6.6.59-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainerPATCH 132/208 xfrm: respect ip protocols rules criteria when performing dst lookups
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eyal Birger <[email protected]>
[ Upstream commit b8469721034300bbb6dec5b4bf32492c95e16a0c ]
The series in the "fixes" tag added the ability to consider L4 attributes in routing rules.
The dst lookup on the outer packet of encapsulated traffic in the xfrm code was not adapted to this change, thus routing behavior that relies on L4 information is not respected.
Pass the ip protocol information when performing dst lookups.
--- include/net/xfrm.h | 2 ++ net/ipv4/xfrm4_policy.c | 2 ++ net/ipv6/xfrm6_policy.c | 3 +++ net/xfrm/xfrm_policy.c | 15 +++++++++++++++ 4 files changed, 22 insertions(+)
include/net/xfrm.h +2 -0
@@ -349,6 +349,8 @@ struct xfrm_dst_lookup_params {xfrm_address_t *saddr;xfrm_address_t *daddr;u32 mark; +__u8 ipproto; +union flowi_uli uli; };struct net_device ;
net/ipv4/xfrm4_policy.c +2 -0
@@ -30,6 +30,8 @@ static struct dst_entry *__xfrm4_dst_lookup(struct flowi4 *fl4, fl4->flowi4_mark = params->mark;if (params->saddr) fl4->saddr = params->saddr->a4; + fl4->flowi4_proto = params->ipproto; + fl4->uli = params->uli; rt =__ip_route_output_key (params->net, fl4);if (!IS_ERR (rt))
net/ipv6/xfrm6_policy.c +3 -0
@@ -37,6 +37,9 @@ static struct dst_entry *xfrm6_dst_lookup(const struct xfrm_dst_lookup_params *pif (params->saddr)memcpy (&fl6.saddr, params->saddr,sizeof (fl6.saddr)); + fl6.flowi4_proto = params->ipproto; + fl6.uli = params->uli; + dst =ip6_route_output (params->net,NULL , &fl6); err = dst->error;
net/xfrm/xfrm_policy.c +15 -0
@@ -296,6 +296,21 @@ static inline struct dst_entry *xfrm_dst_lookup(struct xfrm_state *x, params.tos = tos; params.oif = oif; params.mark = mark; + params.ipproto = x->id.proto; +if (x->encap) { +switch (x->encap->encap_type) { +case UDP_ENCAP_ESPINUDP : + params.ipproto =IPPROTO_UDP ; + params.uli.ports.sport = x->encap->encap_sport; + params.uli.ports.dport = x->encap->encap_dport; +break ; +case TCP_ENCAP_ESPINTCP : + params.ipproto =IPPROTO_TCP ; + params.uli.ports.sport = x->encap->encap_sport; + params.uli.ports.dport = x->encap->encap_dport; +break ; + } + } dst =__xfrm_dst_lookup (family, ¶ms);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/208 xfrm: Add Direction to the SA in or out
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antony Antony <[email protected]>
[ Upstream commit a4a87fa4e96c7746e009de06a567688fd9af6013 ]
This patch introduces the 'dir' attribute, 'in' or 'out', to the xfrm_state, SA, enhancing usability by delineating the scope of values based on direction. An input SA will restrict values pertinent to input, effectively segregating them from output-related values.
And an output SA will restrict attributes for output. This change aims to streamline the configuration process and improve the overall consistency of SA attributes during configuration.
This feature sets the groundwork for future patches, including the upcoming IP-TFS patch.
Stable-dep-of: 3f0ab59e6537 ("xfrm: validate new SA's prefixlen using SA family when sel.family is unset")
--- include/net/xfrm.h | 1 + include/uapi/linux/xfrm.h | 6 ++ net/xfrm/xfrm_compat.c | 7 +- net/xfrm/xfrm_device.c | 6 ++ net/xfrm/xfrm_replay.c | 3 +- net/xfrm/xfrm_state.c | 8 +++ net/xfrm/xfrm_user.c | 138 ++++++++++++++++++++++++++++++++++++-- 7 files changed, 160 insertions(+), 9 deletions(-)
include/net/xfrm.h +1 -0
@@ -292,6 +292,7 @@ struct xfrm_state {/* Private data of this transformer, format is opaque, * interpreted by xfrm_type methods. */ void *data; +u8 dir; };static inline struct net *xs_net (struct xfrm_state *x)
include/uapi/linux/xfrm.h +6 -0
@@ -140,6 +140,11 @@ enum {XFRM_POLICY_MAX =3 }; +enum xfrm_sa_dir { +XFRM_SA_DIR_IN =1 , +XFRM_SA_DIR_OUT =2 +}; +enum {XFRM_SHARE_ANY ,/* No limitations */ XFRM_SHARE_SESSION ,/* For this session only */
@@ -314,6 +319,7 @@ enum xfrm_attr_type_t {XFRMA_SET_MARK_MASK ,/* __u32 */ XFRMA_IF_ID ,/* __u32 */ XFRMA_MTIMER_THRESH ,/* __u32 in seconds for input SA */ +XFRMA_SA_DIR ,/* __u8 */ __XFRMA_MAX#define XFRMA_OUTPUT_MARK XFRMA_SET_MARK/* Compatibility */
net/xfrm/xfrm_compat.c +5 -2
@@ -98,6 +98,7 @@ static const int compat_msg_min[XFRM_NR_MSGTYPES] = { };static const struct nla_policy compat_policy[XFRMA_MAX +1 ] = { + [XFRMA_UNSPEC ] = { .strict_start_type =XFRMA_SA_DIR }, [XFRMA_SA ] = { .len =XMSGSIZE (compat_xfrm_usersa_info)}, [XFRMA_POLICY ] = { .len =XMSGSIZE (compat_xfrm_userpolicy_info)}, [XFRMA_LASTUSED ] = { .type =NLA_U64 },
@@ -129,6 +130,7 @@ static const struct nla_policy compat_policy[XFRMA_MAX+1] = { [XFRMA_SET_MARK_MASK] = { .type = NLA_U32 }, [XFRMA_IF_ID] = { .type = NLA_U32 }, [XFRMA_MTIMER_THRESH] = { .type = NLA_U32 }, + [XFRMA_SA_DIR] = NLA_POLICY_RANGE(NLA_U8, XFRM_SA_DIR_IN, XFRM_SA_DIR_OUT), }; static struct nlmsghdr *xfrm_nlmsg_put_compat(struct sk_buff *skb,
@@ -277,9 +279,10 @@ static int xfrm_xlate64_attr(struct sk_buff *dst, const struct nlattr *src)case XFRMA_SET_MARK_MASK :case XFRMA_IF_ID :case XFRMA_MTIMER_THRESH : +case XFRMA_SA_DIR :return xfrm_nla_cpy (dst, src,nla_len (src));default : -BUILD_BUG_ON (XFRMA_MAX !=XFRMA_MTIMER_THRESH ); +BUILD_BUG_ON (XFRMA_MAX !=XFRMA_SA_DIR );pr_warn_once ("unsupported nla_type %d\n" , src->nla_type);return -EOPNOTSUPP ; }
@@ -434,7 +437,7 @@ static int xfrm_xlate32_attr(void *dst, const struct nlattr *nla,int err;if (type >XFRMA_MAX ) { -BUILD_BUG_ON (XFRMA_MAX !=XFRMA_MTIMER_THRESH ); +BUILD_BUG_ON (XFRMA_MAX !=XFRMA_SA_DIR );NL_SET_ERR_MSG (extack,"Bad attribute" );return -EOPNOTSUPP ; }
net/xfrm/xfrm_device.c +6 -0
@@ -253,6 +253,12 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,return -EINVAL ; } +if ((xuo->flags &XFRM_OFFLOAD_INBOUND && x->dir ==XFRM_SA_DIR_OUT ) || + (!(xuo->flags &XFRM_OFFLOAD_INBOUND ) && x->dir ==XFRM_SA_DIR_IN )) { +NL_SET_ERR_MSG (extack,"Mismatched SA and offload direction" ); +return -EINVAL ; + } + is_packet_offload = xuo->flags &XFRM_OFFLOAD_PACKET ;/* We don't yet support UDP encapsulation and TFC padding. */
net/xfrm/xfrm_replay.c +2 -1
@@ -778,7 +778,8 @@ int xfrm_init_replay(struct xfrm_state *x, struct netlink_ext_ack *extack) }if (x->props.flags &XFRM_STATE_ESN ) { -if (replay_esn->replay_window ==0 ) { +if (replay_esn->replay_window ==0 && + (!x->dir || x->dir ==XFRM_SA_DIR_IN )) {NL_SET_ERR_MSG (extack,"ESN replay window must be > 0" );return -EINVAL ; }
net/xfrm/xfrm_state.c +8 -0
@@ -1349,6 +1349,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,if (km_query (x, tmpl, pol) ==0 ) {spin_lock_bh (&net->xfrm.xfrm_state_lock); x->km.state =XFRM_STATE_ACQ ; + x->dir =XFRM_SA_DIR_OUT ;list_add (&x->km.all, &net->xfrm.state_all); XFRM_STATE_INSERT(bydst, &x->bydst, net->xfrm.state_bydst + h,
@@ -1801,6 +1802,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, x->lastused = orig->lastused; x->new_mapping =0 ; x->new_mapping_sport =0 ; + x->dir = orig->dir;return x;
@@ -1921,8 +1923,14 @@ int xfrm_state_update(struct xfrm_state *x) }if (x1->km.state ==XFRM_STATE_ACQ ) { +if (x->dir && x1->dir != x->dir) + goto out; +__xfrm_state_insert (x); x =NULL ; + }else { +if (x1->dir != x->dir) + goto out; } err =0 ;
net/xfrm/xfrm_user.c +132 -6
229 lines not on this page · raw message
Signature · 1 line
2.43.0
Re: [PATCH 6.6 133/208] xfrm: Add Direction to the SA in or out
Quoted 1 line · Greg Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
Hi Greg,
This patch is a part of a new feature SA direction and it appears the auto patch selector picked one patch out of patch set?
I think this patch alone should not be applied to older stable kernel.
-antony
Quoted 429 lines
------------------
From: Antony Antony <[email protected]>
[ Upstream commit
a4a87fa4e96c7746e009de06a567688fd9af6013]This patch introduces the 'dir' attribute, 'in' or 'out', to the
xfrm_state, SA, enhancing usability by delineating the scope of values based on direction. An input SA will restrict values pertinent to input, effectively segregating them from output-related values.
And an output SA will restrict attributes for output. This change aims to streamline the configuration process and improve the overall consistency of SA attributes during configuration.This feature sets the groundwork for future patches, including the upcoming IP-TFS patch.
Signed-off-by Antony Antony <[email protected]>Reviewed-by Sabrina Dubroca <[email protected]>Signed-off-by Steffen Klassert <[email protected]>Stable-dep-of:
3f0ab59e6537("xfrm: validate new SA's prefixlen using SA family when sel.family is unset")Signed-off-by Sasha Levin <[email protected]>--- include/net/xfrm.h | 1 + include/uapi/linux/xfrm.h | 6 ++ net/xfrm/xfrm_compat.c | 7 +- net/xfrm/xfrm_device.c | 6 ++ net/xfrm/xfrm_replay.c | 3 +- net/xfrm/xfrm_state.c | 8 +++ net/xfrm/xfrm_user.c | 138 ++++++++++++++++++++++++++++++++++++-- 7 files changed, 160 insertions(+), 9 deletions(-)include/net/xfrm.h +1
-0@@ -292,6 +292,7 @@ struct xfrm_state {/* Private data of this transformer, format is opaque, * interpreted by xfrm_type methods. */ void *data; +u8 dir; };static inline struct net *xs_net (struct xfrm_state *x)include/uapi/linux/xfrm.h +6
-0@@ -140,6 +140,11 @@ enum {XFRM_POLICY_MAX =3 }; +enum xfrm_sa_dir { +XFRM_SA_DIR_IN =1 , +XFRM_SA_DIR_OUT =2 +}; +enum {XFRM_SHARE_ANY ,/* No limitations */ XFRM_SHARE_SESSION ,/* For this session only */ @@ -314,6 +319,7 @@ enum xfrm_attr_type_t {XFRMA_SET_MARK_MASK ,/* __u32 */ XFRMA_IF_ID ,/* __u32 */ XFRMA_MTIMER_THRESH ,/* __u32 in seconds for input SA */ +XFRMA_SA_DIR ,/* __u8 */ __XFRMA_MAX#define XFRMA_OUTPUT_MARK XFRMA_SET_MARK/* Compatibility */ net/xfrm/xfrm_compat.c +5
-2@@ -98,6 +98,7 @@ static const int compat_msg_min[XFRM_NR_MSGTYPES] = { };static const struct nla_policy compat_policy[XFRMA_MAX +1 ] = { + [XFRMA_UNSPEC ] = { .strict_start_type =XFRMA_SA_DIR }, [XFRMA_SA ] = { .len =XMSGSIZE (compat_xfrm_usersa_info)}, [XFRMA_POLICY ] = { .len =XMSGSIZE (compat_xfrm_userpolicy_info)}, [XFRMA_LASTUSED ] = { .type =NLA_U64 },@@ -129,6 +130,7 @@ static const struct nla_policy compat_policy[XFRMA_MAX+1] = { [XFRMA_SET_MARK_MASK] = { .type = NLA_U32 }, [XFRMA_IF_ID] = { .type = NLA_U32 }, [XFRMA_MTIMER_THRESH] = { .type = NLA_U32 }, + [XFRMA_SA_DIR] = NLA_POLICY_RANGE(NLA_U8, XFRM_SA_DIR_IN, XFRM_SA_DIR_OUT), }; static struct nlmsghdr *xfrm_nlmsg_put_compat(struct sk_buff *skb,@@ -277,9 +279,10 @@ static int xfrm_xlate64_attr(struct sk_buff *dst, const struct nlattr *src)case XFRMA_SET_MARK_MASK :case XFRMA_IF_ID :case XFRMA_MTIMER_THRESH : +case XFRMA_SA_DIR :return xfrm_nla_cpy (dst, src,nla_len (src));default : -BUILD_BUG_ON (XFRMA_MAX !=XFRMA_MTIMER_THRESH ); +BUILD_BUG_ON (XFRMA_MAX !=XFRMA_SA_DIR );pr_warn_once ("unsupported nla_type %d\n" , src->nla_type);return -EOPNOTSUPP ; }@@ -434,7 +437,7 @@ static int xfrm_xlate32_attr(void *dst, const struct nlattr *nla,int err;if (type >XFRMA_MAX ) { -BUILD_BUG_ON (XFRMA_MAX !=XFRMA_MTIMER_THRESH ); +BUILD_BUG_ON (XFRMA_MAX !=XFRMA_SA_DIR );NL_SET_ERR_MSG (extack,"Bad attribute" );return -EOPNOTSUPP ; }net/xfrm/xfrm_device.c +6
-0@@ -253,6 +253,12 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,return -EINVAL ; } +if ((xuo->flags &XFRM_OFFLOAD_INBOUND && x->dir ==XFRM_SA_DIR_OUT ) || + (!(xuo->flags &XFRM_OFFLOAD_INBOUND ) && x->dir ==XFRM_SA_DIR_IN )) { +NL_SET_ERR_MSG (extack,"Mismatched SA and offload direction" ); +return -EINVAL ; + } + is_packet_offload = xuo->flags &XFRM_OFFLOAD_PACKET ;/* We don't yet support UDP encapsulation and TFC padding. */ net/xfrm/xfrm_replay.c +2
-1@@ -778,7 +778,8 @@ int xfrm_init_replay(struct xfrm_state *x, struct netlink_ext_ack *extack) }if (x->props.flags &XFRM_STATE_ESN ) { -if (replay_esn->replay_window ==0 ) { +if (replay_esn->replay_window ==0 && + (!x->dir || x->dir ==XFRM_SA_DIR_IN )) {NL_SET_ERR_MSG (extack,"ESN replay window must be > 0" );return -EINVAL ; }net/xfrm/xfrm_state.c +8
-0@@ -1349,6 +1349,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,if (km_query (x, tmpl, pol) ==0 ) {spin_lock_bh (&net->xfrm.xfrm_state_lock); x->km.state =XFRM_STATE_ACQ ; + x->dir =XFRM_SA_DIR_OUT ;list_add (&x->km.all, &net->xfrm.state_all); XFRM_STATE_INSERT(bydst, &x->bydst, net->xfrm.state_bydst + h,@@ -1801,6 +1802,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, x->lastused = orig->lastused; x->new_mapping =0 ; x->new_mapping_sport =0 ; + x->dir = orig->dir;return x;@@ -1921,8 +1923,14 @@ int xfrm_state_update(struct xfrm_state *x) }if (x1->km.state ==XFRM_STATE_ACQ ) { +if (x->dir && x1->dir != x->dir) + goto out; +__xfrm_state_insert (x); x =NULL ; + }else { +if (x1->dir != x->dir) + goto out; } err =0 ;net/xfrm/xfrm_user.c +132
-6@@ -130,7 +130,7 @@ static inline int verify_sec_ctx_len(struct nlattr **attrs, struct netlink_ext_a }static inline int verify_replay (struct xfrm_usersa_info *p, -struct nlattr **attrs, +struct nlattr **attrs,u8 sa_dir,struct netlink_ext_ack *extack) {struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL ];@@ -168,6 +168,30 @@ static inline int verify_replay(struct xfrm_usersa_info *p,return -EINVAL ; } +if (sa_dir ==XFRM_SA_DIR_OUT ) { +if (rs->replay_window) { +NL_SET_ERR_MSG (extack,"Replay window should be 0 for output SA" ); +return -EINVAL ; + } +if (rs->seq || rs->seq_hi) { +NL_SET_ERR_MSG (extack, +"Replay seq and seq_hi should be 0 for output SA" ); +return -EINVAL ; + } +if (rs->bmp_len) { +NL_SET_ERR_MSG (extack,"Replay bmp_len should 0 for output SA" ); +return -EINVAL ; + } + } + +if (sa_dir ==XFRM_SA_DIR_IN ) { +if (rs->oseq || rs->oseq_hi) { +NL_SET_ERR_MSG (extack, +"Replay oseq and oseq_hi should be 0 for input SA" ); +return -EINVAL ; + } + } +return 0 ; }@@ -176,6 +200,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, struct netlink_ext_ack *extack) {int err; +u8 sa_dir = attrs[XFRMA_SA_DIR ] ?nla_get_u8 (attrs[XFRMA_SA_DIR ]) :0 ; err = -EINVAL ;switch (p->family) {@@ -334,7 +359,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, goto out;if ((err =verify_sec_ctx_len (attrs, extack))) goto out; -if ((err =verify_replay (p, attrs, extack))) +if ((err =verify_replay (p, attrs, sa_dir, extack))) goto out; err = -EINVAL ;@@ -358,6 +383,77 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, err = -EINVAL ; goto out; } + +if (sa_dir ==XFRM_SA_DIR_OUT ) { +NL_SET_ERR_MSG (extack, +"MTIMER_THRESH attribute should not be set on output SA" ); + err = -EINVAL ; + goto out; + } + } + +if (sa_dir ==XFRM_SA_DIR_OUT ) { +if (p->flags &XFRM_STATE_DECAP_DSCP ) { +NL_SET_ERR_MSG (extack,"Flag DECAP_DSCP should not be set for output SA" ); + err = -EINVAL ; + goto out; + } + +if (p->flags &XFRM_STATE_ICMP ) { +NL_SET_ERR_MSG (extack,"Flag ICMP should not be set for output SA" ); + err = -EINVAL ; + goto out; + } + +if (p->flags &XFRM_STATE_WILDRECV ) { +NL_SET_ERR_MSG (extack,"Flag WILDRECV should not be set for output SA" ); + err = -EINVAL ; + goto out; + } + +if (p->replay_window) { +NL_SET_ERR_MSG (extack,"Replay window should be 0 for output SA" ); + err = -EINVAL ; + goto out; + } + +if (attrs[XFRMA_REPLAY_VAL ]) { +struct xfrm_replay_state *replay; + + replay =nla_data (attrs[XFRMA_REPLAY_VAL ]); + +if (replay->seq || replay->bitmap) { +NL_SET_ERR_MSG (extack, +"Replay seq and bitmap should be 0 for output SA" ); + err = -EINVAL ; + goto out; + } + } + } + +if (sa_dir ==XFRM_SA_DIR_IN ) { +if (p->flags &XFRM_STATE_NOPMTUDISC ) { +NL_SET_ERR_MSG (extack,"Flag NOPMTUDISC should not be set for input SA" ); + err = -EINVAL ; + goto out; + } + +if (attrs[XFRMA_SA_EXTRA_FLAGS ]) { +u32 xflags =nla_get_u32 (attrs[XFRMA_SA_EXTRA_FLAGS ]); + +if (xflags &XFRM_SA_XFLAG_DONT_ENCAP_DSCP ) { +NL_SET_ERR_MSG (extack,"Flag DONT_ENCAP_DSCP should not be set for input SA" ); + err = -EINVAL ; + goto out; + } + +if (xflags &XFRM_SA_XFLAG_OSEQ_MAY_WRAP ) { +NL_SET_ERR_MSG (extack,"Flag OSEQ_MAY_WRAP should not be set for input SA" ); + err = -EINVAL ; + goto out; + } + + } } out:@@ -734,6 +830,9 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,if (attrs[XFRMA_IF_ID ]) x->if_id =nla_get_u32 (attrs[XFRMA_IF_ID ]); +if (attrs[XFRMA_SA_DIR ]) + x->dir =nla_get_u8 (attrs[XFRMA_SA_DIR ]); + err =__xfrm_init_state (x, false, attrs[XFRMA_OFFLOAD_DEV ], extack);if (err) goto error;@@ -1182,8 +1281,13 @@ static int copy_to_user_state_extra(struct xfrm_state *x,if (ret) goto out; } -if (x->mapping_maxage) +if (x->mapping_maxage) { ret =nla_put_u32 (skb,XFRMA_MTIMER_THRESH , x->mapping_maxage); +if (ret) + goto out; + } +if (x->dir) + ret =nla_put_u8 (skb,XFRMA_SA_DIR , x->dir); out:return ret; }@@ -1618,6 +1722,9 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,if (err) goto out; +if (attrs[XFRMA_SA_DIR ]) + x->dir =nla_get_u8 (attrs[XFRMA_SA_DIR ]); + resp_skb =xfrm_state_netlink (skb, x, nlh->nlmsg_seq);if (IS_ERR (resp_skb)) { err =PTR_ERR (resp_skb);@@ -2401,7 +2508,8 @@ static inline unsigned int xfrm_aevent_msgsize(struct xfrm_state *x) +nla_total_size_64bit (sizeof (struct xfrm_lifetime_cur )) +nla_total_size (sizeof (struct xfrm_mark )) +nla_total_size (4 )/* XFRM_AE_RTHR */ - +nla_total_size (4 );/* XFRM_AE_ETHR */ + +nla_total_size (4 )/* XFRM_AE_ETHR */ + +nla_total_size (sizeof (x->dir));/* XFRMA_SA_DIR */ }static int build_aevent (struct sk_buff *skb,struct xfrm_state *x,const struct km_event *c)@@ -2458,6 +2566,12 @@ static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, const structif (err) goto out_cancel; +if (x->dir) { + err =nla_put_u8 (skb,XFRMA_SA_DIR , x->dir); +if (err) + goto out_cancel; + } +nlmsg_end (skb, nlh);return 0 ;@@ -3017,6 +3131,7 @@ EXPORT_SYMBOL_GPL(xfrm_msg_min);#undef XMSGSIZEconst struct nla_policy xfrma_policy[XFRMA_MAX +1 ] = { + [XFRMA_UNSPEC ] = { .strict_start_type =XFRMA_SA_DIR }, [XFRMA_SA ] = { .len =sizeof (struct xfrm_usersa_info )}, [XFRMA_POLICY ] = { .len =sizeof (struct xfrm_userpolicy_info )}, [XFRMA_LASTUSED ] = { .type =NLA_U64 },@@ -3048,6 +3163,7 @@ const struct nla_policy xfrma_policy[XFRMA_MAX+1] = { [XFRMA_SET_MARK_MASK] = { .type = NLA_U32 }, [XFRMA_IF_ID] = { .type = NLA_U32 }, [XFRMA_MTIMER_THRESH] = { .type = NLA_U32 }, + [XFRMA_SA_DIR ] =NLA_POLICY_RANGE (NLA_U8 ,XFRM_SA_DIR_IN ,XFRM_SA_DIR_OUT ), };EXPORT_SYMBOL_GPL (xfrma_policy);@@ -3188,8 +3304,9 @@ static void xfrm_netlink_rcv(struct sk_buff *skb)static inline unsigned int xfrm_expire_msgsize (void ) { -return NLMSG_ALIGN (sizeof (struct xfrm_user_expire )) - +nla_total_size (sizeof (struct xfrm_mark )); +return NLMSG_ALIGN (sizeof (struct xfrm_user_expire )) + +nla_total_size (sizeof (struct xfrm_mark )) + + nla_total_size(sizeof_field(struct xfrm_state, dir)); }static int build_expire (struct sk_buff *skb,struct xfrm_state *x,const struct km_event *c)@@ -3216,6 +3333,12 @@ static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const structif (err)return err; +if (x->dir) { + err =nla_put_u8 (skb,XFRMA_SA_DIR , x->dir); +if (err) +return err; + } +nlmsg_end (skb, nlh);return 0 ; }@@ -3323,6 +3446,9 @@ static inline unsigned int xfrm_sa_len(struct xfrm_state *x)if (x->mapping_maxage) l +=nla_total_size (sizeof (x->mapping_maxage)); +if (x->dir) + l +=nla_total_size (sizeof (x->dir)); +return l; }Signature · 1 line
2.43.0
Sasha Levin
maintainerRe: [PATCH 6.6 133/208] xfrm: Add Direction to the SA in or out
Quoted 8 lines · Antony Antony
Quoted 1 line · Greg Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
Hi Greg,
This patch is a part of a new feature SA direction and it appears the auto patch selector picked one patch out of patch set?
I think this patch alone should not be applied to older stable kernel.
