L42_VOL_DAC ) |HDA_AMP_VAL_MIN_MUTE ; +if (kctrl) + kctrl->private_value =HDA_COMPOSE_AMP_VAL_OFS (DOLPHIN_HP_PIN_NID ,3 ,CS8409_CODEC1 , +HDA_OUTPUT ,CS42L42_VOL_DAC ) |HDA_AMP_VAL_MIN_MUTE ;cs8409_enable_ur (codec,0 );snd_hda_codec_set_name (codec,"CS8409/CS42L42" );break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/80 RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anumula Murali Mohan Reddy <[email protected]>
[ Upstream commit c659b405b82ead335bee6eb33f9691bf718e21e8 ]
ip_dev_find() always returns real net_device address, whether traffic is running on a vlan or real device, if traffic is over vlan, filling endpoint struture with real ndev and an attempt to send a connect request will results in RDMA_CM_EVENT_UNREACHABLE error. This patch fixes the issue by using vlan_dev_real_dev().
--- drivers/infiniband/hw/cxgb4/cm.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/infiniband/hw/cxgb4/cm.c +4 -5
@@ -2086,7 +2086,7 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip, err = -ENOMEM ;if (n->dev->flags &IFF_LOOPBACK ) {if (iptype ==4 ) - pdev =ip_dev_find (&init_net, *(__be32 *)peer_ip); + pdev =__ip_dev_find (&init_net, *(__be32 *)peer_ip, false);else if (IS_ENABLED (CONFIG_IPV6 ))for_each_netdev (&init_net, pdev) { if (ipv6_chk_addr(&init_net,
@@ -2101,12 +2101,12 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip, err = -ENODEV ; goto out; } +if (is_vlan_dev (pdev)) + pdev =vlan_dev_real_dev (pdev); ep->l2t =cxgb4_l2t_get (cdev->rdev.lldi.l2t, n, pdev,rt_tos2priority (tos)); -if (!ep->l2t) { -dev_put (pdev); +if (!ep->l2t) goto out; - } ep->mtu = pdev->mtu; ep->tx_chan =cxgb4_port_chan (pdev); ep->smac_idx = ((struct port_info *)netdev_priv (pdev))->smt_idx;
@@ -2119,7 +2119,6 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip, ep->rss_qid = cdev->rdev.lldi.rxq_ids[cxgb4_port_idx (pdev) * step];set_tcp_window (ep, (struct port_info *)netdev_priv (pdev)); -dev_put (pdev); }else { pdev =get_real_dev (n->dev); ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/80 RDMA/irdma: Fix misspelling of "accept*"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Zubkov <[email protected]>
[ Upstream commit 8cddfa535c931b8d8110c73bfed7354a94cbf891 ]
There is "accept*" misspelled as "accpet*" in the comments. Fix the spelling.
--- drivers/infiniband/hw/irdma/cm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/irdma/cm.c +1 -1
@@ -3582,7 +3582,7 @@ void irdma_free_lsmm_rsrc(struct irdma_qp *iwqp)/** * irdma_accept - registered call for connection to be accepted * @cm_id: cm information for passive connection -* @conn_param: accpet parameters +* @conn_param: accept parameters */ int irdma_accept (struct iw_cm_id *cm_id,struct iw_cm_conn_param *conn_param) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/80 ipv4: give an IPv4 dev to blackhole_netdev
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 22600596b6756b166fd052d5facb66287e6f0bad ]
After commit 8d7017fd621d ("blackhole_netdev: use blackhole_netdev to invalidate dst entries"), blackhole_netdev was introduced to invalidate dst cache entries on the TX path whenever the cache times out or is flushed.
When two UDP sockets (sk1 and sk2) send messages to the same destination simultaneously, they are using the same dst cache. If the dst cache is invalidated on one path (sk2) while the other (sk1) is still transmitting, sk1 may try to use the invalid dst entry.
CPU1 CPU2
udp_sendmsg(sk1) udp_sendmsg(sk2)
udp_send_skb()
ip_output()
<--- dst timeout or flushed
dst_dev_put()
ip_finish_output2()
ip_neigh_for_gw()This results in a scenario where ip_neigh_for_gw() returns -EINVAL because blackhole_dev lacks an in_dev, which is needed to initialize the neigh in arp_constructor(). This error is then propagated back to userspace, breaking the UDP application.
The patch fixes this issue by assigning an in_dev to blackhole_dev for IPv4, similar to what was done for IPv6 in commit e5f80fcf869a ("ipv6:
give an IPv6 dev to blackhole_netdev"). This ensures that even when the dst entry is invalidated with blackhole_dev, it will not fail to create the neigh entry.
As devinet_init() is called ealier than blackhole_netdev_init() in system booting, it can not assign the in_dev to blackhole_dev in devinet_init(). As Paolo suggested, add a separate late_initcall() in devinet.c to ensure inet_blackhole_dev_init() is called after blackhole_netdev_init().
--- net/ipv4/devinet.c | 35 +++++++++++++++++++++++++---------- 1 file changed, 25 insertions(+), 10 deletions(-)
net/ipv4/devinet.c +25 -10
@@ -273,17 +273,19 @@ static struct in_device *inetdev_init(struct net_device *dev)/* Account for reference dev->ip_ptr (below) */ refcount_set (&in_dev->refcnt,1 ); - err =devinet_sysctl_register (in_dev); -if (err) { - in_dev->dead =1 ; -neigh_parms_release (&arp_tbl, in_dev->arp_parms); -in_dev_put (in_dev); - in_dev =NULL ; - goto out; +if (dev != blackhole_netdev) { + err =devinet_sysctl_register (in_dev); +if (err) { + in_dev->dead =1 ; +neigh_parms_release (&arp_tbl, in_dev->arp_parms); +in_dev_put (in_dev); + in_dev =NULL ; + goto out; + } +ip_mc_init_dev (in_dev); +if (dev->flags &IFF_UP ) +ip_mc_up (in_dev); } -ip_mc_init_dev (in_dev); -if (dev->flags &IFF_UP ) -ip_mc_up (in_dev);/* we can receive as soon as ip_ptr is set -- do this last */ rcu_assign_pointer (dev->ip_ptr, in_dev);
@@ -328,6 +330,19 @@ static void inetdev_destroy(struct in_device *in_dev)call_rcu (&in_dev->rcu_head, in_dev_rcu_put); } +static int __init inet_blackhole_dev_init (void ) +{ +int err =0 ; + +rtnl_lock (); +if (!inetdev_init (blackhole_netdev)) + err = -ENOMEM ; +rtnl_unlock (); + +return err; +} +late_initcall (inet_blackhole_dev_init); +int inet_addr_onlink (struct in_device *in_dev,__be32 a,__be32 b) {const struct in_ifaddr *ifa;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/80 RDMA/bnxt_re: Return more meaningful error
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <[email protected]>
[ Upstream commit 98647df0178df215b8239c5c365537283b2852a6 ]
When the HWRM command fails, driver currently returns -EFAULT(Bad address). This does not look correct.
Modified to return -EIO(I/O error).
--- drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +1 -1
@@ -249,7 +249,7 @@ int bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,/* failed with status */ dev_err (&rcfw->pdev->dev,"cmdq[%#x]=%#x status %#x\n" , cookie, opcode, evnt->status); - rc = -EFAULT ; + rc = -EIO ; }return rc;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/80 RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bhargava Chenna Marreddy <[email protected]>
[ Upstream commit 7988bdbbb85ac85a847baf09879edcd0f70521dc ]
Avoid memory corruption while setting up Level-2 PBL pages for the non MR resources when num_pages > 256K.
There will be a single PDE page address (contiguous pages in the case of > PAGE_SIZE), but, current logic assumes multiple pages, leading to invalid memory access after 256K PBL entries in the PDE.
--- drivers/infiniband/hw/bnxt_re/qplib_res.c | 19 +++---------------- 1 file changed, 3 insertions(+), 16 deletions(-)
drivers/infiniband/hw/bnxt_re/qplib_res.c +3 -16
@@ -256,22 +256,9 @@ int bnxt_qplib_alloc_init_hwq(struct bnxt_qplib_hwq *hwq, dst_virt_ptr = (dma_addr_t **)hwq->pbl[PBL_LVL_0 ].pg_arr; src_phys_ptr = hwq->pbl[PBL_LVL_1 ].pg_map_arr; -if (hwq_attr->type ==HWQ_TYPE_MR ) { -/* For MR it is expected that we supply only 1 contigous -* page i.e only 1 entry in the PDL that will contain -* all the PBLs for the user supplied memory region -*/ -for (i =0 ; i < hwq->pbl[PBL_LVL_1 ].pg_count; - i++) - dst_virt_ptr[0 ][i] = src_phys_ptr[i] | - flag; - }else { -for (i =0 ; i < hwq->pbl[PBL_LVL_1 ].pg_count; - i++) - dst_virt_ptr[PTR_PG (i)][PTR_IDX (i)] = - src_phys_ptr[i] | -PTU_PDE_VALID ; - } +for (i =0 ; i < hwq->pbl[PBL_LVL_1 ].pg_count; i++) + dst_virt_ptr[0 ][i] = src_phys_ptr[i] | flag; +/* Alloc or init PTEs */ rc =__alloc_pbl (res, &hwq->pbl[PBL_LVL_2 ], hwq_attr->sginfo);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/80 drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Marek <[email protected]>
[ Upstream commit 358b762400bd94db2a14a72dfcef74c7da6bd845 ]
When (mode->clock * 1000) is larger than (1<<31), int to unsigned long conversion will sign extend the int to 64 bits and the pclk_rate value will be incorrect.
Fix this by making the result of the multiplication unsigned.
Note that above (1<<32) would still be broken and require more changes, but its unlikely anyone will need that anytime soon.
Patchwork: https://patchwork.freedesktop.org/patch/618434/
--- drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/dsi/dsi_host.c +1 -1
@@ -678,7 +678,7 @@ static unsigned long dsi_get_pclk_rate(struct msm_dsi_host *msm_host, bool is_bostruct drm_display_mode *mode = msm_host->mode;unsigned long pclk_rate; - pclk_rate = mode->clock *1000 ; + pclk_rate = mode->clock *1000u ;/* * For bonded DSI mode, the current DRM mode has the complete width of the
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/80 drm/msm: Avoid NULL dereference in msm_disp_state_print_regs()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 293f53263266bc4340d777268ab4328a97f041fa ]
If the allocation in msm_disp_state_dump_regs() failed then block->state can be NULL. The msm_disp_state_print_regs() function _does_ have code to try to handle it with:
if (*reg)
dump_addr = *reg;...but since "dump_addr" is initialized to NULL the above is actually a noop. The code then goes on to dereference dump_addr.
Make the function print "Registers not stored" when it sees a NULL to solve this. Since we're touching the code, fix msm_disp_state_print_regs() not to pointlessly take a double-pointer and properly mark the pointer as const.
Patchwork: https://patchwork.freedesktop.org/patch/619657/
--- drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c +8 -7
@@ -46,20 +46,21 @@ static void msm_disp_state_dump_regs(u32 **reg, u32 aligned_len, void __iomem *b } } -static void msm_disp_state_print_regs (u32 **reg,u32 len,void __iomem *base_addr, -struct drm_printer *p) +static void msm_disp_state_print_regs (const u32 *dump_addr,u32 len, +void __iomem *base_addr,struct drm_printer *p) {int i; -u32 *dump_addr =NULL ;void __iomem *addr;u32 num_rows; +if (!dump_addr) { +drm_printf (p,"Registers not stored\n" ); +return ; + } + addr = base_addr; num_rows = len /REG_DUMP_ALIGN ; -if (*reg) - dump_addr = *reg; -for (i =0 ; i < num_rows; i++) { drm_printf(p, "0x%lx : %08x %08x %08x %08x\n", (unsigned long)(addr - base_addr),
@@ -86,7 +87,7 @@ void msm_disp_state_print(struct msm_disp_state *state, struct drm_printer *p)list_for_each_entry_safe (block, tmp, &state->blocks, node) {drm_printf (p,"====================%s================\n" , block->name); -msm_disp_state_print_regs (&block->state, block->size, block->base_addr, p); +msm_disp_state_print_regs (block->state, block->size, block->base_addr, p); }drm_printf (p,"===================dpu drm state================\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/80 drm/msm: Allocate memory for disp snapshot with kvzalloc()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit e4a45582db1b792c57bdb52c45958264f7fcfbdc ]
With the "drm/msm: add a display mmu fault handler" series [1] we saw issues in the field where memory allocation was failing when allocating space for registers in msm_disp_state_dump_regs(). Specifically we were seeing an order 5 allocation fail. It's not surprising that order 5 allocations will sometimes fail after the system has been up and running for a while.
There's no need here for contiguous memory. Change the allocation to kvzalloc() which should make it much less likely to fail.
[1] https://lore.kernel.org/r/[email protected]/
Patchwork: https://patchwork.freedesktop.org/patch/619658/
--- drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c +2 -2
@@ -24,7 +24,7 @@ static void msm_disp_state_dump_regs(u32 **reg, u32 aligned_len, void __iomem *b end_addr = base_addr + aligned_len;if (!(*reg)) - *reg =kzalloc (len_padded,GFP_KERNEL ); + *reg =kvzalloc (len_padded,GFP_KERNEL );if (*reg) dump_addr = *reg;
@@ -155,7 +155,7 @@ void msm_disp_state_free(void *data)list_for_each_entry_safe (block, tmp, &disp_state->blocks, node) {list_del (&block->node); -kfree (block->state); +kvfree (block->state);kfree (block); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/80 net: usb: usbnet: fix race in probe failure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit b62f4c186c70aa235fef2da68d07325d85ca3ade ]
The same bug as in the disconnect code path also exists in the case of a failure late during the probe process. The flag must also be set.
--- drivers/net/usb/usbnet.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/usbnet.c +1 -0
@@ -1872,6 +1872,7 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)* may trigger an error resubmitting itself and, worse, * schedule a timer. So we kill it all just in case. */ +usbnet_mark_going_away (dev);cancel_work_sync (&dev->kevent);del_timer_sync (&dev->delay);free_percpu (net->tstats);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/80 octeontx2-af: Fix potential integer overflows on integer shifts
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit 637c4f6fe40befa04f19c38b5d15429cbb9191d9 ]
The left shift int 32 bit integer constants 1 is evaluated using 32 bit arithmetic and then assigned to a 64 bit unsigned integer. In the case where the shift is 32 or more this can lead to an overflow. Avoid this by shifting using the BIT_ULL macro instead.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +2 -2
@@ -2239,7 +2239,7 @@ static int nix_smq_flush(struct rvu *rvu, int blkaddr, NIX_AF_TL3_TL2X_LINKX_CFG(tl2_tl3_link_schq, link));if (!(cfg &BIT_ULL (12 )))continue ; - bmap |= (1 << i); + bmap |=BIT_ULL (i); cfg &= ~BIT_ULL (12 );rvu_write64 (rvu, blkaddr,NIX_AF_TL3_TL2X_LINKX_CFG (tl2_tl3_link_schq, link), cfg);
@@ -2260,7 +2260,7 @@ static int nix_smq_flush(struct rvu *rvu, int blkaddr,/* Set NIX_AF_TL3_TL2_LINKX_CFG[ENA] for the TL3/TL2 queue */ for (i =0 ; i < (rvu->hw->cgx_links + rvu->hw->lbk_links); i++) { -if (!(bmap & (1 << i))) +if (!(bmap &BIT_ULL (i)))continue ; cfg =rvu_read64 (rvu, blkaddr,NIX_AF_TL3_TL2X_LINKX_CFG (tl2_tl3_link_schq, link));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/80 macsec: dont increment counters for an unrelated SA
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit cf58aefb1332db322060cad4a330d5f9292b0f41 ]
On RX, we shouldn't be incrementing the stats for an arbitrary SA in case the actual SA hasn't been set up. Those counters are intended to track packets for their respective AN when the SA isn't currently configured. Due to the way MACsec is implemented, we don't keep counters unless the SA is configured, so we can't track those packets, and those counters will remain at 0.
The RXSC's stats keeps track of those packets without telling us which AN they belonged to. We could add counters for non-existent SAs, and then find a way to integrate them in the dump to userspace, but I don't think it's worth the effort.
--- drivers/net/macsec.c | 18 ------------------ 1 file changed, 18 deletions(-)
drivers/net/macsec.c +0 -18
@@ -160,19 +160,6 @@ static struct macsec_rx_sa *macsec_rxsa_get(struct macsec_rx_sa __rcu *ptr)return sa; } -static struct macsec_rx_sa *macsec_active_rxsa_get (struct macsec_rx_sc *rx_sc) -{ -struct macsec_rx_sa *sa =NULL ; -int an; - -for (an =0 ; an <MACSEC_NUM_AN ; an++) { - sa =macsec_rxsa_get (rx_sc->sa[an]); -if (sa) -break ; - } -return sa; -} -static void free_rx_sc_rcu (struct rcu_head *head) { struct macsec_rx_sc *rx_sc = container_of(head, struct macsec_rx_sc, rcu_head);
@@ -1192,15 +1179,12 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)/* If validateFrames is Strict or the C bit in the * SecTAG is set, discard */ -struct macsec_rx_sa *active_rx_sa =macsec_active_rxsa_get (rx_sc);if (hdr->tci_an &MACSEC_TCI_C || secy->validate_frames ==MACSEC_VALIDATE_STRICT ) {u64_stats_update_begin (&rxsc_stats->syncp); rxsc_stats->stats.InPktsNotUsingSA++;u64_stats_update_end (&rxsc_stats->syncp);DEV_STATS_INC (secy->netdev, rx_errors); -if (active_rx_sa) -this_cpu_inc (active_rx_sa->stats->InPktsNotUsingSA); goto drop_nosa; }
@@ -1210,8 +1194,6 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)u64_stats_update_begin (&rxsc_stats->syncp); rxsc_stats->stats.InPktsUnusedSA++;u64_stats_update_end (&rxsc_stats->syncp); -if (active_rx_sa) -this_cpu_inc (active_rx_sa->stats->InPktsUnusedSA); goto deliver; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/80 net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Hai <[email protected]>
[ Upstream commit cf57b5d7a2aad456719152ecd12007fe031628a3 ]
The greth_start_xmit_gbit() returns NETDEV_TX_OK without freeing skb in case of skb->len being too long, add dev_kfree_skb() to fix it.
--- drivers/net/ethernet/aeroflex/greth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/aeroflex/greth.c +2 -1
@@ -484,7 +484,7 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev)if (unlikely (skb->len >MAX_FRAME_SIZE )) { dev->stats.tx_errors++; - goto out; + goto len_error; }/* Save skb pointer. */
@@ -575,6 +575,7 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev) map_error:if (net_ratelimit ())dev_warn (greth->dev,"Could not create TX DMA mapping\n" ); +len_error:dev_kfree_skb (skb); out:return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/80 net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <[email protected]>
[ Upstream commit 82ac39ebd6db0c9f7a97a934bda1e3e101a9d201 ]
pnetid of pi (not newly allocated pe) should be compared
--- net/smc/smc_pnet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/smc/smc_pnet.c +1 -1
@@ -743,7 +743,7 @@ static int smc_pnet_add_pnetid(struct net *net, u8 *pnetid)write_lock (&sn->pnetids_ndev.lock);list_for_each_entry (pi, &sn->pnetids_ndev.list, list) { -if (smc_pnet_match (pnetid, pe->pnetid)) { +if (smc_pnet_match (pnetid, pi->pnetid)) {refcount_inc (&pi->refcnt);kfree (pe); goto unlock;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/80 net: xilinx: axienet: fix potential memory leak in axienet_start_xmit()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Hai <[email protected]>
[ Upstream commit 99714e37e8333bbc22496fe80f241d5b35380e83 ]
The axienet_start_xmit() returns NETDEV_TX_OK without freeing skb in case of dma_map_single() fails, add dev_kfree_skb_any() to fix it.
--- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/xilinx/xilinx_axienet_main.c +2 -0
@@ -868,6 +868,7 @@ axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)if (net_ratelimit ())netdev_err (ndev,"TX DMA mapping error\n" ); ndev->stats.tx_dropped++; +dev_kfree_skb_any (skb);return NETDEV_TX_OK ; }desc_set_phys_addr (lp, phys, cur_p);
@@ -888,6 +889,7 @@ axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev) ndev->stats.tx_dropped++;axienet_free_tx_chain (lp, orig_tail_ptr, ii +1 , true,NULL ,0 ); +dev_kfree_skb_any (skb);return NETDEV_TX_OK ; }desc_set_phys_addr (lp, phys, cur_p);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/80 net: systemport: fix potential memory leak in bcm_sysport_xmit()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Hai <[email protected]>
[ Upstream commit c401ed1c709948e57945485088413e1bb5e94bd1 ]
The bcm_sysport_xmit() returns NETDEV_TX_OK without freeing skb in case of dma_map_single() fails, add dev_kfree_skb() to fix it.
--- drivers/net/ethernet/broadcom/bcmsysport.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/broadcom/bcmsysport.c +1 -0
@@ -1348,6 +1348,7 @@ static netdev_tx_t bcm_sysport_xmit(struct sk_buff *skb,netif_err (priv, tx_err, dev,"DMA map failed at %p (len=%d)\n" , skb->data, skb_len); ret =NETDEV_TX_OK ; +dev_kfree_skb_any (skb); goto out; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/80 tcp/dccp: Dont use timer_pending() in reqsk_queue_unlink().
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit e8c526f2bdf1845bedaf6a478816a3d06fa78b8f ]
Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler().
"""
We are seeing a use-after-free from a bpf prog attached to trace_tcp_retransmit_synack. The program passes the req->sk to the bpf_sk_storage_get_tracing kernel helper which does check for null before using it.
"""
The commit 83fccfc3940c ("inet: fix potential deadlock in reqsk_queue_unlink()") added timer_pending() in reqsk_queue_unlink() not to call del_timer_sync() from reqsk_timer_handler(), but it introduced a small race window.
Before the timer is called, expire_timers() calls detach_timer(timer, true) to clear timer->entry.pprev and marks it as not pending.