It was picked up as a dependency:
Quoted 1 line
Quoted 1 line
Stable-dep-of:
3f0ab59e6537("xfrm: validate new SA's prefixlen using SA family when sel.family is unset")
We can drop it, and the netfilter folks can provide us a backport of the fix above?
Signature · 2 lines
Thanks, Sasha
Re: [PATCH 6.6 133/208] xfrm: Add Direction to the SA in or out
Quoted 11 lines · Sasha Levin
Quoted 8 lines · Antony Antony
Quoted 1 line · Greg Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
Hi Greg,
This patch is a part of a new feature SA direction and it appears the auto patch selector picked one patch out of patch set?
I think this patch alone should not be applied to older stable kernel.It was picked up as a dependency:
I understand how it got selected, however, please drop a4a87fa4e96c ("xfrm: Add Direction to the SA in or out") from backports.
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
Stable-dep-of:
3f0ab59e6537("xfrm: validate new SA's prefixlen using SA family when sel.family is unset")
this is good fix to have in stable kernels
Quoted 3 lines
We can drop it, and the netfilter folks can provide us a backport of the fix above?
It is an ipsec sub system patch.
Here is a backport. I compile tested it on 6.6. It will also apply to linx-6.1.y To apply to older ones kernels, use -3.
regards,
-antony
From 728db0e41ea88d26198c14c383489c6f8509edee Mon Sep 17 00:00:00 2001
From: Sabrina Dubroca <[email protected]>
Date: Tue, 1 Oct 2024 18:48:14 +0200
Subject: [PATCH] xfrm: validate new SA's prefixlen using SA family when
sel.family is unset
[ Upstream commit 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 ]
This expands the validation introduced in commit 07bf7908950a ("xfrm:
Validate address prefix lengths in the xfrm selector.")
syzbot created an SA with
usersa.sel.family = AF_UNSPEC
usersa.sel.prefixlen_s = 128
usersa.family = AF_INET
Because of the AF_UNSPEC selector, verify_newsa_info doesn't put limits on prefixlen_{s,d}. But then copy_from_user_state sets x->sel.family to usersa.family (AF_INET). Do the same conversion in verify_newsa_info before validating prefixlen_{s,d}, since that's how prefixlen is going to be used later on.
--- net/xfrm/xfrm_user.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/xfrm/xfrm_user.c +5 -1
@@ -176,6 +176,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, struct netlink_ext_ack *extack) {int err; +u16 family = p->sel.family; err = -EINVAL ;switch (p->family) {
@@ -196,7 +197,10 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, goto out; } -switch (p->sel.family) { +if (!family && !(p->flags &XFRM_STATE_AF_UNSPEC )) + family = p->family; + +switch (family) {case AF_UNSPEC :break ;
Signature · 1 line
2.30.2
Sasha Levin
maintainerRe: [PATCH 6.6 133/208] xfrm: Add Direction to the SA in or out
Quoted 22 lines · Antony Antony
Quoted 11 lines · Sasha Levin
Quoted 8 lines · Antony Antony
Quoted 1 line · Greg Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
Hi Greg,
This patch is a part of a new feature SA direction and it appears the auto patch selector picked one patch out of patch set?
I think this patch alone should not be applied to older stable kernel.It was picked up as a dependency:
I understand how it got selected, however, please drop
a4a87fa4e96c("xfrm: Add Direction to the SA in or out") from backports.Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
Stable-dep-of:
3f0ab59e6537("xfrm: validate new SA's prefixlen using SA family when sel.family is unset")this is good fix to have in stable kernels
Quoted 1 line
Quoted 6 lines
Quoted 2 lines
We can drop it, and the netfilter folks can provide us a backport of the fix above?
It is an ipsec sub system patch.
Here is a backport. I compile tested it on 6.6. It will also apply to linx-6.1.y To apply to older ones kernels, use -3.
I've replaced what we had in the queue with your backport, thanks!
Signature · 2 lines
Thanks, Sasha
Greg Kroah-Hartman
maintainerPATCH 134/208 xfrm: validate new SAs prefixlen using SA family when sel.family is unset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 ]
This expands the validation introduced in commit 07bf7908950a ("xfrm:
Validate address prefix lengths in the xfrm selector.")
syzbot created an SA with
usersa.sel.family = AF_UNSPEC
usersa.sel.prefixlen_s = 128
usersa.family = AF_INET
Because of the AF_UNSPEC selector, verify_newsa_info doesn't put limits on prefixlen_{s,d}. But then copy_from_user_state sets x->sel.family to usersa.family (AF_INET). Do the same conversion in verify_newsa_info before validating prefixlen_{s,d}, since that's how prefixlen is going to be used later on.
--- net/xfrm/xfrm_user.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/xfrm/xfrm_user.c +5 -1
@@ -201,6 +201,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, {int err;u8 sa_dir = attrs[XFRMA_SA_DIR ] ?nla_get_u8 (attrs[XFRMA_SA_DIR ]) :0 ; +u16 family = p->sel.family; err = -EINVAL ;switch (p->family) {
@@ -221,7 +222,10 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, goto out; } -switch (p->sel.family) { +if (!family && !(p->flags &XFRM_STATE_AF_UNSPEC )) + family = p->family; + +switch (family) {case AF_UNSPEC :break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/208 netfilter: bpf: must hold reference on net namespace
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 1230fe7ad3974f7bf6c78901473e039b34d4fb1f ]
BUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0 Read of size 8 at addr ffff8880106fe400 by task repro/72= bpf_nf_link_release+0xda/0x1e0 bpf_link_free+0x139/0x2d0 bpf_link_release+0x68/0x80 __fput+0x414/0xb60
Eric says:
It seems that bpf was able to defer the __nf_unregister_net_hook() after exit()/close() time.
Perhaps a netns reference is missing, because the netns has been dismantled/freed already.
bpf_nf_link_attach() does :
link->net = net;
But I do not see a reference being taken on net.
Add such a reference and release it after hook unreg. Note that I was unable to get syzbot reproducer to work, so I do not know if this resolves this splat.
--- net/netfilter/nf_bpf_link.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/nf_bpf_link.c +4 -0
@@ -23,6 +23,7 @@ static unsigned int nf_hook_run_bpf(void *bpf_prog, struct sk_buff *skb,struct bpf_nf_link {struct bpf_link link;struct nf_hook_ops hook_ops; +netns_tracker ns_tracker;struct net *net;u32 dead;const struct nf_defrag_hook *defrag_hook;
@@ -120,6 +121,7 @@ static void bpf_nf_link_release(struct bpf_link *link)if (!cmpxchg (&nf_link->dead,0 ,1 )) {nf_unregister_net_hook (nf_link->net, &nf_link->hook_ops);bpf_nf_disable_defrag (nf_link); +put_net_track (nf_link->net, &nf_link->ns_tracker); } }
@@ -258,6 +260,8 @@ int bpf_nf_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)return err; } +get_net_track (net, &link->ns_tracker,GFP_KERNEL ); +return bpf_link_settle (&link_primer); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/208 net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Hai <[email protected]>
[ Upstream commit 2cb3f56e827abb22c4168ad0c1bbbf401bb2f3b8 ]
The sun3_82586_send_packet() returns NETDEV_TX_OK without freeing skb in case of skb->len being too long, add dev_kfree_skb() to fix it.
Message-ID: <[email protected]>
--- drivers/net/ethernet/i825xx/sun3_82586.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/i825xx/sun3_82586.c +1 -0
@@ -1012,6 +1012,7 @@ sun3_82586_send_packet(struct sk_buff *skb, struct net_device *dev)if (skb->len >XMIT_BUFF_SIZE ) {printk ("%s: Sorry, max. framelength is %d bytes. The length of your frame is %d bytes.\n" ,dev->name,XMIT_BUFF_SIZE ,skb->len); +dev_kfree_skb (skb);return NETDEV_TX_OK ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/208 be2net: fix potential memory leak in be_xmit()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Hai <[email protected]>
[ Upstream commit e4dd8bfe0f6a23acd305f9b892c00899089bd621 ]
The be_xmit() returns NETDEV_TX_OK without freeing skb
in case of be_xmit_enqueue() fails, add dev_kfree_skb_any() to fix it.
Message-ID: <[email protected]>
--- drivers/net/ethernet/emulex/benet/be_main.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/ethernet/emulex/benet/be_main.c +5 -5
@@ -1381,10 +1381,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev)be_get_wrb_params_from_skb (adapter, skb, &wrb_params); wrb_cnt =be_xmit_enqueue (adapter, txo, skb, &wrb_params); -if (unlikely (!wrb_cnt)) { -dev_kfree_skb_any (skb); - goto drop; - } +if (unlikely (!wrb_cnt)) + goto drop_skb;/* if os2bmc is enabled and if the pkt is destined to bmc, * enqueue the pkt a 2nd time with mgmt bit set.
@@ -1393,7 +1391,7 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev)BE_WRB_F_SET (wrb_params.features,OS2BMC ,1 ); wrb_cnt =be_xmit_enqueue (adapter, txo, skb, &wrb_params);if (unlikely (!wrb_cnt)) - goto drop; + goto drop_skb;else skb_get (skb); }
@@ -1407,6 +1405,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev)be_xmit_flush (adapter, txo);return NETDEV_TX_OK ; +drop_skb: +dev_kfree_skb_any (skb); drop:tx_stats (txo)->tx_drv_drops++;/* Flush the already enqueued tx requests */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/208 net: plip: fix break; causing plip to never transmit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Boehm <[email protected]>
[ Upstream commit f99cf996ba5a315f8b9f13cc21dff0604a0eb749 ]
Since commit
71ae2cb30531 ("net: plip: Fix fall-through warnings for Clang")
plip was not able to send any packets, this patch replaces one unintended break; with fallthrough; which was originally missed by commit 9525d69a3667 ("net: plip: mark expected switch fall-throughs").
I have verified with a real hardware PLIP connection that everything works once again after applying this patch.
Message-ID: <[email protected]>
--- drivers/net/plip/plip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/plip/plip.c +1 -1
@@ -815,7 +815,7 @@ plip_send_packet(struct net_device *dev, struct net_local *nl,return HS_TIMEOUT ; } } -break ; + fallthrough;case PLIP_PK_LENGTH_LSB : if (plip_send(nibble_timeout, dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/208 octeon_ep: Implement helper for iterating packets in Rx queue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit bd28df26197b2bd0913bf1b36770836481975143 ]
The common code with some packet and index manipulations is extracted and moved to newly implemented helper to make the code more readable and avoid duplication. This is a preparation for skb allocation failure handling.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Stable-dep-of: eb592008f79b ("octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()")
--- .../net/ethernet/marvell/octeon_ep/octep_rx.c | 55 +++++++++++-------- 1 file changed, 32 insertions(+), 23 deletions(-)
drivers/net/ethernet/marvell/octeon_ep/octep_rx.c +32 -23
@@ -336,6 +336,30 @@ static int octep_oq_check_hw_for_pkts(struct octep_device *oct,return new_pkts; } +/** +* octep_oq_next_pkt() - Move to the next packet in Rx queue. +* +* @oq: Octeon Rx queue data structure. +* @buff_info: Current packet buffer info. +* @read_idx: Current packet index in the ring. +* @desc_used: Current packet descriptor number. +* +* Free the resources associated with a packet. +* Increment packet index in the ring and packet descriptor number. +*/ +static void octep_oq_next_pkt (struct octep_oq *oq, +struct octep_rx_buffer *buff_info, +u32 *read_idx,u32 *desc_used) +{ +dma_unmap_page (oq->dev, oq->desc_ring[*read_idx].buffer_ptr, +PAGE_SIZE ,DMA_FROM_DEVICE ); + buff_info->page =NULL ; + (*read_idx)++; + (*desc_used)++; +if (*read_idx == oq->max_count) + *read_idx =0 ; +} +/** * __octep_oq_process_rx() - Process hardware Rx queue and push to stack. *
@@ -365,10 +389,7 @@ static int __octep_oq_process_rx(struct octep_device *oct, desc_used =0 ;for (pkt =0 ; pkt < pkts_to_process; pkt++) { buff_info = (struct octep_rx_buffer *)&oq->buff_info[read_idx]; -dma_unmap_page (oq->dev, oq->desc_ring[read_idx].buffer_ptr, -PAGE_SIZE ,DMA_FROM_DEVICE ); resp_hw =page_address (buff_info->page); - buff_info->page =NULL ;/* Swap the length field that is in Big-Endian to CPU */ buff_info->len =be64_to_cpu (resp_hw->length);
@@ -390,36 +411,27 @@ static int __octep_oq_process_rx(struct octep_device *oct,*/ data_offset =OCTEP_OQ_RESP_HW_SIZE ; } + +octep_oq_next_pkt (oq, buff_info, &read_idx, &desc_used); + + skb =build_skb ((void *)resp_hw,PAGE_SIZE ); +skb_reserve (skb, data_offset); + rx_bytes += buff_info->len;if (buff_info->len <= oq->max_single_buffer_size) { - skb =build_skb ((void *)resp_hw,PAGE_SIZE ); -skb_reserve (skb, data_offset);skb_put (skb, buff_info->len); - read_idx++; - desc_used++; -if (read_idx == oq->max_count) - read_idx =0 ; }else {struct skb_shared_info *shinfo;u16 data_len; - skb =build_skb ((void *)resp_hw,PAGE_SIZE ); -skb_reserve (skb, data_offset);/* Head fragment includes response header(s); * subsequent fragments contains only data. */ skb_put (skb, oq->max_single_buffer_size); - read_idx++; - desc_used++; -if (read_idx == oq->max_count) - read_idx =0 ; - shinfo =skb_shinfo (skb); data_len = buff_info->len - oq->max_single_buffer_size;while (data_len) { -dma_unmap_page (oq->dev, oq->desc_ring[read_idx].buffer_ptr, -PAGE_SIZE ,DMA_FROM_DEVICE ); buff_info = (struct octep_rx_buffer *) &oq->buff_info[read_idx];if (data_len < oq->buffer_size) {
@@ -434,11 +446,8 @@ static int __octep_oq_process_rx(struct octep_device *oct, buff_info->page,0 , buff_info->len, buff_info->len); - buff_info->page =NULL ; - read_idx++; - desc_used++; -if (read_idx == oq->max_count) - read_idx =0 ; + +octep_oq_next_pkt (oq, buff_info, &read_idx, &desc_used); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 140/208 octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit eb592008f79be52ccef88cd9a5249b3fc0367278 ]
build_skb() returns NULL in case of a memory allocation failure so handle it inside __octep_oq_process_rx() to avoid NULL pointer dereference.
__octep_oq_process_rx() is called during NAPI polling by the driver. If skb allocation fails, keep on pulling packets out of the Rx DMA queue: we shouldn't break the polling immediately and thus falsely indicate to the octep_napi_poll() that the Rx pressure is going down. As there is no associated skb in this case, don't process the packets and don't push them up the network stack - they are skipped.
Helper function is implemented to unmmap/flush all the fragment buffers used by the dropped packet. 'alloc_failures' counter is incremented to mark the skb allocation error in driver statistics.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- .../net/ethernet/marvell/octeon_ep/octep_rx.c | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+)
drivers/net/ethernet/marvell/octeon_ep/octep_rx.c +27 -0
@@ -360,6 +360,27 @@ static void octep_oq_next_pkt(struct octep_oq *oq, *read_idx =0 ; } +/** +* octep_oq_drop_rx() - Free the resources associated with a packet. +* +* @oq: Octeon Rx queue data structure. +* @buff_info: Current packet buffer info. +* @read_idx: Current packet index in the ring. +* @desc_used: Current packet descriptor number. +* +*/ +static void octep_oq_drop_rx (struct octep_oq *oq, +struct octep_rx_buffer *buff_info, +u32 *read_idx,u32 *desc_used) +{ +int data_len = buff_info->len - oq->max_single_buffer_size; + +while (data_len >0 ) { +octep_oq_next_pkt (oq, buff_info, read_idx, desc_used); + data_len -= oq->buffer_size; + }; +} +/** * __octep_oq_process_rx() - Process hardware Rx queue and push to stack. *
@@ -415,6 +436,12 @@ static int __octep_oq_process_rx(struct octep_device *oct,octep_oq_next_pkt (oq, buff_info, &read_idx, &desc_used); skb =build_skb ((void *)resp_hw,PAGE_SIZE ); +if (!skb) { +octep_oq_drop_rx (oq, buff_info, + &read_idx, &desc_used); + oq->stats.alloc_failures++; +continue ; + }skb_reserve (skb, data_offset); rx_bytes += buff_info->len;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 141/208 net: dsa: mv88e6xxx: Fix error when setting port policy on mv88e6393x
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Rashleigh <[email protected]>
[ Upstream commit 12bc14949c4a7272b509af0f1022a0deeb215fd8 ]
mv88e6393x_port_set_policy doesn't correctly shift the ptr value when converting the policy format between the old and new styles, so the target register ends up with the ptr being written over the data bits.
Shift the pointer to align with the format expected by mv88e6393x_port_policy_write().
Message-ID: <[email protected]>
--- drivers/net/dsa/mv88e6xxx/port.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/dsa/mv88e6xxx/port.c +1 -0
@@ -1713,6 +1713,7 @@ int mv88e6393x_port_set_policy(struct mv88e6xxx_chip *chip, int port, ptr = shift /8 ; shift %=8 ; mask >>= ptr *8 ; + ptr <<=8 ; err =mv88e6393x_port_policy_read (chip, port, ptr, ®);if (err)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 142/208 fsl/fman: Save device references taken in mac_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit efeddd552ec6767e4c8884caa516ac80b65f8823 ]
In mac_probe() there are calls to of_find_device_by_node() which takes references to of_dev->dev. These references are not saved and not released later on error path in mac_probe() and in mac_remove().
Add new fields into mac_device structure to save references taken for future use in mac_probe() and mac_remove().
This is a preparation for further reference leaks fix.
Stable-dep-of: 1dec67e0d9fb ("fsl/fman: Fix refcount handling of fman-related devices")
--- drivers/net/ethernet/freescale/fman/mac.c | 6 ++++-- drivers/net/ethernet/freescale/fman/mac.h | 6 +++++- 2 files changed, 9 insertions(+), 3 deletions(-)
drivers/net/ethernet/freescale/fman/mac.c +4 -2
@@ -197,6 +197,7 @@ static int mac_probe(struct platform_device *_of_dev) err = -EINVAL ; goto _return_of_node_put; } + mac_dev->fman_dev = &of_dev->dev;/* Get the FMan cell-index */ err =of_property_read_u32 (dev_node,"cell-index" , &val);
@@ -208,7 +209,7 @@ static int mac_probe(struct platform_device *_of_dev)/* cell-index 0 => FMan id 1 */ fman_id = (u8)(val +1 ); - priv->fman =fman_bind (&of_dev->dev); + priv->fman =fman_bind (mac_dev->fman_dev);if (!priv->fman) {dev_err (dev,"fman_bind(%pOF) failed\n" , dev_node); err = -ENODEV ;
@@ -284,8 +285,9 @@ static int mac_probe(struct platform_device *_of_dev) err = -EINVAL ; goto _return_of_node_put; } + mac_dev->fman_port_devs[i] = &of_dev->dev; - mac_dev->port[i] =fman_port_bind (&of_dev->dev); + mac_dev->port[i] =fman_port_bind (mac_dev->fman_port_devs[i]);if (!mac_dev->port[i]) {dev_err (dev,"dev_get_drvdata(%pOF) failed\n" , dev_node);
drivers/net/ethernet/freescale/fman/mac.h +5 -1
@@ -19,12 +19,13 @@struct fman_mac ;struct mac_priv_s ; +#define PORT_NUM 2struct mac_device {void __iomem *vaddr;struct device *dev;struct resource *res;u8 addr[ETH_ALEN ]; -struct fman_port *port[2 ]; +struct fman_port *port[PORT_NUM ];struct phylink *phylink;struct phylink_config phylink_config;phy_interface_t phy_if;
@@ -52,6 +53,9 @@ struct mac_device {struct fman_mac *fman_mac;struct mac_priv_s *priv; + +struct device *fman_dev; +struct device *fman_port_devs[PORT_NUM ]; }; static inline struct mac_device
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 143/208 fsl/fman: Fix refcount handling of fman-related devices
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 1dec67e0d9fbb087c2ab17bf1bd17208231c3bb1 ]
In mac_probe() there are multiple calls to of_find_device_by_node(), fman_bind() and fman_port_bind() which takes references to of_dev->dev. Not all references taken by these calls are released later on error path in mac_probe() and in mac_remove() which lead to reference leaks.
Add references release.
--- drivers/net/ethernet/freescale/fman/mac.c | 62 +++++++++++++++++------ 1 file changed, 47 insertions(+), 15 deletions(-)
drivers/net/ethernet/freescale/fman/mac.c +47 -15
@@ -204,7 +204,7 @@ static int mac_probe(struct platform_device *_of_dev)if (err) {dev_err (dev,"failed to read cell-index for %pOF\n" , dev_node); err = -EINVAL ; - goto _return_of_node_put; + goto _return_dev_put; }/* cell-index 0 => FMan id 1 */ fman_id = (u8)(val +1 );
@@ -213,40 +213,51 @@ static int mac_probe(struct platform_device *_of_dev)if (!priv->fman) {dev_err (dev,"fman_bind(%pOF) failed\n" , dev_node); err = -ENODEV ; - goto _return_of_node_put; + goto _return_dev_put; } +/* Two references have been taken in of_find_device_by_node() +* and fman_bind(). Release one of them here. The second one +* will be released in mac_remove(). +*/ +put_device (mac_dev->fman_dev);of_node_put (dev_node); + dev_node =NULL ;/* Get the address of the memory mapped registers */ mac_dev->res =platform_get_mem_or_io (_of_dev,0 );if (!mac_dev->res) {dev_err (dev,"could not get registers\n" ); -return -EINVAL ; + err = -EINVAL ; + goto _return_dev_put; } err =devm_request_resource (dev,fman_get_mem_region (priv->fman), mac_dev->res);if (err) {dev_err_probe (dev, err,"could not request resource\n" ); -return err; + goto _return_dev_put; } mac_dev->vaddr =devm_ioremap (dev, mac_dev->res->start,resource_size (mac_dev->res));if (!mac_dev->vaddr) {dev_err (dev,"devm_ioremap() failed\n" ); -return -EIO ; + err = -EIO ; + goto _return_dev_put; } -if (!of_device_is_available (mac_node)) -return -ENODEV ; +if (!of_device_is_available (mac_node)) { + err = -ENODEV ; + goto _return_dev_put; + }/* Get the cell-index */ err =of_property_read_u32 (mac_node,"cell-index" , &val);if (err) {dev_err (dev,"failed to read cell-index for %pOF\n" , mac_node); -return -EINVAL ; + err = -EINVAL ; + goto _return_dev_put; } priv->cell_index = (u8 )val;
@@ -260,22 +271,26 @@ static int mac_probe(struct platform_device *_of_dev)if (unlikely (nph <0 )) {dev_err (dev,"of_count_phandle_with_args(%pOF, fsl,fman-ports) failed\n" , mac_node); -return nph; + err = nph; + goto _return_dev_put; }if (nph !=ARRAY_SIZE (mac_dev->port)) {dev_err (dev,"Not supported number of fman-ports handles of mac node %pOF from device tree\n" , mac_node); -return -EINVAL ; + err = -EINVAL ; + goto _return_dev_put; } -for (i =0 ; i <ARRAY_SIZE (mac_dev->port); i++) { +/* PORT_NUM determines the size of the port array */ +for (i =0 ; i <PORT_NUM ; i++) {/* Find the port node */ dev_node =of_parse_phandle (mac_node,"fsl,fman-ports" , i);if (!dev_node) {dev_err (dev,"of_parse_phandle(%pOF, fsl,fman-ports) failed\n" , mac_node); -return -EINVAL ; + err = -EINVAL ; + goto _return_dev_arr_put; } of_dev =of_find_device_by_node (dev_node);
@@ -283,7 +298,7 @@ static int mac_probe(struct platform_device *_of_dev)dev_err (dev,"of_find_device_by_node(%pOF) failed\n" , dev_node); err = -EINVAL ; - goto _return_of_node_put; + goto _return_dev_arr_put; } mac_dev->fman_port_devs[i] = &of_dev->dev;
@@ -292,9 +307,15 @@ static int mac_probe(struct platform_device *_of_dev)dev_err (dev,"dev_get_drvdata(%pOF) failed\n" , dev_node); err = -EINVAL ; - goto _return_of_node_put; + goto _return_dev_arr_put; } +/* Two references have been taken in of_find_device_by_node() +* and fman_port_bind(). Release one of them here. The second +* one will be released in mac_remove(). +*/ +put_device (mac_dev->fman_port_devs[i]);of_node_put (dev_node); + dev_node =NULL ; }/* Get the PHY connection type */
@@ -314,7 +335,7 @@ static int mac_probe(struct platform_device *_of_dev) err =init (mac_dev, mac_node, ¶ms);if (err <0 ) -return err; + goto _return_dev_arr_put;if (!is_zero_ether_addr (mac_dev->addr))dev_info (dev,"FMan MAC address: %pM\n" , mac_dev->addr);
@@ -329,6 +350,12 @@ static int mac_probe(struct platform_device *_of_dev)return err; +_return_dev_arr_put: +/* mac_dev is kzalloc'ed */ +for (i =0 ; i <PORT_NUM ; i++) +put_device (mac_dev->fman_port_devs[i]); +_return_dev_put: +put_device (mac_dev->fman_dev); _return_of_node_put:of_node_put (dev_node);return err;
@@ -337,6 +364,11 @@ static int mac_probe(struct platform_device *_of_dev)static void mac_remove (struct platform_device *pdev) {struct mac_device *mac_dev =platform_get_drvdata (pdev); +int i; + +for (i =0 ; i <PORT_NUM ; i++) +put_device (mac_dev->fman_port_devs[i]); +put_device (mac_dev->fman_dev);platform_device_unregister (mac_dev->priv->eth_dev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 144/208 netfilter: xtables: fix typo causing some targets not to load on IPv6
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 306ed1728e8438caed30332e1ab46b28c25fe3d8 ]
- There is no NFPROTO_IPV6 family for mark and NFLOG.
- TRACE is also missing module autoload with NFPROTO_IPV6.
This results in ip6tables failing to restore a ruleset. This issue has been reported by several users providing incomplete patches.
Very similar to Ilya Katsnelson's patch including a missing chunk in the TRACE extension.
--- net/netfilter/xt_NFLOG.c | 2 +- net/netfilter/xt_TRACE.c | 1 + net/netfilter/xt_mark.c | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-)
net/netfilter/xt_NFLOG.c +1 -1
@@ -79,7 +79,7 @@ static struct xt_target nflog_tg_reg[] __read_mostly = { { .name = "NFLOG", .revision = 0, - .family = NFPROTO_IPV4, + .family = NFPROTO_IPV6, .checkentry = nflog_tg_check, .destroy = nflog_tg_destroy, .target = nflog_tg,
net/netfilter/xt_TRACE.c +1 -0
@@ -49,6 +49,7 @@ static struct xt_target trace_tg_reg[] __read_mostly = { .target = trace_tg, .checkentry = trace_tg_check, .destroy = trace_tg_destroy, + .me = THIS_MODULE, },#endif };
net/netfilter/xt_mark.c +1 -1
@@ -62,7 +62,7 @@ static struct xt_target mark_tg_reg[] __read_mostly = { { .name = "MARK", .revision = 2, - .family = NFPROTO_IPV4, + .family = NFPROTO_IPV6, .target = mark_tg, .targetsize = sizeof(struct xt_mark_tginfo2), .me = THIS_MODULE,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 145/208 net: wwan: fix global oob in wwan_rtnl_policy
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <[email protected]>
[ Upstream commit 47dd5447cab8ce30a847a0337d5341ae4c7476a7 ]
The variable wwan_rtnl_link_ops assign a *bigger* maxtype which leads to a global out-of-bounds read when parsing the netlink attributes. Exactly same bug cause as the oob fixed in commit b33fb5b801c6 ("net: qualcomm:
rmnet: fix global oob in rmnet_policy").
==================================================================
BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:388 [inline] BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x19d7/0x29a0 lib/nlattr.c:603 Read of size 1 at addr ffffffff8b09cb60 by task syz.1.66276/323862 CPU: 0 PID: 323862 Comm: syz.1.66276 Not tainted 6.1.70 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x177/0x231 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x14f/0x750 mm/kasan/report.c:395 kasan_report+0x139/0x170 mm/kasan/report.c:495 validate_nla lib/nlattr.c:388 [inline] __nla_validate_parse+0x19d7/0x29a0 lib/nlattr.c:603 __nla_parse+0x3c/0x50 lib/nlattr.c:700 nla_parse_nested_deprecated include/net/netlink.h:1269 [inline] __rtnl_newlink net/core/rtnetlink.c:3514 [inline] rtnl_newlink+0x7bc/0x1fd0 net/core/rtnetlink.c:3623 rtnetlink_rcv_msg+0x794/0xef0 net/core/rtnetlink.c:6122 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline] netlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352 netlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874 sock_sendmsg_nosec net/socket.c:716 [inline] __sock_sendmsg net/socket.c:728 [inline] ____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499 ___sys_sendmsg+0x21c/0x290 net/socket.c:2553 __sys_sendmsg net/socket.c:2582 [inline] __do_sys_sendmsg net/socket.c:2591 [inline] __se_sys_sendmsg+0x19e/0x270 net/socket.c:2589 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x90 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f67b19a24ad RSP: 002b:00007f67b17febb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f67b1b45f80 RCX: 00007f67b19a24ad RDX: 0000000000000000 RSI: 0000000020005e40 RDI: 0000000000000004 RBP: 00007f67b1a1e01d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd2513764f R14: 00007ffd251376e0 R15: 00007f67b17fed40 </TASK> The buggy address belongs to the variable: wwan_rtnl_policy+0x20/0x40 The buggy address belongs to the physical page: page:ffffea00002c2700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xb09c flags: 0xfff00000001000(reserved|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000001000 ffffea00002c2708 ffffea00002c2708 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected
page_owner info is not present (never set?)
Memory state around the buggy address:
ffffffff8b09ca00: 05 f9 f9 f9 05 f9 f9 f9 00 01 f9 f9 00 01 f9 f9
ffffffff8b09ca80: 00 00 00 05 f9 f9 f9 f9 00 00 03 f9 f9 f9 f9 f9
>ffffffff8b09cb00: 00 00 00 00 05 f9 f9 f9 00 00 00 00 f9 f9 f9 f9
^
ffffffff8b09cb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================According to the comment of nla_parse_nested_deprecated, use correct size IFLA_WWAN_MAX here to fix this issue.
--- drivers/net/wwan/wwan_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wwan/wwan_core.c +1 -1
@@ -1031,7 +1031,7 @@ static const struct nla_policy wwan_rtnl_policy[IFLA_WWAN_MAX + 1] = {static struct rtnl_link_ops wwan_rtnl_link_ops__read_mostly = { .kind ="wwan" , - .maxtype = __IFLA_WWAN_MAX, + .maxtype =IFLA_WWAN_MAX , .alloc = wwan_rtnl_alloc, .validate = wwan_rtnl_validate, .newlink = wwan_rtnl_newlink,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 146/208 net/sched: adjust device watchdog timer to detect stopped queue at right time
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Praveen Kumar Kannoju <[email protected]>
[ Upstream commit 33fb988b67050d9bb512f77f08453fa00088943c ]
Applications are sensitive to long network latency, particularly heartbeat monitoring ones. Longer the tx timeout recovery higher the risk with such applications on a production machines. This patch remedies, yet honoring device set tx timeout.
Modify watchdog next timeout to be shorter than the device specified. Compute the next timeout be equal to device watchdog timeout less the how long ago queue stop had been done. At next watchdog timeout tx timeout handler is called into if still in stopped state. Either called or not called, restore the watchdog timeout back to device specified.
Stable-dep-of: 95ecba62e2fd ("net: fix races in netdev_tx_sent_queue()/dev_watchdog()")
--- net/sched/sch_generic.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
net/sched/sch_generic.c +7 -4
@@ -505,19 +505,22 @@ static void dev_watchdog(struct timer_list *t)unsigned int timedout_ms =0 ;unsigned int i;unsigned long trans_start; +unsigned long oldest_start = jiffies;for (i =0 ; i < dev->num_tx_queues; i++) {struct netdev_queue *txq; txq =netdev_get_tx_queue (dev, i); trans_start =READ_ONCE (txq->trans_start); -if (netif_xmit_stopped (txq) && -time_after (jiffies, (trans_start + - dev->watchdog_timeo))) { +if (!netif_xmit_stopped (txq)) +continue ; +if (time_after (jiffies, trans_start + dev->watchdog_timeo)) { timedout_ms =jiffies_to_msecs (jiffies - trans_start);atomic_long_inc (&txq->trans_timeout);break ; } +if (time_after (oldest_start, trans_start)) + oldest_start = trans_start; }if (unlikely (timedout_ms)) {
@@ -530,7 +533,7 @@ static void dev_watchdog(struct timer_list *t)netif_unfreeze_queues (dev); }if (!mod_timer (&dev->watchdog_timer, -round_jiffies (jiffies + +round_jiffies (oldest_start + dev->watchdog_timeo))) release = false; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 147/208 net: fix races in netdev_tx_sent_queue()/dev_watchdog()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 95ecba62e2fd201bcdcca636f5d774f1cd4f1458 ]
Some workloads hit the infamous dev_watchdog() message:
"NETDEV WATCHDOG: eth0 (xxxx): transmit queue XX timed out"
It seems possible to hit this even for perfectly normal BQL enabled drivers:
1) Assume a TX queue was idle for more than dev->watchdog_timeo (5 seconds unless changed by the driver)
2) Assume a big packet is sent, exceeding current BQL limit.
3) Driver ndo_start_xmit() puts the packet in TX ring, and netdev_tx_sent_queue() is called.
4) QUEUE_STATE_STACK_XOFF could be set from netdev_tx_sent_queue() before txq->trans_start has been written.
5) txq->trans_start is written later, from netdev_start_xmit()
if (rc == NETDEV_TX_OK)
txq_trans_update(txq)dev_watchdog() running on another cpu could read the old txq->trans_start, and then see QUEUE_STATE_STACK_XOFF, because 5) did not happen yet.
To solve the issue, write txq->trans_start right before one XOFF bit is set :
- _QUEUE_STATE_DRV_XOFF from netif_tx_stop_queue()
- __QUEUE_STATE_STACK_XOFF from netdev_tx_sent_queue()
Quoted 1 line
From
dev_watchdog(), we have to readtxq->statebeforetxq->trans_start.
Add memory barriers to enforce correct ordering.
In the future, we could avoid writing over txq->trans_start for normal operations, and rename this field to txq->xoff_start_time.
--- include/linux/netdevice.h | 12 ++++++++++++ net/sched/sch_generic.c | 8 +++++++- 2 files changed, 19 insertions(+), 1 deletion(-)
include/linux/netdevice.h +12 -0
@@ -3363,6 +3363,12 @@ static inline void netif_tx_wake_all_queues(struct net_device *dev) static __always_inline void netif_tx_stop_queue(struct netdev_queue *dev_queue) { +/* Paired with READ_ONCE() from dev_watchdog() */ +WRITE_ONCE (dev_queue->trans_start, jiffies); + +/* This barrier is paired with smp_mb() from dev_watchdog() */ +smp_mb__before_atomic (); +/* Must be an atomic op see netif_txq_try_stop() */ set_bit (__QUEUE_STATE_DRV_XOFF, &dev_queue->state); }
@@ -3479,6 +3485,12 @@ static inline void netdev_tx_sent_queue(struct netdev_queue *dev_queue,if (likely (dql_avail (&dev_queue->dql) >=0 ))return ; +/* Paired with READ_ONCE() from dev_watchdog() */ +WRITE_ONCE (dev_queue->trans_start, jiffies); + +/* This barrier is paired with smp_mb() from dev_watchdog() */ +smp_mb__before_atomic (); +set_bit (__QUEUE_STATE_STACK_XOFF, &dev_queue->state);/*
net/sched/sch_generic.c +7 -1
@@ -511,9 +511,15 @@ static void dev_watchdog(struct timer_list *t)struct netdev_queue *txq; txq =netdev_get_tx_queue (dev, i); - trans_start =READ_ONCE (txq->trans_start);if (!netif_xmit_stopped (txq))continue ; + +/* Paired with WRITE_ONCE() + smp_mb...() in +* netdev_tx_sent_queue() and netif_tx_stop_queue(). +*/ +smp_mb (); + trans_start =READ_ONCE (txq->trans_start); +if (time_after (jiffies, trans_start + dev->watchdog_timeo)) { timedout_ms =jiffies_to_msecs (jiffies - trans_start);atomic_long_inc (&txq->trans_timeout);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 148/208 net: usb: usbnet: fix name regression
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit 8a7d12d674ac6f2147c18f36d1e15f1a48060edf ]
The fix for MAC addresses broke detection of the naming convention because it gave network devices no random MAC before bind() was called. This means that the check for the local assignment bit was always negative as the address was zeroed from allocation, instead of from overwriting the MAC with a unique hardware address.
The correct check for whether bind() has altered the MAC is done with is_zero_ether_addr
--- drivers/net/usb/usbnet.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/usb/usbnet.c +2 -1
@@ -1771,7 +1771,8 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)// can rename the link if it knows better. if ((dev->driver_info->flags &FLAG_ETHER ) !=0 && ((dev->driver_info->flags &FLAG_POINTTOPOINT ) ==0 || - (net->dev_addr [0 ] &0x02 ) ==0 )) +/* somebody touched it*/ + !is_zero_ether_addr (net->dev_addr)))strscpy (net->name,"eth%d" ,sizeof (net->name));/* WLAN devices should always be named "wlan%d" */ if ((dev->driver_info->flags &FLAG_WLAN ) !=0 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 149/208 bpf: Simplify checking size of helper accesses
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Matei <[email protected]>
[ Upstream commit 8a021e7fa10576eeb3938328f39bbf98fe7d4715 ]
This patch simplifies the verification of size arguments associated to pointer arguments to helpers and kfuncs. Many helpers take a pointer argument followed by the size of the memory access performed to be performed through that pointer. Before this patch, the handling of the size argument in check_mem_size_reg() was confusing and wasteful: if the size register's lower bound was 0, then the verification was done twice:
once considering the size of the access to be the lower-bound of the respective argument, and once considering the upper bound (even if the two are the same). The upper bound checking is a super-set of the lower-bound checking(*), except: the only point of the lower-bound check is to handle the case where zero-sized-accesses are explicitly not allowed and the lower-bound is zero. This static condition is now checked explicitly, replacing a much more complex, expensive and confusing verification call to check_helper_mem_access().
Error messages change in this patch. Before, messages about illegal zero-size accesses depended on the type of the pointer and on other conditions, and sometimes the message was plain wrong: in some tests that changed you'll see that the old message was something like "R1 min value is outside of the allowed memory range", where R1 is the pointer register; the error was wrongly claiming that the pointer was bad instead of the size being bad. Other times the information that the size came for a register with a possible range of values was wrong, and the error presented the size as a fixed zero. Now the errors refer to the right register. However, the old error messages did contain useful information about the pointer register which is now lost; recovering this information was deemed not important enough.
(*) Besides standing to reason that the checks for a bigger size access are a super-set of the checks for a smaller size access, I have also mechanically verified this by reading the code for all types of pointers. I could convince myself that it's true for all but PTR_TO_BTF_ID (check_ptr_to_btf_access). There, simply looking line-by-line does not immediately prove what we want. If anyone has any qualms, let me know.
Stable-dep-of: 8ea607330a39 ("bpf: Fix overloading of MEM_UNINIT's meaning")
--- kernel/bpf/verifier.c | 10 ++++------ .../selftests/bpf/progs/verifier_helper_value_access.c | 8 ++++---- tools/testing/selftests/bpf/progs/verifier_raw_stack.c | 2 +- 3 files changed, 9 insertions(+), 11 deletions(-)
kernel/bpf/verifier.c +4 -6
@@ -7324,12 +7324,10 @@ static int check_mem_size_reg(struct bpf_verifier_env *env,return -EACCES ; } -if (reg->umin_value ==0 ) { - err =check_helper_mem_access (env, regno -1 ,0 , - zero_size_allowed, - meta); -if (err) -return err; +if (reg->umin_value ==0 && !zero_size_allowed) { +verbose (env,"R%d invalid zero-sized read: u64=[%lld,%lld]\n" , + regno, reg->umin_value, reg->umax_value); +return -EACCES ; }if (reg->umax_value >=BPF_MAX_VAR_SIZ ) {
tools/testing/selftests/bpf/progs/verifier_helper_value_access.c +4 -4
@@ -91,7 +91,7 @@ l0_%=: exit; \ SEC("tracepoint") __description("helper access to map: empty range") -__failure __msg("invalid access to map value, value_size=48 off=0 size=0") +__failure __msg("R2 invalid zero-sized read") __naked void access_to_map_empty_range(void) { asm volatile (" \
@@ -221,7 +221,7 @@ l0_%=: exit; \ SEC("tracepoint") __description("helper access to adjusted map (via const imm): empty range") -__failure __msg("invalid access to map value, value_size=48 off=4 size=0") +__failure __msg("R2 invalid zero-sized read") __naked void via_const_imm_empty_range(void) { asm volatile (" \
@@ -386,7 +386,7 @@ l0_%=: exit; \ SEC("tracepoint") __description("helper access to adjusted map (via const reg): empty range") -__failure __msg("R1 min value is outside of the allowed memory range") +__failure __msg("R2 invalid zero-sized read") __naked void via_const_reg_empty_range(void) { asm volatile (" \
@@ -556,7 +556,7 @@ l0_%=: exit; \ SEC("tracepoint") __description("helper access to adjusted map (via variable): empty range") -__failure __msg("R1 min value is outside of the allowed memory range") +__failure __msg("R2 invalid zero-sized read") __naked void map_via_variable_empty_range(void) { asm volatile (" \
tools/testing/selftests/bpf/progs/verifier_raw_stack.c +1 -1
@@ -64,7 +64,7 @@ __naked void load_bytes_negative_len_2(void) SEC("tc") __description("raw_stack: skb_load_bytes, zero len") -__failure __msg("invalid zero-sized read") +__failure __msg("R4 invalid zero-sized read: u64=[0,0]")__naked void skb_load_bytes_zero_len (void ) { asm volatile (" \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 150/208 bpf: Add MEM_WRITE attribute
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 6fad274f06f038c29660aa53fbad14241c9fd976 ]
Add a MEM_WRITE attribute for BPF helper functions which can be used in bpf_func_proto to annotate an argument type in order to let the verifier know that the helper writes into the memory passed as an argument. In the past MEM_UNINIT has been (ab)used for this function, but the latter merely tells the verifier that the passed memory can be uninitialized.
There have been bugs with overloading the latter but aside from that there are also cases where the passed memory is read + written which currently cannot be expressed, see also 4b3786a6c539 ("bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error").
Stable-dep-of: 8ea607330a39 ("bpf: Fix overloading of MEM_UNINIT's meaning")
--- include/linux/bpf.h | 14 +++++++++++--- kernel/bpf/helpers.c | 10 +++++----- kernel/bpf/ringbuf.c | 2 +- kernel/bpf/syscall.c | 2 +- kernel/trace/bpf_trace.c | 4 ++-- net/core/filter.c | 4 ++-- 6 files changed, 22 insertions(+), 14 deletions(-)
include/linux/bpf.h +11 -3
@@ -616,6 +616,7 @@ enum bpf_type_flag {*/ PTR_UNTRUSTED =BIT (6 +BPF_BASE_TYPE_BITS ), +/* MEM can be uninitialized. */ MEM_UNINIT = BIT(7 + BPF_BASE_TYPE_BITS),/* DYNPTR points to memory local to the bpf program. */
@@ -681,6 +682,13 @@ enum bpf_type_flag {*/ MEM_ALIGNED =BIT (17 +BPF_BASE_TYPE_BITS ), +/* MEM is being written to, often combined with MEM_UNINIT. Non-presence +* of MEM_WRITE means that MEM is only being read. MEM_WRITE without the +* MEM_UNINIT means that memory needs to be initialized since it is also +* read. +*/ +MEM_WRITE =BIT (18 +BPF_BASE_TYPE_BITS ), + __BPF_TYPE_FLAG_MAX, __BPF_TYPE_LAST_FLAG = __BPF_TYPE_FLAG_MAX - 1, };
@@ -738,10 +746,10 @@ enum bpf_arg_type {ARG_PTR_TO_SOCKET_OR_NULL =PTR_MAYBE_NULL |ARG_PTR_TO_SOCKET ,ARG_PTR_TO_STACK_OR_NULL =PTR_MAYBE_NULL |ARG_PTR_TO_STACK ,ARG_PTR_TO_BTF_ID_OR_NULL =PTR_MAYBE_NULL |ARG_PTR_TO_BTF_ID , -/* pointer to memory does not need to be initialized, helper function must fill -* all bytes or clear them in error case. +/* Pointer to memory does not need to be initialized, since helper function +* fills all bytes or clears them in error case. */ -ARG_PTR_TO_UNINIT_MEM =MEM_UNINIT |ARG_PTR_TO_MEM , +ARG_PTR_TO_UNINIT_MEM =MEM_UNINIT |MEM_WRITE |ARG_PTR_TO_MEM ,/* Pointer to valid memory of size known at compile time. */ ARG_PTR_TO_FIXED_SIZE_MEM = MEM_FIXED_SIZE | ARG_PTR_TO_MEM,
kernel/bpf/helpers.c +5 -5
@@ -110,7 +110,7 @@ const struct bpf_func_proto bpf_map_pop_elem_proto = { .gpl_only = false, .ret_type = RET_INTEGER, .arg1_type = ARG_CONST_MAP_PTR, - .arg2_type = ARG_PTR_TO_MAP_VALUE | MEM_UNINIT, + .arg2_type = ARG_PTR_TO_MAP_VALUE | MEM_UNINIT | MEM_WRITE, }; BPF_CALL_2(bpf_map_peek_elem, struct bpf_map *, map, void *, value)
@@ -123,7 +123,7 @@ const struct bpf_func_proto bpf_map_peek_elem_proto = { .gpl_only = false, .ret_type = RET_INTEGER, .arg1_type = ARG_CONST_MAP_PTR, - .arg2_type = ARG_PTR_TO_MAP_VALUE | MEM_UNINIT, + .arg2_type = ARG_PTR_TO_MAP_VALUE | MEM_UNINIT | MEM_WRITE, }; BPF_CALL_3(bpf_map_lookup_percpu_elem, struct bpf_map *, map, void *, key, u32, cpu)
@@ -538,7 +538,7 @@ const struct bpf_func_proto bpf_strtol_proto = { .arg1_type = ARG_PTR_TO_MEM | MEM_RDONLY, .arg2_type = ARG_CONST_SIZE, .arg3_type = ARG_ANYTHING, - .arg4_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED, + .arg4_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED, .arg4_size = sizeof(s64), };
@@ -568,7 +568,7 @@ const struct bpf_func_proto bpf_strtoul_proto = { .arg1_type = ARG_PTR_TO_MEM | MEM_RDONLY, .arg2_type = ARG_CONST_SIZE, .arg3_type = ARG_ANYTHING, - .arg4_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED, + .arg4_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED, .arg4_size = sizeof(u64), };
@@ -1607,7 +1607,7 @@ static const struct bpf_func_proto bpf_dynptr_from_mem_proto = { .arg1_type = ARG_PTR_TO_UNINIT_MEM, .arg2_type = ARG_CONST_SIZE_OR_ZERO, .arg3_type = ARG_ANYTHING, - .arg4_type = ARG_PTR_TO_DYNPTR | DYNPTR_TYPE_LOCAL | MEM_UNINIT, + .arg4_type = ARG_PTR_TO_DYNPTR | DYNPTR_TYPE_LOCAL | MEM_UNINIT | MEM_WRITE, }; BPF_CALL_5(bpf_dynptr_read, void *, dst, u32, len, const struct bpf_dynptr_kern *, src,
kernel/bpf/ringbuf.c +1 -1
@@ -632,7 +632,7 @@ const struct bpf_func_proto bpf_ringbuf_reserve_dynptr_proto = { .arg1_type = ARG_CONST_MAP_PTR, .arg2_type = ARG_ANYTHING, .arg3_type = ARG_ANYTHING, - .arg4_type = ARG_PTR_TO_DYNPTR | DYNPTR_TYPE_RINGBUF | MEM_UNINIT, + .arg4_type = ARG_PTR_TO_DYNPTR | DYNPTR_TYPE_RINGBUF | MEM_UNINIT | MEM_WRITE, }; BPF_CALL_2(bpf_ringbuf_submit_dynptr, struct bpf_dynptr_kern *, ptr, u64, flags)
kernel/bpf/syscall.c +1 -1
@@ -5689,7 +5689,7 @@ static const struct bpf_func_proto bpf_kallsyms_lookup_name_proto = { .arg1_type = ARG_PTR_TO_MEM, .arg2_type = ARG_CONST_SIZE_OR_ZERO, .arg3_type = ARG_ANYTHING, - .arg4_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED, + .arg4_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED, .arg4_size = sizeof(u64), };
kernel/trace/bpf_trace.c +2 -2
@@ -1220,7 +1220,7 @@ static const struct bpf_func_proto bpf_get_func_arg_proto = { .ret_type = RET_INTEGER, .arg1_type = ARG_PTR_TO_CTX, .arg2_type = ARG_ANYTHING, - .arg3_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED, + .arg3_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED, .arg3_size = sizeof(u64), };
@@ -1237,7 +1237,7 @@ static const struct bpf_func_proto bpf_get_func_ret_proto = { .func = get_func_ret, .ret_type = RET_INTEGER, .arg1_type = ARG_PTR_TO_CTX, - .arg2_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED, + .arg2_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED, .arg2_size = sizeof(u64), };
net/core/filter.c +2 -2
@@ -6310,7 +6310,7 @@ static const struct bpf_func_proto bpf_skb_check_mtu_proto = { .ret_type = RET_INTEGER, .arg1_type = ARG_PTR_TO_CTX, .arg2_type = ARG_ANYTHING, - .arg3_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED, + .arg3_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED, .arg3_size = sizeof(u32), .arg4_type = ARG_ANYTHING, .arg5_type = ARG_ANYTHING,
@@ -6322,7 +6322,7 @@ static const struct bpf_func_proto bpf_xdp_check_mtu_proto = { .ret_type = RET_INTEGER, .arg1_type = ARG_PTR_TO_CTX, .arg2_type = ARG_ANYTHING, - .arg3_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_ALIGNED, + .arg3_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED, .arg3_size = sizeof(u32), .arg4_type = ARG_ANYTHING, .arg5_type = ARG_ANYTHING,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 151/208 bpf: Fix overloading of MEM_UNINITs meaning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 8ea607330a39184f51737c6ae706db7fdca7628e ]
Lonial reported an issue in the BPF verifier where check_mem_size_reg() has the following code:
if (!tnum_is_const(reg->var_off))
/* For unprivileged variable accesses, disable raw
* mode so that the program is required to
* initialize all the memory that the helper could
* just partially fill up.
*/
meta = NULL;This means that writes are not checked when the register containing the size of the passed buffer has not a fixed size. Through this bug, a BPF program can write to a map which is marked as read-only, for example, .rodata global maps.
The problem is that MEM_UNINIT's initial meaning that "the passed buffer to the BPF helper does not need to be initialized" which was added back in commit 435faee1aae9 ("bpf, verifier: add ARG_PTR_TO_RAW_STACK type") got overloaded over time with "the passed buffer is being written to".
The problem however is that checks such as the above which were added later via 06c1c049721a ("bpf: allow helpers access to variable memory") set meta to NULL in order force the user to always initialize the passed buffer to the helper. Due to the current double meaning of MEM_UNINIT, this bypasses verifier write checks to the memory (not boundary checks though) and only assumes the latter memory is read instead.