If reqsk_queue_unlink() checks timer_pending() just after expire_timers() calls detach_timer(), TCP will miss del_timer_sync(); the reqsk timer will continue running and send multiple SYN+ACKs until it expires.
The reported UAF could happen if req->sk is close()d earlier than the timer expiration, which is 63s by default.
The scenario would be
1. inet_csk_complete_hashdance() calls inet_csk_reqsk_queue_drop(), but del_timer_sync() is missed
2. reqsk timer is executed and scheduled again
3. req->sk is accept()ed and reqsk_put() decrements rsk_refcnt, but reqsk timer still has another one, and inet_csk_accept() does not clear req->sk for non-TFO sockets
4. sk is close()d
5. reqsk timer is executed again, and BPF touches req->sk
Let's not use timer_pending() by passing the caller context to __inet_csk_reqsk_queue_drop().
Note that reqsk timer is pinned, so the issue does not happen in most use cases. [1]
[0]
BUG: KFENCE: use-after-free read in bpf_sk_storage_get_tracing+0x2e/0x1b0
Use-after-free read at 0x00000000a891fb3a (in kfence-#1):
bpf_sk_storage_get_tracing+0x2e/0x1b0 bpf_prog_5ea3e95db6da0438_tcp_retransmit_synack+0x1d20/0x1dda bpf_trace_run2+0x4c/0xc0 tcp_rtx_synack+0xf9/0x100 reqsk_timer_handler+0xda/0x3d0 run_timer_softirq+0x292/0x8a0 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 intel_idle_irq+0x5a/0xa0 cpuidle_enter_state+0x94/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb
kfence-#1: 0x00000000a72cc7b6-0x00000000d97616d9, size=2376, cache=TCPv6
allocated by task 0 on cpu 9 at 260507.901592s:
sk_prot_alloc+0x35/0x140 sk_clone_lock+0x1f/0x3f0 inet_csk_clone_lock+0x15/0x160 tcp_create_openreq_child+0x1f/0x410 tcp_v6_syn_recv_sock+0x1da/0x700 tcp_check_req+0x1fb/0x510 tcp_v6_rcv+0x98b/0x1420 ipv6_list_rcv+0x2258/0x26e0 napi_complete_done+0x5b1/0x2990 mlx5e_napi_poll+0x2ae/0x8d0 net_rx_action+0x13e/0x590 irq_exit_rcu+0xf5/0x320 common_interrupt+0x80/0x90 asm_common_interrupt+0x22/0x40 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb
freed by task 0 on cpu 9 at 260507.927527s:
rcu_core_si+0x4ff/0xf10 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb
--- net/ipv4/inet_connection_sock.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
net/ipv4/inet_connection_sock.c +16 -5
@@ -791,21 +791,31 @@ static bool reqsk_queue_unlink(struct request_sock *req) found =__sk_nulls_del_node_init_rcu (req_to_sk (req));spin_unlock (lock); } -if (timer_pending (&req->rsk_timer) &&del_timer_sync (&req->rsk_timer)) -reqsk_put (req); +return found; } -bool inet_csk_reqsk_queue_drop (struct sock *sk,struct request_sock *req) +static bool __inet_csk_reqsk_queue_drop (struct sock *sk, +struct request_sock *req, +bool from_timer) {bool unlinked =reqsk_queue_unlink (req); +if (!from_timer &&timer_delete_sync (&req->rsk_timer)) +reqsk_put (req); +if (unlinked) {reqsk_queue_removed (&inet_csk (sk)->icsk_accept_queue, req);reqsk_put (req); } +return unlinked; } + +bool inet_csk_reqsk_queue_drop (struct sock *sk,struct request_sock *req) +{ +return __inet_csk_reqsk_queue_drop (sk, req, false); +}EXPORT_SYMBOL (inet_csk_reqsk_queue_drop);void inet_csk_reqsk_queue_drop_and_put (struct sock *sk,struct request_sock *req)
@@ -898,7 +908,7 @@ static void reqsk_timer_handler(struct timer_list *t)if (!inet_ehash_insert (req_to_sk (nreq),req_to_sk (oreq),NULL )) {/* delete timer */ -inet_csk_reqsk_queue_drop (sk_listener, nreq); +__inet_csk_reqsk_queue_drop (sk_listener, nreq, true); goto no_ownership; }
@@ -924,7 +934,8 @@ static void reqsk_timer_handler(struct timer_list *t) } drop: -inet_csk_reqsk_queue_drop_and_put (oreq->rsk_listener, oreq); +__inet_csk_reqsk_queue_drop (sk_listener, oreq, true); +reqsk_put (req); } static bool reqsk_queue_hash_req(struct request_sock *req,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/80 genetlink: hold RCU in genlmsg_mcast()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 56440d7ec28d60f8da3bfa09062b3368ff9b16db ]
While running net selftests with CONFIG_PROVE_RCU_LIST=y I saw one lockdep splat [1].
genlmsg_mcast() uses for_each_net_rcu(), and must therefore hold RCU.
Instead of letting all callers guard genlmsg_multicast_allns() with a rcu_read_lock()/rcu_read_unlock() pair, do it in genlmsg_mcast().
This also means the @flags parameter is useless, we need to always use GFP_ATOMIC.
[1]
[10882.424136] ============================= [10882.424166] WARNING: suspicious RCU usage [10882.424309] 6.12.0-rc2-virtme #1156 Not tainted [10882.424400] ----------------------------- [10882.424423] net/netlink/genetlink.c:1940 RCU-list traversed in non-reader section!! [10882.424469]
other info that might help us debug this:
[10882.424500]
rcu_scheduler_active = 2, debug_locks = 1
[10882.424744] 2 locks held by ip/15677:
[10882.424791] #0: ffffffffb6b491b0 (cb_lock){++++}-{3:3}, at: genl_rcv (net/netlink/genetlink.c:1219)
[10882.426334] #1: ffffffffb6b49248 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg (net/netlink/genetlink.c:61 net/netlink/genetlink.c:57 net/netlink/genetlink.c:1209)
[10882.426465]
stack backtrace:
[10882.426805] CPU: 14 UID: 0 PID: 15677 Comm: ip Not tainted 6.12.0-rc2-virtme #1156
[10882.426919] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[10882.427046] Call Trace:
[10882.427131] <TASK>
[10882.427244] dump_stack_lvl (lib/dump_stack.c:123)
[10882.427335] lockdep_rcu_suspicious (kernel/locking/lockdep.c:6822)
[10882.427387] genlmsg_multicast_allns (net/netlink/genetlink.c:1940 (discriminator 7) net/netlink/genetlink.c:1977 (discriminator 7))
[10882.427436] l2tp_tunnel_notify.constprop.0 (net/l2tp/l2tp_netlink.c:119) l2tp_netlink
[10882.427683] l2tp_nl_cmd_tunnel_create (net/l2tp/l2tp_netlink.c:253) l2tp_netlink
[10882.427748] genl_family_rcv_msg_doit (net/netlink/genetlink.c:1115)
[10882.427834] genl_rcv_msg (net/netlink/genetlink.c:1195 net/netlink/genetlink.c:1210)
[10882.427877] ? __pfx_l2tp_nl_cmd_tunnel_create (net/l2tp/l2tp_netlink.c:186) l2tp_netlink
[10882.427927] ? __pfx_genl_rcv_msg (net/netlink/genetlink.c:1201)
[10882.427959] netlink_rcv_skb (net/netlink/af_netlink.c:2551)
[10882.428069] genl_rcv (net/netlink/genetlink.c:1220)
[10882.428095] netlink_unicast (net/netlink/af_netlink.c:1332 net/netlink/af_netlink.c:1357)
[10882.428140] netlink_sendmsg (net/netlink/af_netlink.c:1901)
[10882.428210] ____sys_sendmsg (net/socket.c:729 (discriminator 1) net/socket.c:744 (discriminator 1) net/socket.c:2607 (discriminator 1))--- drivers/target/target_core_user.c | 2 +- include/net/genetlink.h | 3 +-- net/l2tp/l2tp_netlink.c | 4 ++-- net/netlink/genetlink.c | 28 ++++++++++++++-------------- net/wireless/nl80211.c | 8 ++------ 5 files changed, 20 insertions(+), 25 deletions(-)
drivers/target/target_core_user.c +1 -1
@@ -2129,7 +2129,7 @@ static int tcmu_netlink_event_send(struct tcmu_dev *udev, } ret =genlmsg_multicast_allns (&tcmu_genl_family, skb,0 , -TCMU_MCGRP_CONFIG ,GFP_KERNEL ); +TCMU_MCGRP_CONFIG );/* Wait during an add as the listener may not be up yet */ if (ret == 0 ||
include/net/genetlink.h +1 -2
@@ -336,13 +336,12 @@ static inline int genlmsg_multicast(const struct genl_family *family,* @skb: netlink message as socket buffer * @portid: own netlink portid to avoid sending to yourself * @group: offset of multicast group in groups array -* @flags: allocation flags * * This function must hold the RTNL or rcu_read_lock(). */ int genlmsg_multicast_allns (const struct genl_family *family,struct sk_buff *skb,u32 portid, -unsigned int group,gfp_t flags); +unsigned int group);/** * genlmsg_unicast - unicast a netlink message
net/l2tp/l2tp_netlink.c +2 -2
@@ -115,7 +115,7 @@ static int l2tp_tunnel_notify(struct genl_family *family, NLM_F_ACK, tunnel, cmd);if (ret >=0 ) { - ret =genlmsg_multicast_allns (family, msg,0 ,0 ,GFP_ATOMIC ); + ret =genlmsg_multicast_allns (family, msg,0 ,0 );/* We don't care if no one is listening */ if (ret == -ESRCH ) ret =0 ;
@@ -143,7 +143,7 @@ static int l2tp_session_notify(struct genl_family *family, NLM_F_ACK, session, cmd);if (ret >=0 ) { - ret =genlmsg_multicast_allns (family, msg,0 ,0 ,GFP_ATOMIC ); + ret =genlmsg_multicast_allns (family, msg,0 ,0 );/* We don't care if no one is listening */ if (ret == -ESRCH ) ret =0 ;
net/netlink/genetlink.c +14 -14
@@ -1089,15 +1089,11 @@ static int genl_ctrl_event(int event, const struct genl_family *family,if (IS_ERR (msg))return PTR_ERR (msg); -if (!family->netnsok) { +if (!family->netnsok)genlmsg_multicast_netns (&genl_ctrl, &init_net, msg,0 ,0 ,GFP_KERNEL ); - }else { -rcu_read_lock (); -genlmsg_multicast_allns (&genl_ctrl, msg,0 , -0 ,GFP_ATOMIC ); -rcu_read_unlock (); - } +else +genlmsg_multicast_allns (&genl_ctrl, msg,0 ,0 );return 0 ; }
@@ -1441,23 +1437,23 @@ static int __init genl_init(void)core_initcall (genl_init); -static int genlmsg_mcast (struct sk_buff *skb,u32 portid,unsigned long group, -gfp_t flags) +static int genlmsg_mcast (struct sk_buff *skb,u32 portid,unsigned long group) {struct sk_buff *tmp;struct net *net, *prev =NULL ;bool delivered = false;int err; +rcu_read_lock ();for_each_net_rcu (net) {if (prev) { - tmp =skb_clone (skb, flags); + tmp =skb_clone (skb,GFP_ATOMIC );if (!tmp) { err = -ENOMEM ; goto error; } err =nlmsg_multicast (prev->genl_sock, tmp, - portid, group, flags); + portid, group,GFP_ATOMIC );if (!err) delivered = true;else if (err != -ESRCH )
@@ -1466,27 +1462,31 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group, prev = net; } + err =nlmsg_multicast (prev->genl_sock, skb, portid, group,GFP_ATOMIC ); + +rcu_read_unlock (); - err =nlmsg_multicast (prev->genl_sock, skb, portid, group, flags);if (!err) delivered = true;else if (err != -ESRCH )return err;return delivered ?0 : -ESRCH ; error: +rcu_read_unlock (); +kfree_skb (skb);return err; }int genlmsg_multicast_allns (const struct genl_family *family,struct sk_buff *skb,u32 portid, -unsigned int group,gfp_t flags) +unsigned int group) {if (WARN_ON_ONCE (group >= family->n_mcgrps))return -EINVAL ; group = family->mcgrp_offset + group; -return genlmsg_mcast (skb, portid, group, flags); +return genlmsg_mcast (skb, portid, group); }EXPORT_SYMBOL (genlmsg_multicast_allns);
net/wireless/nl80211.c +2 -6
@@ -16262,10 +16262,8 @@ void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,genlmsg_end (msg, hdr); -rcu_read_lock ();genlmsg_multicast_allns (&nl80211_fam, msg,0 , -NL80211_MCGRP_REGULATORY ,GFP_ATOMIC ); -rcu_read_unlock (); +NL80211_MCGRP_REGULATORY );return ;
@@ -16779,10 +16777,8 @@ void nl80211_send_beacon_hint_event(struct wiphy *wiphy,genlmsg_end (msg, hdr); -rcu_read_lock ();genlmsg_multicast_allns (&nl80211_fam, msg,0 , -NL80211_MCGRP_REGULATORY ,GFP_ATOMIC ); -rcu_read_unlock (); +NL80211_MCGRP_REGULATORY );return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/80 scsi: target: core: Fix null-ptr-deref in target_alloc_device()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Hai <[email protected]>
[ Upstream commit fca6caeb4a61d240f031914413fcc69534f6dc03 ]
There is a null-ptr-deref issue reported by KASAN:
BUG: KASAN: null-ptr-deref in target_alloc_device+0xbc4/0xbe0 [target_core_mod] ... kasan_report+0xb9/0xf0 target_alloc_device+0xbc4/0xbe0 [target_core_mod] core_dev_setup_virtual_lun0+0xef/0x1f0 [target_core_mod] target_core_init_configfs+0x205/0x420 [target_core_mod] do_one_initcall+0xdd/0x4e0
...
entry_SYSCALL_64_after_hwframe+0x76/0x7e
In target_alloc_device(), if allocing memory for dev queues fails, then dev will be freed by dev->transport->free_device(), but dev->transport is not initialized at that time, which will lead to a null pointer reference problem.
Fixing this bug by freeing dev with hba->backend->ops->free_device().
--- drivers/target/target_core_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/target/target_core_device.c +1 -1
@@ -724,7 +724,7 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name) dev->queues =kcalloc (nr_cpu_ids,sizeof (*dev->queues),GFP_KERNEL );if (!dev->queues) { - dev->transport->free_device (dev); + hba->backend->ops->free_device (dev);return NULL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/80 smb: client: fix OOBs when building SMB2_IOCTL request
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit 1ab60323c5201bef25f2a3dc0ccc404d9aca77f1 ]
When using encryption, either enforced by the server or when using 'seal' mount option, the client will squash all compound request buffers down for encryption into a single iov in smb2_set_next_command().
SMB2_ioctl_init() allocates a small buffer (448 bytes) to hold the SMB2_IOCTL request in the first iov, and if the user passes an input buffer that is greater than 328 bytes, smb2_set_next_command() will end up writing off the end of @rqst->iov[0].iov_base as shown below:
mount.cifs //srv/share /mnt -o ...,seal
ln -s $(perl -e "print('a')for 1..1024") /mnt/linkBUG: KASAN: slab-out-of-bounds in smb2_set_next_command.cold+0x1d6/0x24c [cifs] Write of size 4116 at addr ffff8881148fcab8 by task ln/859 CPU: 1 UID: 0 PID: 859 Comm: ln Not tainted 6.12.0-rc3 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 ? smb2_set_next_command.cold+0x1d6/0x24c [cifs] print_report+0x156/0x4d9 ? smb2_set_next_command.cold+0x1d6/0x24c [cifs] ? __virt_addr_valid+0x145/0x310 ? __phys_addr+0x46/0x90 ? smb2_set_next_command.cold+0x1d6/0x24c [cifs] kasan_report+0xda/0x110 ? smb2_set_next_command.cold+0x1d6/0x24c [cifs] kasan_check_range+0x10f/0x1f0 __asan_memcpy+0x3c/0x60 smb2_set_next_command.cold+0x1d6/0x24c [cifs] smb2_compound_op+0x238c/0x3840 [cifs] ? kasan_save_track+0x14/0x30 ? kasan_save_free_info+0x3b/0x70 ? vfs_symlink+0x1a1/0x2c0 ? do_symlinkat+0x108/0x1c0 ? __pfx_smb2_compound_op+0x10/0x10 [cifs] ? kmem_cache_free+0x118/0x3e0 ? cifs_get_writable_path+0xeb/0x1a0 [cifs] smb2_get_reparse_inode+0x423/0x540 [cifs] ? __pfx_smb2_get_reparse_inode+0x10/0x10 [cifs] ? rcu_is_watching+0x20/0x50 ? __kmalloc_noprof+0x37c/0x480 ? smb2_create_reparse_symlink+0x257/0x490 [cifs] ? smb2_create_reparse_symlink+0x38f/0x490 [cifs] smb2_create_reparse_symlink+0x38f/0x490 [cifs] ? __pfx_smb2_create_reparse_symlink+0x10/0x10 [cifs] ? find_held_lock+0x8a/0xa0 ? hlock_class+0x32/0xb0 ? __build_path_from_dentry_optional_prefix+0x19d/0x2e0 [cifs] cifs_symlink+0x24f/0x960 [cifs] ? __pfx_make_vfsuid+0x10/0x10 ? __pfx_cifs_symlink+0x10/0x10 [cifs] ? make_vfsgid+0x6b/0xc0 ? generic_permission+0x96/0x2d0 vfs_symlink+0x1a1/0x2c0 do_symlinkat+0x108/0x1c0 ? __pfx_do_symlinkat+0x10/0x10 ? strncpy_from_user+0xaa/0x160 __x64_sys_symlinkat+0xb9/0xf0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f08d75c13bb
--- fs/cifs/smb2pdu.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/cifs/smb2pdu.c +9 -0
@@ -3028,6 +3028,15 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,return rc;if (indatalen) { +unsigned int len; + +if (WARN_ON_ONCE (smb3_encryption_required (tcon) && + (check_add_overflow (total_len -1 , +ALIGN (indatalen,8 ), &len) || + len >MAX_CIFS_SMALL_BUFFER_SIZE ))) { +cifs_small_buf_release (req); +return -EIO ; + }/* * indatalen is usually small at a couple of bytes max, so * just allocate through generic pool
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/80 usb: typec: altmode should keep reference to parent
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
[ Upstream commit befab3a278c59db0cc88c8799638064f6d3fd6f8 ]
The altmode device release refers to its parent device, but without keeping a reference to it.
When registering the altmode, get a reference to the parent and put it in the release function.
Before this fix, when using CONFIG_DEBUG_KOBJECT_RELEASE, we see issues like this:
[ 43.572860] kobject: 'port0.0' (ffff8880057ba008): kobject_release, parent 0000000000000000 (delayed 3000) [ 43.573532] kobject: 'port0.1' (ffff8880057bd008): kobject_release, parent 0000000000000000 (delayed 1000) [ 43.574407] kobject: 'port0' (ffff8880057b9008): kobject_release, parent 0000000000000000 (delayed 3000) [ 43.575059] kobject: 'port1.0' (ffff8880057ca008): kobject_release, parent 0000000000000000 (delayed 4000) [ 43.575908] kobject: 'port1.1' (ffff8880057c9008): kobject_release, parent 0000000000000000 (delayed 4000) [ 43.576908] kobject: 'typec' (ffff8880062dbc00): kobject_release, parent 0000000000000000 (delayed 4000) [ 43.577769] kobject: 'port1' (ffff8880057bf008): kobject_release, parent 0000000000000000 (delayed 3000) [ 46.612867] ================================================================== [ 46.613402] BUG: KASAN: slab-use-after-free in typec_altmode_release+0x38/0x129 [ 46.614003] Read of size 8 at addr ffff8880057b9118 by task kworker/2:1/48 [ 46.614538] [ 46.614668] CPU: 2 UID: 0 PID: 48 Comm: kworker/2:1 Not tainted 6.12.0-rc1-00138-gedbae730ad31 #535 [ 46.615391] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 46.616042] Workqueue: events kobject_delayed_cleanup [ 46.616446] Call Trace: [ 46.616648] <TASK> [ 46.616820] dump_stack_lvl+0x5b/0x7c [ 46.617112] ? typec_altmode_release+0x38/0x129 [ 46.617470] print_report+0x14c/0x49e [ 46.617769] ? rcu_read_unlock_sched+0x56/0x69 [ 46.618117] ? __virt_addr_valid+0x19a/0x1ab [ 46.618456] ? kmem_cache_debug_flags+0xc/0x1d [ 46.618807] ? typec_altmode_release+0x38/0x129 [ 46.619161] kasan_report+0x8d/0xb4 [ 46.619447] ? typec_altmode_release+0x38/0x129 [ 46.619809] ? process_scheduled_works+0x3cb/0x85f [ 46.620185] typec_altmode_release+0x38/0x129 [ 46.620537] ? process_scheduled_works+0x3cb/0x85f [ 46.620907] device_release+0xaf/0xf2 [ 46.621206] kobject_delayed_cleanup+0x13b/0x17a [ 46.621584] process_scheduled_works+0x4f6/0x85f [ 46.621955] ? __pfx_process_scheduled_works+0x10/0x10 [ 46.622353] ? hlock_class+0x31/0x9a [ 46.622647] ? lock_acquired+0x361/0x3c3 [ 46.622956] ? move_linked_works+0x46/0x7d [ 46.623277] worker_thread+0x1ce/0x291 [ 46.623582] ? __kthread_parkme+0xc8/0xdf [ 46.623900] ? __pfx_worker_thread+0x10/0x10 [ 46.624236] kthread+0x17e/0x190 [ 46.624501] ? kthread+0xfb/0x190 [ 46.624756] ? __pfx_kthread+0x10/0x10 [ 46.625015] ret_from_fork+0x20/0x40 [ 46.625268] ? __pfx_kthread+0x10/0x10 [ 46.625532] ret_from_fork_asm+0x1a/0x30 [ 46.625805] </TASK> [ 46.625953] [ 46.626056] Allocated by task 678: [ 46.626287] kasan_save_stack+0x24/0x44 [ 46.626555] kasan_save_track+0x14/0x2d [ 46.626811] __kasan_kmalloc+0x3f/0x4d [ 46.627049] __kmalloc_noprof+0x1bf/0x1f0 [ 46.627362] typec_register_port+0x23/0x491 [ 46.627698] cros_typec_probe+0x634/0xbb6 [ 46.628026] platform_probe+0x47/0x8c [ 46.628311] really_probe+0x20a/0x47d [ 46.628605] device_driver_attach+0x39/0x72 [ 46.628940] bind_store+0x87/0xd7 [ 46.629213] kernfs_fop_write_iter+0x1aa/0x218 [ 46.629574] vfs_write+0x1d6/0x29b [ 46.629856] ksys_write+0xcd/0x13b [ 46.630128] do_syscall_64+0xd4/0x139 [ 46.630420] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 46.630820] [ 46.630946] Freed by task 48: [ 46.631182] kasan_save_stack+0x24/0x44 [ 46.631493] kasan_save_track+0x14/0x2d [ 46.631799] kasan_save_free_info+0x3f/0x4d [ 46.632144] __kasan_slab_free+0x37/0x45 [ 46.632474] kfree+0x1d4/0x252 [ 46.632725] device_release+0xaf/0xf2 [ 46.633017] kobject_delayed_cleanup+0x13b/0x17a [ 46.633388] process_scheduled_works+0x4f6/0x85f [ 46.633764] worker_thread+0x1ce/0x291 [ 46.634065] kthread+0x17e/0x190 [ 46.634324] ret_from_fork+0x20/0x40 [ 46.634621] ret_from_fork_asm+0x1a/0x30
--- drivers/usb/typec/class.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/typec/class.c +3 -0
@@ -501,6 +501,7 @@ static void typec_altmode_release(struct device *dev)typec_altmode_put_partner (alt);altmode_id_remove (alt->adev.dev.parent, alt->id); +put_device (alt->adev.dev.parent);kfree (alt); }
@@ -550,6 +551,8 @@ typec_register_altmode(struct device *parent, alt->adev.dev.type = &typec_altmode_dev_type;dev_set_name (&alt->adev.dev,"%s.%u" ,dev_name (parent), id); +get_device (alt->adev.dev.parent); +/* Link partners and plugs with the ports */ if (!is_port)typec_altmode_set_partner (alt);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/80 s390: Initialize psw mask in perf_arch_fetch_caller_regs()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 223e7fb979fa06934f1595b6ad0ae1d4ead1147f ]
Also initialize regs->psw.mask in perf_arch_fetch_caller_regs(). This way user_mode(regs) will return false, like it should.