Fix this by reverting MEM_UNINIT back to its original meaning, and having MEM_WRITE as an annotation to BPF helpers in order to then trigger the BPF verifier checks for writing to memory.
Some notes: check_arg_pair_ok() ensures that for ARG_CONST_SIZE{,_OR_ZERO} we can access fn->arg_type[arg - 1] since it must contain a preceding ARG_PTR_TO_MEM. For check_mem_reg() the meta argument can be removed altogether since we do check both BPF_READ and BPF_WRITE. Same for the equivalent check_kfunc_mem_size_reg().
--- kernel/bpf/verifier.c | 73 +++++++++++++++++++++---------------------- 1 file changed, 35 insertions(+), 38 deletions(-)
kernel/bpf/verifier.c +35 -38
@@ -7198,7 +7198,8 @@ static int check_stack_range_initialized( }static int check_helper_mem_access (struct bpf_verifier_env *env,int regno, -int access_size,bool zero_size_allowed, +int access_size,enum bpf_access_type access_type, +bool zero_size_allowed,struct bpf_call_arg_meta *meta) {struct bpf_reg_state *regs =cur_regs (env), *reg = ®s[regno];
@@ -7210,7 +7211,7 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,return check_packet_access (env, regno, reg->off, access_size, zero_size_allowed);case PTR_TO_MAP_KEY : -if (meta && meta->raw_mode) { +if (access_type ==BPF_WRITE ) {verbose (env,"R%d cannot write into %s\n" , regno,reg_type_str (env, reg->type));return -EACCES ;
@@ -7218,15 +7219,13 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,return check_mem_region_access (env, regno, reg->off, access_size, reg->map_ptr->key_size, false);case PTR_TO_MAP_VALUE : -if (check_map_access_type (env, regno, reg->off, access_size, - meta && meta->raw_mode ?BPF_WRITE : -BPF_READ )) +if (check_map_access_type (env, regno, reg->off, access_size, access_type))return -EACCES ;return check_map_access (env, regno, reg->off, access_size, zero_size_allowed,ACCESS_HELPER );case PTR_TO_MEM :if (type_is_rdonly_mem (reg->type)) { -if (meta && meta->raw_mode) { +if (access_type ==BPF_WRITE ) {verbose (env,"R%d cannot write into %s\n" , regno,reg_type_str (env, reg->type));return -EACCES ;
@@ -7237,7 +7236,7 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno, zero_size_allowed);case PTR_TO_BUF :if (type_is_rdonly_mem (reg->type)) { -if (meta && meta->raw_mode) { +if (access_type ==BPF_WRITE ) {verbose (env,"R%d cannot write into %s\n" , regno,reg_type_str (env, reg->type));return -EACCES ;
@@ -7265,7 +7264,6 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,* Dynamically check it now. */ if (!env->ops->convert_ctx_access) { -enum bpf_access_type atype = meta && meta->raw_mode ?BPF_WRITE :BPF_READ ;int offset = access_size -1 ;/* Allow zero-byte read from PTR_TO_CTX */
@@ -7273,7 +7271,7 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,return zero_size_allowed ?0 : -EACCES ;return check_mem_access (env, env->insn_idx, regno, offset,BPF_B , - atype,-1 , false, false); + access_type,-1 , false, false); } fallthrough;
@@ -7292,6 +7290,7 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,static int check_mem_size_reg (struct bpf_verifier_env *env,struct bpf_reg_state *reg,u32 regno, +enum bpf_access_type access_type,bool zero_size_allowed,struct bpf_call_arg_meta *meta) {
@@ -7307,15 +7306,12 @@ static int check_mem_size_reg(struct bpf_verifier_env *env,*/ meta->msize_max_value = reg->umax_value; -/* The register is SCALAR_VALUE; the access check -* happens using its boundaries. +/* The register is SCALAR_VALUE; the access check happens using +* its boundaries. For unprivileged variable accesses, disable +* raw mode so that the program is required to initialize all +* the memory that the helper could just partially fill up. */ if (!tnum_is_const (reg->var_off)) -/* For unprivileged variable accesses, disable raw -* mode so that the program is required to -* initialize all the memory that the helper could -* just partially fill up. -*/ meta =NULL ;if (reg->smin_value <0 ) {
@@ -7335,9 +7331,8 @@ static int check_mem_size_reg(struct bpf_verifier_env *env, regno);return -EACCES ; } - err =check_helper_mem_access (env, regno -1 , - reg->umax_value, - zero_size_allowed, meta); + err =check_helper_mem_access (env, regno -1 , reg->umax_value, + access_type, zero_size_allowed, meta);if (!err) err =mark_chain_precision (env, regno);return err;
@@ -7348,13 +7343,11 @@ int check_mem_reg(struct bpf_verifier_env *env, struct bpf_reg_state *reg, {bool may_be_null =type_may_be_null (reg->type);struct bpf_reg_state saved_reg; -struct bpf_call_arg_meta meta;int err;if (register_is_null (reg))return 0 ; -memset (&meta,0 ,sizeof (meta));/* Assuming that the register contains a value check if the memory * access is safe. Temporarily save and restore the register's state as * the conversion shouldn't be visible to a caller.
@@ -7364,10 +7357,8 @@ int check_mem_reg(struct bpf_verifier_env *env, struct bpf_reg_state *reg,mark_ptr_not_null_reg (reg); } - err =check_helper_mem_access (env, regno, mem_size, true, &meta); -/* Check access for BPF_WRITE */ - meta.raw_mode = true; - err = err ?:check_helper_mem_access (env, regno, mem_size, true, &meta); + err =check_helper_mem_access (env, regno, mem_size,BPF_READ , true,NULL ); + err = err ?:check_helper_mem_access (env, regno, mem_size,BPF_WRITE , true,NULL );if (may_be_null) *reg = saved_reg;
@@ -7393,13 +7384,12 @@ static int check_kfunc_mem_size_reg(struct bpf_verifier_env *env, struct bpf_regmark_ptr_not_null_reg (mem_reg); } - err =check_mem_size_reg (env, reg, regno, true, &meta); -/* Check access for BPF_WRITE */ - meta.raw_mode = true; - err = err ?:check_mem_size_reg (env, reg, regno, true, &meta); + err =check_mem_size_reg (env, reg, regno,BPF_READ , true, &meta); + err = err ?:check_mem_size_reg (env, reg, regno,BPF_WRITE , true, &meta);if (may_be_null) *mem_reg = saved_reg; +return err; }
@@ -8585,9 +8575,8 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,verbose (env,"invalid map_ptr to access map->key\n" );return -EACCES ; } - err =check_helper_mem_access (env, regno, - meta->map_ptr->key_size, false, -NULL ); + err =check_helper_mem_access (env, regno, meta->map_ptr->key_size, +BPF_READ , false,NULL );break ;case ARG_PTR_TO_MAP_VALUE :if (type_may_be_null (arg_type) &®ister_is_null (reg))
@@ -8602,9 +8591,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,return -EACCES ; } meta->raw_mode = arg_type &MEM_UNINIT ; - err =check_helper_mem_access (env, regno, - meta->map_ptr->value_size, false, - meta); + err =check_helper_mem_access (env, regno, meta->map_ptr->value_size, + arg_type &MEM_WRITE ?BPF_WRITE :BPF_READ , + false, meta);break ;case ARG_PTR_TO_PERCPU_BTF_ID :if (!reg->btf_id) {
@@ -8646,7 +8635,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,*/ meta->raw_mode = arg_type &MEM_UNINIT ;if (arg_type &MEM_FIXED_SIZE ) { - err =check_helper_mem_access (env, regno, fn->arg_size[arg], false, meta); + err =check_helper_mem_access (env, regno, fn->arg_size[arg], + arg_type &MEM_WRITE ?BPF_WRITE :BPF_READ , + false, meta);if (err)return err;if (arg_type &MEM_ALIGNED )
@@ -8654,10 +8645,16 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, }break ;case ARG_CONST_SIZE : - err =check_mem_size_reg (env, reg, regno, false, meta); + err =check_mem_size_reg (env, reg, regno, + fn->arg_type[arg -1 ] &MEM_WRITE ? +BPF_WRITE :BPF_READ , + false, meta);break ;case ARG_CONST_SIZE_OR_ZERO : - err =check_mem_size_reg (env, reg, regno, true, meta); + err =check_mem_size_reg (env, reg, regno, + fn->arg_type[arg -1 ] &MEM_WRITE ? +BPF_WRITE :BPF_READ , + true, meta);break ;case ARG_PTR_TO_DYNPTR : err =process_dynptr_func (env, regno, insn_idx, arg_type,0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 152/208 bpf: Remove MEM_UNINIT from skb/xdp MTU helpers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 14a3d3ef02ba53447d5112a2641aac0d10dc994f ]
We can now undo parts of 4b3786a6c539 ("bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error") as discussed in [0].
Given the BPF helpers now have MEM_WRITE tag, the MEM_UNINIT can be cleared.
The mtu_len is an input as well as output argument, meaning, the BPF program has to set it to something. It cannot be uninitialized. Therefore, allowing uninitialized memory and zeroing it on error would be odd. It was done as an interim step in 4b3786a6c539 as the desired behavior could not have been expressed before the introduction of MEM_WRITE tag.
--- net/core/filter.c | 42 +++++++++++++++--------------------------- 1 file changed, 15 insertions(+), 27 deletions(-)
net/core/filter.c +15 -27
@@ -6223,24 +6223,16 @@ BPF_CALL_5(bpf_skb_check_mtu, struct sk_buff *, skb, {int ret =BPF_MTU_CHK_RET_FRAG_NEEDED ;struct net_device *dev = skb->dev; -int skb_len, dev_len; -int mtu =0 ; +int mtu, dev_len, skb_len; -if (unlikely (flags & ~(BPF_MTU_CHK_SEGS ))) { - ret = -EINVAL ; - goto out; - } - -if (unlikely (flags &BPF_MTU_CHK_SEGS && (len_diff || *mtu_len))) { - ret = -EINVAL ; - goto out; - } +if (unlikely (flags & ~(BPF_MTU_CHK_SEGS ))) +return -EINVAL ; +if (unlikely (flags &BPF_MTU_CHK_SEGS && (len_diff || *mtu_len))) +return -EINVAL ; dev =__dev_via_ifindex (dev, ifindex); -if (unlikely (!dev)) { - ret = -ENODEV ; - goto out; - } +if (unlikely (!dev)) +return -ENODEV ; mtu =READ_ONCE (dev->mtu); dev_len = mtu + dev->hard_header_len;
@@ -6275,19 +6267,15 @@ BPF_CALL_5(bpf_xdp_check_mtu, struct xdp_buff *, xdp,struct net_device *dev = xdp->rxq->dev;int xdp_len = xdp->data_end - xdp->data;int ret =BPF_MTU_CHK_RET_SUCCESS ; -int mtu =0 , dev_len; +int mtu, dev_len;/* XDP variant doesn't support multi-buffer segment check (yet) */ -if (unlikely (flags)) { - ret = -EINVAL ; - goto out; - } +if (unlikely (flags)) +return -EINVAL ; dev =__dev_via_ifindex (dev, ifindex); -if (unlikely (!dev)) { - ret = -ENODEV ; - goto out; - } +if (unlikely (!dev)) +return -ENODEV ; mtu =READ_ONCE (dev->mtu); dev_len = mtu + dev->hard_header_len;
@@ -6299,7 +6287,7 @@ BPF_CALL_5(bpf_xdp_check_mtu, struct xdp_buff *, xdp, xdp_len += len_diff;/* minus result pass check */ if (xdp_len > dev_len) ret =BPF_MTU_CHK_RET_FRAG_NEEDED ; -out: + *mtu_len = mtu;return ret; }
@@ -6310,7 +6298,7 @@ static const struct bpf_func_proto bpf_skb_check_mtu_proto = { .ret_type = RET_INTEGER, .arg1_type = ARG_PTR_TO_CTX, .arg2_type = ARG_ANYTHING, - .arg3_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED, + .arg3_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_WRITE | MEM_ALIGNED, .arg3_size = sizeof(u32), .arg4_type = ARG_ANYTHING, .arg5_type = ARG_ANYTHING,
@@ -6322,7 +6310,7 @@ static const struct bpf_func_proto bpf_xdp_check_mtu_proto = { .ret_type = RET_INTEGER, .arg1_type = ARG_PTR_TO_CTX, .arg2_type = ARG_ANYTHING, - .arg3_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED, + .arg3_type = ARG_PTR_TO_FIXED_SIZE_MEM | MEM_WRITE | MEM_ALIGNED, .arg3_size = sizeof(u32), .arg4_type = ARG_ANYTHING, .arg5_type = ARG_ANYTHING,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 153/208 net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions created by classifiers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 34d35b4edbbe890a91bec939bfd29ad92517a52b ]
tcf_action_init() has logic for checking mismatches between action and filter offload flags (skip_sw/skip_hw). AFAIU, this is intended to run on the transition between the new tc_act_bind(flags) returning true (aka now gets bound to classifier) and tc_act_bind(act->tcfa_flags) returning false (aka action was not bound to classifier before). Otherwise, the check is skipped.
For the case where an action is not standalone, but rather it was created by a classifier and is bound to it, tcf_action_init() skips the check entirely, and this means it allows mismatched flags to occur.
Taking the matchall classifier code path as an example (with mirred as an action), the reason is the following:
1 | mall_change() 2 | -> mall_replace_hw_filter() 3 | -> tcf_exts_validate_ex() 4 | -> flags |= TCA_ACT_FLAGS_BIND; 5 | -> tcf_action_init() 6 | -> tcf_action_init_1() 7 | -> a_o->init() 8 | -> tcf_mirred_init() 9 | -> tcf_idr_create_from_flags() 10 | -> tcf_idr_create() 11 | -> p->tcfa_flags = flags; 12 | -> tc_act_bind(flags)) 13 | -> tc_act_bind(act->tcfa_flags)
When invoked from tcf_exts_validate_ex() like matchall does (but other classifiers validate their extensions as well), tcf_action_init() runs in a call path where "flags" always contains TCA_ACT_FLAGS_BIND (set by line 4). So line 12 is always true, and line 13 is always true as well. No transition ever takes place, and the check is skipped.
The code was added in this form in commit c86e0209dc77 ("flow_offload:
validate flags of filter and actions"), but I'm attributing the blame even earlier in that series, to when TCA_ACT_FLAGS_SKIP_HW and TCA_ACT_FLAGS_SKIP_SW were added to the UAPI.
Following the development process of this change, the check did not always exist in this form. A change took place between v3 [1] and v4 [2], AFAIU due to review feedback that it doesn't make sense for action flags to be different than classifier flags. I think I agree with that feedback, but it was translated into code that omits enforcing this for "classic" actions created at the same time with the filters themselves.
There are 3 more important cases to discuss. First there is this command:
$ tc qdisc add dev eth0 clasct $ tc filter add dev eth0 ingress matchall skip_sw \ action mirred ingress mirror dev eth1
which should be allowed, because prior to the concept of dedicated action flags, it used to work and it used to mean the action inherited the skip_sw/skip_hw flags from the classifier. It's not a mismatch.
Then we have this command:
$ tc qdisc add dev eth0 clasct $ tc filter add dev eth0 ingress matchall skip_sw \ action mirred ingress mirror dev eth1 skip_hw
where there is a mismatch and it should be rejected.
Finally, we have:
$ tc qdisc add dev eth0 clasct $ tc filter add dev eth0 ingress matchall skip_sw \ action mirred ingress mirror dev eth1 skip_sw
where the offload flags coincide, and this should be treated the same as the first command based on inheritance, and accepted.
[1]: https://lore.kernel.org/netdev/[email protected]/
[2]: https://lore.kernel.org/netdev/[email protected]/
--- net/sched/act_api.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-)
net/sched/act_api.c +22 -1
@@ -1489,8 +1489,29 @@ int tcf_action_init(struct net *net, struct tcf_proto *tp, struct nlattr *nla,bool skip_sw =tc_skip_sw (fl_flags);bool skip_hw =tc_skip_hw (fl_flags); -if (tc_act_bind (act->tcfa_flags)) +if (tc_act_bind (act->tcfa_flags)) { +/* Action is created by classifier and is not +* standalone. Check that the user did not set +* any action flags different than the +* classifier flags, and inherit the flags from +* the classifier for the compatibility case +* where no flags were specified at all. +*/ +if ((tc_act_skip_sw (act->tcfa_flags) && !skip_sw) || + (tc_act_skip_hw (act->tcfa_flags) && !skip_hw)) { +NL_SET_ERR_MSG (extack, +"Mismatch between action and filter offload flags" ); + err = -EINVAL ; + goto err; + } +if (skip_sw) + act->tcfa_flags |=TCA_ACT_FLAGS_SKIP_SW ; +if (skip_hw) + act->tcfa_flags |=TCA_ACT_FLAGS_SKIP_HW ;continue ; + } + +/* Action is standalone */ if (skip_sw !=tc_act_skip_sw (act->tcfa_flags) || skip_hw !=tc_act_skip_hw (act->tcfa_flags)) { NL_SET_ERR_MSG(extack,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 154/208 net: sched: fix use-after-free in taprio_change()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit f504465970aebb2467da548f7c1efbbf36d0f44b ]
In 'taprio_change()', 'admin' pointer may become dangling due to sched switch / removal caused by 'advance_sched()', and critical section protected by 'q->current_entry_lock' is too small to prevent from such a scenario (which causes use-after-free detected by KASAN). Fix this by prefer 'rcu_replace_pointer()' over 'rcu_assign_pointer()' to update 'admin' immediately before an attempt to schedule freeing.
--- net/sched/sch_taprio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sched/sch_taprio.c +2 -1
@@ -1988,7 +1988,8 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt,taprio_start_sched (sch, start, new_admin); -rcu_assign_pointer (q->admin_sched, new_admin); + admin =rcu_replace_pointer (q->admin_sched, new_admin, +lockdep_rtnl_is_held ());if (admin)call_rcu (&admin->rcu, taprio_free_sched_cb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 155/208 net: sched: use RCU read-side critical section in taprio_dump()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit b22db8b8befe90b61c98626ca1a2fbb0505e9fe3 ]
Fix possible use-after-free in 'taprio_dump()' by adding RCU read-side critical section there. Never seen on x86 but found on a KASAN-enabled arm64 system when investigating
https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa:
[T15862] BUG: KASAN: slab-use-after-free in taprio_dump+0xa0c/0xbb0
[T15862] Read of size 4 at addr ffff0000d4bb88f8 by task repro/15862
[T15862]
[T15862] CPU: 0 UID: 0 PID: 15862 Comm: repro Not tainted 6.11.0-rc1-00293-gdefaf1a2113a-dirty #2 [T15862] Hardware name: QEMU QEMU Virtual Machine, BIOS edk2-20240524-5.fc40 05/24/2024 [T15862] Call trace:
[T15862] dump_backtrace+0x20c/0x220 [T15862] show_stack+0x2c/0x40 [T15862] dump_stack_lvl+0xf8/0x174 [T15862] print_report+0x170/0x4d8 [T15862] kasan_report+0xb8/0x1d4 [T15862] __asan_report_load4_noabort+0x20/0x2c [T15862] taprio_dump+0xa0c/0xbb0 [T15862] tc_fill_qdisc+0x540/0x1020 [T15862] qdisc_notify.isra.0+0x330/0x3a0 [T15862] tc_modify_qdisc+0x7b8/0x1838 [T15862] rtnetlink_rcv_msg+0x3c8/0xc20 [T15862] netlink_rcv_skb+0x1f8/0x3d4 [T15862] rtnetlink_rcv+0x28/0x40 [T15862] netlink_unicast+0x51c/0x790 [T15862] netlink_sendmsg+0x79c/0xc20 [T15862] __sock_sendmsg+0xe0/0x1a0 [T15862] ____sys_sendmsg+0x6c0/0x840 [T15862] ___sys_sendmsg+0x1ac/0x1f0 [T15862] __sys_sendmsg+0x110/0x1d0 [T15862] __arm64_sys_sendmsg+0x74/0xb0 [T15862] invoke_syscall+0x88/0x2e0 [T15862] el0_svc_common.constprop.0+0xe4/0x2a0 [T15862] do_el0_svc+0x44/0x60 [T15862] el0_svc+0x50/0x184 [T15862] el0t_64_sync_handler+0x120/0x12c [T15862] el0t_64_sync+0x190/0x194 [T15862] [T15862] Allocated by task 15857: [T15862] kasan_save_stack+0x3c/0x70 [T15862] kasan_save_track+0x20/0x3c [T15862] kasan_save_alloc_info+0x40/0x60 [T15862] __kasan_kmalloc+0xd4/0xe0 [T15862] __kmalloc_cache_noprof+0x194/0x334 [T15862] taprio_change+0x45c/0x2fe0 [T15862] tc_modify_qdisc+0x6a8/0x1838 [T15862] rtnetlink_rcv_msg+0x3c8/0xc20 [T15862] netlink_rcv_skb+0x1f8/0x3d4 [T15862] rtnetlink_rcv+0x28/0x40 [T15862] netlink_unicast+0x51c/0x790 [T15862] netlink_sendmsg+0x79c/0xc20 [T15862] __sock_sendmsg+0xe0/0x1a0 [T15862] ____sys_sendmsg+0x6c0/0x840 [T15862] ___sys_sendmsg+0x1ac/0x1f0 [T15862] __sys_sendmsg+0x110/0x1d0 [T15862] __arm64_sys_sendmsg+0x74/0xb0 [T15862] invoke_syscall+0x88/0x2e0 [T15862] el0_svc_common.constprop.0+0xe4/0x2a0 [T15862] do_el0_svc+0x44/0x60 [T15862] el0_svc+0x50/0x184 [T15862] el0t_64_sync_handler+0x120/0x12c [T15862] el0t_64_sync+0x190/0x194 [T15862] [T15862] Freed by task 6192: [T15862] kasan_save_stack+0x3c/0x70 [T15862] kasan_save_track+0x20/0x3c [T15862] kasan_save_free_info+0x4c/0x80 [T15862] poison_slab_object+0x110/0x160 [T15862] __kasan_slab_free+0x3c/0x74 [T15862] kfree+0x134/0x3c0 [T15862] taprio_free_sched_cb+0x18c/0x220 [T15862] rcu_core+0x920/0x1b7c [T15862] rcu_core_si+0x10/0x1c [T15862] handle_softirqs+0x2e8/0xd64 [T15862] __do_softirq+0x14/0x20
--- net/sched/sch_taprio.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
net/sched/sch_taprio.c +12 -6
@@ -2397,9 +2397,6 @@ static int taprio_dump(struct Qdisc *sch, struct sk_buff *skb)struct tc_mqprio_qopt opt = {0 };struct nlattr *nest, *sched_nest; - oper =rtnl_dereference (q->oper_sched); - admin =rtnl_dereference (q->admin_sched); -mqprio_qopt_reconstruct (dev, &opt); nest =nla_nest_start_noflag (skb,TCA_OPTIONS );
@@ -2420,18 +2417,23 @@ static int taprio_dump(struct Qdisc *sch, struct sk_buff *skb) nla_put_u32(skb, TCA_TAPRIO_ATTR_TXTIME_DELAY, q->txtime_delay)) goto options_error; +rcu_read_lock (); + + oper =rtnl_dereference (q->oper_sched); + admin =rtnl_dereference (q->admin_sched); +if (oper &&taprio_dump_tc_entries (skb, q, oper)) - goto options_error; + goto options_error_rcu;if (oper &&dump_schedule (skb, oper)) - goto options_error; + goto options_error_rcu;if (!admin) goto done; sched_nest =nla_nest_start_noflag (skb,TCA_TAPRIO_ATTR_ADMIN_SCHED );if (!sched_nest) - goto options_error; + goto options_error_rcu;if (dump_schedule (skb, admin)) goto admin_error;
@@ -2439,11 +2441,15 @@ static int taprio_dump(struct Qdisc *sch, struct sk_buff *skb)nla_nest_end (skb, sched_nest); done: +rcu_read_unlock ();return nla_nest_end (skb, nest); admin_error:nla_nest_cancel (skb, sched_nest); +options_error_rcu: +rcu_read_unlock (); + options_error:nla_nest_cancel (skb, nest);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 156/208 r8169: avoid unsolicited interrupts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit 10ce0db787004875f4dba068ea952207d1d8abeb ]
It was reported that after resume from suspend a PCI error is logged and connectivity is broken. Error message is:
PCI error (cmd = 0x0407, status_errs = 0x0000)
The message seems to be a red herring as none of the error bits is set, and the PCI command register value also is normal. Exception handling for a PCI error includes a chip reset what apparently brakes connectivity here. The interrupt status bit triggering the PCI error handling isn't actually used on PCIe chip versions, so it's not clear why this bit is set by the chip. Fix this by ignoring this bit on PCIe chip versions.
--- drivers/net/ethernet/realtek/r8169_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/realtek/r8169_main.c +3 -1
@@ -4576,7 +4576,9 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)if ((status &0xffff ) ==0xffff || !(status & tp->irq_mask))return IRQ_NONE ; -if (unlikely (status & SYSErr)) { +/* At least RTL8168fp may unexpectedly set the SYSErr bit */ +if (unlikely (status & SYSErr && + tp->mac_version <=RTL_GIGA_MAC_VER_06 )) {rtl8169_pcierr_interrupt (tp->dev); goto out; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 157/208 posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 6e62807c7fbb3c758d233018caf94dfea9c65dbd ]
If get_clock_desc() succeeds, it calls fget() for the clockid's fd, and get the clk->rwsem read lock, so the error path should release the lock to make the lock balance and fput the clockid's fd to make the refcount balance and release the fd related resource.
However the below commit left the error path locked behind resulting in unbalanced locking. Check timespec64_valid_strict() before get_clock_desc() to fix it, because the "ts" is not changed after that.