It looks like all current users initialize regs to zero, so that this doesn't fix a bug currently. However it is better to not rely on callers to do this.
--- arch/s390/include/asm/perf_event.h | 1 + 1 file changed, 1 insertion(+)
arch/s390/include/asm/perf_event.h +1 -0
@@ -75,6 +75,7 @@ struct perf_sf_sde_regs {#define SAMPLE_FREQ_MODE (hwc) (SAMPL_FLAGS(hwc) & PERF_CPUM_SF_FREQ_MODE)#define perf_arch_fetch_caller_regs (regs, __ip) do { \ + (regs)->psw.mask = 0; \ (regs)->psw.addr = (__ip); \ (regs)->gprs[15] = (unsigned long)__builtin_frame_address(0) - \ offsetof(struct stack_frame, back_chain); \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/80 Bluetooth: bnep: fix wild-memory-access in proto_unregister
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
[ Upstream commit 64a90991ba8d4e32e3173ddd83d0b24167a5668c ]
There's issue as follows:
KASAN: maybe wild-memory-access in range [0xdead...108-0xdead...10f] CPU: 3 UID: 0 PID: 2805 Comm: rmmod Tainted: G W RIP: 0010:proto_unregister+0xee/0x400 Call Trace: <TASK> __do_sys_delete_module+0x318/0x580 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
As bnep_init() ignore bnep_sock_init()'s return value, and bnep_sock_init() will cleanup all resource. Then when remove bnep module will call bnep_sock_cleanup() to cleanup sock's resource.
To solve above issue just return bnep_sock_init()'s return value in bnep_exit().
--- net/bluetooth/bnep/core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/bluetooth/bnep/core.c +1 -2
@@ -745,8 +745,7 @@ static int __init bnep_init(void)if (flt[0 ])BT_INFO ("BNEP filters: %s" , flt); -bnep_sock_init (); -return 0 ; +return bnep_sock_init (); } static void __exit bnep_exit(void)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/80 arm64:uprobe fix the uprobe SWBP_INSN in big-endian
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: junhua huang <[email protected]>
[ Upstream commit 60f07e22a73d318cddaafa5ef41a10476807cc07 ]
We use uprobe in aarch64_be, which we found the tracee task would exit due to SIGILL when we enable the uprobe trace.
We can see the replace inst from uprobe is not correct in aarch big-endian. As in Armv8-A, instruction fetches are always treated as little-endian, we should treat the UPROBE_SWBP_INSN as little-endian。
The test case is as following。
bash-4.4# ./mqueue_test_aarchbe 1 1 2 1 10 > /dev/null & bash-4.4# cd /sys/kernel/debug/tracing/
bash-4.4# echo 'p:test /mqueue_test_aarchbe:0xc30 %x0 %x1' > uprobe_events bash-4.4# echo 1 > events/uprobes/enable
bash-4.4#
bash-4.4# ps
PID TTY TIME CMD
140 ? 00:00:01 bash
237 ? 00:00:00 ps
[1]+ Illegal instruction ./mqueue_test_aarchbe 1 1 2 1 100 > /dev/null
which we debug use gdb as following:
bash-4.4# gdb attach 155
(gdb) disassemble send
Dump of assembler code for function send:
0x0000000000400c30 <+0>: .inst 0xa00020d4 ; undefined 0x0000000000400c34 <+4>: mov x29, sp 0x0000000000400c38 <+8>: str w0, [sp, #28] 0x0000000000400c3c <+12>: strb w1, [sp, #27] 0x0000000000400c40 <+16>: str xzr, [sp, #40] 0x0000000000400c44 <+20>: str xzr, [sp, #48] 0x0000000000400c48 <+24>: add x0, sp, #0x1b 0x0000000000400c4c <+28>: mov w3, #0x0 // #0 0x0000000000400c50 <+32>: mov x2, #0x1 // #1 0x0000000000400c54 <+36>: mov x1, x0 0x0000000000400c58 <+40>: ldr w0, [sp, #28] 0x0000000000400c5c <+44>: bl 0x405e10 <mq_send> 0x0000000000400c60 <+48>: str w0, [sp, #60] 0x0000000000400c64 <+52>: ldr w0, [sp, #60] 0x0000000000400c68 <+56>: ldp x29, x30, [sp], #64 0x0000000000400c6c <+60>: ret
End of assembler dump.
(gdb) info b
No breakpoints or watchpoints.
(gdb) c
Continuing.
Program received signal SIGILL, Illegal instruction. 0x0000000000400c30 in send ()
(gdb) x/10x 0x400c30
0x400c30 <send>: 0xd42000a0 0xfd030091 0xe01f00b9 0xe16f0039 0x400c40 <send+16>: 0xff1700f9 0xff1b00f9 0xe06f0091 0x03008052 0x400c50 <send+32>: 0x220080d2 0xe10300aa (gdb) disassemble 0x400c30 Dump of assembler code for function send: => 0x0000000000400c30 <+0>: .inst 0xa00020d4 ; undefined 0x0000000000400c34 <+4>: mov x29, sp 0x0000000000400c38 <+8>: str w0, [sp, #28] 0x0000000000400c3c <+12>: strb w1, [sp, #27] 0x0000000000400c40 <+16>: str xzr, [sp, #40]
Stable-dep-of: 13f8f1e05f1d ("arm64: probes: Fix uprobes for big-endian kernels")
--- arch/arm64/include/asm/uprobes.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/include/asm/uprobes.h +1 -1
@@ -12,7 +12,7 @@#define MAX_UINSN_BYTES AARCH64_INSN_SIZE -#define UPROBE_SWBP_INSN BRK64_OPCODE_UPROBES +#define UPROBE_SWBP_INSN cpu_to_le32(BRK64_OPCODE_UPROBES)#define UPROBE_SWBP_INSN_SIZE AARCH64_INSN_SIZE#define UPROBE_XOL_SLOT_BYTES MAX_UINSN_BYTES
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/80 arm64: probes: Fix uprobes for big-endian kernels
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
[ Upstream commit 13f8f1e05f1dc36dbba6cba0ae03354c0dafcde7 ]
The arm64 uprobes code is broken for big-endian kernels as it doesn't convert the in-memory instruction encoding (which is always little-endian) into the kernel's native endianness before analyzing and simulating instructions. This may result in a few distinct problems:
* The kernel may may erroneously reject probing an instruction which can safely be probed.
* The kernel may erroneously erroneously permit stepping an instruction out-of-line when that instruction cannot be stepped out-of-line safely.
* The kernel may erroneously simulate instruction incorrectly dur to interpretting the byte-swapped encoding.
The endianness mismatch isn't caught by the compiler or sparse because:
* The arch_uprobe::{insn,ixol} fields are encoded as arrays of u8, so the compiler and sparse have no idea these contain a little-endian 32-bit value. The core uprobes code populates these with a memcpy() which similarly does not handle endianness.
* While the uprobe_opcode_t type is an alias for __le32, both arch_uprobe_analyze_insn() and arch_uprobe_skip_sstep() cast from u8[] to the similarly-named probe_opcode_t, which is an alias for u32. Hence there is no endianness conversion warning.
Fix this by changing the arch_uprobe::{insn,ixol} fields to __le32 and adding the appropriate __le32_to_cpu() conversions prior to consuming the instruction encoding. The core uprobes copies these fields as opaque ranges of bytes, and so is unaffected by this change.
At the same time, remove MAX_UINSN_BYTES and consistently use AARCH64_INSN_SIZE for clarity.
Tested with the following:
| #include <stdio.h>
| #include <stdbool.h>
|
| #define noinline __attribute__((noinline))
|
| static noinline void *adrp_self(void)
| {
| void *addr;
|
| asm volatile(
| " adrp %x0, adrp_self\n"
| " add %x0, %x0, :lo12:adrp_self\n"
| : "=r" (addr));
| }
|
|
| int main(int argc, char *argv)
| {
| void *ptr = adrp_self();
| bool equal = (ptr == adrp_self);
|
| printf("adrp_self => %p\n"
| "adrp_self() => %p\n"
| "%s\n",
| adrp_self, ptr, equal ? "EQUAL" : "NOT EQUAL");
|
| return 0;
| }.... where the adrp_self() function was compiled to:
| 00000000004007e0 <adrp_self>: | 4007e0: 90000000 adrp x0, 400000 <__ehdr_start> | 4007e4: 911f8000 add x0, x0, #0x7e0 | 4007e8: d65f03c0 ret
Before this patch, the ADRP is not recognized, and is assumed to be steppable, resulting in corruption of the result:
| # ./adrp-self | adrp_self => 0x4007e0 | adrp_self() => 0x4007e0 | EQUAL | # echo 'p /root/adrp-self:0x007e0' > /sys/kernel/tracing/uprobe_events | # echo 1 > /sys/kernel/tracing/events/uprobes/enable | # ./adrp-self | adrp_self => 0x4007e0 | adrp_self() => 0xffffffffff7e0 | NOT EQUAL
After this patch, the ADRP is correctly recognized and simulated:
| # ./adrp-self | adrp_self => 0x4007e0 | adrp_self() => 0x4007e0 | EQUAL | # | # echo 'p /root/adrp-self:0x007e0' > /sys/kernel/tracing/uprobe_events | # echo 1 > /sys/kernel/tracing/events/uprobes/enable | # ./adrp-self | adrp_self => 0x4007e0 | adrp_self() => 0x4007e0 | EQUAL
--- arch/arm64/include/asm/uprobes.h | 8 +++----- arch/arm64/kernel/probes/uprobes.c | 4 ++-- 2 files changed, 5 insertions(+), 7 deletions(-)
arch/arm64/include/asm/uprobes.h +3 -5
@@ -10,11 +10,9 @@#include <asm/insn.h> #include <asm/probes.h> -#define MAX_UINSN_BYTES AARCH64_INSN_SIZE -#define UPROBE_SWBP_INSN cpu_to_le32(BRK64_OPCODE_UPROBES)#define UPROBE_SWBP_INSN_SIZE AARCH64_INSN_SIZE -#define UPROBE_XOL_SLOT_BYTES MAX_UINSN_BYTES +#define UPROBE_XOL_SLOT_BYTES AARCH64_INSN_SIZEtypedef u32 uprobe_opcode_t ;
@@ -23,8 +21,8 @@ struct arch_uprobe_task {struct arch_uprobe {union { -u8 insn[MAX_UINSN_BYTES ]; -u8 ixol[MAX_UINSN_BYTES ]; +__le32 insn; +__le32 ixol; };struct arch_probe_insn api;bool simulate;
arch/arm64/kernel/probes/uprobes.c +2 -2
@@ -42,7 +42,7 @@ int arch_uprobe_analyze_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,else if (!IS_ALIGNED (addr,AARCH64_INSN_SIZE ))return -EINVAL ; - insn = *(probe_opcode_t *)(&auprobe->insn[0 ]); + insn =le32_to_cpu (auprobe->insn);switch (arm_probe_decode_insn (insn, &auprobe->api)) {case INSN_REJECTED :
@@ -108,7 +108,7 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)if (!auprobe->simulate)return false; - insn = *(probe_opcode_t *)(&auprobe->insn[0 ]); + insn =le32_to_cpu (auprobe->insn); addr =instruction_pointer (regs);if (auprobe->api.handler)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/80 KVM: s390: gaccess: Refactor gpa and length calculation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janis Schoetterl-Glausch <[email protected]>
[ Upstream commit 416e7f0c9d613bf84e182eba9547ae8f9f5bfa4c ]
Improve readability by renaming the length variable and not calculating the offset manually.
Message-Id: <[email protected]>
Stable-dep-of: e8061f06185b ("KVM: s390: gaccess: Check if guest address is in memslot")
--- arch/s390/kvm/gaccess.c | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-)
arch/s390/kvm/gaccess.c +17 -15
@@ -831,8 +831,9 @@ int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, void *data, unsigned long len, enum gacc_mode mode) {psw_t *psw = &vcpu->arch.sie_block->gpsw; -unsigned long _len, nr_pages, gpa, idx; +unsigned long nr_pages, gpa, idx;unsigned long pages_array[2 ]; +unsigned int fragment_len;unsigned long *pages;int need_ipte_lock;union asce asce;
@@ -855,15 +856,15 @@ int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, void *data,ipte_lock (vcpu); rc =guest_page_range (vcpu, ga, ar, pages, nr_pages, asce, mode);for (idx =0 ; idx < nr_pages && !rc; idx++) { - gpa = *(pages + idx) + (ga & ~PAGE_MASK ); - _len =min (PAGE_SIZE - (gpa & ~PAGE_MASK ), len); + gpa = pages[idx] +offset_in_page (ga); + fragment_len =min (PAGE_SIZE -offset_in_page (gpa), len);if (mode ==GACC_STORE ) - rc =kvm_write_guest (vcpu->kvm, gpa, data, _len); + rc =kvm_write_guest (vcpu->kvm, gpa, data, fragment_len);else - rc =kvm_read_guest (vcpu->kvm, gpa, data, _len); - len -= _len; - ga += _len; - data += _len; + rc =kvm_read_guest (vcpu->kvm, gpa, data, fragment_len); + len -= fragment_len; + ga += fragment_len; + data += fragment_len; }if (need_ipte_lock)ipte_unlock (vcpu);
@@ -875,19 +876,20 @@ int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, void *data,int access_guest_real (struct kvm_vcpu *vcpu,unsigned long gra,void *data,unsigned long len,enum gacc_mode mode) { -unsigned long _len, gpa; +unsigned int fragment_len; +unsigned long gpa;int rc =0 ;while (len && !rc) { gpa =kvm_s390_real_to_abs (vcpu, gra); - _len =min (PAGE_SIZE - (gpa & ~PAGE_MASK ), len); + fragment_len =min (PAGE_SIZE -offset_in_page (gpa), len);if (mode) - rc =write_guest_abs (vcpu, gpa, data, _len); + rc =write_guest_abs (vcpu, gpa, data, fragment_len);else - rc =read_guest_abs (vcpu, gpa, data, _len); - len -= _len; - gra += _len; - data += _len; + rc =read_guest_abs (vcpu, gpa, data, fragment_len); + len -= fragment_len; + gra += fragment_len; + data += fragment_len; }return rc; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/80 KVM: s390: gaccess: Refactor access address range check
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janis Schoetterl-Glausch <[email protected]>
[ Upstream commit 7faa543df19bf62d4583a64d3902705747f2ad29 ]
Do not round down the first address to the page boundary, just translate it normally, which gives the value we care about in the first place. Given this, translating a single address is just the special case of translating a range spanning a single page.
Make the output optional, so the function can be used to just check a range.
Message-Id: <[email protected]>
Stable-dep-of: e8061f06185b ("KVM: s390: gaccess: Check if guest address is in memslot")
--- arch/s390/kvm/gaccess.c | 122 +++++++++++++++++++++++----------------- 1 file changed, 69 insertions(+), 53 deletions(-)
arch/s390/kvm/gaccess.c +69 -53
@@ -794,35 +794,74 @@ static int low_address_protection_enabled(struct kvm_vcpu *vcpu,return 1 ; } -static int guest_page_range (struct kvm_vcpu *vcpu,unsigned long ga,u8 ar, -unsigned long *pages,unsigned long nr_pages, -const union asce asce,enum gacc_mode mode) +/** +* guest_range_to_gpas() - Calculate guest physical addresses of page fragments +* covering a logical range +* @vcpu: virtual cpu +* @ga: guest address, start of range +* @ar: access register +* @gpas: output argument, may be NULL +* @len: length of range in bytes +* @asce: address-space-control element to use for translation +* @mode: access mode +* +* Translate a logical range to a series of guest absolute addresses, +* such that the concatenation of page fragments starting at each gpa make up +* the whole range. +* The translation is performed as if done by the cpu for the given @asce, @ar, +* @mode and state of the @vcpu. +* If the translation causes an exception, its program interruption code is +* returned and the &struct kvm_s390_pgm_info pgm member of @vcpu is modified +* such that a subsequent call to kvm_s390_inject_prog_vcpu() will inject +* a correct exception into the guest. +* The resulting gpas are stored into @gpas, unless it is NULL. +* +* Note: All fragments except the first one start at the beginning of a page. +* When deriving the boundaries of a fragment from a gpa, all but the last +* fragment end at the end of the page. +* +* Return: +* * 0 - success +* * <0 - translation could not be performed, for example if guest +* memory could not be accessed +* * >0 - an access exception occurred. In this case the returned value +* is the program interruption code and the contents of pgm may +* be used to inject an exception into the guest. +*/ +static int guest_range_to_gpas (struct kvm_vcpu *vcpu,unsigned long ga,u8 ar, +unsigned long *gpas,unsigned long len, +const union asce asce,enum gacc_mode mode) {psw_t *psw = &vcpu->arch.sie_block->gpsw; +unsigned int offset =offset_in_page (ga); +unsigned int fragment_len;int lap_enabled, rc =0 ;enum prot_type prot; +unsigned long gpa; lap_enabled =low_address_protection_enabled (vcpu, asce); -while (nr_pages) { +while (min (PAGE_SIZE - offset, len) >0 ) { + fragment_len =min (PAGE_SIZE - offset, len); ga =kvm_s390_logical_to_effective (vcpu, ga);if (mode ==GACC_STORE && lap_enabled &&is_low_address (ga))return trans_exc (vcpu,PGM_PROTECTION , ga, ar, mode,PROT_TYPE_LA ); - ga &=PAGE_MASK ;if (psw_bits (*psw).dat) { - rc =guest_translate (vcpu, ga, pages, asce, mode, &prot); + rc =guest_translate (vcpu, ga, &gpa, asce, mode, &prot);if (rc <0 )return rc; }else { - *pages =kvm_s390_real_to_abs (vcpu, ga); -if (kvm_is_error_gpa (vcpu->kvm, *pages)) + gpa =kvm_s390_real_to_abs (vcpu, ga); +if (kvm_is_error_gpa (vcpu->kvm, gpa)) rc =PGM_ADDRESSING ; }if (rc)return trans_exc (vcpu, rc, ga, ar, mode, prot); - ga +=PAGE_SIZE ; - pages++; - nr_pages--; +if (gpas) + *gpas++ = gpa; + offset =0 ; + ga += fragment_len; + len -= fragment_len; }return 0 ; }
@@ -831,10 +870,10 @@ int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, void *data, unsigned long len, enum gacc_mode mode) {psw_t *psw = &vcpu->arch.sie_block->gpsw; -unsigned long nr_pages, gpa, idx; -unsigned long pages_array[2 ]; +unsigned long nr_pages, idx; +unsigned long gpa_array[2 ];unsigned int fragment_len; -unsigned long *pages; +unsigned long *gpas;int need_ipte_lock;union asce asce;int rc;
@@ -846,30 +885,28 @@ int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, void *data,if (rc)return rc; nr_pages = (((ga & ~PAGE_MASK ) + len -1 ) >>PAGE_SHIFT ) +1 ; - pages = pages_array; -if (nr_pages >ARRAY_SIZE (pages_array)) - pages =vmalloc (array_size (nr_pages,sizeof (unsigned long ))); -if (!pages) + gpas = gpa_array; +if (nr_pages >ARRAY_SIZE (gpa_array)) + gpas =vmalloc (array_size (nr_pages,sizeof (unsigned long ))); +if (!gpas)return -ENOMEM ; need_ipte_lock =psw_bits (*psw).dat && !asce.r;if (need_ipte_lock)ipte_lock (vcpu); - rc =guest_page_range (vcpu, ga, ar, pages, nr_pages, asce, mode); + rc =guest_range_to_gpas (vcpu, ga, ar, gpas, len, asce, mode);for (idx =0 ; idx < nr_pages && !rc; idx++) { - gpa = pages[idx] +offset_in_page (ga); - fragment_len =min (PAGE_SIZE -offset_in_page (gpa), len); + fragment_len =min (PAGE_SIZE -offset_in_page (gpas[idx]), len);if (mode ==GACC_STORE ) - rc =kvm_write_guest (vcpu->kvm, gpa, data, fragment_len); + rc =kvm_write_guest (vcpu->kvm, gpas[idx], data, fragment_len);else - rc =kvm_read_guest (vcpu->kvm, gpa, data, fragment_len); + rc =kvm_read_guest (vcpu->kvm, gpas[idx], data, fragment_len); len -= fragment_len; - ga += fragment_len; data += fragment_len; }if (need_ipte_lock)ipte_unlock (vcpu); -if (nr_pages >ARRAY_SIZE (pages_array)) -vfree (pages); +if (nr_pages >ARRAY_SIZE (gpa_array)) +vfree (gpas);return rc; }
@@ -911,8 +948,6 @@ int access_guest_real(struct kvm_vcpu *vcpu, unsigned long gra,int guest_translate_address (struct kvm_vcpu *vcpu,unsigned long gva,u8 ar,unsigned long *gpa,enum gacc_mode mode) { -psw_t *psw = &vcpu->arch.sie_block->gpsw; -enum prot_type prot;union asce asce;int rc;
@@ -920,23 +955,7 @@ int guest_translate_address(struct kvm_vcpu *vcpu, unsigned long gva, u8 ar, rc =get_vcpu_asce (vcpu, &asce, gva, ar, mode);if (rc)return rc; -if (is_low_address (gva) &&low_address_protection_enabled (vcpu, asce)) { -if (mode ==GACC_STORE ) -return trans_exc (vcpu,PGM_PROTECTION , gva,0 , - mode,PROT_TYPE_LA ); - } - -if (psw_bits (*psw).dat && !asce.r) {/* Use DAT? */ - rc =guest_translate (vcpu, gva, gpa, asce, mode, &prot); -if (rc >0 ) -return trans_exc (vcpu, rc, gva,0 , mode, prot); - }else { - *gpa =kvm_s390_real_to_abs (vcpu, gva); -if (kvm_is_error_gpa (vcpu->kvm, *gpa)) -return trans_exc (vcpu, rc, gva,PGM_ADDRESSING , mode,0 ); - } - -return rc; +return guest_range_to_gpas (vcpu, gva, ar, gpa,1 , asce, mode); }/**
@@ -950,17 +969,14 @@ int guest_translate_address(struct kvm_vcpu *vcpu, unsigned long gva, u8 ar,int check_gva_range (struct kvm_vcpu *vcpu,unsigned long gva,u8 ar,unsigned long length,enum gacc_mode mode) { -unsigned long gpa; -unsigned long currlen; +union asce asce;int rc =0 ; + rc =get_vcpu_asce (vcpu, &asce, gva, ar, mode); +if (rc) +return rc;ipte_lock (vcpu); -while (length >0 && !rc) { - currlen =min (length,PAGE_SIZE - (gva %PAGE_SIZE )); - rc =guest_translate_address (vcpu, gva, ar, &gpa, mode); - gva += currlen; - length -= currlen; - } + rc =guest_range_to_gpas (vcpu, gva, ar,NULL , length, asce, mode);ipte_unlock (vcpu);return rc;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/80 KVM: s390: gaccess: Cleanup access to guest pages
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janis Schoetterl-Glausch <[email protected]>
[ Upstream commit bad13799e0305deb258372b7298a86be4c78aaba ]
Introduce a helper function for guest frame access.
Message-Id: <[email protected]>
Stable-dep-of: e8061f06185b ("KVM: s390: gaccess: Check if guest address is in memslot")
--- arch/s390/kvm/gaccess.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-)
arch/s390/kvm/gaccess.c +16 -8
@@ -866,6 +866,20 @@ static int guest_range_to_gpas(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar,return 0 ; } +static int access_guest_page (struct kvm *kvm,enum gacc_mode mode,gpa_t gpa, +void *data,unsigned int len) +{ +const unsigned int offset =offset_in_page (gpa); +const gfn_t gfn =gpa_to_gfn (gpa); +int rc; + +if (mode ==GACC_STORE ) + rc =kvm_write_guest_page (kvm, gfn, data, offset, len); +else + rc =kvm_read_guest_page (kvm, gfn, data, offset, len); +return rc; +} +int access_guest (struct kvm_vcpu *vcpu,unsigned long ga,u8 ar,void *data,unsigned long len,enum gacc_mode mode) {
@@ -896,10 +910,7 @@ int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, void *data, rc =guest_range_to_gpas (vcpu, ga, ar, gpas, len, asce, mode);for (idx =0 ; idx < nr_pages && !rc; idx++) { fragment_len =min (PAGE_SIZE -offset_in_page (gpas[idx]), len); -if (mode ==GACC_STORE ) - rc =kvm_write_guest (vcpu->kvm, gpas[idx], data, fragment_len); -else - rc =kvm_read_guest (vcpu->kvm, gpas[idx], data, fragment_len); + rc =access_guest_page (vcpu->kvm, mode, gpas[idx], data, fragment_len); len -= fragment_len; data += fragment_len; }
@@ -920,10 +931,7 @@ int access_guest_real(struct kvm_vcpu *vcpu, unsigned long gra,while (len && !rc) { gpa =kvm_s390_real_to_abs (vcpu, gra); fragment_len =min (PAGE_SIZE -offset_in_page (gpa), len); -if (mode) - rc =write_guest_abs (vcpu, gpa, data, fragment_len); -else - rc =read_guest_abs (vcpu, gpa, data, fragment_len); + rc =access_guest_page (vcpu->kvm, mode, gpa, data, fragment_len); len -= fragment_len; gra += fragment_len; data += fragment_len;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/80 KVM: s390: gaccess: Check if guest address is in memslot
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nico Boehr <[email protected]>
[ Upstream commit e8061f06185be0a06a73760d6526b8b0feadfe52 ]
Previously, access_guest_page() did not check whether the given guest address is inside of a memslot. This is not a problem, since kvm_write_guest_page/kvm_read_guest_page return -EFAULT in this case.
However, -EFAULT is also returned when copy_to/from_user fails.
When emulating a guest instruction, the address being outside a memslot usually means that an addressing exception should be injected into the guest.
Failure in copy_to/from_user however indicates that something is wrong in userspace and hence should be handled there.
To be able to distinguish these two cases, return PGM_ADDRESSING in access_guest_page() when the guest address is outside guest memory. In access_guest_real(), populate vcpu->arch.pgm.code such that kvm_s390_inject_prog_cond() can be used in the caller for injecting into the guest (if applicable).
Since this adds a new return value to access_guest_page(), we need to make sure that other callers are not confused by the new positive return value.
There are the following users of access_guest_page():
- access_guest_with_key() does the checking itself (in guest_range_to_gpas()), so this case should never happen. Even if, the handling is set up properly.
- access_guest_real() just passes the return code to its callers, which are:
- read_guest_real() - see below
- write_guest_real() - see below
There are the following users of read_guest_real():
- ar_translation() in gaccess.c which already returns PGM_*
- setup_apcb10(), setup_apcb00(), setup_apcb11() in vsie.c which always return -EFAULT on read_guest_read() nonzero return - no change
- shadow_crycb(), handle_stfle() always present this as validity, this could be handled better but doesn't change current behaviour - no change
There are the following users of write_guest_real():
- kvm_s390_store_status_unloaded() always returns -EFAULT on write_guest_real() failure.
--- arch/s390/kvm/gaccess.c | 4 ++++ arch/s390/kvm/gaccess.h | 14 ++++++++------ 2 files changed, 12 insertions(+), 6 deletions(-)
arch/s390/kvm/gaccess.c +4 -0
@@ -873,6 +873,8 @@ static int access_guest_page(struct kvm *kvm, enum gacc_mode mode, gpa_t gpa,const gfn_t gfn =gpa_to_gfn (gpa);int rc; +if (!gfn_to_memslot (kvm, gfn)) +return PGM_ADDRESSING ;if (mode ==GACC_STORE ) rc =kvm_write_guest_page (kvm, gfn, data, offset, len);else
@@ -936,6 +938,8 @@ int access_guest_real(struct kvm_vcpu *vcpu, unsigned long gra, gra += fragment_len; data += fragment_len; } +if (rc >0 ) + vcpu->arch.pgm.code = rc;return rc; }
arch/s390/kvm/gaccess.h +8 -6
@@ -344,11 +344,12 @@ int read_guest_abs(struct kvm_vcpu *vcpu, unsigned long gpa, void *data,* @len: number of bytes to copy * * Copy @len bytes from @data (kernel space) to @gra (guest real address). -* It is up to the caller to ensure that the entire guest memory range is -* valid memory before calling this function. * Guest low address and key protection are not checked. * -* Returns zero on success or -EFAULT on error. +* Returns zero on success, -EFAULT when copying from @data failed, or +* PGM_ADRESSING in case @gra is outside a memslot. In this case, pgm check info +* is also stored to allow injecting into the guest (if applicable) using +* kvm_s390_inject_prog_cond(). * * If an error occurs data may have been copied partially to guest memory. */
@@ -367,11 +368,12 @@ int write_guest_real(struct kvm_vcpu *vcpu, unsigned long gra, void *data,* @len: number of bytes to copy * * Copy @len bytes from @gra (guest real address) to @data (kernel space). -* It is up to the caller to ensure that the entire guest memory range is -* valid memory before calling this function. * Guest key protection is not checked. * -* Returns zero on success or -EFAULT on error. +* Returns zero on success, -EFAULT when copying to @data failed, or +* PGM_ADRESSING in case @gra is outside a memslot. In this case, pgm check info +* is also stored to allow injecting into the guest (if applicable) using +* kvm_s390_inject_prog_cond(). * * If an error occurs data may have been copied partially to kernel space. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/80 usb: gadget: Add function wakeup support
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Elson Roy Serrao <[email protected]>
[ Upstream commit f0db885fb05d35befa81896db6b19eb3ee9ccdfe ]
USB3.2 spec section 9.2.5.4 quotes that a function may signal that it wants to exit from Function Suspend by sending a Function Wake Notification to the host if it is enabled for function remote wakeup. Add an api in composite layer that can be used by the function drivers to support this feature. Also expose a gadget op so that composite layer can trigger a wakeup request to the UDC driver.
Stable-dep-of: 705e3ce37bcc ("usb: dwc3: core: Fix system suspend on TI AM62 platforms")
--- drivers/usb/gadget/composite.c | 40 ++++++++++++++++++++++++++++++++++ include/linux/usb/composite.h | 6 +++++ include/linux/usb/gadget.h | 1 + 3 files changed, 47 insertions(+)
drivers/usb/gadget/composite.c +40 -0
@@ -477,6 +477,46 @@ int usb_interface_id(struct usb_configuration *config, }EXPORT_SYMBOL_GPL (usb_interface_id); +/** +* usb_func_wakeup - sends function wake notification to the host. +* @func: function that sends the remote wakeup notification. +* +* Applicable to devices operating at enhanced superspeed when usb +* functions are put in function suspend state and armed for function +* remote wakeup. On completion, function wake notification is sent. If +* the device is in low power state it tries to bring the device to active +* state before sending the wake notification. Since it is a synchronous +* call, caller must take care of not calling it in interrupt context. +* For devices operating at lower speeds returns negative errno. +* +* Returns zero on success, else negative errno. +*/ +int usb_func_wakeup (struct usb_function *func) +{ +struct usb_gadget *gadget = func->config->cdev->gadget; +int id; + +if (!gadget->ops->func_wakeup) +return -EOPNOTSUPP ; + +if (!func->func_wakeup_armed) { +ERROR (func->config->cdev,"not armed for func remote wakeup\n" ); +return -EINVAL ; + } + +for (id =0 ; id <MAX_CONFIG_INTERFACES ; id++) +if (func->config->interface[id] == func) +break ; + +if (id ==MAX_CONFIG_INTERFACES ) { +ERROR (func->config->cdev,"Invalid function\n" ); +return -EINVAL ; + } + +return gadget->ops->func_wakeup (gadget, id); +} +EXPORT_SYMBOL_GPL (usb_func_wakeup); +static u8 encode_bMaxPower (enum usb_device_speed speed,struct usb_configuration *c) {
include/linux/usb/composite.h +6 -0
@@ -163,6 +163,9 @@ struct usb_os_desc_table {* GetStatus() request when the recipient is Interface. * @func_suspend: callback to be called when * SetFeature(FUNCTION_SUSPEND) is reseived +* @func_suspended: Indicates whether the function is in function suspend state. +* @func_wakeup_armed: Indicates whether the function is armed by the host for +* wakeup signaling. * * A single USB function uses one or more interfaces, and should in most * cases support operation at both full and high speeds. Each function is
@@ -233,6 +236,8 @@ struct usb_function {int (*get_status)(struct usb_function *);int (*func_suspend)(struct usb_function *,u8 suspend_opt); +bool func_suspended; +bool func_wakeup_armed;/* private: */ /* internals */ struct list_head list;
@@ -254,6 +259,7 @@ int config_ep_by_speed_and_alt(struct usb_gadget *g, struct usb_function *f,int config_ep_by_speed (struct usb_gadget *g,struct usb_function *f,struct usb_ep *_ep); +int usb_func_wakeup (struct usb_function *func);#define MAX_CONFIG_INTERFACES 16/* arbitrary; max 255 */
include/linux/usb/gadget.h +1 -0
@@ -311,6 +311,7 @@ struct usb_udc;struct usb_gadget_ops {int (*get_frame)(struct usb_gadget *);int (*wakeup)(struct usb_gadget *); +int (*func_wakeup)(struct usb_gadget *gadget,int intf_id);int (*set_remote_wakeup)(struct usb_gadget *,int set);int (*set_selfpowered) (struct usb_gadget *,int is_selfpowered);int (*vbus_session) (struct usb_gadget *,int is_active);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/80 XHCI: Separate PORT and CAPs macros into dedicated file
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
[ Upstream commit c35ba0ac48355df1d11fcce85945f76c42d250ac ]
Split the PORT and CAPs macro definitions into a separate file to facilitate sharing with other files without the need to include the entire xhci.h.
Stable-dep-of: 705e3ce37bcc ("usb: dwc3: core: Fix system suspend on TI AM62 platforms")
--- drivers/usb/host/xhci-caps.h | 85 ++++++++++++ drivers/usb/host/xhci-port.h | 176 +++++++++++++++++++++++ drivers/usb/host/xhci.h | 262 +---------------------------------- 3 files changed, 264 insertions(+), 259 deletions(-) create mode 100644 drivers/usb/host/xhci-caps.h create mode 100644 drivers/usb/host/xhci-port.h
drivers/usb/host/xhci-caps.h new file +85 -0
@@ -0,0 +1,85 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +/* hc_capbase bitmasks */ +/* bits 7:0 - how long is the Capabilities register */ +#define HC_LENGTH (p) XHCI_HC_LENGTH(p) +/* bits 31:16 */ +#define HC_VERSION (p) (((p) >> 16) & 0xffff) + +/* HCSPARAMS1 - hcs_params1 - bitmasks */ +/* bits 0:7, Max Device Slots */ +#define HCS_MAX_SLOTS (p) (((p) >> 0) & 0xff) +#define HCS_SLOTS_MASK 0xff +/* bits 8:18, Max Interrupters */ +#define HCS_MAX_INTRS (p) (((p) >> 8) & 0x7ff) +/* bits 24:31, Max Ports - max value is 0x7F = 127 ports */ +#define HCS_MAX_PORTS (p) (((p) >> 24) & 0x7f) + +/* HCSPARAMS2 - hcs_params2 - bitmasks */ +/* bits 0:3, frames or uframes that SW needs to queue transactions +* ahead of the HW to meet periodic deadlines */ +#define HCS_IST (p) (((p) >> 0) & 0xf) +/* bits 4:7, max number of Event Ring segments */ +#define HCS_ERST_MAX (p) (((p) >> 4) & 0xf) +/* bits 21:25 Hi 5 bits of Scratchpad buffers SW must allocate for the HW */ +/* bit 26 Scratchpad restore - for save/restore HW state - not used yet */ +/* bits 27:31 Lo 5 bits of Scratchpad buffers SW must allocate for the HW */ +#define HCS_MAX_SCRATCHPAD (p) ((((p) >> 16) & 0x3e0) | (((p) >> 27) & 0x1f)) + +/* HCSPARAMS3 - hcs_params3 - bitmasks */ +/* bits 0:7, Max U1 to U0 latency for the roothub ports */ +#define HCS_U1_LATENCY (p) (((p) >> 0) & 0xff) +/* bits 16:31, Max U2 to U0 latency for the roothub ports */ +#define HCS_U2_LATENCY (p) (((p) >> 16) & 0xffff) + +/* HCCPARAMS - hcc_params - bitmasks */ +/* true: HC can use 64-bit address pointers */ +#define HCC_64BIT_ADDR (p) ((p) & (1 << 0)) +/* true: HC can do bandwidth negotiation */ +#define HCC_BANDWIDTH_NEG (p) ((p) & (1 << 1)) +/* true: HC uses 64-byte Device Context structures +* FIXME 64-byte context structures aren't supported yet. +*/ +#define HCC_64BYTE_CONTEXT (p) ((p) & (1 << 2)) +/* true: HC has port power switches */ +#define HCC_PPC (p) ((p) & (1 << 3)) +/* true: HC has port indicators */ +#define HCS_INDICATOR (p) ((p) & (1 << 4)) +/* true: HC has Light HC Reset Capability */ +#define HCC_LIGHT_RESET (p) ((p) & (1 << 5)) +/* true: HC supports latency tolerance messaging */ +#define HCC_LTC (p) ((p) & (1 << 6)) +/* true: no secondary Stream ID Support */ +#define HCC_NSS (p) ((p) & (1 << 7)) +/* true: HC supports Stopped - Short Packet */ +#define HCC_SPC (p) ((p) & (1 << 9)) +/* true: HC has Contiguous Frame ID Capability */ +#define HCC_CFC (p) ((p) & (1 << 11)) +/* Max size for Primary Stream Arrays - 2^(n+1), where n is bits 12:15 */ +#define HCC_MAX_PSA (p) (1 << ((((p) >> 12) & 0xf) + 1)) +/* Extended Capabilities pointer from PCI base - section 5.3.6 */ +#define HCC_EXT_CAPS (p) XHCI_HCC_EXT_CAPS(p) + +#define CTX_SIZE (_hcc) (HCC_64BYTE_CONTEXT(_hcc) ? 64 : 32) + +/* db_off bitmask - bits 0:1 reserved */ +#define DBOFF_MASK (~0x3) + +/* run_regs_off bitmask - bits 0:4 reserved */ +#define RTSOFF_MASK (~0x1f) + +/* HCCPARAMS2 - hcc_params2 - bitmasks */ +/* true: HC supports U3 entry Capability */ +#define HCC2_U3C (p) ((p) & (1 << 0)) +/* true: HC supports Configure endpoint command Max exit latency too large */ +#define HCC2_CMC (p) ((p) & (1 << 1)) +/* true: HC supports Force Save context Capability */ +#define HCC2_FSC (p) ((p) & (1 << 2)) +/* true: HC supports Compliance Transition Capability */ +#define HCC2_CTC (p) ((p) & (1 << 3)) +/* true: HC support Large ESIT payload Capability > 48k */ +#define HCC2_LEC (p) ((p) & (1 << 4)) +/* true: HC support Configuration Information Capability */ +#define HCC2_CIC (p) ((p) & (1 << 5)) +/* true: HC support Extended TBC Capability, Isoc burst count > 65535 */ +#define HCC2_ETC (p) ((p) & (1 << 6))
drivers/usb/host/xhci-port.h new file +176 -0
176 lines not on this page · raw message
drivers/usb/host/xhci.h +3 -259
280 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/80 usb: dwc3: core: Fix system suspend on TI AM62 platforms
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <[email protected]>
[ Upstream commit 705e3ce37bccdf2ed6f848356ff355f480d51a91 ]
Since commit 6d735722063a ("usb: dwc3: core: Prevent phy suspend during init"), system suspend is broken on AM62 TI platforms.
Before that commit, both DWC3_GUSB3PIPECTL_SUSPHY and DWC3_GUSB2PHYCFG_SUSPHY bits (hence forth called 2 SUSPHY bits) were being set during core initialization and even during core re-initialization after a system suspend/resume.
These bits are required to be set for system suspend/resume to work correctly on AM62 platforms.
Since that commit, the 2 SUSPHY bits are not set for DEVICE/OTG mode if gadget driver is not loaded and started.
For Host mode, the 2 SUSPHY bits are set before the first system suspend but get cleared at system resume during core re-init and are never set again.
This patch resovles these two issues by ensuring the 2 SUSPHY bits are set before system suspend and restored to the original state during system resume.
--- drivers/usb/dwc3/core.c | 19 +++++++++++++++++++ drivers/usb/dwc3/core.h | 3 +++ 2 files changed, 22 insertions(+)
drivers/usb/dwc3/core.c +19 -0
@@ -1796,6 +1796,11 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) {u32 reg; + dwc->susphy_state = (dwc3_readl (dwc->regs,DWC3_GUSB2PHYCFG (0 )) & +DWC3_GUSB2PHYCFG_SUSPHY ) || + (dwc3_readl (dwc->regs,DWC3_GUSB3PIPECTL (0 )) & +DWC3_GUSB3PIPECTL_SUSPHY ); +switch (dwc->current_dr_role) {case DWC3_GCTL_PRTCAP_DEVICE :if (pm_runtime_suspended (dwc->dev))
@@ -1843,6 +1848,15 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)break ; } +if (!PMSG_IS_AUTO (msg)) { +/* +* TI AM62 platform requires SUSPHY to be +* enabled for system suspend to work. +*/ +if (!dwc->susphy_state) +dwc3_enable_susphy (dwc, true); + } +return 0 ; }
@@ -1905,6 +1919,11 @@ static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg)break ; } +if (!PMSG_IS_AUTO (msg)) { +/* restore SUSPHY state to that before system suspend. */ +dwc3_enable_susphy (dwc, dwc->susphy_state); + } +return 0 ; }
drivers/usb/dwc3/core.h +3 -0
@@ -1085,6 +1085,8 @@ struct dwc3_scratchpad_array {* @dis_metastability_quirk: set to disable metastability quirk. * @dis_split_quirk: set to disable split boundary. * @suspended: set to track suspend event due to U3/L2. +* @susphy_state: state of DWC3_GUSB2PHYCFG_SUSPHY + DWC3_GUSB3PIPECTL_SUSPHY +* before PM suspend. * @imod_interval: set the interrupt moderation interval in 250ns * increments or 0 to disable. * @max_cfg_eps: current max number of IN eps used across all USB configs.