--- kernel/time/posix-clock.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
kernel/time/posix-clock.c +3 -3
@@ -290,6 +290,9 @@ static int pc_clock_settime(clockid_t id, const struct timespec64 *ts)struct posix_clock_desc cd;int err; +if (!timespec64_valid_strict (ts)) +return -EINVAL ; + err =get_clock_desc (id, &cd);if (err)return err;
@@ -299,9 +302,6 @@ static int pc_clock_settime(clockid_t id, const struct timespec64 *ts) goto out; } -if (!timespec64_valid_strict (ts)) -return -EINVAL ; -if (cd.clk->ops.clock_settime) err = cd.clk->ops.clock_settime (cd.clk, ts);else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 158/208 Bluetooth: SCO: Fix UAF on sco_sock_timeout
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 1bf4470a3939c678fb822073e9ea77a0560bc6bb ]
conn->sk maybe have been unlinked/freed while waiting for sco_conn_lock so this checks if the conn->sk is still valid by checking if it part of sco_sk_list.
--- include/net/bluetooth/bluetooth.h | 1 + net/bluetooth/af_bluetooth.c | 22 ++++++++++++++++++++++ net/bluetooth/sco.c | 18 ++++++++++++------ 3 files changed, 35 insertions(+), 6 deletions(-)
include/net/bluetooth/bluetooth.h +1 -0
@@ -403,6 +403,7 @@ int bt_sock_register(int proto, const struct net_proto_family *ops);void bt_sock_unregister (int proto);void bt_sock_link (struct bt_sock_list *l,struct sock *s);void bt_sock_unlink (struct bt_sock_list *l,struct sock *s); +bool bt_sock_linked (struct bt_sock_list *l,struct sock *s);struct sock *bt_sock_alloc (struct net *net,struct socket *sock,struct proto *prot,int proto,gfp_t prio,int kern); int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
net/bluetooth/af_bluetooth.c +22 -0
@@ -185,6 +185,28 @@ void bt_sock_unlink(struct bt_sock_list *l, struct sock *sk) }EXPORT_SYMBOL (bt_sock_unlink); +bool bt_sock_linked (struct bt_sock_list *l,struct sock *s) +{ +struct sock *sk; + +if (!l || !s) +return false; + +read_lock (&l->lock); + +sk_for_each (sk, &l->head) { +if (s == sk) { +read_unlock (&l->lock); +return true; + } + } + +read_unlock (&l->lock); + +return false; +} +EXPORT_SYMBOL (bt_sock_linked); +void bt_accept_enqueue (struct sock *parent,struct sock *sk,bool bh) {const struct cred *old_cred;
net/bluetooth/sco.c +12 -6
@@ -76,6 +76,16 @@ struct sco_pinfo {#define SCO_CONN_TIMEOUT (HZ * 40)#define SCO_DISCONN_TIMEOUT (HZ * 2) +static struct sock *sco_sock_hold (struct sco_conn *conn) +{ +if (!conn || !bt_sock_linked (&sco_sk_list, conn->sk)) +return NULL ; + +sock_hold (conn->sk); + +return conn->sk; +} +static void sco_sock_timeout (struct work_struct *work) { struct sco_conn *conn = container_of(work, struct sco_conn,
@@ -87,9 +97,7 @@ static void sco_sock_timeout(struct work_struct *work)sco_conn_unlock (conn);return ; } - sk = conn->sk; -if (sk) -sock_hold (sk); + sk =sco_sock_hold (conn);sco_conn_unlock (conn);if (!sk)
@@ -194,9 +202,7 @@ static void sco_conn_del(struct hci_conn *hcon, int err)/* Kill socket */ sco_conn_lock (conn); - sk = conn->sk; -if (sk) -sock_hold (sk); + sk =sco_sock_hold (conn);sco_conn_unlock (conn);if (sk) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 159/208 Bluetooth: ISO: Fix UAF on iso_sock_timeout
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 246b435ad668596aa0e2bbb9d491b6413861211a ]
conn->sk maybe have been unlinked/freed while waiting for iso_conn_lock so this checks if the conn->sk is still valid by checking if it part of iso_sk_list.
--- net/bluetooth/iso.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
net/bluetooth/iso.c +12 -6
@@ -90,6 +90,16 @@ static struct sock *iso_get_sock_listen(bdaddr_t *src, bdaddr_t *dst,#define ISO_CONN_TIMEOUT (HZ * 40)#define ISO_DISCONN_TIMEOUT (HZ * 2) +static struct sock *iso_sock_hold (struct iso_conn *conn) +{ +if (!conn || !bt_sock_linked (&iso_sk_list, conn->sk)) +return NULL ; + +sock_hold (conn->sk); + +return conn->sk; +} +static void iso_sock_timeout (struct work_struct *work) { struct iso_conn *conn = container_of(work, struct iso_conn,
@@ -97,9 +107,7 @@ static void iso_sock_timeout(struct work_struct *work)struct sock *sk;iso_conn_lock (conn); - sk = conn->sk; -if (sk) -sock_hold (sk); + sk =iso_sock_hold (conn);iso_conn_unlock (conn);if (!sk)
@@ -217,9 +225,7 @@ static void iso_conn_del(struct hci_conn *hcon, int err)/* Kill socket */ iso_conn_lock (conn); - sk = conn->sk; -if (sk) -sock_hold (sk); + sk =iso_sock_hold (conn);iso_conn_unlock (conn);if (sk) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 160/208 bpf,perf: Fix perf_event_detach_bpf_prog error handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
[ Upstream commit 0ee288e69d033850bc87abe0f9cc3ada24763d7f ]
Peter reported that perf_event_detach_bpf_prog might skip to release the bpf program for -ENOENT error from bpf_prog_array_copy.
This can't happen because bpf program is stored in perf event and is detached and released only when perf event is freed.
Let's drop the -ENOENT check and make sure the bpf program is released in any case.
--- kernel/trace/bpf_trace.c | 2 -- 1 file changed, 2 deletions(-)
kernel/trace/bpf_trace.c +0 -2
@@ -2217,8 +2217,6 @@ void perf_event_detach_bpf_prog(struct perf_event *event) old_array =bpf_event_rcu_dereference (event->tp_event->prog_array); ret =bpf_prog_array_copy (old_array, event->prog,NULL ,0 , &new_array); -if (ret == -ENOENT ) - goto unlock;if (ret <0 ) {bpf_prog_array_delete_safe (old_array, event->prog); }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 161/208 net: dsa: mv88e6xxx: group cycle counter coefficients
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shenghao Yang <[email protected]>
[ Upstream commit 67af86afff74c914944374a103c04e4d9868dd15 ]
Instead of having them as individual fields in ptp_ops, wrap the coefficients in a separate struct so they can be referenced together.
--- drivers/net/dsa/mv88e6xxx/chip.h | 6 ++-- drivers/net/dsa/mv88e6xxx/ptp.c | 59 ++++++++++++++++---------------- 2 files changed, 32 insertions(+), 33 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.h +2 -4
@@ -206,6 +206,7 @@ struct mv88e6xxx_gpio_ops;struct mv88e6xxx_avb_ops ;struct mv88e6xxx_ptp_ops ;struct mv88e6xxx_pcs_ops ; +struct mv88e6xxx_cc_coeffs ;struct mv88e6xxx_irq {u16 masked;
@@ -719,10 +720,7 @@ struct mv88e6xxx_ptp_ops {int arr1_sts_reg;int dep_sts_reg;u32 rx_filters; -u32 cc_shift; -u32 cc_mult; -u32 cc_mult_num; -u32 cc_mult_dem; +const struct mv88e6xxx_cc_coeffs *cc_coeffs; };struct mv88e6xxx_pcs_ops {
drivers/net/dsa/mv88e6xxx/ptp.c +30 -29
114 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 162/208 net: dsa: mv88e6xxx: read cycle counter period from hardware
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shenghao Yang <[email protected]>
[ Upstream commit 7e3c18097a709e9b958e721066e5fe76e563739b ]
Instead of relying on a fixed mapping of hardware family to cycle counter frequency, pull this information from the MV88E6XXX_TAI_CLOCK_PERIOD register.
This lets us support switches whose cycle counter frequencies depend on board design.
--- drivers/net/dsa/mv88e6xxx/chip.h | 2 +- drivers/net/dsa/mv88e6xxx/ptp.c | 60 ++++++++++++++++++++++---------- 2 files changed, 43 insertions(+), 19 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.h +1 -1
@@ -398,6 +398,7 @@ struct mv88e6xxx_chip {struct cyclecounter tstamp_cc;struct timecounter tstamp_tc;struct delayed_work overflow_work; +const struct mv88e6xxx_cc_coeffs *cc_coeffs;struct ptp_clock *ptp_clock;struct ptp_clock_info ptp_clock_info;
@@ -720,7 +721,6 @@ struct mv88e6xxx_ptp_ops {int arr1_sts_reg;int dep_sts_reg;u32 rx_filters; -const struct mv88e6xxx_cc_coeffs *cc_coeffs; };struct mv88e6xxx_pcs_ops {
drivers/net/dsa/mv88e6xxx/ptp.c +42 -18
124 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 163/208 net: dsa: mv88e6xxx: support 4000ps cycle counter period
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shenghao Yang <[email protected]>
[ Upstream commit 3e65ede526cf4f95636dbc835598d100c7668ab3 ]
The MV88E6393X family of devices can run its cycle counter off an internal 250MHz clock instead of an external 125MHz one.
Add support for this cycle counter period by adding another set of coefficients and lowering the periodic cycle counter read interval to compensate for faster overflows at the increased frequency.
Otherwise, the PHC runs at 2x real time in userspace and cannot be synchronized.
--- drivers/net/dsa/mv88e6xxx/ptp.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-)
drivers/net/dsa/mv88e6xxx/ptp.c +20 -3
@@ -40,7 +40,7 @@ static const struct mv88e6xxx_cc_coeffs mv88e6xxx_cc_10ns_coeffs = { .cc_mult_dem = 3125ULL, }; -/* Other families: +/* Other families except MV88E6393X in internal clock mode: * Raw timestamps are in units of 8-ns clock periods. * * clkadj = scaled_ppm * 8*2^28 / (10^6 * 2^16)
@@ -55,6 +55,21 @@ static const struct mv88e6xxx_cc_coeffs mv88e6xxx_cc_8ns_coeffs = { .cc_mult_dem = 15625ULL }; +/* Family MV88E6393X using internal clock: +* Raw timestamps are in units of 4-ns clock periods. +* +* clkadj = scaled_ppm * 4*2^28 / (10^6 * 2^16) +* simplifies to +* clkadj = scaled_ppm * 2^8 / 5^6 +*/ +#define MV88E6XXX_CC_4NS_SHIFT 28 +static const struct mv88e6xxx_cc_coeffs mv88e6xxx_cc_4ns_coeffs = { + .cc_shift =MV88E6XXX_CC_4NS_SHIFT , + .cc_mult =4 <<MV88E6XXX_CC_4NS_SHIFT , + .cc_mult_num =1 <<8 , + .cc_mult_dem =15625ULL +}; +#define TAI_EVENT_WORK_INTERVAL msecs_to_jiffies(100)#define cc_to_chip (cc) container_of(cc, struct mv88e6xxx_chip, tstamp_cc)
@@ -110,6 +125,8 @@ mv88e6xxx_cc_coeff_get(struct mv88e6xxx_chip *chip) }switch (period_ps) { +case 4000 : +return &mv88e6xxx_cc_4ns_coeffs;case 8000 :return &mv88e6xxx_cc_8ns_coeffs;case 10000 :
@@ -479,10 +496,10 @@ static u64 mv88e6xxx_ptp_clock_read(const struct cyclecounter *cc)return 0 ; } -/* With a 125MHz input clock, the 32-bit timestamp counter overflows in ~34.3 +/* With a 250MHz input clock, the 32-bit timestamp counter overflows in ~17.2 * seconds; this task forces periodic reads so that we don't miss any. */ -#define MV88E6XXX_TAI_OVERFLOW_PERIOD (HZ * 16) +#define MV88E6XXX_TAI_OVERFLOW_PERIOD (HZ * 8)static void mv88e6xxx_ptp_overflow_check (struct work_struct *work) {struct delayed_work *dw =to_delayed_work (work);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 164/208 ASoC: dt-bindings: davinci-mcasp: Fix interrupts property
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <[email protected]>
[ Upstream commit 17d8adc4cd5181c13c1041b197b76efc09eaf8a8 ]
My understanding of the interrupts property is that it can either be:
1/ - TX
2/ - TX
- RX
3/ - Common/combined.
There are very little chances that either:
- TX
- Common/combined
or even
- TX
- RX
- Common/combined
could be a thing.
Looking at the interrupt-names definition (which uses oneOf instead of anyOf), it makes indeed little sense to use anyOf in the interrupts definition. I believe this is just a mistake, hence let's fix it.
--- .../devicetree/bindings/sound/davinci-mcasp-audio.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/sound/davinci-mcasp-audio.yaml +1 -1
@@ -102,7 +102,7 @@ properties: default: 2 interrupts: - anyOf: + oneOf: - minItems: 1 items: - description: TX interrupt
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 165/208 ASoC: dt-bindings: davinci-mcasp: Fix interrupt properties
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <[email protected]>
[ Upstream commit 8380dbf1b9ef66e3ce6c1d660fd7259637c2a929 ]
Combinations of "tx" alone, "rx" alone and "tx", "rx" together are supposedly valid (see link below), which is not the case today as "rx" alone is not accepted by the current binding.
Let's rework the two interrupt properties to expose all correct possibilities.
--- .../bindings/sound/davinci-mcasp-audio.yaml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
Documentation/devicetree/bindings/sound/davinci-mcasp-audio.yaml +9 -9
@@ -102,21 +102,21 @@ properties: default: 2 interrupts: - oneOf: - - minItems: 1 - items: - - description: TX interrupt - - description: RX interrupt - - items: - - description: common/combined interrupt + minItems: 1 + maxItems: 2 interrupt-names: oneOf: - - minItems: 1 + - description: TX interrupt + const: tx + - description: RX interrupt + const: rx + - description: TX and RX interrupts items: - const: tx - const: rx - - const: common + - description: Common/combined interrupt + const: common fck_parent: $ref: /schemas/types.yaml#/definitions/string
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 166/208 ASoC: loongson: Fix component check failed on FDT systems
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Binbin Zhou <[email protected]>
[ Upstream commit a6134e7b4d4a14e0942f113a6df1d518baa2a0a4 ]
Add missing snd_soc_dai_link.platforms assignment to avoid soc_dai_link_sanity_check() failure.
--- sound/soc/loongson/loongson_card.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/loongson/loongson_card.c +1 -0
@@ -137,6 +137,7 @@ static int loongson_card_parse_of(struct loongson_card_data *data)dev_err (dev,"getting cpu dlc error (%d)\n" , ret); goto err; } + loongson_dai_links[i].platforms->of_node = loongson_dai_links[i].cpus->of_node; ret =snd_soc_of_get_dlc (codec,NULL , loongson_dai_links[i].codecs,0 );if (ret <0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 167/208 ASoC: max98388: Fix missing increment of variable slot_found
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit ca2803fadfd239abf155ef4a563b22a9507ee4b2 ]
The variable slot_found is being initialized to zero and inside a for-loop is being checked if it's reached MAX_NUM_CH, however, this is currently impossible since slot_found is never changed. In a previous loop a similar coding pattern is used and slot_found is being incremented. It appears the increment of slot_found is missing from the loop, so fix the code by adding in the increment.
--- sound/soc/codecs/max98388.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/max98388.c +1 -0
@@ -764,6 +764,7 @@ static int max98388_dai_tdm_slot(struct snd_soc_dai *dai, addr =MAX98388_R2044_PCM_TX_CTRL1 + (cnt /8 ); bits = cnt %8 ;regmap_update_bits (max98388->regmap, addr, bits, bits); + slot_found++;if (slot_found >=MAX_NUM_CH )break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 168/208 ASoC: rsnd: Fix probe failure on HiHope boards due to endpoint parsing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
[ Upstream commit 9b064d200aa8fee9d1d7ced05d8a617e45966715 ]
On the HiHope boards, we have a single port with a single endpoint defined as below:
....
rsnd_port: port {
rsnd_endpoint: endpoint {
remote-endpoint = <&dw_hdmi0_snd_in>;
dai-format = "i2s";
bitclock-master = <&rsnd_endpoint>;
frame-master = <&rsnd_endpoint>;
playback = <&ssi2>;
};
};....
With commit 547b02f74e4a ("ASoC: rsnd: enable multi Component support for Audio Graph Card/Card2"), support for multiple ports was added. This caused probe failures on HiHope boards, as the endpoint could not be retrieved due to incorrect device node pointers being used.
This patch fixes the issue by updating the rsnd_dai_of_node() and rsnd_dai_probe() functions to use the correct device node pointers based on the port names ('port' or 'ports'). It ensures that the endpoint is properly parsed for both single and multi-port configurations, restoring compatibility with HiHope boards.
--- sound/soc/sh/rcar/core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
sound/soc/sh/rcar/core.c +5 -2
@@ -1297,7 +1297,9 @@ static int rsnd_dai_of_node(struct rsnd_priv *priv, int *is_graph)if (!of_node_name_eq (ports,"ports" ) && !of_node_name_eq (ports,"port" ))continue ; - priv->component_dais[i] =of_graph_get_endpoint_count (ports); + priv->component_dais[i] = +of_graph_get_endpoint_count (of_node_name_eq (ports,"ports" ) ? + ports : np); nr += priv->component_dais[i]; i++;if (i >=RSND_MAX_COMPONENT ) {
@@ -1510,7 +1512,8 @@ static int rsnd_dai_probe(struct rsnd_priv *priv)if (!of_node_name_eq (ports,"ports" ) && !of_node_name_eq (ports,"port" ))continue ; -for_each_endpoint_of_node (ports, dai_np) { +for_each_endpoint_of_node (of_node_name_eq (ports,"ports" ) ? + ports : np, dai_np) {__rsnd_dai_probe (priv, dai_np, dai_np,0 , dai_i);if (rsnd_is_gen3 (priv) ||rsnd_is_gen4 (priv)) { rdai =rsnd_rdai_get (priv, dai_i);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 169/208 ASoC: fsl_micfil: Add a flag to distinguish with different volume control types
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chancel Liu <[email protected]>
[ Upstream commit da95e891dd5d5de6c5ebc010bd028a2e028de093 ]
On i.MX8MM the register of volume control has positive and negative values. It is different from other platforms like i.MX8MP and i.MX93 which only have positive values. Add a volume_sx flag to use SX_TLV volume control for this kind of platform. Use common TLV volume control for other platforms.
--- sound/soc/fsl/fsl_micfil.c | 43 +++++++++++++++++++++++++++++++++++++- 1 file changed, 42 insertions(+), 1 deletion(-)
sound/soc/fsl/fsl_micfil.c +42 -1
@@ -67,6 +67,7 @@ struct fsl_micfil_soc_data {bool imx;bool use_edma;bool use_verid; +bool volume_sx;u64 formats; };
@@ -76,6 +77,7 @@ static struct fsl_micfil_soc_data fsl_micfil_imx8mm = { .fifo_depth = 8, .dataline = 0xf, .formats = SNDRV_PCM_FMTBIT_S16_LE, + .volume_sx = true, };static struct fsl_micfil_soc_data fsl_micfil_imx8mp = {
@@ -84,6 +86,7 @@ static struct fsl_micfil_soc_data fsl_micfil_imx8mp = { .fifo_depth = 32, .dataline = 0xf, .formats = SNDRV_PCM_FMTBIT_S32_LE, + .volume_sx = false, };static struct fsl_micfil_soc_data fsl_micfil_imx93 = {
@@ -94,6 +97,7 @@ static struct fsl_micfil_soc_data fsl_micfil_imx93 = { .formats = SNDRV_PCM_FMTBIT_S32_LE, .use_edma = true, .use_verid = true, + .volume_sx = false, };static const struct of_device_id fsl_micfil_dt_ids[] = {
@@ -317,7 +321,26 @@ static int hwvad_detected(struct snd_kcontrol *kcontrol,return 0 ; } -static const struct snd_kcontrol_new fsl_micfil_snd_controls[] = { +static const struct snd_kcontrol_new fsl_micfil_volume_controls[] = { +SOC_SINGLE_TLV ("CH0 Volume" ,REG_MICFIL_OUT_CTRL , +MICFIL_OUTGAIN_CHX_SHIFT (0 ),0xF ,0 , gain_tlv), +SOC_SINGLE_TLV ("CH1 Volume" ,REG_MICFIL_OUT_CTRL , +MICFIL_OUTGAIN_CHX_SHIFT (1 ),0xF ,0 , gain_tlv), +SOC_SINGLE_TLV ("CH2 Volume" ,REG_MICFIL_OUT_CTRL , +MICFIL_OUTGAIN_CHX_SHIFT (2 ),0xF ,0 , gain_tlv), +SOC_SINGLE_TLV ("CH3 Volume" ,REG_MICFIL_OUT_CTRL , +MICFIL_OUTGAIN_CHX_SHIFT (3 ),0xF ,0 , gain_tlv), +SOC_SINGLE_TLV ("CH4 Volume" ,REG_MICFIL_OUT_CTRL , +MICFIL_OUTGAIN_CHX_SHIFT (4 ),0xF ,0 , gain_tlv), +SOC_SINGLE_TLV ("CH5 Volume" ,REG_MICFIL_OUT_CTRL , +MICFIL_OUTGAIN_CHX_SHIFT (5 ),0xF ,0 , gain_tlv), +SOC_SINGLE_TLV ("CH6 Volume" ,REG_MICFIL_OUT_CTRL , +MICFIL_OUTGAIN_CHX_SHIFT (6 ),0xF ,0 , gain_tlv), +SOC_SINGLE_TLV ("CH7 Volume" ,REG_MICFIL_OUT_CTRL , +MICFIL_OUTGAIN_CHX_SHIFT (7 ),0xF ,0 , gain_tlv), +}; + +static const struct snd_kcontrol_new fsl_micfil_volume_sx_controls[] = {SOC_SINGLE_SX_TLV ("CH0 Volume" ,REG_MICFIL_OUT_CTRL ,MICFIL_OUTGAIN_CHX_SHIFT (0 ),0x8 ,0xF , gain_tlv), SOC_SINGLE_SX_TLV("CH1 Volume", REG_MICFIL_OUT_CTRL,
@@ -334,6 +357,9 @@ static const struct snd_kcontrol_new fsl_micfil_snd_controls[] = { MICFIL_OUTGAIN_CHX_SHIFT(6), 0x8, 0xF, gain_tlv), SOC_SINGLE_SX_TLV("CH7 Volume", REG_MICFIL_OUT_CTRL, MICFIL_OUTGAIN_CHX_SHIFT(7), 0x8, 0xF, gain_tlv), +}; + +static const struct snd_kcontrol_new fsl_micfil_snd_controls[] = {SOC_ENUM_EXT ("MICFIL Quality Select" , fsl_micfil_quality_enum, micfil_quality_get, micfil_quality_set),
@@ -801,6 +827,20 @@ static int fsl_micfil_dai_probe(struct snd_soc_dai *cpu_dai)return 0 ; } +static int fsl_micfil_component_probe (struct snd_soc_component *component) +{ +struct fsl_micfil *micfil =snd_soc_component_get_drvdata (component); + +if (micfil->soc->volume_sx) +snd_soc_add_component_controls (component, fsl_micfil_volume_sx_controls, +ARRAY_SIZE (fsl_micfil_volume_sx_controls)); +else +snd_soc_add_component_controls (component, fsl_micfil_volume_controls, +ARRAY_SIZE (fsl_micfil_volume_controls)); + +return 0 ; +} +static const struct snd_soc_dai_ops fsl_micfil_dai_ops = { .probe = fsl_micfil_dai_probe, .startup = fsl_micfil_startup,
@@ -821,6 +861,7 @@ static struct snd_soc_dai_driver fsl_micfil_dai = {static const struct snd_soc_component_driver fsl_micfil_component = { .name ="fsl-micfil-dai" , + .probe = fsl_micfil_component_probe, .controls = fsl_micfil_snd_controls, .num_controls =ARRAY_SIZE (fsl_micfil_snd_controls), .legacy_dai_naming =1 ,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 170/208 ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Shumilin <[email protected]>
[ Upstream commit 72cafe63b35d06b5cfbaf807e90ae657907858da ]
The step variable is initialized to zero. It is changed in the loop, but if it's not changed it will remain zero. Add a variable check before the division.
The observed behavior was introduced by commit 826b5de90c0b ("ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size"), and it is difficult to show that any of the interval parameters will satisfy the snd_interval_test() condition with data from the amdtp_rate_table[] table.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- sound/firewire/amdtp-stream.c | 3 +++ 1 file changed, 3 insertions(+)
sound/firewire/amdtp-stream.c +3 -0
@@ -172,6 +172,9 @@ static int apply_constraint_to_size(struct snd_pcm_hw_params *params, step =max (step, amdtp_syt_intervals[i]); } +if (step ==0 ) +return -EINVAL ; + t.min =roundup (s->min, step); t.max =rounddown (s->max, step); t.integer =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 171/208 powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Can <[email protected]>
[ Upstream commit 5209d1b654f1db80509040cc694c7814a1b547e3 ]
The caller of the function dev_pm_qos_add_request() checks again a non zero value but dev_pm_qos_add_request() can return '1' if the request already exists. Therefore, the setup function fails while the QoS request actually did not failed.
Fix that by changing the check against a negative value like all the other callers of the function.