@@ -1300,6 +1302,7 @@ struct dwc3 { unsigned dis_split_quirk:1; unsigned async_callbacks:1; unsigned suspended:1; + unsigned susphy_state:1;u16 imod_interval;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/80 block, bfq: fix procress reference leakage for bfqq in merge chain
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 73aeab373557fa6ee4ae0b742c6211ccd9859280 ]
Original state:
Process 1 Process 2 Process 3 Process 4
(BIC1) (BIC2) (BIC3) (BIC4)
Λ | | |
\--------------\ \-------------\ \-------------\|
V V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
ref 0 1 2 4
After commit 0e456dba86c7 ("block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()"), if P1 issues a new IO:
Without the patch:
Process 1 Process 2 Process 3 Process 4
(BIC1) (BIC2) (BIC3) (BIC4)
Λ | | |
\------------------------------\ \-------------\|
V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
ref 0 0 2 4
bfqq3 will be used to handle IO from P1, this is not expected, IO should be redirected to bfqq4;
With the patch:
-------------------------------------------
| |
Process 1 Process 2 Process 3 | Process 4
(BIC1) (BIC2) (BIC3) | (BIC4)
| | | |
\-------------\ \-------------\|
V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
ref 0 0 2 4
IO is redirected to bfqq4, however, procress reference of bfqq3 is still 2, while there is only P2 using it.
Fix the problem by calling bfq_merge_bfqqs() for each bfqq in the merge chain. Also change bfqq_merge_bfqqs() to return new_bfqq to simplify code.
--- block/bfq-iosched.c | 37 +++++++++++++++++-------------------- 1 file changed, 17 insertions(+), 20 deletions(-)
block/bfq-iosched.c +17 -20
@@ -2981,10 +2981,12 @@ void bfq_release_process_ref(struct bfq_data *bfqd, struct bfq_queue *bfqq)bfq_put_queue (bfqq); } -static void -bfq_merge_bfqqs (struct bfq_data *bfqd,struct bfq_io_cq *bic, -struct bfq_queue *bfqq,struct bfq_queue *new_bfqq) +static struct bfq_queue *bfq_merge_bfqqs (struct bfq_data *bfqd, +struct bfq_io_cq *bic, +struct bfq_queue *bfqq) { +struct bfq_queue *new_bfqq = bfqq->new_bfqq; +bfq_log_bfqq (bfqd, bfqq,"merging with queue %lu" , (unsigned long )new_bfqq->pid);/* Save weight raising and idle window of the merged queues */
@@ -3078,6 +3080,8 @@ bfq_merge_bfqqs(struct bfq_data *bfqd, struct bfq_io_cq *bic,bfq_reassign_last_bfqq (bfqq, new_bfqq);bfq_release_process_ref (bfqd, bfqq); + +return new_bfqq; } static bool bfq_allow_bio_merge(struct request_queue *q, struct request *rq,
@@ -3113,14 +3117,8 @@ static bool bfq_allow_bio_merge(struct request_queue *q, struct request *rq,* fulfilled, i.e., bic can be redirected to new_bfqq * and bfqq can be put. */ -bfq_merge_bfqqs (bfqd, bfqd->bio_bic, bfqq, - new_bfqq); -/* -* If we get here, bio will be queued into new_queue, -* so use new_bfqq to decide whether bio and rq can be -* merged. -*/ - bfqq = new_bfqq; +while (bfqq != new_bfqq) + bfqq =bfq_merge_bfqqs (bfqd, bfqd->bio_bic, bfqq);/* * Change also bqfd->bio_bfqq, as
@@ -5482,9 +5480,7 @@ bfq_do_early_stable_merge(struct bfq_data *bfqd, struct bfq_queue *bfqq,* state before killing it. */ bfqq->bic = bic; -bfq_merge_bfqqs (bfqd, bic, bfqq, new_bfqq); - -return new_bfqq; +return bfq_merge_bfqqs (bfqd, bic, bfqq); }/*
@@ -5916,6 +5912,7 @@ static bool __bfq_insert_request(struct bfq_data *bfqd, struct request *rq)bool waiting, idle_timer_disabled = false;if (new_bfqq) { +struct bfq_queue *old_bfqq = bfqq;/* * Release the request's reference to the old bfqq * and make sure one is taken to the shared queue.
@@ -5931,18 +5928,18 @@ static bool __bfq_insert_request(struct bfq_data *bfqd, struct request *rq)* then complete the merge and redirect it to * new_bfqq. */ -if (bic_to_bfqq (RQ_BIC (rq),1 ) == bfqq) -bfq_merge_bfqqs (bfqd,RQ_BIC (rq), - bfqq, new_bfqq); +if (bic_to_bfqq (RQ_BIC (rq),1 ) == bfqq) { +while (bfqq != new_bfqq) + bfqq =bfq_merge_bfqqs (bfqd,RQ_BIC (rq), bfqq); + } -bfq_clear_bfqq_just_created (bfqq); +bfq_clear_bfqq_just_created (old_bfqq);/* * rq is about to be enqueued into new_bfqq, * release rq reference on bfqq */ -bfq_put_queue (bfqq); +bfq_put_queue (old_bfqq); rq->elv.priv[1 ] = new_bfqq; - bfqq = new_bfqq; }bfq_update_io_thinktime (bfqd, bfqq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/80 exec: dont WARN for racy path_noexec check
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mateusz Guzik <[email protected]>
[ Upstream commit 0d196e7589cefe207d5d41f37a0a28a1fdeeb7c6 ]
Both i_mode and noexec checks wrapped in WARN_ON stem from an artifact of the previous implementation. They used to legitimately check for the condition, but that got moved up in two commits:633fb6ac3980 ("exec: move S_ISREG() check earlier") 0fd338b2d2cd ("exec: move path_noexec() check earlier")
Instead of being removed said checks are WARN_ON'ed instead, which has some debug value.
However, the spurious path_noexec check is racy, resulting in unwarranted warnings should someone race with setting the noexec flag.
One can note there is more to perm-checking whether execve is allowed and none of the conditions are guaranteed to still hold after they were tested for.
Additionally this does not validate whether the code path did any perm checking to begin with -- it will pass if the inode happens to be regular.
Keep the redundant path_noexec() check even though it's mindless nonsense checking for guarantee that isn't given so drop the WARN.
Reword the commentary and do small tidy ups while here.
--- fs/exec.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-)
fs/exec.c +9 -12
@@ -142,13 +142,11 @@ SYSCALL_DEFINE1(uselib, const char __user *, library) goto out;/* -* may_open() has already checked for this, so it should be -* impossible to trip now. But we need to be extra cautious -* and check again at the very end too. +* Check do_open_execat() for an explanation. */ error = -EACCES ; -if (WARN_ON_ONCE (!S_ISREG (file_inode (file)->i_mode) || -path_noexec (&file->f_path))) +if (WARN_ON_ONCE (!S_ISREG (file_inode (file)->i_mode)) || +path_noexec (&file->f_path)) goto exit;fsnotify_open (file);
@@ -919,16 +917,16 @@ static struct file *do_open_execat(int fd, struct filename *name, int flags) file =do_filp_open (fd, name, &open_exec_flags);if (IS_ERR (file)) - goto out; +return file;/* -* may_open() has already checked for this, so it should be -* impossible to trip now. But we need to be extra cautious -* and check again at the very end too. +* In the past the regular type check was here. It moved to may_open() in +* 633fb6ac3980 ("exec: move S_ISREG() check earlier"). Since then it is +* an invariant that all non-regular files error out before we get here. */ err = -EACCES ; -if (WARN_ON_ONCE (!S_ISREG (file_inode (file)->i_mode) || -path_noexec (&file->f_path))) +if (WARN_ON_ONCE (!S_ISREG (file_inode (file)->i_mode)) || +path_noexec (&file->f_path)) goto exit; err =deny_write_access (file);
@@ -938,7 +936,6 @@ static struct file *do_open_execat(int fd, struct filename *name, int flags)if (name->name[0 ] !='\0' )fsnotify_open (file); -out:return file; exit:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/80 drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit d92b90f9a54d9300a6e883258e79f36dab53bfae ]
Replace the fake VLA at end of the vbva_mouse_pointer_shape shape with a real VLA to fix a "memcpy: detected field-spanning write error" warning:
[ 13.319813] memcpy: detected field-spanning write (size 16896) of single field "p->data" at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 (size 4) [ 13.319841] WARNING: CPU: 0 PID: 1105 at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 hgsmi_update_pointer_shape+0x192/0x1c0 [vboxvideo] [ 13.320038] Call Trace: [ 13.320173] hgsmi_update_pointer_shape [vboxvideo] [ 13.320184] vbox_cursor_atomic_update [vboxvideo]
Note as mentioned in the added comment it seems the original length calculation for the allocated and send hgsmi buffer is 4 bytes too large. Changing this is not the goal of this patch, so this behavior is kept.
--- drivers/gpu/drm/vboxvideo/hgsmi_base.c | 10 +++++++++- drivers/gpu/drm/vboxvideo/vboxvideo.h | 4 +--- 2 files changed, 10 insertions(+), 4 deletions(-)
drivers/gpu/drm/vboxvideo/hgsmi_base.c +9 -1
@@ -139,7 +139,15 @@ int hgsmi_update_pointer_shape(struct gen_pool *ctx, u32 flags, flags |=VBOX_MOUSE_POINTER_VISIBLE ; } - p =hgsmi_buffer_alloc (ctx,sizeof (*p) + pixel_len,HGSMI_CH_VBVA , +/* +* The 4 extra bytes come from switching struct vbva_mouse_pointer_shape +* from having a 4 bytes fixed array at the end to using a proper VLA +* at the end. These 4 extra bytes were not subtracted from sizeof(*p) +* before the switch to the VLA, so this way the behavior is unchanged. +* Chances are these 4 extra bytes are not necessary but they are kept +* to avoid regressions. +*/ + p =hgsmi_buffer_alloc (ctx,sizeof (*p) + pixel_len +4 ,HGSMI_CH_VBVA ,VBVA_MOUSE_POINTER_SHAPE );if (!p)return -ENOMEM ;
drivers/gpu/drm/vboxvideo/vboxvideo.h +1 -3
@@ -351,10 +351,8 @@ struct vbva_mouse_pointer_shape {* Bytes in the gap between the AND and the XOR mask are undefined. * XOR mask scanlines have no gap between them and size of XOR mask is: * xor_len = width * 4 * height. -* -* Preallocate 4 bytes for accessing actual data as p->data. */ -u8 data[4 ]; +u8 data[]; } __packed;/* pointer is visible */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/80 ASoC: codecs: lpass-rx-macro: add missing CDC_RX_BCL_VBAT_RF_PROC2 to default regs values
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <[email protected]>
[ Upstream commit e249786b2188107a7c50e7174d35f955a60988a1 ]
CDC_RX_BCL_VBAT_RF_PROC1 is listed twice and its default value is 0x2a which is overwriten by its next occurence in rx_defaults[]. The second one should be missing CDC_RX_BCL_VBAT_RF_PROC2 instead and its default value is expected 0x0.
--- sound/soc/codecs/lpass-rx-macro.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/lpass-rx-macro.c +1 -1
@@ -907,7 +907,7 @@ static const struct reg_default rx_defaults[] = { { CDC_RX_BCL_VBAT_PK_EST2, 0x01 }, { CDC_RX_BCL_VBAT_PK_EST3, 0x40 }, { CDC_RX_BCL_VBAT_RF_PROC1, 0x2A }, - { CDC_RX_BCL_VBAT_RF_PROC1, 0x00 }, + { CDC_RX_BCL_VBAT_RF_PROC2, 0x00 }, { CDC_RX_BCL_VBAT_TAC1, 0x00 }, { CDC_RX_BCL_VBAT_TAC2, 0x18 }, { CDC_RX_BCL_VBAT_TAC3, 0x18 },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/80 ASoC: fsl_sai: Enable FIFO continue on error FCONT bit
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit 72455e33173c1a00c0ce93d2b0198eb45d5f4195 ]
FCONT=1 means On FIFO error, the SAI will continue from the same word that caused the FIFO error to set after the FIFO warning flag has been cleared.
Set FCONT bit in control register to avoid the channel swap issue after SAI xrun.
--- sound/soc/fsl/fsl_sai.c | 5 ++++- sound/soc/fsl/fsl_sai.h | 1 + 2 files changed, 5 insertions(+), 1 deletion(-)
sound/soc/fsl/fsl_sai.c +4 -1
@@ -498,6 +498,9 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, val_cr4 |=FSL_SAI_CR4_FRSZ (slots); +/* Set to avoid channel swap */ + val_cr4 |=FSL_SAI_CR4_FCONT ; +/* Set to output mode to avoid tri-stated data pins */ if (tx) val_cr4 |=FSL_SAI_CR4_CHMOD ;
@@ -523,7 +526,7 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, FSL_SAI_CR3_TRCE((1 << pins) - 1));regmap_update_bits (sai->regmap,FSL_SAI_xCR4 (tx, ofs),FSL_SAI_CR4_SYWD_MASK |FSL_SAI_CR4_FRSZ_MASK | -FSL_SAI_CR4_CHMOD_MASK , +FSL_SAI_CR4_CHMOD_MASK |FSL_SAI_CR4_FCONT_MASK , val_cr4); regmap_update_bits(sai->regmap, FSL_SAI_xCR5(tx, ofs), FSL_SAI_CR5_WNW_MASK | FSL_SAI_CR5_W0W_MASK |
sound/soc/fsl/fsl_sai.h +1 -0
@@ -132,6 +132,7 @@/* SAI Transmit and Receive Configuration 4 Register */ +#define FSL_SAI_CR4_FCONT_MASK BIT(28)#define FSL_SAI_CR4_FCONT BIT(28)#define FSL_SAI_CR4_FCOMB_SHIFT BIT(26)#define FSL_SAI_CR4_FCOMB_SOFT BIT(27)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/80 arm64: Force position-independent veneers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
[ Upstream commit 9abe390e689f4f5c23c5f507754f8678431b4f72 ]
Certain portions of code always need to be position-independent regardless of CONFIG_RELOCATABLE, including code which is executed in an idmap or which is executed before relocations are applied. In some kernel configurations the LLD linker generates position-dependent veneers for such code, and when executed these result in early boot-time failures.
Marc Zyngier encountered a boot failure resulting from this when building a (particularly cursed) configuration with LLVM, as he reported to the list:
https://lore.kernel.org/linux-arm-kernel/[email protected]/
In Marc's kernel configuration, the .head.text and .rodata.text sections end up more than 128MiB apart, requiring a veneer to branch between the two:
| [mark@lakrids:~/src/linux]% usekorg 14.1.0 aarch64-linux-objdump -t vmlinux | grep -w _text | ffff800080000000 g .head.text 0000000000000000 _text | [mark@lakrids:~/src/linux]% usekorg 14.1.0 aarch64-linux-objdump -t vmlinux | grep -w primary_entry | ffff8000889df0e0 g .rodata.text 000000000000006c primary_entry,
... consequently, LLD inserts a position-dependent veneer for the branch from _stext (in .head.text) to primary_entry (in .rodata.text):
| ffff800080000000 <_text>: | ffff800080000000: fa405a4d ccmp x18, #0x0, #0xd, pl // pl = nfrst | ffff800080000004: 14003fff b ffff800080010000 <__AArch64AbsLongThunk_primary_entry> ... | ffff800080010000 <__AArch64AbsLongThunk_primary_entry>: | ffff800080010000: 58000050 ldr x16, ffff800080010008 <__AArch64AbsLongThunk_primary_entry+0x8> | ffff800080010004: d61f0200 br x16 | ffff800080010008: 889df0e0 .word 0x889df0e0 | ffff80008001000c: ffff8000 .word 0xffff8000
... and as this is executed early in boot before the kernel is mapped in TTBR1 this results in a silent boot failure.
Fix this by passing '--pic-veneer' to the linker, which will cause the linker to use position-independent veneers, e.g.
| ffff800080000000 <_text>: | ffff800080000000: fa405a4d ccmp x18, #0x0, #0xd, pl // pl = nfrst | ffff800080000004: 14003fff b ffff800080010000 <__AArch64ADRPThunk_primary_entry> ... | ffff800080010000 <__AArch64ADRPThunk_primary_entry>: | ffff800080010000: f004e3f0 adrp x16, ffff800089c8f000 <__idmap_text_start> | ffff800080010004: 91038210 add x16, x16, #0xe0 | ffff800080010008: d61f0200 br x16
I've opted to pass '--pic-veneer' unconditionally, as:
* In addition to solving the boot failure, these sequences are generally nicer as they require fewer instructions and don't need to perform data accesses.
* While the position-independent veneer sequences have a limited +/-2GiB range, this is not a new restriction. Even kernels built with CONFIG_RELOCATABLE=n are limited to 2GiB in size as we have several structues using 32-bit relative offsets and PPREL32 relocations, which are similarly limited to +/-2GiB in range. These include extable entries, jump table entries, and alt_instr entries.
* GNU LD defaults to using position-independent veneers, and supports the same '--pic-veneer' option, so this change is not expected to adversely affect GNU LD.
I've tested with GNU LD 2.30 to 2.42 inclusive and LLVM 13.0.1 to 19.1.0 inclusive, using the kernel.org binaries from:
* https://mirrors.edge.kernel.org/pub/tools/crosstool/
* https://mirrors.edge.kernel.org/pub/tools/llvm/
--- arch/arm64/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/Makefile +1 -1
@@ -10,7 +10,7 @@ # # Copyright (C) 1995-2001 by Russell King -LDFLAGS_vmlinux :=--no-undefined -X +LDFLAGS_vmlinux :=--no-undefined -X --pic-veneer ifeq ($(CONFIG_RELOCATABLE), y) # Pass --no-apply-dynamic-relocs to restore pre-binutils-2.27 behaviour
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/80 udf: fix uninit-value use in udf_get_fileshortad
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gianfranco Trad <[email protected]>
[ Upstream commit 264db9d666ad9a35075cc9ed9ec09d021580fbb1 ]
Check for overflow when computing alen in udf_current_aext to mitigate later uninit-value use in udf_get_fileshortad KMSAN bug[1]. After applying the patch reproducer did not trigger any issue[2].
[1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df
[2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000
--- fs/udf/inode.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
fs/udf/inode.c +6 -3
@@ -2100,12 +2100,15 @@ int8_t udf_current_aext(struct inode *in alen =udf_file_entry_alloc_offset (inode) + iinfo->i_lenAlloc; }else { +struct allocExtDesc *header = + (struct allocExtDesc *)epos->bh->b_data; +if (!epos->offset) epos->offset =sizeof (struct allocExtDesc ); ptr = epos->bh->b_data + epos->offset; - alen =sizeof (struct allocExtDesc ) + -le32_to_cpu (((struct allocExtDesc *)epos->bh->b_data)-> - lengthAllocDescs); +if (check_add_overflow (sizeof (struct allocExtDesc ), +le32_to_cpu (header->lengthAllocDescs), &alen)) +return -1 ; }switch (iinfo->i_alloc_type) {
Greg Kroah-Hartman
maintainerPATCH 46/80 platform/x86: dell-wmi: Ignore suspend notifications
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
commit a7990957fa53326fe9b47f0349373ed99bb69aaa upstream.
Some machines like the Dell G15 5155 emit WMI events when suspending/resuming. Ignore those WMI events.
--- drivers/platform/x86/dell/dell-wmi-base.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/platform/x86/dell/dell-wmi-base.c +9 -0
@@ -263,6 +263,15 @@ static const struct key_entry dell_wmi_k/*Speaker Mute*/ { KE_KEY, 0x109, { KEY_MUTE} }, +/* S2Idle screen off */ + { KE_IGNORE, 0x120, { KEY_RESERVED }}, + +/* Leaving S4 or S2Idle suspend */ + { KE_IGNORE, 0x130, { KEY_RESERVED }}, + +/* Entering S2Idle suspend */ + { KE_IGNORE, 0x140, { KEY_RESERVED }}, +/* Mic mute */ { KE_KEY, 0x150, { KEY_MICMUTE } },
Greg Kroah-Hartman
maintainerPATCH 47/80 arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: junhua huang <[email protected]>
commit ef08c0fadd8a17ebe429b85e23952dac3263ad34 upstream.
After we fixed the uprobe inst endian in aarch_be, the sparse check report the following warning info:
sparse warnings: (new ones prefixed by >>)
Quoted 2 lines
Quoted 2 lines
kernel/events/uprobes.c:223:25: sparse: sparse: restricted__le32degrades to integerkernel/events/uprobes.c:574:56: sparse: sparse: incorrect type in argument 4 (different base types)
@@ expected unsigned int [addressable] [usertype] opcode @@ got restricted __le32 [usertype] @@
kernel/events/uprobes.c:574:56: sparse: expected unsigned int [addressable] [usertype] opcode
kernel/events/uprobes.c:574:56: sparse: got restricted __le32 [usertype]
Quoted 1 line
Quoted 1 line
kernel/events/uprobes.c:1483:32: sparse: sparse: incorrect type in initializer (different base types)
@@ expected unsigned int [usertype] insn @@ got restricted __le32 [usertype] @@
kernel/events/uprobes.c:1483:32: sparse: expected unsigned int [usertype] insn
kernel/events/uprobes.c:1483:32: sparse: got restricted __le32 [usertype]
use the __le32 to u32 for uprobe_opcode_t, to keep the same.
--- arch/arm64/include/asm/uprobes.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/include/asm/uprobes.h +1 -1
@@ -14,7 +14,7 @@#define UPROBE_SWBP_INSN_SIZE AARCH64_INSN_SIZE#define UPROBE_XOL_SLOT_BYTES AARCH64_INSN_SIZE -typedef u32 uprobe_opcode_t ; +typedef __le32 uprobe_opcode_t ;struct arch_uprobe_task { };
Greg Kroah-Hartman
maintainerPATCH 48/80 ASoC: qcom: sm8250: add qrb4210-rb2-sndcard compatible string
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <[email protected]>
[ Upstream commit b97bc0656a66f89f78098d4d72dc04fa9518ab11 ]
Add "qcom,qrb4210-rb2-sndcard" to the list of recognizable devices.
--- sound/soc/qcom/sm8250.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/qcom/sm8250.c +1 -0
@@ -211,6 +211,7 @@ static int sm8250_platform_probe(struct platform_device *pdev)static const struct of_device_id snd_sm8250_dt_match[] = { {.compatible ="qcom,sm8250-sndcard" }, + {.compatible ="qcom,qrb4210-rb2-sndcard" }, {.compatible ="qcom,qrb5165-rb5-sndcard" }, {} };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/80 platform/x86: dell-sysman: add support for alienware products
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Crag Wang <[email protected]>
[ Upstream commit a561509b4187a8908eb7fbb2d1bf35bbc20ec74b ]
Alienware supports firmware-attributes and has its own OEM string.
--- drivers/platform/x86/dell/dell-wmi-sysman/sysman.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/dell/dell-wmi-sysman/sysman.c +1 -0
@@ -524,6 +524,7 @@ static int __init sysman_init(void)int ret =0 ;if (!dmi_find_device (DMI_DEV_TYPE_OEM_STRING ,"Dell System" ,NULL ) && + !dmi_find_device (DMI_DEV_TYPE_OEM_STRING ,"Alienware" ,NULL ) && !dmi_find_device (DMI_DEV_TYPE_OEM_STRING ,"www.dell.com" ,NULL )) {pr_err ("Unable to run on non-Dell system\n" );return -ENODEV ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/80 jfs: Fix sanity check in dbMount
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Kleikamp <[email protected]>
[ Upstream commit 67373ca8404fe57eb1bb4b57f314cff77ce54932 ]
MAXAG is a legitimate value for bmp->db_numag
--- fs/jfs/jfs_dmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/jfs/jfs_dmap.c +1 -1
@@ -187,7 +187,7 @@ int dbMount(struct inode *ipbmap) } bmp->db_numag =le32_to_cpu (dbmp_le->dn_numag); -if (!bmp->db_numag || bmp->db_numag >=MAXAG ) { +if (!bmp->db_numag || bmp->db_numag >MAXAG ) { err = -EINVAL ; goto err_release_metapage; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/80 tracing: Consider the NULL character when validating the event length
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 0b6e2e22cb23105fcb171ab92f0f7516c69c8471 ]
strlen() returns a string length excluding the null byte. If the string length equals to the maximum buffer length, the buffer will have no space for the NULL terminating character.
This commit checks this condition and returns failure for it.
--- kernel/trace/trace_probe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace_probe.c +1 -1
@@ -261,7 +261,7 @@ int traceprobe_parse_event_name(const char **pevent, const char **pgroup,if (len ==0 ) {trace_probe_log_err (offset,NO_EVENT_NAME );return -EINVAL ; - }else if (len >MAX_EVENT_NAME_LEN ) { + }else if (len >=MAX_EVENT_NAME_LEN ) {trace_probe_log_err (offset,EVENT_TOO_LONG );return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/80 xfrm: extract dst lookup parameters into a struct
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eyal Birger <[email protected]>
[ Upstream commit e509996b16728e37d5a909a5c63c1bd64f23b306 ]
Preparation for adding more fields to dst lookup functions without changing their signatures.
Stable-dep-of: b84697210343 ("xfrm: respect ip protocols rules criteria when performing dst lookups")
--- include/net/xfrm.h | 26 +++++++++++++------------- net/ipv4/xfrm4_policy.c | 38 ++++++++++++++++---------------------- net/ipv6/xfrm6_policy.c | 28 +++++++++++++--------------- net/xfrm/xfrm_device.c | 11 ++++++++--- net/xfrm/xfrm_policy.c | 35 +++++++++++++++++++++++------------ 5 files changed, 73 insertions(+), 65 deletions(-)
include/net/xfrm.h +13 -13
@@ -315,20 +315,23 @@ struct xfrm_if_cb {void xfrm_if_register_cb (const struct xfrm_if_cb *ifcb);void xfrm_if_unregister_cb (void ); +struct xfrm_dst_lookup_params { +struct net *net; +int tos; +int oif; +xfrm_address_t *saddr; +xfrm_address_t *daddr; +u32 mark; +}; +struct net_device ;struct xfrm_type ;struct xfrm_dst ;struct xfrm_policy_afinfo {struct dst_ops *dst_ops; -struct dst_entry *(*dst_lookup)(struct net *net, -int tos,int oif, -const xfrm_address_t *saddr, -const xfrm_address_t *daddr, -u32 mark); -int (*get_saddr)(struct net *net,int oif, -xfrm_address_t *saddr, -xfrm_address_t *daddr, -u32 mark); +struct dst_entry *(*dst_lookup)(const struct xfrm_dst_lookup_params *params); +int (*get_saddr)(xfrm_address_t *saddr, +const struct xfrm_dst_lookup_params *params);int (*fill_dst)(struct xfrm_dst *xdst,struct net_device *dev,const struct flowi *fl);
@@ -1645,10 +1648,7 @@ static inline int xfrm_user_policy(struct sock *sk, int optname, }#endif -struct dst_entry *__xfrm_dst_lookup (struct net *net,int tos,int oif, -const xfrm_address_t *saddr, -const xfrm_address_t *daddr, -int family,u32 mark); +struct dst_entry *__xfrm_dst_lookup (int family,const struct xfrm_dst_lookup_params *params);struct xfrm_policy *xfrm_policy_alloc (struct net *net,gfp_t gfp);
net/ipv4/xfrm4_policy.c +16 -22
@@ -17,47 +17,41 @@#include <net/ip.h> #include <net/l3mdev.h> -static struct dst_entry *__xfrm4_dst_lookup (struct net *net,struct flowi4 *fl4, -int tos,int oif, -const xfrm_address_t *saddr, -const xfrm_address_t *daddr, -u32 mark) +static struct dst_entry *__xfrm4_dst_lookup (struct flowi4 *fl4, +const struct xfrm_dst_lookup_params *params) {struct rtable *rt;memset (fl4,0 ,sizeof (*fl4)); - fl4->daddr = daddr->a4; - fl4->flowi4_tos = tos; - fl4->flowi4_l3mdev =l3mdev_master_ifindex_by_index (net, oif); - fl4->flowi4_mark = mark; -if (saddr) - fl4->saddr = saddr->a4; - - rt =__ip_route_output_key (net, fl4); + fl4->daddr = params->daddr->a4; + fl4->flowi4_tos = params->tos; + fl4->flowi4_l3mdev =l3mdev_master_ifindex_by_index (params->net, + params->oif); + fl4->flowi4_mark = params->mark; +if (params->saddr) + fl4->saddr = params->saddr->a4; + + rt =__ip_route_output_key (params->net, fl4);if (!IS_ERR (rt))return &rt->dst;return ERR_CAST (rt); } -static struct dst_entry *xfrm4_dst_lookup (struct net *net,int tos,int oif, -const xfrm_address_t *saddr, -const xfrm_address_t *daddr, -u32 mark) +static struct dst_entry *xfrm4_dst_lookup (const struct xfrm_dst_lookup_params *params) {struct flowi4 fl4; -return __xfrm4_dst_lookup (net, &fl4, tos, oif, saddr, daddr, mark); +return __xfrm4_dst_lookup (&fl4, params); } -static int xfrm4_get_saddr (struct net *net,int oif, -xfrm_address_t *saddr,xfrm_address_t *daddr, -u32 mark) +static int xfrm4_get_saddr (xfrm_address_t *saddr, +const struct xfrm_dst_lookup_params *params) {struct dst_entry *dst;struct flowi4 fl4; - dst =__xfrm4_dst_lookup (net, &fl4,0 , oif,NULL , daddr, mark); + dst =__xfrm4_dst_lookup (&fl4, params);if (IS_ERR (dst))return -EHOSTUNREACH ;
net/ipv6/xfrm6_policy.c +13 -15
@@ -23,23 +23,21 @@#include <net/ip6_route.h> #include <net/l3mdev.h> -static struct dst_entry *xfrm6_dst_lookup (struct net *net,int tos,int oif, -const xfrm_address_t *saddr, -const xfrm_address_t *daddr, -u32 mark) +static struct dst_entry *xfrm6_dst_lookup (const struct xfrm_dst_lookup_params *params) {struct flowi6 fl6;struct dst_entry *dst;int err;memset (&fl6,0 ,sizeof (fl6)); - fl6.flowi6_l3mdev =l3mdev_master_ifindex_by_index (net, oif); - fl6.flowi6_mark = mark; -memcpy (&fl6.daddr, daddr,sizeof (fl6.daddr)); -if (saddr) -memcpy (&fl6.saddr, saddr,sizeof (fl6.saddr)); + fl6.flowi6_l3mdev =l3mdev_master_ifindex_by_index (params->net, + params->oif); + fl6.flowi6_mark = params->mark; +memcpy (&fl6.daddr, params->daddr,sizeof (fl6.daddr)); +if (params->saddr) +memcpy (&fl6.saddr, params->saddr,sizeof (fl6.saddr)); - dst =ip6_route_output (net,NULL , &fl6); + dst =ip6_route_output (params->net,NULL , &fl6); err = dst->error;if (dst->error) {
@@ -50,15 +48,14 @@ static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, int oif,return dst; } -static int xfrm6_get_saddr (struct net *net,int oif, -xfrm_address_t *saddr,xfrm_address_t *daddr, -u32 mark) +static int xfrm6_get_saddr (xfrm_address_t *saddr, +const struct xfrm_dst_lookup_params *params) {struct dst_entry *dst;struct net_device *dev;struct inet6_dev *idev; - dst =xfrm6_dst_lookup (net,0 , oif,NULL , daddr, mark); + dst =xfrm6_dst_lookup (params);if (IS_ERR (dst))return -EHOSTUNREACH ;
@@ -68,7 +65,8 @@ static int xfrm6_get_saddr(struct net *net, int oif,return -EHOSTUNREACH ; } dev = idev->dev; -ipv6_dev_get_saddr (dev_net (dev), dev, &daddr->in6,0 , &saddr->in6); +ipv6_dev_get_saddr (dev_net (dev), dev, ¶ms->daddr->in6,0 , + &saddr->in6);dst_release (dst);return 0 ; }
net/xfrm/xfrm_device.c +8 -3
@@ -241,6 +241,8 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, dev =dev_get_by_index (net, xuo->ifindex);if (!dev) { +struct xfrm_dst_lookup_params params; +if (!(xuo->flags &XFRM_OFFLOAD_INBOUND )) { saddr = &x->props.saddr; daddr = &x->id.daddr;
@@ -249,9 +251,12 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, daddr = &x->props.saddr; } - dst =__xfrm_dst_lookup (net,0 ,0 , saddr, daddr, - x->props.family, -xfrm_smark_get (0 , x)); +memset (¶ms,0 ,sizeof (params)); + params.net = net; + params.saddr = saddr; + params.daddr = daddr; + params.mark =xfrm_smark_get (0 , x); + dst =__xfrm_dst_lookup (x->props.family, ¶ms);if (IS_ERR (dst))return 0 ;
net/xfrm/xfrm_policy.c +23 -12
@@ -251,10 +251,8 @@ static const struct xfrm_if_cb *xfrm_if_get_cb(void)return rcu_dereference (xfrm_if_cb); } -struct dst_entry *__xfrm_dst_lookup (struct net *net,int tos,int oif, -const xfrm_address_t *saddr, -const xfrm_address_t *daddr, -int family,u32 mark) +struct dst_entry *__xfrm_dst_lookup (int family, +const struct xfrm_dst_lookup_params *params) {const struct xfrm_policy_afinfo *afinfo;struct dst_entry *dst;
@@ -263,7 +261,7 @@ struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, int oif,if (unlikely (afinfo ==NULL ))return ERR_PTR (-EAFNOSUPPORT ); - dst = afinfo->dst_lookup (net, tos, oif, saddr, daddr, mark); + dst = afinfo->dst_lookup (params);rcu_read_unlock ();
@@ -277,6 +275,7 @@ static inline struct dst_entry *xfrm_dst_lookup(struct xfrm_state *x,xfrm_address_t *prev_daddr, int family, u32 mark) { + struct xfrm_dst_lookup_params params;struct net *net =xs_net (x);xfrm_address_t *saddr = &x->props.saddr;xfrm_address_t *daddr = &x->id.daddr;
@@ -291,7 +290,14 @@ static inline struct dst_entry *xfrm_dst_lookup(struct xfrm_state *x, daddr = x->coaddr; } - dst =__xfrm_dst_lookup (net, tos, oif, saddr, daddr, family, mark); + params.net = net; + params.saddr = saddr; + params.daddr = daddr; + params.tos = tos; + params.oif = oif; + params.mark = mark; + + dst =__xfrm_dst_lookup (family, ¶ms);if (!IS_ERR (dst)) {if (prev_saddr != saddr)
@@ -2342,15 +2348,15 @@ int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) }static int -xfrm_get_saddr (struct net *net,int oif,xfrm_address_t *local, -xfrm_address_t *remote,unsigned short family,u32 mark) +xfrm_get_saddr (unsigned short family,xfrm_address_t *saddr, +const struct xfrm_dst_lookup_params *params) {int err;const struct xfrm_policy_afinfo *afinfo =xfrm_policy_get_afinfo (family);if (unlikely (afinfo ==NULL ))return -EINVAL ; - err = afinfo->get_saddr (net, oif, local, remote, mark); + err = afinfo->get_saddr (saddr, params);rcu_read_unlock ();return err; }
@@ -2379,9 +2385,14 @@ xfrm_tmpl_resolve_one(struct xfrm_policy *policy, const struct flowi *fl, remote = &tmpl->id.daddr; local = &tmpl->saddr;if (xfrm_addr_any (local, tmpl->encap_family)) { - error =xfrm_get_saddr (net, fl->flowi_oif, - &tmp, remote, - tmpl->encap_family,0 ); +struct xfrm_dst_lookup_params params; + +memset (¶ms,0 ,sizeof (params)); + params.net = net; + params.oif = fl->flowi_oif; + params.daddr = remote; + error =xfrm_get_saddr (tmpl->encap_family, &tmp, + ¶ms);if (error) goto fail; local = &tmp;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/80 xfrm: respect ip protocols rules criteria when performing dst lookups
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eyal Birger <[email protected]>
[ Upstream commit b8469721034300bbb6dec5b4bf32492c95e16a0c ]
The series in the "fixes" tag added the ability to consider L4 attributes in routing rules.
The dst lookup on the outer packet of encapsulated traffic in the xfrm code was not adapted to this change, thus routing behavior that relies on L4 information is not respected.
Pass the ip protocol information when performing dst lookups.
--- include/net/xfrm.h | 2 ++ net/ipv4/xfrm4_policy.c | 2 ++ net/ipv6/xfrm6_policy.c | 3 +++ net/xfrm/xfrm_policy.c | 15 +++++++++++++++ 4 files changed, 22 insertions(+)
include/net/xfrm.h +2 -0
@@ -322,6 +322,8 @@ struct xfrm_dst_lookup_params {xfrm_address_t *saddr;xfrm_address_t *daddr;u32 mark; +__u8 ipproto; +union flowi_uli uli; };struct net_device ;
net/ipv4/xfrm4_policy.c +2 -0
@@ -30,6 +30,8 @@ static struct dst_entry *__xfrm4_dst_lookup(struct flowi4 *fl4, fl4->flowi4_mark = params->mark;if (params->saddr) fl4->saddr = params->saddr->a4; + fl4->flowi4_proto = params->ipproto; + fl4->uli = params->uli; rt =__ip_route_output_key (params->net, fl4);if (!IS_ERR (rt))
net/ipv6/xfrm6_policy.c +3 -0
@@ -37,6 +37,9 @@ static struct dst_entry *xfrm6_dst_lookup(const struct xfrm_dst_lookup_params *pif (params->saddr)memcpy (&fl6.saddr, params->saddr,sizeof (fl6.saddr)); + fl6.flowi4_proto = params->ipproto; + fl6.uli = params->uli; + dst =ip6_route_output (params->net,NULL , &fl6); err = dst->error;
net/xfrm/xfrm_policy.c +15 -0
@@ -296,6 +296,21 @@ static inline struct dst_entry *xfrm_dst_lookup(struct xfrm_state *x, params.tos = tos; params.oif = oif; params.mark = mark; + params.ipproto = x->id.proto; +if (x->encap) { +switch (x->encap->encap_type) { +case UDP_ENCAP_ESPINUDP : + params.ipproto =IPPROTO_UDP ; + params.uli.ports.sport = x->encap->encap_sport; + params.uli.ports.dport = x->encap->encap_dport; +break ; +case TCP_ENCAP_ESPINTCP : + params.ipproto =IPPROTO_TCP ; + params.uli.ports.sport = x->encap->encap_sport; + params.uli.ports.dport = x->encap->encap_dport; +break ; + } + } dst =__xfrm_dst_lookup (family, ¶ms);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/80 net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Hai <[email protected]>
[ Upstream commit 2cb3f56e827abb22c4168ad0c1bbbf401bb2f3b8 ]
The sun3_82586_send_packet() returns NETDEV_TX_OK without freeing skb in case of skb->len being too long, add dev_kfree_skb() to fix it.
Message-ID: <[email protected]>
--- drivers/net/ethernet/i825xx/sun3_82586.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/i825xx/sun3_82586.c +1 -0
@@ -1012,6 +1012,7 @@ sun3_82586_send_packet(struct sk_buff *skb, struct net_device *dev)if (skb->len >XMIT_BUFF_SIZE ) {printk ("%s: Sorry, max. framelength is %d bytes. The length of your frame is %d bytes.\n" ,dev->name,XMIT_BUFF_SIZE ,skb->len); +dev_kfree_skb (skb);return NETDEV_TX_OK ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/80 be2net: fix potential memory leak in be_xmit()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Hai <[email protected]>
[ Upstream commit e4dd8bfe0f6a23acd305f9b892c00899089bd621 ]
The be_xmit() returns NETDEV_TX_OK without freeing skb
in case of be_xmit_enqueue() fails, add dev_kfree_skb_any() to fix it.
Message-ID: <[email protected]>
--- drivers/net/ethernet/emulex/benet/be_main.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/ethernet/emulex/benet/be_main.c +5 -5
@@ -1382,10 +1382,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev)be_get_wrb_params_from_skb (adapter, skb, &wrb_params); wrb_cnt =be_xmit_enqueue (adapter, txo, skb, &wrb_params); -if (unlikely (!wrb_cnt)) { -dev_kfree_skb_any (skb); - goto drop; - } +if (unlikely (!wrb_cnt)) + goto drop_skb;/* if os2bmc is enabled and if the pkt is destined to bmc, * enqueue the pkt a 2nd time with mgmt bit set.
@@ -1394,7 +1392,7 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev)BE_WRB_F_SET (wrb_params.features,OS2BMC ,1 ); wrb_cnt =be_xmit_enqueue (adapter, txo, skb, &wrb_params);if (unlikely (!wrb_cnt)) - goto drop; + goto drop_skb;else skb_get (skb); }
@@ -1408,6 +1406,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev)be_xmit_flush (adapter, txo);return NETDEV_TX_OK ; +drop_skb: +dev_kfree_skb_any (skb); drop:tx_stats (txo)->tx_drv_drops++;/* Flush the already enqueued tx requests */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/80 net: plip: fix break; causing plip to never transmit
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Boehm <[email protected]>
[ Upstream commit f99cf996ba5a315f8b9f13cc21dff0604a0eb749 ]
Since commit
71ae2cb30531 ("net: plip: Fix fall-through warnings for Clang")
plip was not able to send any packets, this patch replaces one unintended break; with fallthrough; which was originally missed by commit 9525d69a3667 ("net: plip: mark expected switch fall-throughs").
I have verified with a real hardware PLIP connection that everything works once again after applying this patch.
Message-ID: <[email protected]>
--- drivers/net/plip/plip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/plip/plip.c +1 -1
@@ -811,7 +811,7 @@ plip_send_packet(struct net_device *dev, struct net_local *nl,return HS_TIMEOUT ; } } -break ; + fallthrough;case PLIP_PK_LENGTH_LSB : if (plip_send(nibble_timeout, dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/80 net: dsa: mv88e6xxx: Fix error when setting port policy on mv88e6393x
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Rashleigh <[email protected]>
[ Upstream commit 12bc14949c4a7272b509af0f1022a0deeb215fd8 ]
mv88e6393x_port_set_policy doesn't correctly shift the ptr value when converting the policy format between the old and new styles, so the target register ends up with the ptr being written over the data bits.
Shift the pointer to align with the format expected by mv88e6393x_port_policy_write().
Message-ID: <[email protected]>
--- drivers/net/dsa/mv88e6xxx/port.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/dsa/mv88e6xxx/port.c +1 -0
@@ -1699,6 +1699,7 @@ int mv88e6393x_port_set_policy(struct mv88e6xxx_chip *chip, int port, ptr = shift /8 ; shift %=8 ; mask >>= ptr *8 ; + ptr <<=8 ; err =mv88e6393x_port_policy_read (chip, port, ptr, ®);if (err)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/80 netfilter: xtables: fix typo causing some targets not to load on IPv6
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 306ed1728e8438caed30332e1ab46b28c25fe3d8 ]
- There is no NFPROTO_IPV6 family for mark and NFLOG.
- TRACE is also missing module autoload with NFPROTO_IPV6.
This results in ip6tables failing to restore a ruleset. This issue has been reported by several users providing incomplete patches.
Very similar to Ilya Katsnelson's patch including a missing chunk in the TRACE extension.