--- drivers/powercap/dtpm_devfreq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/powercap/dtpm_devfreq.c +1 -1
@@ -166,7 +166,7 @@ static int __dtpm_devfreq_setup(struct devfreq *devfreq, struct dtpm *parent) ret =dev_pm_qos_add_request (dev, &dtpm_devfreq->qos_req,DEV_PM_QOS_MAX_FREQUENCY ,PM_QOS_MAX_FREQUENCY_DEFAULT_VALUE ); -if (ret) { +if (ret <0 ) {pr_err ("Failed to add QoS request: %d\n" , ret); goto out_dtpm_unregister; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 172/208 nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Erkun <[email protected]>
[ Upstream commit d5ff2fb2e7167e9483846e34148e60c0c016a1f6 ]
In the normal case, when we excute echo 0 > /proc/fs/nfsd/threads, the function nfs4_state_destroy_net in nfs4_state_shutdown_net will release all resources related to the hashed nfs4_client. If the nfsd_client_shrinker is running concurrently, the expire_client function will first unhash this client and then destroy it. This can lead to the following warning. Additionally, numerous use-after-free errors may occur as well.
nfsd_client_shrinker echo 0 > /proc/fs/nfsd/threads
expire_client nfsd_shutdown_net
unhash_client ...
nfs4_state_shutdown_net
/* won't wait shrinker exit */
/* cancel_work(&nn->nfsd_shrinker_work)
* nfsd_file for this /* won't destroy unhashed client1 */
* client1 still alive nfs4_state_destroy_net*/
nfsd_file_cache_shutdown
/* trigger warning */
kmem_cache_destroy(nfsd_file_slab)
kmem_cache_destroy(nfsd_file_mark_slab) /* release nfsd_file and mark */
__destroy_client
====================================================================
BUG nfsd_file (Not tainted): Objects remaining in nfsd_file on __kmem_cache_shutdown()
--------------------------------------------------------------------
CPU: 4 UID: 0 PID: 764 Comm: sh Not tainted 6.12.0-rc3+ #1 dump_stack_lvl+0x53/0x70 slab_err+0xb0/0xf0 __kmem_cache_shutdown+0x15c/0x310 kmem_cache_destroy+0x66/0x160 nfsd_file_cache_shutdown+0xac/0x210 [nfsd] nfsd_destroy_serv+0x251/0x2a0 [nfsd] nfsd_svc+0x125/0x1e0 [nfsd] write_threads+0x16a/0x2a0 [nfsd] nfsctl_transaction_write+0x74/0xa0 [nfsd] vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e
====================================================================
BUG nfsd_file_mark (Tainted: G B W ): Objects remainingnfsd_file_mark on __kmem_cache_shutdown()
--------------------------------------------------------------------
dump_stack_lvl+0x53/0x70 slab_err+0xb0/0xf0 __kmem_cache_shutdown+0x15c/0x310 kmem_cache_destroy+0x66/0x160 nfsd_file_cache_shutdown+0xc8/0x210 [nfsd] nfsd_destroy_serv+0x251/0x2a0 [nfsd] nfsd_svc+0x125/0x1e0 [nfsd] write_threads+0x16a/0x2a0 [nfsd] nfsctl_transaction_write+0x74/0xa0 [nfsd] vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e
To resolve this issue, cancel nfsd_shrinker_work using synchronous mode in nfs4_state_shutdown_net.
--- fs/nfsd/nfs4state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfs4state.c +1 -1
@@ -8254,7 +8254,7 @@ nfs4_state_shutdown_net(struct net *net)struct nfsd_net *nn =net_generic (net, nfsd_net_id);unregister_shrinker (&nn->nfsd_client_shrinker); -cancel_work (&nn->nfsd_shrinker_work); +cancel_work_sync (&nn->nfsd_shrinker_work);cancel_delayed_work_sync (&nn->laundromat_work);locks_end_grace (&nn->nfsd4_manager);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 173/208 ALSA: hda/realtek: Update default depop procedure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
[ Upstream commit e3ea2757c312e51bbf62ebc434a6f7df1e3a201f ]
Old procedure has a chance to meet Headphone no output.
--- sound/pci/hda/patch_realtek.c | 38 ++++++++++++++++------------------- 1 file changed, 17 insertions(+), 21 deletions(-)
sound/pci/hda/patch_realtek.c +17 -21
@@ -3857,20 +3857,18 @@ static void alc_default_init(struct hda_codec *codec) hp_pin_sense =snd_hda_jack_detect (codec, hp_pin); -if (hp_pin_sense) +if (hp_pin_sense) {msleep (2 ); -snd_hda_codec_write (codec, hp_pin,0 , -AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); - -if (hp_pin_sense) -msleep (85 ); +snd_hda_codec_write (codec, hp_pin,0 , +AC_VERB_SET_PIN_WIDGET_CONTROL ,PIN_OUT ); -snd_hda_codec_write (codec, hp_pin,0 , -AC_VERB_SET_PIN_WIDGET_CONTROL ,PIN_OUT ); +msleep (75 ); -if (hp_pin_sense) -msleep (100 ); +snd_hda_codec_write (codec, hp_pin,0 , +AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_UNMUTE ); +msleep (75 ); + } }static void alc_default_shutup (struct hda_codec *codec)
@@ -3886,22 +3884,20 @@ static void alc_default_shutup(struct hda_codec *codec) hp_pin_sense =snd_hda_jack_detect (codec, hp_pin); -if (hp_pin_sense) +if (hp_pin_sense) {msleep (2 ); -snd_hda_codec_write (codec, hp_pin,0 , -AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); - -if (hp_pin_sense) -msleep (85 ); - -if (!spec->no_shutup_pins)snd_hda_codec_write (codec, hp_pin,0 , -AC_VERB_SET_PIN_WIDGET_CONTROL ,0x0 ); +AC_VERB_SET_AMP_GAIN_MUTE ,AMP_OUT_MUTE ); -if (hp_pin_sense) -msleep (100 ); +msleep (75 ); +if (!spec->no_shutup_pins) +snd_hda_codec_write (codec, hp_pin,0 , +AC_VERB_SET_PIN_WIDGET_CONTROL ,0x0 ); + +msleep (75 ); + }alc_auto_setup_eapd (codec, false);alc_shutup_pins (codec); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 174/208 smb: client: Handle kstrdup failures for passwords
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrique Carvalho <[email protected]>
[ Upstream commit 9a5dd61151399ad5a5d69aad28ab164734c1e3bc ]
In smb3_reconfigure(), after duplicating ctx->password and ctx->password2 with kstrdup(), we need to check for allocation failures.
If ses->password allocation fails, return -ENOMEM. If ses->password2 allocation fails, free ses->password, set it to NULL, and return -ENOMEM.
--- fs/smb/client/fs_context.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/smb/client/fs_context.c +7 -0
@@ -918,8 +918,15 @@ static int smb3_reconfigure(struct fs_context *fc)else {kfree_sensitive (ses->password); ses->password =kstrdup (ctx->password,GFP_KERNEL ); +if (!ses->password) +return -ENOMEM ;kfree_sensitive (ses->password2); ses->password2 =kstrdup (ctx->password2,GFP_KERNEL ); +if (!ses->password2) { +kfree_sensitive (ses->password); + ses->password =NULL ; +return -ENOMEM ; + } }STEAL_STRING (cifs_sb, ctx, domainname);STEAL_STRING (cifs_sb, ctx, nodename);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 175/208 cpufreq/cppc: Move and rename cppc_cpufreq_{perf_to_khz|khz_to_perf}()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Guittot <[email protected]>
[ Upstream commit 50b813b147e9eb6546a1fc49d4e703e6d23691f2 ]
Move and rename cppc_cpufreq_perf_to_khz() and cppc_cpufreq_khz_to_perf() to use them outside cppc_cpufreq in topology_init_cpu_capacity_cppc().
Modify the interface to use struct cppc_perf_caps *caps instead of struct cppc_cpudata *cpu_data as we only use the fields of cppc_perf_caps.
cppc_cpufreq was converting the lowest and nominal freq from MHz to kHz before using them. We move this conversion inside cppc_perf_to_khz and cppc_khz_to_perf to make them generic and usable outside cppc_cpufreq.
No functional change
Stable-dep-of: d93df29bdab1 ("cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception")
--- drivers/acpi/cppc_acpi.c | 104 ++++++++++++++++++++++++ drivers/cpufreq/cppc_cpufreq.c | 139 ++++----------------------------- include/acpi/cppc_acpi.h | 2 + 3 files changed, 123 insertions(+), 122 deletions(-)
drivers/acpi/cppc_acpi.c +104 -0
@@ -39,6 +39,9 @@#include <linux/rwsem.h> #include <linux/wait.h> #include <linux/topology.h> +#include <linux/dmi.h> +#include <linux/units.h> +#include <asm/unaligned.h> #include <acpi/cppc_acpi.h>
@@ -1858,3 +1861,104 @@ unsigned int cppc_get_transition_latency(int cpu_num)return latency_ns; }EXPORT_SYMBOL_GPL (cppc_get_transition_latency); + +/* Minimum struct length needed for the DMI processor entry we want */ +#define DMI_ENTRY_PROCESSOR_MIN_LENGTH 48 + +/* Offset in the DMI processor structure for the max frequency */ +#define DMI_PROCESSOR_MAX_SPEED 0x14 + +/* Callback function used to retrieve the max frequency from DMI */ +static void cppc_find_dmi_mhz (const struct dmi_header *dm,void *private) +{ +const u8 *dmi_data = (const u8 *)dm; +u16 *mhz = (u16 *)private; + +if (dm->type ==DMI_ENTRY_PROCESSOR && + dm->length >=DMI_ENTRY_PROCESSOR_MIN_LENGTH ) { +u16 val = (u16 )get_unaligned ((const u16 *) + (dmi_data +DMI_PROCESSOR_MAX_SPEED )); + *mhz = val > *mhz ? val : *mhz; + } +} + +/* Look up the max frequency in DMI */ +static u64 cppc_get_dmi_max_khz (void ) +{ +u16 mhz =0 ; + +dmi_walk (cppc_find_dmi_mhz, &mhz); + +/* +* Real stupid fallback value, just in case there is no +* actual value set. +*/ + mhz = mhz ? mhz :1 ; + +return KHZ_PER_MHZ * mhz; +} + +/* +* If CPPC lowest_freq and nominal_freq registers are exposed then we can +* use them to convert perf to freq and vice versa. The conversion is +* extrapolated as an affine function passing by the 2 points: +* - (Low perf, Low freq) +* - (Nominal perf, Nominal freq) +*/ +unsigned int cppc_perf_to_khz (struct cppc_perf_caps *caps,unsigned int perf) +{ +s64 retval, offset =0 ; +static u64 max_khz; +u64 mul, div; + +if (caps->lowest_freq && caps->nominal_freq) { + mul = caps->nominal_freq - caps->lowest_freq; + mul *=KHZ_PER_MHZ ; + div = caps->nominal_perf - caps->lowest_perf; + offset = caps->nominal_freq *KHZ_PER_MHZ - +div64_u64 (caps->nominal_perf * mul, div); + }else { +if (!max_khz) + max_khz =cppc_get_dmi_max_khz (); + mul = max_khz; + div = caps->highest_perf; + } + + retval = offset +div64_u64 (perf * mul, div); +if (retval >=0 ) +return retval; +return 0 ; +} +EXPORT_SYMBOL_GPL (cppc_perf_to_khz); + +unsigned int cppc_khz_to_perf (struct cppc_perf_caps *caps,unsigned int freq) +{ +s64 retval, offset =0 ; +static u64 max_khz; +u64 mul, div; + +if (caps->lowest_freq && caps->nominal_freq) { + mul = caps->nominal_perf - caps->lowest_perf; + div = caps->nominal_freq - caps->lowest_freq; +/* +* We don't need to convert to kHz for computing offset and can +* directly use nominal_freq and lowest_freq as the div64_u64 +* will remove the frequency unit. +*/ + offset = caps->nominal_perf - +div64_u64 (caps->nominal_freq * mul, div); +/* But we need it for computing the perf level. */ + div *=KHZ_PER_MHZ ; + }else { +if (!max_khz) + max_khz =cppc_get_dmi_max_khz (); + mul = caps->highest_perf; + div = max_khz; + } + + retval = offset +div64_u64 (freq * mul, div); +if (retval >=0 ) +return retval; +return 0 ; +} +EXPORT_SYMBOL_GPL (cppc_khz_to_perf);
drivers/cpufreq/cppc_cpufreq.c +17 -122
239 lines not on this page · raw message
include/acpi/cppc_acpi.h +2 -0
@@ -147,6 +147,8 @@ extern int cppc_set_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls);extern int cppc_set_enable (int cpu,bool enable);extern int cppc_get_perf_caps (int cpu,struct cppc_perf_caps *caps);extern bool cppc_perf_ctrs_in_pcc (void ); +extern unsigned int cppc_perf_to_khz (struct cppc_perf_caps *caps,unsigned int perf); +extern unsigned int cppc_khz_to_perf (struct cppc_perf_caps *caps,unsigned int freq);extern bool acpi_cpc_valid (void );extern bool cppc_allow_fast_switch (void );extern int acpi_get_psd_map (unsigned int cpu,struct cppc_cpudata *cpu_data);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 176/208 cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: liwei <[email protected]>
[ Upstream commit d93df29bdab133b85e94b3c328e7fe26a0ebd56c ]
When the nominal_freq recorded by the kernel is equal to the lowest_freq, and the frequency adjustment operation is triggered externally, there is a logic error in cppc_perf_to_khz()/cppc_khz_to_perf(), resulting in perf and khz conversion errors.
Fix this by adding a branch processing logic when nominal_freq is equal to lowest_freq.
--- drivers/acpi/cppc_acpi.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
drivers/acpi/cppc_acpi.c +17 -5
@@ -1912,9 +1912,15 @@ unsigned int cppc_perf_to_khz(struct cppc_perf_caps *caps, unsigned int perf)u64 mul, div;if (caps->lowest_freq && caps->nominal_freq) { - mul = caps->nominal_freq - caps->lowest_freq; +/* Avoid special case when nominal_freq is equal to lowest_freq */ +if (caps->lowest_freq == caps->nominal_freq) { + mul = caps->nominal_freq; + div = caps->nominal_perf; + }else { + mul = caps->nominal_freq - caps->lowest_freq; + div = caps->nominal_perf - caps->lowest_perf; + } mul *=KHZ_PER_MHZ ; - div = caps->nominal_perf - caps->lowest_perf; offset = caps->nominal_freq *KHZ_PER_MHZ -div64_u64 (caps->nominal_perf * mul, div); }else {
@@ -1935,11 +1941,17 @@ unsigned int cppc_khz_to_perf(struct cppc_perf_caps *caps, unsigned int freq) {s64 retval, offset =0 ;static u64 max_khz; -u64 mul, div; +u64 mul, div;if (caps->lowest_freq && caps->nominal_freq) { - mul = caps->nominal_perf - caps->lowest_perf; - div = caps->nominal_freq - caps->lowest_freq; +/* Avoid special case when nominal_freq is equal to lowest_freq */ +if (caps->lowest_freq == caps->nominal_freq) { + mul = caps->nominal_perf; + div = caps->nominal_freq; + }else { + mul = caps->nominal_perf - caps->lowest_perf; + div = caps->nominal_freq - caps->lowest_freq; + }/* * We don't need to convert to kHz for computing offset and can * directly use nominal_freq and lowest_freq as the div64_u64
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 177/208 btrfs: fix passing 0 to ERR_PTR in btrfs_search_dir_index_item()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yue Haibing <[email protected]>
commit 75f49c3dc7b7423d3734f2e4dabe3dac8d064338 upstream.
The ret may be zero in btrfs_search_dir_index_item() and should not passed to ERR_PTR(). Now btrfs_unlink_subvol() is the only caller to this, reconstructed it to check ERR_PTR(-ENOENT) while ret >= 0.
This fixes smatch warnings:
fs/btrfs/dir-item.c:353
btrfs_search_dir_index_item() warn: passing zero to 'ERR_PTR'
--- fs/btrfs/dir-item.c | 4 ++-- fs/btrfs/inode.c | 7 ++----- 2 files changed, 4 insertions(+), 7 deletions(-)
fs/btrfs/dir-item.c +2 -2
@@ -347,8 +347,8 @@ btrfs_search_dir_index_item(struct btrfsreturn di; }/* Adjust return code if the key was not found in the next leaf. */ -if (ret >0 ) - ret =0 ; +if (ret >=0 ) + ret = -ENOENT ;return ERR_PTR (ret); }
fs/btrfs/inode.c +2 -5
@@ -4293,11 +4293,8 @@ static int btrfs_unlink_subvol(struct bt*/ if (btrfs_ino (inode) ==BTRFS_EMPTY_SUBVOL_DIR_OBJECTID ) { di =btrfs_search_dir_index_item (root, path, dir_ino, &fname.disk_name); -if (IS_ERR_OR_NULL (di)) { -if (!di) - ret = -ENOENT ; -else - ret =PTR_ERR (di); +if (IS_ERR (di)) { + ret =PTR_ERR (di);btrfs_abort_transaction (trans, ret); goto out; }
Greg Kroah-Hartman
maintainerPATCH 178/208 btrfs: zoned: fix zone unusable accounting for freed reserved extent
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <[email protected]>
commit bf9821ba4792a0d9a2e72803ae7b4341faf3d532 upstream.
When btrfs reserves an extent and does not use it (e.g, by an error), it calls btrfs_free_reserved_extent() to free the reserved extent. In the process, it calls btrfs_add_free_space() and then it accounts the region bytes as block_group->zone_unusable.
However, it leaves the space_info->bytes_zone_unusable side not updated. As a result, ENOSPC can happen while a space_info reservation succeeded. The reservation is fine because the freed region is not added in space_info->bytes_zone_unusable, leaving that space as "free". OTOH, corresponding block group counts it as zone_unusable and its allocation pointer is not rewound, we cannot allocate an extent from that block group. That will also negate space_info's async/sync reclaim process, and cause an ENOSPC error from the extent allocation process.
Fix that by returning the space to space_info->bytes_zone_unusable. Ideally, since a bio is not submitted for this reserved region, we should return the space to free space and rewind the allocation pointer. But, it needs rework on extent allocation handling, so let it work in this way for now.
--- fs/btrfs/block-group.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/block-group.c +2 -0
@@ -3794,6 +3794,8 @@ void btrfs_free_reserved_bytes(struct btspin_lock (&cache->lock);if (cache->ro) space_info->bytes_readonly += num_bytes; +else if (btrfs_is_zoned (cache->fs_info)) + space_info->bytes_zone_unusable += num_bytes; cache->reserved -= num_bytes; space_info->bytes_reserved -= num_bytes; space_info->max_extent_size =0 ;
Greg Kroah-Hartman
maintainerPATCH 179/208 drm/amd: Guard against bad data for ATIF ACPI method
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit bf58f03931fdcf7b3c45cb76ac13244477a60f44 upstream.
If a BIOS provides bad data in response to an ATIF method call this causes a NULL pointer dereference in the caller.
``` ? show_regs (arch/x86/kernel/dumpstack.c:478 (discriminator 1)) ? __die (arch/x86/kernel/dumpstack.c:423 arch/x86/kernel/dumpstack.c:434) ? page_fault_oops (arch/x86/mm/fault.c:544 (discriminator 2) arch/x86/mm/fault.c:705 (discriminator 2)) ? do_user_addr_fault (arch/x86/mm/fault.c:440 (discriminator 1) arch/x86/mm/fault.c:1232 (discriminator 1)) ? acpi_ut_update_object_reference (drivers/acpi/acpica/utdelete.c:642) ? exc_page_fault (arch/x86/mm/fault.c:1542) ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623) ? amdgpu_atif_query_backlight_caps.constprop.0 (drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c:387 (discriminator 2)) amdgpu ? amdgpu_atif_query_backlight_caps.constprop.0 (drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c:386 (discriminator 1)) amdgpu ```
It has been encountered on at least one system, so guard for it.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +12 -3
@@ -147,6 +147,7 @@ static union acpi_object *amdgpu_atif_ca struct acpi_buffer *params) {acpi_status status; +union acpi_object *obj;union acpi_object atif_arg_elements[2 ];struct acpi_object_list atif_arg;struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER ,NULL };
@@ -169,16 +170,24 @@ static union acpi_object *amdgpu_atif_ca status =acpi_evaluate_object (atif->handle,NULL , &atif_arg, &buffer); + obj = (union acpi_object *)buffer.pointer; -/* Fail only if calling the method fails and ATIF is supported */ +/* Fail if calling the method fails and ATIF is supported */ if (ACPI_FAILURE (status) && status !=AE_NOT_FOUND ) {DRM_DEBUG_DRIVER ("failed to evaluate ATIF got %s\n" ,acpi_format_exception (status)); -kfree (buffer.pointer); +kfree (obj);return NULL ; } -return buffer.pointer; +if (obj->type !=ACPI_TYPE_BUFFER ) { +DRM_DEBUG_DRIVER ("bad object returned from ATIF: %d\n" , + obj->type); +kfree (obj); +return NULL ; + } + +return obj; }/**
Greg Kroah-Hartman
maintainerPATCH 180/208 ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[]
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Heusel <[email protected]>
commit 53f1a907d36fb3aa02a4d34073bcec25823a6c74 upstream.
The LG Gram Pro 16 2-in-1 (2024) the 16T90SP has its keybopard IRQ (1) described as ActiveLow in the DSDT, which the kernel overrides to EdgeHigh which breaks the keyboard.
Add the 16T90SP to the irq1_level_low_skip_override[] quirk table to fix this.
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -498,6 +498,13 @@ static const struct dmi_system_id tongfa DMI_MATCH(DMI_BOARD_NAME, "GMxRGxx"), }, }, + { + /* LG Electronics 16T90SP */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"), + DMI_MATCH(DMI_BOARD_NAME, "16T90SP"), + }, + }, { } };
Greg Kroah-Hartman
maintainerPATCH 181/208 ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koba Ko <[email protected]>
commit 088984c8d54c0053fc4ae606981291d741c5924b upstream.
PRMT needs to find the correct type of block to translate the PA-VA mapping for EFI runtime services.
The issue arises because the PRMT is finding a block of type EFI_CONVENTIONAL_MEMORY, which is not appropriate for runtime services as described in Section 2.2.2 (Runtime Services) of the UEFI Specification [1]. Since the PRM handler is a type of runtime service, this causes an exception when the PRM handler is called.
[Firmware Bug]: Unable to handle paging request in EFI runtime service
WARNING: CPU: 22 PID: 4330 at drivers/firmware/efi/runtime-wrappers.c:341
__efi_queue_work+0x11c/0x170
Call trace:
Let PRMT find a block with EFI_MEMORY_RUNTIME for PRM handler and PRM context.
If no suitable block is found, a warning message will be printed, but the procedure continues to manage the next PRM handler.
However, if the PRM handler is actually called without proper allocation, it would result in a failure during error handling.
By using the correct memory types for runtime services, ensure that the PRM handler and the context are properly mapped in the virtual address space during runtime, preventing the paging request error.
The issue is really that only memory that has been remapped for runtime by the firmware can be used by the PRM handler, and so the region needs to have the EFI_MEMORY_RUNTIME attribute.
--- drivers/acpi/prmt.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-)
drivers/acpi/prmt.c +22 -5
@@ -72,17 +72,21 @@ struct prm_module_info {struct prm_handler_info handlers[]; }; -static u64 efi_pa_va_lookup (u64 pa) +static u64 efi_pa_va_lookup (efi_guid_t *guid,u64 pa) {efi_memory_desc_t *md;u64 pa_offset = pa & ~PAGE_MASK ;u64 page = pa &PAGE_MASK ;for_each_efi_memory_desc (md) { -if (md->phys_addr < pa && pa < md->phys_addr +PAGE_SIZE * md->num_pages) +if ((md->attribute &EFI_MEMORY_RUNTIME ) && + (md->phys_addr < pa && pa < md->phys_addr +PAGE_SIZE * md->num_pages)) {return pa_offset + md->virt_addr + page - md->phys_addr; + } } +pr_warn ("Failed to find VA for GUID: %pUL, PA: 0x%llx" , guid, pa); +return 0 ; }
@@ -148,9 +152,15 @@ acpi_parse_prmt(union acpi_subtable_head th = &tm->handlers[cur_handler];guid_copy (&th->guid, (guid_t *)handler_info->handler_guid); - th->handler_addr = (void *)efi_pa_va_lookup (handler_info->handler_address); - th->static_data_buffer_addr =efi_pa_va_lookup (handler_info->static_data_buffer_address); - th->acpi_param_buffer_addr =efi_pa_va_lookup (handler_info->acpi_param_buffer_address); + th->handler_addr = + (void *)efi_pa_va_lookup (&th->guid, handler_info->handler_address); + + th->static_data_buffer_addr = +efi_pa_va_lookup (&th->guid, handler_info->static_data_buffer_address); + + th->acpi_param_buffer_addr = +efi_pa_va_lookup (&th->guid, handler_info->acpi_param_buffer_address); + }while (++cur_handler < tm->handler_count && (handler_info =get_next_handler (handler_info)));return 0 ;
@@ -253,6 +263,13 @@ static acpi_status acpi_platformrt_spaceif (!handler || !module) goto invalid_guid; +if (!handler->handler_addr || + !handler->static_data_buffer_addr || + !handler->acpi_param_buffer_addr) { + buffer->prm_status =PRM_HANDLER_ERROR ; +return AE_OK ; + } +ACPI_COPY_NAMESEG (context.signature,"PRMC" ); context.revision =0x0 ; context.reserved =0x0 ;
Greg Kroah-Hartman
maintainerPATCH 182/208 ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shubham Panwar <[email protected]>
commit 8fa73ee44daefc884c53a25158c25a4107eb5a94 upstream.
Add a DMI quirk for Samsung Galaxy Book2 to fix an initial lid state detection issue.
The _LID device incorrectly returns the lid status as "closed" during boot, causing the system to enter a suspend loop right after booting.
The quirk ensures that the correct lid state is reported initially, preventing the system from immediately suspending after startup. It only addresses the initial lid state detection and ensures proper system behavior upon boot.
--- drivers/acpi/button.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/acpi/button.c +11 -0
@@ -130,6 +130,17 @@ static const struct dmi_system_id dmi_li }, .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN, }, + { + /* + * Samsung galaxybook2 ,initial _LID device notification returns + * lid closed. + */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), + DMI_MATCH(DMI_PRODUCT_NAME, "750XED"), + }, + .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN, + }, {} };
Greg Kroah-Hartman
maintainerPATCH 183/208 nilfs2: fix kernel bug due to missing clearing of buffer delay flag
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit 6ed469df0bfbef3e4b44fca954a781919db9f7ab upstream.
Syzbot reported that after nilfs2 reads a corrupted file system image and degrades to read-only, the BUG_ON check for the buffer delay flag in submit_bh_wbc() may fail, causing a kernel bug.
This is because the buffer delay flag is not cleared when clearing the buffer state flags to discard a page/folio or a buffer head. So, fix this.
This became necessary when the use of nilfs2's own page clear routine was expanded. This state inconsistency does not occur if the buffer is written normally by log writing.