--- net/netfilter/xt_NFLOG.c | 2 +- net/netfilter/xt_TRACE.c | 1 + net/netfilter/xt_mark.c | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-)
net/netfilter/xt_NFLOG.c +1 -1
@@ -79,7 +79,7 @@ static struct xt_target nflog_tg_reg[] __read_mostly = { { .name = "NFLOG", .revision = 0, - .family = NFPROTO_IPV4, + .family = NFPROTO_IPV6, .checkentry = nflog_tg_check, .destroy = nflog_tg_destroy, .target = nflog_tg,
net/netfilter/xt_TRACE.c +1 -0
@@ -49,6 +49,7 @@ static struct xt_target trace_tg_reg[] __read_mostly = { .target = trace_tg, .checkentry = trace_tg_check, .destroy = trace_tg_destroy, + .me = THIS_MODULE, },#endif };
net/netfilter/xt_mark.c +1 -1
@@ -62,7 +62,7 @@ static struct xt_target mark_tg_reg[] __read_mostly = { { .name = "MARK", .revision = 2, - .family = NFPROTO_IPV4, + .family = NFPROTO_IPV6, .target = mark_tg, .targetsize = sizeof(struct xt_mark_tginfo2), .me = THIS_MODULE,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/80 net: wwan: fix global oob in wwan_rtnl_policy
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <[email protected]>
[ Upstream commit 47dd5447cab8ce30a847a0337d5341ae4c7476a7 ]
The variable wwan_rtnl_link_ops assign a *bigger* maxtype which leads to a global out-of-bounds read when parsing the netlink attributes. Exactly same bug cause as the oob fixed in commit b33fb5b801c6 ("net: qualcomm:
rmnet: fix global oob in rmnet_policy").
==================================================================
BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:388 [inline] BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x19d7/0x29a0 lib/nlattr.c:603 Read of size 1 at addr ffffffff8b09cb60 by task syz.1.66276/323862 CPU: 0 PID: 323862 Comm: syz.1.66276 Not tainted 6.1.70 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x177/0x231 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x14f/0x750 mm/kasan/report.c:395 kasan_report+0x139/0x170 mm/kasan/report.c:495 validate_nla lib/nlattr.c:388 [inline] __nla_validate_parse+0x19d7/0x29a0 lib/nlattr.c:603 __nla_parse+0x3c/0x50 lib/nlattr.c:700 nla_parse_nested_deprecated include/net/netlink.h:1269 [inline] __rtnl_newlink net/core/rtnetlink.c:3514 [inline] rtnl_newlink+0x7bc/0x1fd0 net/core/rtnetlink.c:3623 rtnetlink_rcv_msg+0x794/0xef0 net/core/rtnetlink.c:6122 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline] netlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352 netlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874 sock_sendmsg_nosec net/socket.c:716 [inline] __sock_sendmsg net/socket.c:728 [inline] ____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499 ___sys_sendmsg+0x21c/0x290 net/socket.c:2553 __sys_sendmsg net/socket.c:2582 [inline] __do_sys_sendmsg net/socket.c:2591 [inline] __se_sys_sendmsg+0x19e/0x270 net/socket.c:2589 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x90 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f67b19a24ad RSP: 002b:00007f67b17febb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f67b1b45f80 RCX: 00007f67b19a24ad RDX: 0000000000000000 RSI: 0000000020005e40 RDI: 0000000000000004 RBP: 00007f67b1a1e01d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd2513764f R14: 00007ffd251376e0 R15: 00007f67b17fed40 </TASK> The buggy address belongs to the variable: wwan_rtnl_policy+0x20/0x40 The buggy address belongs to the physical page: page:ffffea00002c2700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xb09c flags: 0xfff00000001000(reserved|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000001000 ffffea00002c2708 ffffea00002c2708 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected
page_owner info is not present (never set?)
Memory state around the buggy address:
ffffffff8b09ca00: 05 f9 f9 f9 05 f9 f9 f9 00 01 f9 f9 00 01 f9 f9
ffffffff8b09ca80: 00 00 00 05 f9 f9 f9 f9 00 00 03 f9 f9 f9 f9 f9
>ffffffff8b09cb00: 00 00 00 00 05 f9 f9 f9 00 00 00 00 f9 f9 f9 f9
^
ffffffff8b09cb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================According to the comment of nla_parse_nested_deprecated, use correct size IFLA_WWAN_MAX here to fix this issue.
--- drivers/net/wwan/wwan_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wwan/wwan_core.c +1 -1
@@ -927,7 +927,7 @@ static const struct nla_policy wwan_rtnl_policy[IFLA_WWAN_MAX + 1] = {static struct rtnl_link_ops wwan_rtnl_link_ops__read_mostly = { .kind ="wwan" , - .maxtype = __IFLA_WWAN_MAX, + .maxtype =IFLA_WWAN_MAX , .alloc = wwan_rtnl_alloc, .validate = wwan_rtnl_validate, .newlink = wwan_rtnl_newlink,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/80 net: usb: usbnet: fix name regression
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit 8a7d12d674ac6f2147c18f36d1e15f1a48060edf ]
The fix for MAC addresses broke detection of the naming convention because it gave network devices no random MAC before bind() was called. This means that the check for the local assignment bit was always negative as the address was zeroed from allocation, instead of from overwriting the MAC with a unique hardware address.
The correct check for whether bind() has altered the MAC is done with is_zero_ether_addr
--- drivers/net/usb/usbnet.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/usb/usbnet.c +2 -1
@@ -1769,7 +1769,8 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)// can rename the link if it knows better. if ((dev->driver_info->flags &FLAG_ETHER ) !=0 && ((dev->driver_info->flags &FLAG_POINTTOPOINT ) ==0 || - (net->dev_addr [0 ] &0x02 ) ==0 )) +/* somebody touched it*/ + !is_zero_ether_addr (net->dev_addr)))strscpy (net->name,"eth%d" ,sizeof (net->name));/* WLAN devices should always be named "wlan%d" */ if ((dev->driver_info->flags &FLAG_WLAN ) !=0 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/80 net: sched: fix use-after-free in taprio_change()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit f504465970aebb2467da548f7c1efbbf36d0f44b ]
In 'taprio_change()', 'admin' pointer may become dangling due to sched switch / removal caused by 'advance_sched()', and critical section protected by 'q->current_entry_lock' is too small to prevent from such a scenario (which causes use-after-free detected by KASAN). Fix this by prefer 'rcu_replace_pointer()' over 'rcu_assign_pointer()' to update 'admin' immediately before an attempt to schedule freeing.
--- net/sched/sch_taprio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sched/sch_taprio.c +2 -1
@@ -1612,7 +1612,8 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt,taprio_start_sched (sch, start, new_admin); -rcu_assign_pointer (q->admin_sched, new_admin); + admin =rcu_replace_pointer (q->admin_sched, new_admin, +lockdep_rtnl_is_held ());if (admin)call_rcu (&admin->rcu, taprio_free_sched_cb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/80 r8169: avoid unsolicited interrupts
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit 10ce0db787004875f4dba068ea952207d1d8abeb ]
It was reported that after resume from suspend a PCI error is logged and connectivity is broken. Error message is:
PCI error (cmd = 0x0407, status_errs = 0x0000)
The message seems to be a red herring as none of the error bits is set, and the PCI command register value also is normal. Exception handling for a PCI error includes a chip reset what apparently brakes connectivity here. The interrupt status bit triggering the PCI error handling isn't actually used on PCIe chip versions, so it's not clear why this bit is set by the chip. Fix this by ignoring this bit on PCIe chip versions.
--- drivers/net/ethernet/realtek/r8169_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/realtek/r8169_main.c +3 -1
@@ -4627,7 +4627,9 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)if ((status &0xffff ) ==0xffff || !(status & tp->irq_mask))return IRQ_NONE ; -if (unlikely (status & SYSErr)) { +/* At least RTL8168fp may unexpectedly set the SYSErr bit */ +if (unlikely (status & SYSErr && + tp->mac_version <=RTL_GIGA_MAC_VER_06 )) {rtl8169_pcierr_interrupt (tp->dev); goto out; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/80 posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 6e62807c7fbb3c758d233018caf94dfea9c65dbd ]
If get_clock_desc() succeeds, it calls fget() for the clockid's fd, and get the clk->rwsem read lock, so the error path should release the lock to make the lock balance and fput the clockid's fd to make the refcount balance and release the fd related resource.
However the below commit left the error path locked behind resulting in unbalanced locking. Check timespec64_valid_strict() before get_clock_desc() to fix it, because the "ts" is not changed after that.
--- kernel/time/posix-clock.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
kernel/time/posix-clock.c +3 -3
@@ -290,6 +290,9 @@ static int pc_clock_settime(clockid_t id, const struct timespec64 *ts)struct posix_clock_desc cd;int err; +if (!timespec64_valid_strict (ts)) +return -EINVAL ; + err =get_clock_desc (id, &cd);if (err)return err;
@@ -299,9 +302,6 @@ static int pc_clock_settime(clockid_t id, const struct timespec64 *ts) goto out; } -if (!timespec64_valid_strict (ts)) -return -EINVAL ; -if (cd.clk->ops.clock_settime) err = cd.clk->ops.clock_settime (cd.clk, ts);else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/80 bpf,perf: Fix perf_event_detach_bpf_prog error handling
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
[ Upstream commit 0ee288e69d033850bc87abe0f9cc3ada24763d7f ]
Peter reported that perf_event_detach_bpf_prog might skip to release the bpf program for -ENOENT error from bpf_prog_array_copy.
This can't happen because bpf program is stored in perf event and is detached and released only when perf event is freed.
Let's drop the -ENOENT check and make sure the bpf program is released in any case.
--- kernel/trace/bpf_trace.c | 2 -- 1 file changed, 2 deletions(-)
kernel/trace/bpf_trace.c +0 -2
@@ -1790,8 +1790,6 @@ void perf_event_detach_bpf_prog(struct perf_event *event) old_array =bpf_event_rcu_dereference (event->tp_event->prog_array); ret =bpf_prog_array_copy (old_array, event->prog,NULL ,0 , &new_array); -if (ret == -ENOENT ) - goto unlock;if (ret <0 ) {bpf_prog_array_delete_safe (old_array, event->prog); }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/80 ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Shumilin <[email protected]>
[ Upstream commit 72cafe63b35d06b5cfbaf807e90ae657907858da ]
The step variable is initialized to zero. It is changed in the loop, but if it's not changed it will remain zero. Add a variable check before the division.
The observed behavior was introduced by commit 826b5de90c0b ("ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size"), and it is difficult to show that any of the interval parameters will satisfy the snd_interval_test() condition with data from the amdtp_rate_table[] table.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- sound/firewire/amdtp-stream.c | 3 +++ 1 file changed, 3 insertions(+)
sound/firewire/amdtp-stream.c +3 -0
@@ -172,6 +172,9 @@ static int apply_constraint_to_size(struct snd_pcm_hw_params *params, step =max (step, amdtp_syt_intervals[i]); } +if (step ==0 ) +return -EINVAL ; + t.min =roundup (s->min, step); t.max =rounddown (s->max, step); t.integer =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/80 ALSA: hda/realtek: Update default depop procedure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
[ Upstream commit e3ea2757c312e51bbf62ebc434a6f7df1e3a201f ]
Old procedure has a chance to meet Headphone no output.
--- sound/pci/hda/patch_realtek.c | 38 ++++++++++++++++------------------- 1 file changed, 17 insertions(+), 21 deletions(-)
sound/pci/hda/patch_realtek.c +17 -21
@@ -3848,20 +3848,18 @@ static void alc_default_init(struct hda_codec *codec) hp_pin_sense =snd_hda_jack_detect (codec, hp_pin); -if (hp_pin_sense) +if (hp_pin_sense) {msleep (2 ); -snd_hda_codec_write (codec, hp_pin,0 , -AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); - -if (hp_pin_sense) -msleep (85 ); +snd_hda_codec_write (codec, hp_pin,0 , +AC_VERB_SET_PIN_WIDGET_CONTROL ,PIN_OUT ); -snd_hda_codec_write (codec, hp_pin,0 , -AC_VERB_SET_PIN_WIDGET_CONTROL ,PIN_OUT ); +msleep (75 ); -if (hp_pin_sense) -msleep (100 ); +snd_hda_codec_write (codec, hp_pin,0 , +AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_UNMUTE ); +msleep (75 ); + } }static void alc_default_shutup (struct hda_codec *codec)
@@ -3877,22 +3875,20 @@ static void alc_default_shutup(struct hda_codec *codec) hp_pin_sense =snd_hda_jack_detect (codec, hp_pin); -if (hp_pin_sense) +if (hp_pin_sense) {msleep (2 ); -snd_hda_codec_write (codec, hp_pin,0 , -AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); - -if (hp_pin_sense) -msleep (85 ); - -if (!spec->no_shutup_pins)snd_hda_codec_write (codec, hp_pin,0 , -AC_VERB_SET_PIN_WIDGET_CONTROL ,0x0 ); +AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); -if (hp_pin_sense) -msleep (100 ); +msleep (75 ); +if (!spec->no_shutup_pins) +snd_hda_codec_write (codec, hp_pin,0 , +AC_VERB_SET_PIN_WIDGET_CONTROL ,0x0 ); + +msleep (75 ); + }alc_auto_setup_eapd (codec, false);alc_shutup_pins (codec); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/80 btrfs: zoned: fix zone unusable accounting for freed reserved extent
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <[email protected]>
commit bf9821ba4792a0d9a2e72803ae7b4341faf3d532 upstream.
When btrfs reserves an extent and does not use it (e.g, by an error), it calls btrfs_free_reserved_extent() to free the reserved extent. In the process, it calls btrfs_add_free_space() and then it accounts the region bytes as block_group->zone_unusable.
However, it leaves the space_info->bytes_zone_unusable side not updated. As a result, ENOSPC can happen while a space_info reservation succeeded. The reservation is fine because the freed region is not added in space_info->bytes_zone_unusable, leaving that space as "free". OTOH, corresponding block group counts it as zone_unusable and its allocation pointer is not rewound, we cannot allocate an extent from that block group. That will also negate space_info's async/sync reclaim process, and cause an ENOSPC error from the extent allocation process.
Fix that by returning the space to space_info->bytes_zone_unusable. Ideally, since a bio is not submitted for this reserved region, we should return the space to free space and rewind the allocation pointer. But, it needs rework on extent allocation handling, so let it work in this way for now.
--- fs/btrfs/block-group.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/block-group.c +2 -0
@@ -3386,6 +3386,8 @@ void btrfs_free_reserved_bytes(struct btspin_lock (&cache->lock);if (cache->ro) space_info->bytes_readonly += num_bytes; +else if (btrfs_is_zoned (cache->fs_info)) + space_info->bytes_zone_unusable += num_bytes; cache->reserved -= num_bytes; space_info->bytes_reserved -= num_bytes; space_info->max_extent_size =0 ;
Greg Kroah-Hartman
maintainerPATCH 68/80 drm/amd: Guard against bad data for ATIF ACPI method
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit bf58f03931fdcf7b3c45cb76ac13244477a60f44 upstream.
If a BIOS provides bad data in response to an ATIF method call this causes a NULL pointer dereference in the caller.
``` ? show_regs (arch/x86/kernel/dumpstack.c:478 (discriminator 1)) ? __die (arch/x86/kernel/dumpstack.c:423 arch/x86/kernel/dumpstack.c:434) ? page_fault_oops (arch/x86/mm/fault.c:544 (discriminator 2) arch/x86/mm/fault.c:705 (discriminator 2)) ? do_user_addr_fault (arch/x86/mm/fault.c:440 (discriminator 1) arch/x86/mm/fault.c:1232 (discriminator 1)) ? acpi_ut_update_object_reference (drivers/acpi/acpica/utdelete.c:642) ? exc_page_fault (arch/x86/mm/fault.c:1542) ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623) ? amdgpu_atif_query_backlight_caps.constprop.0 (drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c:387 (discriminator 2)) amdgpu ? amdgpu_atif_query_backlight_caps.constprop.0 (drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c:386 (discriminator 1)) amdgpu ```
It has been encountered on at least one system, so guard for it.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +12 -3
@@ -108,6 +108,7 @@ static union acpi_object *amdgpu_atif_ca struct acpi_buffer *params) {acpi_status status; +union acpi_object *obj;union acpi_object atif_arg_elements[2 ];struct acpi_object_list atif_arg;struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER ,NULL };
@@ -130,16 +131,24 @@ static union acpi_object *amdgpu_atif_ca status =acpi_evaluate_object (atif->handle,NULL , &atif_arg, &buffer); + obj = (union acpi_object *)buffer.pointer; -/* Fail only if calling the method fails and ATIF is supported */ +/* Fail if calling the method fails and ATIF is supported */ if (ACPI_FAILURE (status) && status !=AE_NOT_FOUND ) {DRM_DEBUG_DRIVER ("failed to evaluate ATIF got %s\n" ,acpi_format_exception (status)); -kfree (buffer.pointer); +kfree (obj);return NULL ; } -return buffer.pointer; +if (obj->type !=ACPI_TYPE_BUFFER ) { +DRM_DEBUG_DRIVER ("bad object returned from ATIF: %d\n" , + obj->type); +kfree (obj); +return NULL ; + } + +return obj; }/**
Greg Kroah-Hartman
maintainerPATCH 69/80 ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[]
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Heusel <[email protected]>
commit 53f1a907d36fb3aa02a4d34073bcec25823a6c74 upstream.
The LG Gram Pro 16 2-in-1 (2024) the 16T90SP has its keybopard IRQ (1) described as ActiveLow in the DSDT, which the kernel overrides to EdgeHigh which breaks the keyboard.
Add the 16T90SP to the irq1_level_low_skip_override[] quirk table to fix this.
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -505,6 +505,13 @@ static const struct dmi_system_id tongfa DMI_MATCH(DMI_BOARD_NAME, "GMxRGxx"), }, }, + { + /* LG Electronics 16T90SP */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"), + DMI_MATCH(DMI_BOARD_NAME, "16T90SP"), + }, + }, { } };
Greg Kroah-Hartman
maintainerPATCH 70/80 ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shubham Panwar <[email protected]>
commit 8fa73ee44daefc884c53a25158c25a4107eb5a94 upstream.
Add a DMI quirk for Samsung Galaxy Book2 to fix an initial lid state detection issue.
The _LID device incorrectly returns the lid status as "closed" during boot, causing the system to enter a suspend loop right after booting.
The quirk ensures that the correct lid state is reported initially, preventing the system from immediately suspending after startup. It only addresses the initial lid state detection and ensures proper system behavior upon boot.
--- drivers/acpi/button.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/acpi/button.c +11 -0
@@ -130,6 +130,17 @@ static const struct dmi_system_id dmi_li }, .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN, }, + { + /* + * Samsung galaxybook2 ,initial _LID device notification returns + * lid closed. + */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), + DMI_MATCH(DMI_PRODUCT_NAME, "750XED"), + }, + .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN, + }, {} };
Greg Kroah-Hartman
maintainerPATCH 71/80 nilfs2: fix kernel bug due to missing clearing of buffer delay flag
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit 6ed469df0bfbef3e4b44fca954a781919db9f7ab upstream.
Syzbot reported that after nilfs2 reads a corrupted file system image and degrades to read-only, the BUG_ON check for the buffer delay flag in submit_bh_wbc() may fail, causing a kernel bug.
This is because the buffer delay flag is not cleared when clearing the buffer state flags to discard a page/folio or a buffer head. So, fix this.
This became necessary when the use of nilfs2's own page clear routine was expanded. This state inconsistency does not occur if the buffer is written normally by log writing.
--- fs/nilfs2/page.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/nilfs2/page.c +4 -2
@@ -77,7 +77,8 @@ void nilfs_forget_buffer(struct buffer_hconst unsigned long clear_bits = (BIT (BH_Uptodate) |BIT (BH_Dirty) |BIT (BH_Mapped) |BIT (BH_Async_Write) |BIT (BH_NILFS_Volatile) | -BIT (BH_NILFS_Checked) |BIT (BH_NILFS_Redirected)); +BIT (BH_NILFS_Checked) |BIT (BH_NILFS_Redirected) | +BIT (BH_Delay));lock_buffer (bh);set_mask_bits (&bh->b_state, clear_bits,0 );
@@ -409,7 +410,8 @@ void nilfs_clear_dirty_page(struct pageconst unsigned long clear_bits = (BIT (BH_Uptodate) |BIT (BH_Dirty) |BIT (BH_Mapped) |BIT (BH_Async_Write) |BIT (BH_NILFS_Volatile) | -BIT (BH_NILFS_Checked) |BIT (BH_NILFS_Redirected)); +BIT (BH_NILFS_Checked) |BIT (BH_NILFS_Redirected) | +BIT (BH_Delay)); bh = head =page_buffers (page); do {
Greg Kroah-Hartman
maintainerPATCH 72/80 openat2: explicitly return -E2BIG for (usize > PAGE_SIZE)
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksa Sarai <[email protected]>
commit f92f0a1b05698340836229d791b3ffecc71b265a upstream.
While we do currently return -EFAULT in this case, it seems prudent to follow the behaviour of other syscalls like clone3. It seems quite unlikely that anyone depends on this error code being EFAULT, but we can always revert this if it turns out to be an issue.
--- fs/open.c | 2 ++ 1 file changed, 2 insertions(+)
fs/open.c +2 -0
@@ -1296,6 +1296,8 @@ SYSCALL_DEFINE4(openat2, int, dfd, constif (unlikely (usize <OPEN_HOW_SIZE_VER0 ))return -EINVAL ; +if (unlikely (usize >PAGE_SIZE )) +return -E2BIG ; err =copy_struct_from_user (&tmp,sizeof (tmp), how, usize);if (err)
Greg Kroah-Hartman
maintainerPATCH 73/80 KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit f559b2e9c5c5308850544ab59396b7d53cfc67bd upstream.
Ignore nCR3[4:0] when loading PDPTEs from memory for nested SVM, as bits 4:0 of CR3 are ignored when PAE paging is used, and thus VMRUN doesn't enforce 32-byte alignment of nCR3.