--- fs/nilfs2/page.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/nilfs2/page.c +4 -2
@@ -77,7 +77,8 @@ void nilfs_forget_buffer(struct buffer_hconst unsigned long clear_bits = (BIT (BH_Uptodate) |BIT (BH_Dirty) |BIT (BH_Mapped) |BIT (BH_Async_Write) |BIT (BH_NILFS_Volatile) | -BIT (BH_NILFS_Checked) |BIT (BH_NILFS_Redirected)); +BIT (BH_NILFS_Checked) |BIT (BH_NILFS_Redirected) | +BIT (BH_Delay));lock_buffer (bh);set_mask_bits (&bh->b_state, clear_bits,0 );
@@ -410,7 +411,8 @@ void nilfs_clear_dirty_page(struct pageconst unsigned long clear_bits = (BIT (BH_Uptodate) |BIT (BH_Dirty) |BIT (BH_Mapped) |BIT (BH_Async_Write) |BIT (BH_NILFS_Volatile) | -BIT (BH_NILFS_Checked) |BIT (BH_NILFS_Redirected)); +BIT (BH_NILFS_Checked) |BIT (BH_NILFS_Redirected) | +BIT (BH_Delay)); bh = head =page_buffers (page); do {
Greg Kroah-Hartman
maintainerPATCH 184/208 openat2: explicitly return -E2BIG for (usize > PAGE_SIZE)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksa Sarai <[email protected]>
commit f92f0a1b05698340836229d791b3ffecc71b265a upstream.
While we do currently return -EFAULT in this case, it seems prudent to follow the behaviour of other syscalls like clone3. It seems quite unlikely that anyone depends on this error code being EFAULT, but we can always revert this if it turns out to be an issue.
--- fs/open.c | 2 ++ 1 file changed, 2 insertions(+)
fs/open.c +2 -0
@@ -1461,6 +1461,8 @@ SYSCALL_DEFINE4(openat2, int, dfd, constif (unlikely (usize <OPEN_HOW_SIZE_VER0 ))return -EINVAL ; +if (unlikely (usize >PAGE_SIZE )) +return -E2BIG ; err =copy_struct_from_user (&tmp,sizeof (tmp), how, usize);if (err)
Greg Kroah-Hartman
maintainerPATCH 185/208 KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit f559b2e9c5c5308850544ab59396b7d53cfc67bd upstream.
Ignore nCR3[4:0] when loading PDPTEs from memory for nested SVM, as bits 4:0 of CR3 are ignored when PAE paging is used, and thus VMRUN doesn't enforce 32-byte alignment of nCR3.
In the absolute worst case scenario, failure to ignore bits 4:0 can result in an out-of-bounds read, e.g. if the target page is at the end of a memslot, and the VMM isn't using guard pages.
Per the APM:
The CR3 register points to the base address of the page-directory-pointer table. The page-directory-pointer table is aligned on a 32-byte boundary, with the low 5 address bits 4:0 assumed to be 0.
And the SDM's much more explicit:
4:0 Ignored
Note, KVM gets this right when loading PDPTRs, it's only the nSVM flow that is broken.
Message-ID: <[email protected]>
--- arch/x86/kvm/svm/nested.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/x86/kvm/svm/nested.c +5 -1
@@ -63,8 +63,12 @@ static u64 nested_svm_get_tdp_pdptr(struu64 pdpte;int ret; +/* +* Note, nCR3 is "assumed" to be 32-byte aligned, i.e. the CPU ignores +* nCR3[4:0] when loading PDPTEs from memory. +*/ ret =kvm_vcpu_read_guest_page (vcpu,gpa_to_gfn (cr3), &pdpte, -offset_in_page (cr3) + index *8 ,8 ); + (cr3 &GENMASK (11 ,5 )) + index *8 ,8 );if (ret)return 0 ;return pdpte;
Greg Kroah-Hartman
maintainerPATCH 186/208 KVM: arm64: Fix shift-out-of-bounds bug
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilkka Koskinen <[email protected]>
commit c6c167afa090ea0451f91814e1318755a8fb8bb9 upstream.
Fix a shift-out-of-bounds bug reported by UBSAN when running VM with MTE enabled host kernel.
UBSAN: shift-out-of-bounds in arch/arm64/kvm/sys_regs.c:1988:14 shift exponent 33 is too large for 32-bit type 'int' CPU: 26 UID: 0 PID: 7629 Comm: qemu-kvm Not tainted 6.12.0-rc2 #34 Hardware name: IEI NF5280R7/Mitchell MB, BIOS 00.00. 2024-10-12 09:28:54 10/14/2024 Call trace: dump_backtrace+0xa0/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x74/0x90 dump_stack+0x18/0x28 __ubsan_handle_shift_out_of_bounds+0xf8/0x1e0 reset_clidr+0x10c/0x1c8 kvm_reset_sys_regs+0x50/0x1c8 kvm_reset_vcpu+0xec/0x2b0 __kvm_vcpu_set_target+0x84/0x158 kvm_vcpu_set_target+0x138/0x168 kvm_arch_vcpu_ioctl_vcpu_init+0x40/0x2b0 kvm_arch_vcpu_ioctl+0x28c/0x4b8 kvm_vcpu_ioctl+0x4bc/0x7a8 __arm64_sys_ioctl+0xb4/0x100 invoke_syscall+0x70/0x100 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x3c/0x158 el0t_64_sync_handler+0x120/0x130 el0t_64_sync+0x194/0x198
--- arch/arm64/kvm/sys_regs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/kvm/sys_regs.c +1 -1
@@ -1708,7 +1708,7 @@ static u64 reset_clidr(struct kvm_vcpu ** one cache line. */ if (kvm_has_mte (vcpu->kvm)) - clidr |=2 <<CLIDR_TTYPE_SHIFT (loc); + clidr |=2ULL <<CLIDR_TTYPE_SHIFT (loc);__vcpu_sys_reg (vcpu, r->reg) = clidr;
Greg Kroah-Hartman
maintainerPATCH 187/208 KVM: arm64: Dont eagerly teardown the vgic on init error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit df5fd75ee305cb5927e0b1a0b46cc988ad8db2b1 upstream.
As there is very little ordering in the KVM API, userspace can instanciate a half-baked GIC (missing its memory map, for example) at almost any time.
This means that, with the right timing, a thread running vcpu-0 can enter the kernel without a GIC configured and get a GIC created behind its back by another thread. Amusingly, it will pick up that GIC and start messing with the data structures without the GIC having been fully initialised.
Similarly, a thread running vcpu-1 can enter the kernel, and try to init the GIC that was previously created. Since this GIC isn't properly configured (no memory map), it fails to correctly initialise.
And that's the point where we decide to teardown the GIC, freeing all its resources. Behind vcpu-0's back. Things stop pretty abruptly, with a variety of symptoms. Clearly, this isn't good, we should be a bit more careful about this.
It is obvious that this guest is not viable, as it is missing some important part of its configuration. So instead of trying to tear bits of it down, let's just mark it as *dead*. It means that any further interaction from userspace will result in -EIO. The memory will be released on the "normal" path, when userspace gives up.
--- arch/arm64/kvm/arm.c | 3 +++ arch/arm64/kvm/vgic/vgic-init.c | 6 +++--- 2 files changed, 6 insertions(+), 3 deletions(-)
arch/arm64/kvm/arm.c +3 -0
@@ -777,6 +777,9 @@ static int kvm_vcpu_suspend(struct kvm_vstatic int check_vcpu_requests (struct kvm_vcpu *vcpu) {if (kvm_request_pending (vcpu)) { +if (kvm_check_request (KVM_REQ_VM_DEAD , vcpu)) +return -EIO ; +if (kvm_check_request (KVM_REQ_SLEEP , vcpu))kvm_vcpu_sleep (vcpu);
arch/arm64/kvm/vgic/vgic-init.c +3 -3
@@ -494,10 +494,10 @@ int kvm_vgic_map_resources(struct kvm *k out:mutex_unlock (&kvm->arch.config_lock); out_slots: -mutex_unlock (&kvm->slots_lock); -if (ret) -kvm_vgic_destroy (kvm); +kvm_vm_dead (kvm); + +mutex_unlock (&kvm->slots_lock);return ret; }
Greg Kroah-Hartman
maintainerPATCH 188/208 x86/lam: Disable ADDRESS_MASKING in most cases
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <[email protected]>
commit 3267cb6d3a174ff83d6287dcd5b0047bbd912452 upstream.
Linear Address Masking (LAM) has a weakness related to transient execution as described in the SLAM paper[1]. Unless Linear Address Space Separation (LASS) is enabled this weakness may be exploitable.
Until kernel adds support for LASS[2], only allow LAM for COMPILE_TEST, or when speculation mitigations have been disabled at compile time, otherwise keep LAM disabled.
There are no processors in market that support LAM yet, so currently nobody is affected by this issue.
[1] SLAM: https://download.vusec.net/papers/slam_sp24.pdf
[2] LASS: https://lore.kernel.org/lkml/[email protected]/
[ dhansen: update SPECULATION_MITIGATIONS -> CPU_MITIGATIONS ]
--- arch/x86/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/x86/Kconfig +1 -0
@@ -2217,6 +2217,7 @@ config RANDOMIZE_MEMORY_PHYSICAL_PADDING config ADDRESS_MASKING bool "Linear Address Masking support" depends on X86_64 + depends on COMPILE_TEST || !CPU_MITIGATIONS # wait for LASS help Linear Address Masking (LAM) modifies the checking that is applied to 64-bit linear addresses, allowing software to use of the
Greg Kroah-Hartman
maintainerPATCH 189/208 ALSA: hda/tas2781: select CRC32 instead of CRC32_SARWATE
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 86c96e7289c5758284b562ac7b5c94429f48d2d9 upstream.
Fix the kconfig option for the tas2781 HDA driver to select CRC32 rather than CRC32_SARWATE. CRC32_SARWATE is an option from the kconfig 'choice' that selects the specific CRC32 implementation. Selecting a 'choice' option seems to have no effect, but even if it did work, it would be incorrect for a random driver to override the user's choice. CRC32 is the correct option to select for crc32() to be available.
--- sound/pci/hda/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/Kconfig +1 -1
@@ -173,7 +173,7 @@ config SND_HDA_SCODEC_TAS2781_I2C depends on SND_SOC select SND_SOC_TAS2781_COMLIB select SND_SOC_TAS2781_FMWLIB - select CRC32_SARWATE + select CRC32 help Say Y or M here to include TAS2781 I2C HD-audio side codec support in snd-hda-intel driver, such as ALC287.
Greg Kroah-Hartman
maintainerPATCH 190/208 ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Relvas <[email protected]>
commit 35fdc6e1c16099078bcbd73a6c8f1733ae7f1909 upstream.
The Acer Predator G9-593 has a 2+1 speaker system which isn't probed correctly.
This patch adds a quirk with the proper pin connections.
Note that I do not own this laptop, so I cannot guarantee that this fixes the issue.
Testing was done by other users here:
https://discussion.fedoraproject.org/t/-/118482
This model appears to have two different dev IDs...
- 0x1177 (as seen on the forum link above)
- 0x1178 (as seen on https://linux-hardware.org/?probe=127df9999f)
I don't think the audio system was changed between model revisions, so the patch applies for both IDs.
--- sound/pci/hda/patch_realtek.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
sound/pci/hda/patch_realtek.c +10 -0
@@ -7358,6 +7358,7 @@ enum {ALC286_FIXUP_ACER_AIO_HEADSET_MIC ,ALC256_FIXUP_ASUS_HEADSET_MIC ,ALC256_FIXUP_ASUS_MIC_NO_PRESENCE , +ALC255_FIXUP_PREDATOR_SUBWOOFER ,ALC299_FIXUP_PREDATOR_SPK ,ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE , ALC289_FIXUP_DELL_SPK1,
@@ -8705,6 +8706,13 @@ static const struct hda_fixup alc269_fix .chained = true, .chain_id =ALC256_FIXUP_ASUS_HEADSET_MODE }, + [ALC255_FIXUP_PREDATOR_SUBWOOFER] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x17 ,0x90170151 },/* use as internal speaker (LFE) */ + {0x1b ,0x90170152 }/* use as internal speaker (back) */ + } + }, [ALC299_FIXUP_PREDATOR_SPK] = { .type = HDA_FIXUP_PINS, .v.pins = (const struct hda_pintbl []) {
@@ -9678,6 +9686,8 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1025 ,0x110e ,"Acer Aspire ES1-432" ,ALC255_FIXUP_ACER_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1025 ,0x1166 ,"Acer Veriton N4640G" ,ALC269_FIXUP_LIFEBOOK ),SND_PCI_QUIRK (0x1025 ,0x1167 ,"Acer Veriton N6640G" ,ALC269_FIXUP_LIFEBOOK ), +SND_PCI_QUIRK (0x1025 ,0x1177 ,"Acer Predator G9-593" ,ALC255_FIXUP_PREDATOR_SUBWOOFER ), +SND_PCI_QUIRK (0x1025 ,0x1178 ,"Acer Predator G9-593" ,ALC255_FIXUP_PREDATOR_SUBWOOFER ),SND_PCI_QUIRK (0x1025 ,0x1246 ,"Acer Predator Helios 500" ,ALC299_FIXUP_PREDATOR_SPK ),SND_PCI_QUIRK (0x1025 ,0x1247 ,"Acer vCopperbox" ,ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS ), SND_PCI_QUIRK(0x1025, 0x1248, "Acer Veriton N4660G", ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE),
Greg Kroah-Hartman
maintainerPATCH 191/208 LoongArch: Get correct cores_per_package for SMT systems
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit b7296f9d5bf99330063d4bbecc43c9b33fed0137 upstream.
In loongson_sysconf, The "core" of cores_per_node and cores_per_package stands for a logical core, which means in a SMT system it stands for a thread indeed. This information is gotten from SMBIOS Type4 Structure, so in order to get a correct cores_per_package for both SMT and non-SMT systems in parse_cpu_table() we should use SMBIOS_THREAD_PACKAGE_OFFSET instead of SMBIOS_CORE_PACKAGE_OFFSET.
--- arch/loongarch/include/asm/bootinfo.h | 4 ++++ arch/loongarch/kernel/setup.c | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-)
arch/loongarch/include/asm/bootinfo.h +4 -0
@@ -24,6 +24,10 @@ struct loongson_board_info {const char *board_vendor; }; +/* +* The "core" of cores_per_node and cores_per_package stands for a +* logical core, which means in a SMT system it stands for a thread. +*/ struct loongson_system_configuration {int nr_cpus;int nr_nodes;
arch/loongarch/kernel/setup.c +2 -1
@@ -55,6 +55,7 @@#define SMBIOS_FREQHIGH_OFFSET 0x17#define SMBIOS_FREQLOW_MASK 0xFF#define SMBIOS_CORE_PACKAGE_OFFSET 0x23 +#define SMBIOS_THREAD_PACKAGE_OFFSET 0x25#define LOONGSON_EFI_ENABLE (1 << 3)#ifdef CONFIG_EFI
@@ -129,7 +130,7 @@ static void __init parse_cpu_table(const cpu_clock_freq = freq_temp *1000000 ; loongson_sysconf.cpuname = (void *)dmi_string_parse (dm, dmi_data[16 ]); - loongson_sysconf.cores_per_package = *(dmi_data +SMBIOS_CORE_PACKAGE_OFFSET ); + loongson_sysconf.cores_per_package = *(dmi_data +SMBIOS_THREAD_PACKAGE_OFFSET );pr_info ("CpuClock = %llu\n" , cpu_clock_freq); }
Greg Kroah-Hartman
maintainerPATCH 192/208 LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 69cc6fad5df4ce652d969be69acc60e269e5eea1 upstream.
Unaligned access exception can be triggered in irq-enabled context such as user mode, in this case do_ale() may call get_user() which may cause sleep. Then we will get:
BUG: sleeping function called from invalid context at arch/loongarch/kernel/access-helper.h:7
in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 129, name: modprobe
preempt_count: 0, expected: 0
RCU nest depth: 0, expected: 0
CPU: 0 UID: 0 PID: 129 Comm: modprobe Tainted: G W 6.12.0-rc1+ #1723
Tainted: [W]=WARN
Stack : 9000000105e0bd48 0000000000000000 9000000003803944 9000000105e08000
9000000105e0bc70 9000000105e0bc78 0000000000000000 0000000000000000
9000000105e0bc78 0000000000000001 9000000185e0ba07 9000000105e0b890
ffffffffffffffff 9000000105e0bc78 73924b81763be05b 9000000100194500
000000000000020c 000000000000000a 0000000000000000 0000000000000003
00000000000023f0 00000000000e1401 00000000072f8000 0000007ffbb0e260
0000000000000000 0000000000000000 9000000005437650 90000000055d5000
0000000000000000 0000000000000003 0000007ffbb0e1f0 0000000000000000
0000005567b00490 0000000000000000 9000000003803964 0000007ffbb0dfec
00000000000000b0 0000000000000007 0000000000000003 0000000000071c1d
...
Call Trace:
[<9000000003803964>] show_stack+0x64/0x1a0
[<9000000004c57464>] dump_stack_lvl+0x74/0xb0
[<9000000003861ab4>] __might_resched+0x154/0x1a0
[<900000000380c96c>] emulate_load_store_insn+0x6c/0xf60
[<9000000004c58118>] do_ale+0x78/0x180
[<9000000003801bc8>] handle_ale+0x128/0x1e0So enable IRQ if unaligned access exception is triggered in irq-enabled context to fix it.
--- arch/loongarch/kernel/traps.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/loongarch/kernel/traps.c +5 -0
@@ -529,6 +529,9 @@ asmlinkage void noinstr do_ale(struct pt#else unsigned int *pc; +if (regs->csr_prmd &CSR_PRMD_PIE ) +local_irq_enable (); +perf_sw_event (PERF_COUNT_SW_ALIGNMENT_FAULTS ,1 , regs, regs->csr_badvaddr);/*
@@ -553,6 +556,8 @@ sigbus:die_if_kernel ("Kernel ale access" , regs);force_sig_fault (SIGBUS ,BUS_ADRALN , (void __user *)regs->csr_badvaddr); out: +if (regs->csr_prmd &CSR_PRMD_PIE ) +local_irq_disable ();#endif irqentry_exit (regs, state); }
Greg Kroah-Hartman
maintainerPATCH 193/208 LoongArch: Make KASAN usable for variable cpu_vabits
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 3c252263be801f937f56b4bcd8e8e2b5307c1ce5 upstream.
Currently, KASAN on LoongArch assume the CPU VA bits is 48, which is true for Loongson-3 series, but not for Loongson-2 series (only 40 or lower), this patch fix that issue and make KASAN usable for variable cpu_vabits.
Solution is very simple: Just define XRANGE_SHADOW_SHIFT which means valid address length from VA_BITS to min(cpu_vabits, VA_BITS).
--- arch/loongarch/include/asm/kasan.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/loongarch/include/asm/kasan.h +1 -1
@@ -16,7 +16,7 @@#define XRANGE_SHIFT (48)/* Valid address length */ -#define XRANGE_SHADOW_SHIFT (PGDIR_SHIFT + PAGE_SHIFT - 3) +#define XRANGE_SHADOW_SHIFT min(cpu_vabits, VA_BITS)/* Used for taking out the valid address */ #define XRANGE_SHADOW_MASK GENMASK_ULL(XRANGE_SHADOW_SHIFT - 1, 0)/* One segment whole address space size */
Greg Kroah-Hartman
maintainerPATCH 194/208 xfrm: fix one more kernel-infoleak in algo dumping
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Vaganov <[email protected]>
commit 6889cd2a93e1e3606b3f6e958aa0924e836de4d2 upstream.
During fuzz testing, the following issue was discovered:
BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x598/0x2a30 _copy_to_iter+0x598/0x2a30 __skb_datagram_iter+0x168/0x1060 skb_copy_datagram_iter+0x5b/0x220 netlink_recvmsg+0x362/0x1700 sock_recvmsg+0x2dc/0x390 __sys_recvfrom+0x381/0x6d0 __x64_sys_recvfrom+0x130/0x200 x64_sys_call+0x32c8/0x3cc0 do_syscall_64+0xd8/0x1c0 entry_SYSCALL_64_after_hwframe+0x79/0x81
Uninit was stored to memory at:
copy_to_user_state_extra+0xcc1/0x1e00 dump_one_state+0x28c/0x5f0 xfrm_state_walk+0x548/0x11e0 xfrm_dump_sa+0x1e0/0x840 netlink_dump+0x943/0x1c40 __netlink_dump_start+0x746/0xdb0 xfrm_user_rcv_msg+0x429/0xc00 netlink_rcv_skb+0x613/0x780 xfrm_netlink_rcv+0x77/0xc0 netlink_unicast+0xe90/0x1280 netlink_sendmsg+0x126d/0x1490 __sock_sendmsg+0x332/0x3d0 ____sys_sendmsg+0x863/0xc30 ___sys_sendmsg+0x285/0x3e0 __x64_sys_sendmsg+0x2d6/0x560 x64_sys_call+0x1316/0x3cc0 do_syscall_64+0xd8/0x1c0 entry_SYSCALL_64_after_hwframe+0x79/0x81
Uninit was created at:
__kmalloc+0x571/0xd30 attach_auth+0x106/0x3e0 xfrm_add_sa+0x2aa0/0x4230 xfrm_user_rcv_msg+0x832/0xc00 netlink_rcv_skb+0x613/0x780 xfrm_netlink_rcv+0x77/0xc0 netlink_unicast+0xe90/0x1280 netlink_sendmsg+0x126d/0x1490 __sock_sendmsg+0x332/0x3d0 ____sys_sendmsg+0x863/0xc30 ___sys_sendmsg+0x285/0x3e0 __x64_sys_sendmsg+0x2d6/0x560 x64_sys_call+0x1316/0x3cc0 do_syscall_64+0xd8/0x1c0 entry_SYSCALL_64_after_hwframe+0x79/0x81
Bytes 328-379 of 732 are uninitialized Memory access of size 732 starts at ffff88800e18e000 Data copied to user address 00007ff30f48aff0
CPU: 2 PID: 18167 Comm: syz-executor.0 Not tainted 6.8.11 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Fixes copying of xfrm algorithms where some random
data of the structure fields can end up in userspace. Padding in structures may be filled with random (possibly sensitve) data and should never be given directly to user-space.
A similar issue was resolved in the commit 8222d5910dae ("xfrm: Zero padding when dumping algos and encap")
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- net/xfrm/xfrm_user.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/xfrm/xfrm_user.c +3 -1
@@ -1098,7 +1098,9 @@ static int copy_to_user_auth(struct xfrmif (!nla)return -EMSGSIZE ; ap =nla_data (nla); -memcpy (ap, auth,sizeof (struct xfrm_algo_auth )); +strscpy_pad (ap->alg_name, auth->alg_name,sizeof (ap->alg_name)); + ap->alg_key_len = auth->alg_key_len; + ap->alg_trunc_len = auth->alg_trunc_len;if (redact_secret && auth->alg_key_len)memset (ap->alg_key,0 , (auth->alg_key_len +7 ) /8 );else
Greg Kroah-Hartman
maintainerPATCH 195/208 hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haiyang Zhang <[email protected]>
commit 4c262801ea60c518b5bebc22a09f5b78b3147da2 upstream.
The existing code moves VF to the same namespace as the synthetic NIC during netvsc_register_vf(). But, if the synthetic device is moved to a new namespace after the VF registration, the VF won't be moved together.
To make the behavior more consistent, add a namespace check for synthetic NIC's NETDEV_REGISTER event (generated during its move), and move the VF if it is not in the same namespace.
--- drivers/net/hyperv/netvsc_drv.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
drivers/net/hyperv/netvsc_drv.c +30 -0
@@ -2795,6 +2795,31 @@ static struct hv_driver netvsc_drv = { }, }; +/* Set VF's namespace same as the synthetic NIC */ +static void netvsc_event_set_vf_ns (struct net_device *ndev) +{ +struct net_device_context *ndev_ctx =netdev_priv (ndev); +struct net_device *vf_netdev; +int ret; + + vf_netdev =rtnl_dereference (ndev_ctx->vf_netdev); +if (!vf_netdev) +return ; + +if (!net_eq (dev_net (ndev),dev_net (vf_netdev))) { + ret =dev_change_net_namespace (vf_netdev,dev_net (ndev), +"eth%d" ); +if (ret) +netdev_err (vf_netdev, +"Cannot move to same namespace as %s: %d\n" , + ndev->name, ret); +else +netdev_info (vf_netdev, +"Moved VF to namespace with: %s\n" , + ndev->name); + } +} +/* * On Hyper-V, every VF interface is matched with a corresponding * synthetic interface. The synthetic interface is presented first
@@ -2807,6 +2832,11 @@ static int netvsc_netdev_event(struct nostruct net_device *event_dev =netdev_notifier_info_to_dev (ptr);int ret =0 ; +if (event_dev->netdev_ops == &device_ops && event ==NETDEV_REGISTER ) { +netvsc_event_set_vf_ns (event_dev); +return NOTIFY_DONE ; + } + ret =check_dev_is_matching_vf (event_dev);if (ret !=0 )return NOTIFY_DONE ;
Greg Kroah-Hartman
maintainerPATCH 196/208 drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit ba1959f71117b27f3099ee789e0815360b4081dd upstream.
Stuart Hayhurst has found that both at bootup and fullscreen VA-API video is leading to black screens for around 1 second and kernel WARNING [1] traces when calling dmub_psr_enable() with Parade 08-01 TCON.
These symptoms all go away with PSR-SU disabled for this TCON, so disable it for now while DMUB traces [2] from the failure can be analyzed and the failure state properly root caused.