In the absolute worst case scenario, failure to ignore bits 4:0 can result in an out-of-bounds read, e.g. if the target page is at the end of a memslot, and the VMM isn't using guard pages.
Per the APM:
The CR3 register points to the base address of the page-directory-pointer table. The page-directory-pointer table is aligned on a 32-byte boundary, with the low 5 address bits 4:0 assumed to be 0.
And the SDM's much more explicit:
4:0 Ignored
Note, KVM gets this right when loading PDPTRs, it's only the nSVM flow that is broken.
Message-ID: <[email protected]>
--- arch/x86/kvm/svm/nested.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/x86/kvm/svm/nested.c +5 -1
@@ -77,8 +77,12 @@ static u64 nested_svm_get_tdp_pdptr(struu64 pdpte;int ret; +/* +* Note, nCR3 is "assumed" to be 32-byte aligned, i.e. the CPU ignores +* nCR3[4:0] when loading PDPTEs from memory. +*/ ret =kvm_vcpu_read_guest_page (vcpu,gpa_to_gfn (cr3), &pdpte, -offset_in_page (cr3) + index *8 ,8 ); + (cr3 &GENMASK (11 ,5 )) + index *8 ,8 );if (ret)return 0 ;return pdpte;
Greg Kroah-Hartman
maintainerPATCH 74/80 ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Relvas <[email protected]>
commit 35fdc6e1c16099078bcbd73a6c8f1733ae7f1909 upstream.
The Acer Predator G9-593 has a 2+1 speaker system which isn't probed correctly.
This patch adds a quirk with the proper pin connections.
Note that I do not own this laptop, so I cannot guarantee that this fixes the issue.
Testing was done by other users here:
https://discussion.fedoraproject.org/t/-/118482
This model appears to have two different dev IDs...
- 0x1177 (as seen on the forum link above)
- 0x1178 (as seen on https://linux-hardware.org/?probe=127df9999f)
I don't think the audio system was changed between model revisions, so the patch applies for both IDs.
--- sound/pci/hda/patch_realtek.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
sound/pci/hda/patch_realtek.c +10 -0
@@ -7024,6 +7024,7 @@ enum {ALC286_FIXUP_ACER_AIO_HEADSET_MIC ,ALC256_FIXUP_ASUS_HEADSET_MIC ,ALC256_FIXUP_ASUS_MIC_NO_PRESENCE , +ALC255_FIXUP_PREDATOR_SUBWOOFER ,ALC299_FIXUP_PREDATOR_SPK ,ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE , ALC289_FIXUP_DELL_SPK2,
@@ -8259,6 +8260,13 @@ static const struct hda_fixup alc269_fix .chained = true, .chain_id =ALC256_FIXUP_ASUS_HEADSET_MODE }, + [ALC255_FIXUP_PREDATOR_SUBWOOFER] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x17 ,0x90170151 },/* use as internal speaker (LFE) */ + {0x1b ,0x90170152 }/* use as internal speaker (back) */ + } + }, [ALC299_FIXUP_PREDATOR_SPK] = { .type = HDA_FIXUP_PINS, .v.pins = (const struct hda_pintbl []) {
@@ -8997,6 +9005,8 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1025 ,0x110e ,"Acer Aspire ES1-432" ,ALC255_FIXUP_ACER_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1025 ,0x1166 ,"Acer Veriton N4640G" ,ALC269_FIXUP_LIFEBOOK ),SND_PCI_QUIRK (0x1025 ,0x1167 ,"Acer Veriton N6640G" ,ALC269_FIXUP_LIFEBOOK ), +SND_PCI_QUIRK (0x1025 ,0x1177 ,"Acer Predator G9-593" ,ALC255_FIXUP_PREDATOR_SUBWOOFER ), +SND_PCI_QUIRK (0x1025 ,0x1178 ,"Acer Predator G9-593" ,ALC255_FIXUP_PREDATOR_SUBWOOFER ),SND_PCI_QUIRK (0x1025 ,0x1246 ,"Acer Predator Helios 500" ,ALC299_FIXUP_PREDATOR_SPK ),SND_PCI_QUIRK (0x1025 ,0x1247 ,"Acer vCopperbox" ,ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS ), SND_PCI_QUIRK(0x1025, 0x1248, "Acer Veriton N4660G", ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE),
Greg Kroah-Hartman
maintainerPATCH 75/80 xfrm: fix one more kernel-infoleak in algo dumping
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Vaganov <[email protected]>
commit 6889cd2a93e1e3606b3f6e958aa0924e836de4d2 upstream.
During fuzz testing, the following issue was discovered:
BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x598/0x2a30 _copy_to_iter+0x598/0x2a30 __skb_datagram_iter+0x168/0x1060 skb_copy_datagram_iter+0x5b/0x220 netlink_recvmsg+0x362/0x1700 sock_recvmsg+0x2dc/0x390 __sys_recvfrom+0x381/0x6d0 __x64_sys_recvfrom+0x130/0x200 x64_sys_call+0x32c8/0x3cc0 do_syscall_64+0xd8/0x1c0 entry_SYSCALL_64_after_hwframe+0x79/0x81
Uninit was stored to memory at:
copy_to_user_state_extra+0xcc1/0x1e00 dump_one_state+0x28c/0x5f0 xfrm_state_walk+0x548/0x11e0 xfrm_dump_sa+0x1e0/0x840 netlink_dump+0x943/0x1c40 __netlink_dump_start+0x746/0xdb0 xfrm_user_rcv_msg+0x429/0xc00 netlink_rcv_skb+0x613/0x780 xfrm_netlink_rcv+0x77/0xc0 netlink_unicast+0xe90/0x1280 netlink_sendmsg+0x126d/0x1490 __sock_sendmsg+0x332/0x3d0 ____sys_sendmsg+0x863/0xc30 ___sys_sendmsg+0x285/0x3e0 __x64_sys_sendmsg+0x2d6/0x560 x64_sys_call+0x1316/0x3cc0 do_syscall_64+0xd8/0x1c0 entry_SYSCALL_64_after_hwframe+0x79/0x81
Uninit was created at:
__kmalloc+0x571/0xd30 attach_auth+0x106/0x3e0 xfrm_add_sa+0x2aa0/0x4230 xfrm_user_rcv_msg+0x832/0xc00 netlink_rcv_skb+0x613/0x780 xfrm_netlink_rcv+0x77/0xc0 netlink_unicast+0xe90/0x1280 netlink_sendmsg+0x126d/0x1490 __sock_sendmsg+0x332/0x3d0 ____sys_sendmsg+0x863/0xc30 ___sys_sendmsg+0x285/0x3e0 __x64_sys_sendmsg+0x2d6/0x560 x64_sys_call+0x1316/0x3cc0 do_syscall_64+0xd8/0x1c0 entry_SYSCALL_64_after_hwframe+0x79/0x81
Bytes 328-379 of 732 are uninitialized Memory access of size 732 starts at ffff88800e18e000 Data copied to user address 00007ff30f48aff0
CPU: 2 PID: 18167 Comm: syz-executor.0 Not tainted 6.8.11 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Fixes copying of xfrm algorithms where some random
data of the structure fields can end up in userspace. Padding in structures may be filled with random (possibly sensitve) data and should never be given directly to user-space.
A similar issue was resolved in the commit 8222d5910dae ("xfrm: Zero padding when dumping algos and encap")
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- net/xfrm/xfrm_user.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/xfrm/xfrm_user.c +3 -1
@@ -887,7 +887,9 @@ static int copy_to_user_auth(struct xfrmif (!nla)return -EMSGSIZE ; ap =nla_data (nla); -memcpy (ap, auth,sizeof (struct xfrm_algo_auth )); +strscpy_pad (ap->alg_name, auth->alg_name,sizeof (ap->alg_name)); + ap->alg_key_len = auth->alg_key_len; + ap->alg_trunc_len = auth->alg_trunc_len;if (redact_secret && auth->alg_key_len)memset (ap->alg_key,0 , (auth->alg_key_len +7 ) /8 );else
Greg Kroah-Hartman
maintainerPATCH 76/80 hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haiyang Zhang <[email protected]>
commit 4c262801ea60c518b5bebc22a09f5b78b3147da2 upstream.
The existing code moves VF to the same namespace as the synthetic NIC during netvsc_register_vf(). But, if the synthetic device is moved to a new namespace after the VF registration, the VF won't be moved together.
To make the behavior more consistent, add a namespace check for synthetic NIC's NETDEV_REGISTER event (generated during its move), and move the VF if it is not in the same namespace.
--- drivers/net/hyperv/netvsc_drv.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
drivers/net/hyperv/netvsc_drv.c +30 -0
@@ -2813,6 +2813,31 @@ static struct hv_driver netvsc_drv = { }, }; +/* Set VF's namespace same as the synthetic NIC */ +static void netvsc_event_set_vf_ns (struct net_device *ndev) +{ +struct net_device_context *ndev_ctx =netdev_priv (ndev); +struct net_device *vf_netdev; +int ret; + + vf_netdev =rtnl_dereference (ndev_ctx->vf_netdev); +if (!vf_netdev) +return ; + +if (!net_eq (dev_net (ndev),dev_net (vf_netdev))) { + ret =dev_change_net_namespace (vf_netdev,dev_net (ndev), +"eth%d" ); +if (ret) +netdev_err (vf_netdev, +"Cannot move to same namespace as %s: %d\n" , + ndev->name, ret); +else +netdev_info (vf_netdev, +"Moved VF to namespace with: %s\n" , + ndev->name); + } +} +/* * On Hyper-V, every VF interface is matched with a corresponding * synthetic interface. The synthetic interface is presented first
@@ -2825,6 +2850,11 @@ static int netvsc_netdev_event(struct nostruct net_device *event_dev =netdev_notifier_info_to_dev (ptr);int ret =0 ; +if (event_dev->netdev_ops == &device_ops && event ==NETDEV_REGISTER ) { +netvsc_event_set_vf_ns (event_dev); +return NOTIFY_DONE ; + } + ret =check_dev_is_matching_vf (event_dev);if (ret !=0 )return NOTIFY_DONE ;
Greg Kroah-Hartman
maintainerPATCH 77/80 selinux: improve error checking in sel_write_load()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Moore <[email protected]>
[ Upstream commit 42c773238037c90b3302bf37a57ae3b5c3f6004a ]
Move our existing input sanity checking to the top of sel_write_load() and add a check to ensure the buffer size is non-zero.
Move a local variable initialization from the declaration to before it is used.
Minor style adjustments.
--- security/selinux/selinuxfs.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-)
security/selinux/selinuxfs.c +14 -13
@@ -619,6 +619,13 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,ssize_t length;void *data =NULL ; +/* no partial writes */ +if (*ppos) +return -EINVAL ; +/* no empty policies */ +if (!count) +return -EINVAL ; +mutex_lock (&fsi->state->policy_mutex); length = avc_has_perm(&selinux_state,
@@ -627,26 +634,21 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,if (length) goto out; -/* No partial writes. */ - length = -EINVAL ; -if (*ppos !=0 ) - goto out; - - length = -ENOMEM ; data =vmalloc (count); -if (!data) +if (!data) { + length = -ENOMEM ; goto out; - - length = -EFAULT ; -if (copy_from_user (data, buf, count) !=0 ) + } +if (copy_from_user (data, buf, count) !=0 ) { + length = -EFAULT ; goto out; + } length =security_load_policy (fsi->state, data, count, &load_state);if (length) {pr_warn_ratelimited ("SELinux: failed to load policy\n" ); goto out; } - length =sel_make_policy_nodes (fsi, load_state.policy);if (length) {pr_warn_ratelimited ("SELinux: failed to initialize selinuxfs\n" );
@@ -655,13 +657,12 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, }selinux_policy_commit (fsi->state, &load_state); - length = count; -audit_log (audit_context (),GFP_KERNEL ,AUDIT_MAC_POLICY_LOAD ,"auid=%u ses=%u lsm=selinux res=1" ,from_kuid (&init_user_ns,audit_get_loginuid (current)),audit_get_sessionid (current)); + out:mutex_unlock (&fsi->state->policy_mutex);vfree (data);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/80 serial: protect uart_port_dtr_rts() in uart_shutdown() too
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <[email protected]>
[ Upstream commit 602babaa84d627923713acaf5f7e9a4369e77473 ]
Commit af224ca2df29 (serial: core: Prevent unsafe uart port access, part
3) added few uport == NULL checks. It added one to uart_shutdown(), so the commit assumes, uport can be NULL in there. But right after that protection, there is an unprotected "uart_port_dtr_rts(uport, false);" call. That is invoked only if HUPCL is set, so I assume that is the reason why we do not see lots of these reports.
Or it cannot be NULL at this point at all for some reason :P.
Until the above is investigated, stay on the safe side and move this dereference to the if too.
I got this inconsistency from Coverity under CID 1585130. Thanks.
[Adapted over commit 5701cb8bf50e ("tty: Call ->dtr_rts() parameter active consistently") not in the tree]
--- drivers/tty/serial/serial_core.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/tty/serial/serial_core.c +9 -7
@@ -286,14 +286,16 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state)/* * Turn off DTR and RTS early. */ -if (uport &&uart_console (uport) && tty) { - uport->cons->cflag = tty->termios.c_cflag; - uport->cons->ispeed = tty->termios.c_ispeed; - uport->cons->ospeed = tty->termios.c_ospeed; - } +if (uport) { +if (uart_console (uport) && tty) { + uport->cons->cflag = tty->termios.c_cflag; + uport->cons->ispeed = tty->termios.c_ispeed; + uport->cons->ospeed = tty->termios.c_ospeed; + } -if (!tty ||C_HUPCL (tty)) -uart_port_dtr_rts (uport,0 ); +if (!tty ||C_HUPCL (tty)) +uart_port_dtr_rts (uport,0 ); + }uart_port_shutdown (port); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/80 net: phy: dp83822: Fix reset pin definitions
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michel Alex <[email protected]>
commit de96f6a3003513c796bbe4e23210a446913f5c00 upstream.
This change fixes a rare issue where the PHY fails to detect a link due to incorrect reset behavior.
The SW_RESET definition was incorrectly assigned to bit 14, which is the Digital Restart bit according to the datasheet. This commit corrects SW_RESET to bit 15 and assigns DIG_RESTART to bit 14 as per the datasheet specifications.
The SW_RESET define is only used in the phy_reset function, which fully re-initializes the PHY after the reset is performed. The change in the bit definitions should not have any negative impact on the functionality of the PHY.
v2:
- added Fixes tag
- improved commit message
Message-ID: <AS1P250MB0608A798661549BF83C4B43EA9462@AS1P250MB0608.EURP250.PROD.OUTLOOK.COM>
--- drivers/net/phy/dp83822.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/phy/dp83822.c +2 -2
@@ -40,8 +40,8 @@/* Control Register 2 bits */ #define DP83822_FX_ENABLE BIT(14) -#define DP83822_HW_RESET BIT(15) -#define DP83822_SW_RESET BIT(14) +#define DP83822_SW_RESET BIT(15) +#define DP83822_DIG_RESTART BIT(14)/* PHY STS bits */ #define DP83822_PHYSTS_DUPLEX BIT(2)
Greg Kroah-Hartman
maintainerPATCH 80/80 ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zichen Xie <[email protected]>
commit 49da1463c9e3d2082276c3e0e2a8b65a88711cd2 upstream.
A devm_kzalloc() in asoc_qcom_lpass_cpu_platform_probe() could possibly return NULL pointer. NULL Pointer Dereference may be triggerred without addtional check.
Add a NULL check for the returned pointer.
--- sound/soc/qcom/lpass-cpu.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/qcom/lpass-cpu.c +2 -0
@@ -975,6 +975,8 @@ int asoc_qcom_lpass_cpu_platform_probe(s/* Allocation for i2sctl regmap fields */ drvdata->i2sctl =devm_kzalloc (&pdev->dev,sizeof (struct lpaif_i2sctl ),GFP_KERNEL ); +if (!drvdata->i2sctl) +return -ENOMEM ;/* Initialize bitfields for dai I2SCTL register */ ret = lpass_cpu_init_i2sctl_bitfields(dev, drvdata->i2sctl,
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.170 release. There are 80 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Hello,
Quoted 7 lines · On Mon, 28 Oct 2024 07:24:40 +0100 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 5.15.170 release. There are 80 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Oct 2024 06:22:39 +0000. Anything received after that time might be too late.
This rc kernel passes DAMON functionality test[1] on my test machine. Attaching the test results summary below. Please note that I retrieved the kernel from linux-stable-rc tree[2].
[1] https://github.com/damonitor/damon-tests/tree/next/corr
[2] be79a1947245 ("Linux 5.15.170-rc1")
Thanks,
SJ
[...]
---
ok 1 selftests: damon: debugfs_attrs.sh
ok 1 selftests: damon-tests: kunit.sh
ok 2 selftests: damon-tests: huge_count_read_write.sh
ok 3 selftests: damon-tests: buffer_overflow.sh
ok 4 selftests: damon-tests: rm_contexts.sh
ok 5 selftests: damon-tests: record_null_deref.sh
ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh
ok 8 selftests: damon-tests: damo_tests.sh
ok 9 selftests: damon-tests: masim-record.sh
ok 10 selftests: damon-tests: build_i386.sh
ok 11 selftests: damon-tests: build_arm64.sh # SKIP
ok 12 selftests: damon-tests: build_m68k.sh # SKIP
ok 13 selftests: damon-tests: build_i386_idle_flag.sh
ok 14 selftests: damon-tests: build_i386_highpte.sh
ok 15 selftests: damon-tests: build_nomemcg.sh
[33m
[92mPASS [39m
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.170 release. There are 80 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Oct 2024 06:22:39 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.170-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Thanks,
Hardik
Hi Greg,
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.170 release. There are 80 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
No problems seen on x86_64 and aarch64 with our testing.
Thanks,
Harshit
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.170 release. There are 80 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Oct 2024 06:22:39 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.170-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 5.15.170-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: cebe213d2a87dfac79e970b8902e0c80cfffae9b
* git describe: v5.15.168-164-gcebe213d2a87
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.15.y/build/v5.15.168-164-gcebe213d2a87
## Test Regressions (compared to v5.15.168-83-g4d74f086d8cf)
## Metric Regressions (compared to v5.15.168-83-g4d74f086d8cf)
## Test Fixes (compared to v5.15.168-83-g4d74f086d8cf)
## Metric Fixes (compared to v5.15.168-83-g4d74f086d8cf)
## Test result summary
total: 68730, pass: 51797, fail: 1825, skip: 15012, xfail: 96
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 102 total, 102 passed, 0 failed
* arm64: 29 total, 29 passed, 0 failed
* i386: 23 total, 23 passed, 0 failed
* mips: 22 total, 22 passed, 0 failed
* parisc: 3 total, 3 passed, 0 failed
* powerpc: 24 total, 24 passed, 0 failed
* riscv: 8 total, 8 passed, 0 failed
* s390: 9 total, 9 passed, 0 failed
* sh: 10 total, 10 passed, 0 failed
* sparc: 6 total, 6 passed, 0 failed
* x86_64: 25 total, 25 passed, 0 failed
## Test suites summary
* boot
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-watchdog
* kselftest-x86
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org
Quoted 14 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.170 release. There are 80 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Oct 2024 06:22:39 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.170-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.
Quoted 5 lines
thanks,
greg k-h
-------------
Hi,
Please find the KernelCI report below :-
OVERVIEW
Builds: 23 passed, 0 failed
Boot tests: 39 passed, 6 failed
CI systems: maestro
REVISION
Commit
name: 5.15.170-rc1
hash: a203ce258bb66ceea0d88b41de9b16cd41a6895f
Checked out from
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.yBUILDS
No new build failures found
BOOT TESTS
Failures
- i386 (defconfig)
Error detail: BUG: kernel NULL pointer dereference, address: 000002fc
Error: https://kcidb.kernelci.org/d/test/test?var-datasource=edquppk2ghfcwc&var-origin=maestro&var-build_architecture=All&var-build_config_name=All&var-id=maestro:67203122aaccbda536603534&orgId=1
- i386 (defconfig)
Error detail: BUG: kernel NULL pointer dereference, address: 000002fc
Error: https://kcidb.kernelci.org/d/test/test?var-datasource=edquppk2ghfcwc&var-origin=maestro&var-build_architecture=All&var-build_config_name=All&var-id=maestro:67203125aaccbda536603557&orgId=1
- x86_64 (x86_64_defconfig)
Error detail: BUG: kernel NULL pointer dereference, address: 000002fc
Error: https://kcidb.kernelci.org/d/test/test?var-datasource=edquppk2ghfcwc&var-origin=maestro&var-build_architecture=All&var-build_config_name=All&var-id=maestro:672030c9aaccbda536603435&orgId=1
- x86_64 (x86_64_defconfig)
Error detail: BUG: kernel NULL pointer dereference, address: 000002fc
Error: https://kcidb.kernelci.org/d/test/test?var-datasource=edquppk2ghfcwc&var-origin=maestro&var-build_architecture=All&var-build_config_name=All&var-id=maestro:672030cbaaccbda53660343a&orgId=1
- x86_64 (x86_64_defconfig)
Error detail: BUG: kernel NULL pointer dereference, address: 000002fc
Error: https://kcidb.kernelci.org/d/test/test?var-datasource=edquppk2ghfcwc&var-origin=maestro&var-build_architecture=All&var-build_config_name=All&var-id=maestro:672030cdaaccbda53660343e&orgId=1
- x86_64 (x86_64_defconfig)
Error detail: BUG: kernel NULL pointer dereference, address: 000002fc
Error: https://kcidb.kernelci.org/d/test/test?var-datasource=edquppk2ghfcwc&var-origin=maestro&var-build_architecture=All&var-build_config_name=All&var-id=maestro:672030cdaaccbda536603440&orgId=1
See complete and up-to-date report at:
https://kcidb.kernelci.org/d/revision/revision?orgId=1&var-datasource=edquppk2ghfcwc&var-git_commit_hash=a203ce258bb66ceea0d88b41de9b16cd41a6895f&var-patchset_hash=&var-origin=maestro&var-build_architecture=All&var-build_config_name=All&var-test_path=boot
Thanks,
KernelCI team
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.170 release. There are 80 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Oct 2024 06:22:39 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.170-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).