--- drivers/gpu/drm/amd/display/modules/power/power_helpers.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/modules/power/power_helpers.c +2 -0
@@ -841,6 +841,8 @@ bool is_psr_su_specific_panel(struct dc_ isPSRSUSupported = false; else if (dpcd_caps->sink_dev_id_str[1] == 0x08 && dpcd_caps->sink_dev_id_str[0] == 0x03) isPSRSUSupported = false; + else if (dpcd_caps->sink_dev_id_str[1] == 0x08 && dpcd_caps->sink_dev_id_str[0] == 0x01) + isPSRSUSupported = false; else if (dpcd_caps->psr_info.force_psrsu_cap == 0x1) isPSRSUSupported = true; }
Greg Kroah-Hartman
maintainerPATCH 197/208 selinux: improve error checking in sel_write_load()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Moore <[email protected]>
[ Upstream commit 42c773238037c90b3302bf37a57ae3b5c3f6004a ]
Move our existing input sanity checking to the top of sel_write_load() and add a check to ensure the buffer size is non-zero.
Move a local variable initialization from the declaration to before it is used.
Minor style adjustments.
--- security/selinux/selinuxfs.c | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-)
security/selinux/selinuxfs.c +16 -14
@@ -582,11 +582,18 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { - struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info; + struct selinux_fs_info *fsi;struct selinux_load_state load_state;ssize_t length;void *data =NULL ; +/* no partial writes */ +if (*ppos) +return -EINVAL ; +/* no empty policies */ +if (!count) +return -EINVAL ; +mutex_lock (&selinux_state.policy_mutex); length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
@@ -594,26 +601,22 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,if (length) goto out; -/* No partial writes. */ - length = -EINVAL ; -if (*ppos !=0 ) - goto out; - - length = -ENOMEM ; data =vmalloc (count); -if (!data) +if (!data) { + length = -ENOMEM ; goto out; - - length = -EFAULT ; -if (copy_from_user (data, buf, count) !=0 ) + } +if (copy_from_user (data, buf, count) !=0 ) { + length = -EFAULT ; goto out; + } length =security_load_policy (data, count, &load_state);if (length) {pr_warn_ratelimited ("SELinux: failed to load policy\n" ); goto out; } - + fsi =file_inode (file)->i_sb->s_fs_info; length =sel_make_policy_nodes (fsi, load_state.policy);if (length) {pr_warn_ratelimited ("SELinux: failed to initialize selinuxfs\n" );
@@ -622,13 +625,12 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, }selinux_policy_commit (&load_state); - length = count; -audit_log (audit_context (),GFP_KERNEL ,AUDIT_MAC_POLICY_LOAD ,"auid=%u ses=%u lsm=selinux res=1" ,from_kuid (&init_user_ns,audit_get_loginuid (current)),audit_get_sessionid (current)); + out:mutex_unlock (&selinux_state.policy_mutex);vfree (data);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 198/208 net: phy: dp83822: Fix reset pin definitions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michel Alex <[email protected]>
commit de96f6a3003513c796bbe4e23210a446913f5c00 upstream.
This change fixes a rare issue where the PHY fails to detect a link due to incorrect reset behavior.
The SW_RESET definition was incorrectly assigned to bit 14, which is the Digital Restart bit according to the datasheet. This commit corrects SW_RESET to bit 15 and assigns DIG_RESTART to bit 14 as per the datasheet specifications.
The SW_RESET define is only used in the phy_reset function, which fully re-initializes the PHY after the reset is performed. The change in the bit definitions should not have any negative impact on the functionality of the PHY.
v2:
- added Fixes tag
- improved commit message
Message-ID: <AS1P250MB0608A798661549BF83C4B43EA9462@AS1P250MB0608.EURP250.PROD.OUTLOOK.COM>
--- drivers/net/phy/dp83822.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/phy/dp83822.c +2 -2
@@ -40,8 +40,8 @@/* Control Register 2 bits */ #define DP83822_FX_ENABLE BIT(14) -#define DP83822_HW_RESET BIT(15) -#define DP83822_SW_RESET BIT(14) +#define DP83822_SW_RESET BIT(15) +#define DP83822_DIG_RESTART BIT(14)/* PHY STS bits */ #define DP83822_PHYSTS_DUPLEX BIT(2)
Greg Kroah-Hartman
maintainerPATCH 199/208 block: fix sanity checks in blk_rq_map_user_bvec
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xinyu Zhang <[email protected]>
commit 2ff949441802a8d076d9013c7761f63e8ae5a9bd upstream.
blk_rq_map_user_bvec contains a check bytes + bv->bv_len > nr_iter which causes unnecessary failures in NVMe passthrough I/O, reproducible as follows:
- register a 2 page, page-aligned buffer against a ring
- use that buffer to do a 1 page io_uring NVMe passthrough read
The second (i = 1) iteration of the loop in blk_rq_map_user_bvec will then have nr_iter == 1 page, bytes == 1 page, bv->bv_len == 1 page, so the check bytes + bv->bv_len > nr_iter will succeed, causing the I/O to fail. This failure is unnecessary, as when the check succeeds, it means we've checked the entire buffer that will be used by the request - i.e. blk_rq_map_user_bvec should complete successfully. Therefore, terminate the loop early and return successfully when the check bytes + bv->bv_len
Quoted 1 line
nr_itersucceeds.
While we're at it, also remove the check that all segments in the bvec are single-page. While this seems to be true for all users of the function, it doesn't appear to be required anywhere downstream.
--- block/blk-map.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
block/blk-map.c +1 -3
@@ -600,9 +600,7 @@ static int blk_rq_map_user_bvec(struct rif (nsegs >= nr_segs || bytes >UINT_MAX - bv->bv_len) goto put_bio;if (bytes + bv->bv_len > nr_iter) - goto put_bio; -if (bv->bv_offset + bv->bv_len >PAGE_SIZE ) - goto put_bio; +break ; nsegs++; bytes += bv->bv_len;
Greg Kroah-Hartman
maintainerPATCH 200/208 ata: libata: Set DID_TIME_OUT for commands that actually timed out
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
commit 8e59a2a5459fd9840dbe2cbde85fe154b11e1727 upstream.
When ata_qc_complete() schedules a command for EH using ata_qc_schedule_eh(), blk_abort_request() will be called, which leads to req->q->mq_ops->timeout() / scsi_timeout() being called.
scsi_timeout(), if the LLDD has no abort handler (libata has no abort handler), will set host byte to DID_TIME_OUT, and then call scsi_eh_scmd_add() to add the command to EH.
Thus, when commands first enter libata's EH strategy_handler, all the commands that have been added to EH will have DID_TIME_OUT set.
Commit e5dd410acb34 ("ata: libata: Clear DID_TIME_OUT for ATA PT commands with sense data") clears this bogus DID_TIME_OUT flag for all commands that reached libata's EH strategy_handler.
libata has its own flag (AC_ERR_TIMEOUT), that it sets for commands that have not received a completion at the time of entering EH.
ata_eh_worth_retry() has no special handling for AC_ERR_TIMEOUT, so by default timed out commands will get flag ATA_QCFLAG_RETRY set, and will be retried after the port has been reset (ata_eh_link_autopsy() always triggers a port reset if any command has AC_ERR_TIMEOUT set).
For a command that has ATA_QCFLAG_RETRY set, while also having an error flag set (e.g. AC_ERR_TIMEOUT), ata_eh_finish() will not increment scmd->allowed, so the command will at most be retried scmd->allowed number of times (which by default is set to 3).
However, scsi_eh_flush_done_q() will only retry commands for which scsi_noretry_cmd() returns false.
For a command that has DID_TIME_OUT set, while also having either the FAILFAST flag set, or the command being a passthrough command, scsi_noretry_cmd() will return true. Thus, such a command will never be retried.
Thus, make sure that libata sets SCSI's DID_TIME_OUT flag for commands that actually timed out (libata's AC_ERR_TIMEOUT flag), such that timed out commands will once again not be retried if they are also a FAILFAST or passthrough command.
--- drivers/ata/libata-eh.c | 1 + 1 file changed, 1 insertion(+)
drivers/ata/libata-eh.c +1 -0
@@ -636,6 +636,7 @@ void ata_scsi_cmd_error_handler(struct S/* the scmd has an associated qc */ if (!(qc->flags &ATA_QCFLAG_EH )) {/* which hasn't failed yet, timeout */ +set_host_byte (scmd,DID_TIME_OUT ); qc->err_mask |=AC_ERR_TIMEOUT ; qc->flags |=ATA_QCFLAG_EH ; nr_timedout++;
Greg Kroah-Hartman
maintainerPATCH 201/208 ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zichen Xie <[email protected]>
commit 49da1463c9e3d2082276c3e0e2a8b65a88711cd2 upstream.
A devm_kzalloc() in asoc_qcom_lpass_cpu_platform_probe() could possibly return NULL pointer. NULL Pointer Dereference may be triggerred without addtional check.
Add a NULL check for the returned pointer.
--- sound/soc/qcom/lpass-cpu.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/qcom/lpass-cpu.c +2 -0
@@ -1246,6 +1246,8 @@ int asoc_qcom_lpass_cpu_platform_probe(s/* Allocation for i2sctl regmap fields */ drvdata->i2sctl =devm_kzalloc (&pdev->dev,sizeof (struct lpaif_i2sctl ),GFP_KERNEL ); +if (!drvdata->i2sctl) +return -ENOMEM ;/* Initialize bitfields for dai I2SCTL register */ ret = lpass_cpu_init_i2sctl_bitfields(dev, drvdata->i2sctl,
Greg Kroah-Hartman
maintainerPATCH 202/208 platform/x86: dell-wmi: Ignore suspend notifications
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
commit a7990957fa53326fe9b47f0349373ed99bb69aaa upstream.
Some machines like the Dell G15 5155 emit WMI events when suspending/resuming. Ignore those WMI events.
--- drivers/platform/x86/dell/dell-wmi-base.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/platform/x86/dell/dell-wmi-base.c +9 -0
@@ -264,6 +264,15 @@ static const struct key_entry dell_wmi_k/*Speaker Mute*/ { KE_KEY, 0x109, { KEY_MUTE} }, +/* S2Idle screen off */ + { KE_IGNORE, 0x120, { KEY_RESERVED }}, + +/* Leaving S4 or S2Idle suspend */ + { KE_IGNORE, 0x130, { KEY_RESERVED }}, + +/* Entering S2Idle suspend */ + { KE_IGNORE, 0x140, { KEY_RESERVED }}, +/* Mic mute */ { KE_KEY, 0x150, { KEY_MICMUTE } },
Greg Kroah-Hartman
maintainerPATCH 203/208 ACPI: PRM: Clean up guid type in struct prm_handler_info
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 3d1c651272cf1df8aac7d9b6d92d836d27bed50f upstream.
Clang 19 prints a warning when we pass &th->guid to efi_pa_va_lookup():
drivers/acpi/prmt.c:156:29: error: passing 1-byte aligned argument to 4-byte aligned parameter 1 of 'efi_pa_va_lookup' may result in an unaligned pointer access [-Werror,-Walign-mismatch]
156 | (void *)efi_pa_va_lookup(&th->guid, handler_info->handler_address);
| ^
The problem is that efi_pa_va_lookup() takes a efi_guid_t and &th->guid is a regular guid_t. The difference between the two types is the alignment. efi_guid_t is a typedef.
typedef guid_t efi_guid_t __aligned(__alignof__(u32));
It's possible that this a bug in Clang 19. Even though the alignment of &th->guid is not explicitly specified, it will still end up being aligned at 4 or 8 bytes.
Anyway, as Ard points out, it's cleaner to change guid to efi_guid_t type and that also makes the warning go away.
--- drivers/acpi/prmt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/prmt.c +1 -1
@@ -52,7 +52,7 @@ struct prm_context_buffer {static LIST_HEAD (prm_module_list);struct prm_handler_info { -guid_t guid; +efi_guid_t guid; efi_status_t (__efiapi *handler_addr)(u64, void *);u64 static_data_buffer_addr;u64 acpi_param_buffer_addr;
Greg Kroah-Hartman
maintainerPATCH 204/208 RDMA/bnxt_re: Fix the offset for GenP7 adapters for user applications
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Selvin Xavier <[email protected]>
commit 9248f363d0791a548a9c7711365b8be4c70bd375 upstream.
User Doorbell page indexes start at an offset for GenP7 adapters. Fix the offset that will be used for user doorbell page indexes.
--- drivers/infiniband/hw/bnxt_re/main.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/infiniband/hw/bnxt_re/main.c +5 -3
@@ -107,12 +107,14 @@ static void bnxt_re_set_db_offset(structdev_info (rdev_to_dev (rdev),"Couldn't get DB bar size, Low latency framework is disabled\n" );/* set register offsets for both UC and WC */ -if (bnxt_qplib_is_chip_gen_p7 (cctx)) +if (bnxt_qplib_is_chip_gen_p7 (cctx)) { res->dpi_tbl.ucreg.offset = offset; -else + res->dpi_tbl.wcreg.offset = en_dev->l2_db_size; + }else { res->dpi_tbl.ucreg.offset = res->is_vf ?BNXT_QPLIB_DBR_VF_DB_OFFSET :BNXT_QPLIB_DBR_PF_DB_OFFSET ; - res->dpi_tbl.wcreg.offset = res->dpi_tbl.ucreg.offset; + res->dpi_tbl.wcreg.offset = res->dpi_tbl.ucreg.offset; + }/* If WC mapping is disabled by L2 driver then en_dev->l2_db_size * is equal to the DB-Bar actual size. This indicates that L2
Greg Kroah-Hartman
maintainerPATCH 205/208 RDMA/bnxt_re: Avoid creating fence MR for newer adapters
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <[email protected]>
commit 282fd66e2ef6e5d72b8fcd77efb2b282d2569464 upstream.
Limit the usage of fence MR to adapters older than Gen P5 products.
--- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/infiniband/hw/bnxt_re/ib_verbs.c +10 -0
@@ -400,6 +400,10 @@ static void bnxt_re_create_fence_wqe(strstruct bnxt_re_fence_data *fence = &pd->fence;struct ib_mr *ib_mr = &fence->mr->ib_mr;struct bnxt_qplib_swqe *wqe = &fence->bind_wqe; +struct bnxt_re_dev *rdev = pd->rdev; + +if (bnxt_qplib_is_chip_gen_p5_p7 (rdev->chip_ctx)) +return ;memset (wqe,0 ,sizeof (*wqe)); wqe->type =BNXT_QPLIB_SWQE_TYPE_BIND_MW ;
@@ -454,6 +458,9 @@ static void bnxt_re_destroy_fence_mr(strstruct device *dev = &rdev->en_dev->pdev->dev;struct bnxt_re_mr *mr = fence->mr; +if (bnxt_qplib_is_chip_gen_p5_p7 (rdev->chip_ctx)) +return ; +if (fence->mw) {bnxt_re_dealloc_mw (fence->mw); fence->mw =NULL ;
@@ -485,6 +492,9 @@ static int bnxt_re_create_fence_mr(strucstruct ib_mw *mw;int rc; +if (bnxt_qplib_is_chip_gen_p5_p7 (rdev->chip_ctx)) +return 0 ; + dma_addr =dma_map_single (dev, fence->va,BNXT_RE_FENCE_BYTES ,DMA_BIDIRECTIONAL ); rc =dma_mapping_error (dev, dma_addr);
Greg Kroah-Hartman
maintainerPATCH 206/208 RDMA/bnxt_re: Fix unconditional fence for newer adapters
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <[email protected]>
commit 8eaca6b5997bd8fd7039f2693e4ecf112823c816 upstream.
Older adapters required an unconditional fence for non-wire memory operations. Newer adapters doesn't require this and therefore, disabling the unconditional fence.
--- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-)
drivers/infiniband/hw/bnxt_re/ib_verbs.c +16 -12
@@ -2563,11 +2563,6 @@ static int bnxt_re_build_inv_wqe(const s wqe->type =BNXT_QPLIB_SWQE_TYPE_LOCAL_INV ; wqe->local_inv.inv_l_key = wr->ex.invalidate_rkey; -/* Need unconditional fence for local invalidate -* opcode to work as expected. -*/ - wqe->flags |=BNXT_QPLIB_SWQE_FLAGS_UC_FENCE ; -if (wr->send_flags &IB_SEND_SIGNALED ) wqe->flags |=BNXT_QPLIB_SWQE_FLAGS_SIGNAL_COMP ;if (wr->send_flags &IB_SEND_SOLICITED )
@@ -2590,12 +2585,6 @@ static int bnxt_re_build_reg_wqe(const s wqe->frmr.levels = qplib_frpl->hwq.level; wqe->type =BNXT_QPLIB_SWQE_TYPE_REG_MR ; -/* Need unconditional fence for reg_mr -* opcode to function as expected. -*/ - - wqe->flags |=BNXT_QPLIB_SWQE_FLAGS_UC_FENCE ; -if (wr->wr.send_flags &IB_SEND_SIGNALED ) wqe->flags |=BNXT_QPLIB_SWQE_FLAGS_SIGNAL_COMP ;
@@ -2726,6 +2715,18 @@ bad:return rc; } +static void bnxt_re_legacy_set_uc_fence (struct bnxt_qplib_swqe *wqe) +{ +/* Need unconditional fence for non-wire memory opcode +* to work as expected. +*/ +if (wqe->type ==BNXT_QPLIB_SWQE_TYPE_LOCAL_INV || + wqe->type ==BNXT_QPLIB_SWQE_TYPE_FAST_REG_MR || + wqe->type ==BNXT_QPLIB_SWQE_TYPE_REG_MR || + wqe->type ==BNXT_QPLIB_SWQE_TYPE_BIND_MW ) + wqe->flags |=BNXT_QPLIB_SWQE_FLAGS_UC_FENCE ; +} +int bnxt_re_post_send (struct ib_qp *ib_qp,const struct ib_send_wr *wr,const struct ib_send_wr **bad_wr) {
@@ -2805,8 +2806,11 @@ int bnxt_re_post_send(struct ib_qp *ib_q rc = -EINVAL ; goto bad; } -if (!rc) +if (!rc) { +if (!bnxt_qplib_is_chip_gen_p5_p7 (qp->rdev->chip_ctx)) +bnxt_re_legacy_set_uc_fence (&wqe); rc =bnxt_qplib_post_send (&qp->qplib_qp, &wqe); + } bad:if (rc) { ibdev_err(&qp->rdev->ibdev,
Greg Kroah-Hartman
maintainerPATCH 207/208 tracing: probes: Fix to zero initialize a local variable
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
commit 0add699ad068d26e5b1da9ff28b15461fc4005df upstream.
Fix to initialize 'val' local variable with zero.
Dan reported that Smatch static code checker reports an error that a local 'val' variable needs to be initialized. Actually, the 'val' is expected to be initialized by FETCH_OP_ARG in the same loop, but it is not obvious. So initialize it with zero.
--- kernel/trace/trace_probe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace_probe.c +1 -1
@@ -843,7 +843,7 @@ out:void store_trace_entry_data (void *edata,struct trace_probe *tp,struct pt_regs *regs) {struct probe_entry_arg *earg = tp->entry_arg; -unsigned long val; +unsigned long val =0 ;int i;if (!earg)
Greg Kroah-Hartman
maintainerPATCH 208/208 task_work: make TWA_NMI_CURRENT handling conditional on IRQ_WORK
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit cec6937dd1aae1b38d147bd190cb895d06cf96d0 upstream.
The TWA_NMI_CURRENT handling very much depends on IRQ_WORK, but that isn't universally enabled everywhere.
Maybe the IRQ_WORK infrastructure should just be unconditional - x86 ends up indirectly enabling it through unconditionally enabling PERF_EVENTS, for example. But it also gets enabled by having SMP support, or even if you just have PRINTK enabled.
But in the meantime TWA_NMI_CURRENT causes tons of build failures on various odd minimal configs. Which did show up in linux-next, but despite that nobody bothered to fix it or even inform me until -rc1 was out.
--- kernel/task_work.c | 6 ++++++ 1 file changed, 6 insertions(+)
kernel/task_work.c +6 -0
@@ -6,12 +6,14 @@static struct callback_head work_exited;/* all we need is ->next == NULL */ +#ifdef CONFIG_IRQ_WORK static void task_work_set_notify_irq (struct irq_work *entry) {test_and_set_tsk_thread_flag (current,TIF_NOTIFY_RESUME ); } static DEFINE_PER_CPU(struct irq_work, irq_work_NMI_resume) =IRQ_WORK_INIT_HARD (task_work_set_notify_irq); +#endif /** * task_work_add - ask the @task to execute @work->func()
@@ -59,6 +61,8 @@ int task_work_add(struct task_struct *taif (notify ==TWA_NMI_CURRENT ) {if (WARN_ON_ONCE (task != current))return -EINVAL ; +if (!IS_ENABLED (CONFIG_IRQ_WORK )) +return -EINVAL ; }else {/* * Record the work call stack in order to print it in KASAN
@@ -92,9 +96,11 @@ int task_work_add(struct task_struct *tacase TWA_SIGNAL_NO_IPI :__set_notify_signal (task);break ; +#ifdef CONFIG_IRQ_WORK case TWA_NMI_CURRENT :irq_work_queue (this_cpu_ptr (&irq_work_NMI_resume));break ; +#endif default :WARN_ON_ONCE (1 );break ;
Quoted 8 lines · On Mon, 28 Oct 2024 07:23:00 +0100 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.6.59 release. There are 208 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Oct 2024 06:22:39 +0000. Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64:
Thanks!
Cheers,
Miguel
Hi Greg
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.59 release. There are 208 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Oct 2024 06:22:39 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.59-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
6.6.59-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64) arch linux)
[ 0.000000] Linux version 6.6.59-rc1rv
(takeshi@ThinkPadX1Gen10J0764) (gcc (GCC) 14.2.1 20240910, GNU ld (GNU Binutils) 2.43.0) #1 SMP PREEMPT_DYNAMIC Mon Oct 28 20:41:12 JST 2024
Thanks
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.59 release. There are 208 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.59 release. There are 208 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Oct 2024 06:22:39 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.59-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 6.6.59-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: 02900c91433b84926f38cf08dbcf877e84697d21
* git describe: v6.6.57-334-g02900c91433b
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.6.y/build/v6.6.57-334-g02900c91433b
## Test Regressions (compared to v6.6.57-125-g6cb44f821fff)
## Metric Regressions (compared to v6.6.57-125-g6cb44f821fff)
## Test Fixes (compared to v6.6.57-125-g6cb44f821fff)
## Metric Fixes (compared to v6.6.57-125-g6cb44f821fff)
## Test result summary
total: 111228, pass: 91063, fail: 1276, skip: 18810, xfail: 79
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 129 total, 129 passed, 0 failed
* arm64: 41 total, 41 passed, 0 failed
* i386: 28 total, 26 passed, 2 failed
* mips: 26 total, 25 passed, 1 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 36 total, 35 passed, 1 failed
* riscv: 19 total, 19 passed, 0 failed
* s390: 14 total, 13 passed, 1 failed
* sh: 10 total, 10 passed, 0 failed
* sparc: 7 total, 7 passed, 0 failed
* x86_64: 33 total, 33 passed, 0 failed
## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-watchdog
* kselftest-x86
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org
Hello,
Quoted 7 lines · On Mon, 28 Oct 2024 07:23:00 +0100 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.6.59 release. There are 208 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Oct 2024 06:22:39 +0000. Anything received after that time might be too late.
This rc kernel passes DAMON functionality test[1] on my test machine. Attaching the test results summary below. Please note that I retrieved the kernel from linux-stable-rc tree[2].
[1] https://github.com/damonitor/damon-tests/tree/next/corr
[2] 02900c91433b ("Linux 6.6.59-rc1")
Thanks,
SJ
[...]
---
ok 1 selftests: damon: debugfs_attrs.sh
ok 2 selftests: damon: debugfs_schemes.sh
ok 3 selftests: damon: debugfs_target_ids.sh
ok 4 selftests: damon: debugfs_empty_targets.sh
ok 5 selftests: damon: debugfs_huge_count_read_write.sh
ok 6 selftests: damon: debugfs_duplicate_context_creation.sh
ok 7 selftests: damon: debugfs_rm_non_contexts.sh
ok 8 selftests: damon: sysfs.sh
ok 9 selftests: damon: sysfs_update_removed_scheme_dir.sh
ok 10 selftests: damon: reclaim.sh
ok 11 selftests: damon: lru_sort.sh
ok 1 selftests: damon-tests: kunit.sh
ok 2 selftests: damon-tests: huge_count_read_write.sh
ok 3 selftests: damon-tests: buffer_overflow.sh
ok 4 selftests: damon-tests: rm_contexts.sh
ok 5 selftests: damon-tests: record_null_deref.sh
ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh
ok 8 selftests: damon-tests: damo_tests.sh
ok 9 selftests: damon-tests: masim-record.sh
ok 10 selftests: damon-tests: build_i386.sh
ok 11 selftests: damon-tests: build_arm64.sh # SKIP
ok 12 selftests: damon-tests: build_m68k.sh # SKIP
ok 13 selftests: damon-tests: build_i386_idle_flag.sh
ok 14 selftests: damon-tests: build_i386_highpte.sh
ok 15 selftests: damon-tests: build_nomemcg.sh
[33m
[92mPASS [39m
Am 28.10.2024 um 07:23 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.6.59 release. There are 208 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.59 release. There are 208 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Oct 2024 06:22:39 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.59-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Thanks,
Hardik
Hi Greg,
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.59 release. There are 208 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
No problems seen on x86_64 and aarch64 with our testing.
Thanks,
Harshit
Quoted 14 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.59 release. There are 208 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Oct 2024 06:22:39 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.59-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.
Quoted 5 lines
thanks,
greg k-h
-------------
Hi,
Please find the KernelCI report below :-
OVERVIEW
Builds: 24 passed, 0 failed
Boot tests: 48 passed, 0 failed
CI systems: maestro
REVISION
Commit
name: 6.6.59-rc1
hash: ef2696e271126e75fbbeba63c906736842815c4e
Checked out from
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.yBUILDS
No new build failures found
BOOT TESTS
No new boot failures found
See complete and up-to-date report at:
https://kcidb.kernelci.org/d/revision/revision?orgId=1&var-datasource=edquppk2ghfcwc&var-git_commit_hash=ef2696e271126e75fbbeba63c906736842815c4e&var-patchset_hash=&var-origin=maestro&var-build_architecture=All&var-build_config_name=All&var-test_path=boot
Thanks,
KernelCI team
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.59 release. There are 208 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Oct 2024 06:22:39 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.59-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).