6.12.46-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.12.46-rc1 review
This is the start of the stable review cycle for the 6.12.46 release. There are 175 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 09 Sep 2025 19:55:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.46-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.46-rc1
Qiu-ji Chen <[email protected]>
dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
Yu Kuai <[email protected]>
md/raid1: fix data lost for writemostly rdev
Radim Krčmář <[email protected]>
riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id
Radim Krčmář <[email protected]>
riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG
Radim Krčmář <[email protected]>
riscv: use lw when reading int cpu in asm_per_cpu
Radim Krčmář <[email protected]>
riscv: use lw when reading int cpu in new_vmalloc_check
Nathan Chancellor <[email protected]>
riscv: Only allow LTO with CMODEL_MEDANY
Anup Patel <[email protected]>
ACPI: RISC-V: Fix FFH_CPPC_CSR error handling
Li Nan <[email protected]>
md: prevent incorrect update of resync/recovery offset
zhang jiao <[email protected]>
tools: gpio: remove the include directory on make clean
Colin Ian King <[email protected]>
drm/amd/amdgpu: Fix missing error return on kzalloc failure
Ian Rogers <[email protected]>
perf bpf-utils: Harden get_bpf_prog_info_linear
Ian Rogers <[email protected]>
perf bpf-utils: Constify bpil_array_desc
Ian Rogers <[email protected]>
perf bpf-event: Fix use-after-free in synthesis
Michael Walle <[email protected]>
drm/bridge: ti-sn65dsi86: fix REFCLK setting
Larisa Grigore <[email protected]>
spi: spi-fsl-lpspi: Clear status register after disabling the module
Larisa Grigore <[email protected]>
spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
Larisa Grigore <[email protected]>
spi: spi-fsl-lpspi: Set correct chip-select polarity bit
Larisa Grigore <[email protected]>
spi: spi-fsl-lpspi: Fix transmissions when using CONT
Ming Lei <[email protected]>
scsi: sr: Reinstate rotational media flag
Christoph Hellwig <[email protected]>
block: add a queue_limits_commit_update_frozen helper
Vadim Pasternak <[email protected]>
hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM
David Arcari <[email protected]>
platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID
Antheas Kapenekakis <[email protected]>
platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk
Wentao Liang <[email protected]>
pcmcia: Add error handling for add_interval() in do_validate_mem()
Chen Ni <[email protected]>
pcmcia: omap: Add missing check for platform_get_resource
Alex Deucher <[email protected]>
Revert "drm/amdgpu: Avoid extra evict-restore process."
Aaron Erhardt <[email protected]>
ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
Takashi Iwai <[email protected]>
ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
Miguel Ojeda <[email protected]>
rust: support Rust >= 1.91.0 target spec
Qiu-ji Chen <[email protected]>
dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
Nícolas F. R. A. Prado <[email protected]>
thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold
Sumanth Korikkar <[email protected]>
mm: fix accounting of memmap pages
Yeoreum Yun <[email protected]>
kunit: kasan_test: disable fortify string checker on kasan_strings() test
Dave Airlie <[email protected]>
nouveau: fix disabling the nonstall irq due to storm code
Li Qiong <[email protected]>
mm/slub: avoid accessing metadata when pointer is invalid in object_err()
Vlastimil Babka <[email protected]>
mm, slab: cleanup slab_bug() parameters
Hyesoo Yu <[email protected]>
mm: slub: call WARN() when detecting a slab corruption
Hyesoo Yu <[email protected]>
mm: slub: Print the broken data before restoring them
Su Yue <[email protected]>
md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb
Wang Liang <[email protected]>
net: fix NULL pointer dereference in l3mdev_l3_rcv
Wen Gong <[email protected]>
wifi: ath11k: update channel list in worker when wait flag is set
Wen Gong <[email protected]>
wifi: ath11k: update channel list in reg notifier instead reg worker
Ojaswin Mujoo <[email protected]>
ext4: avoid journaling sb update on error if journal is destroying
Ojaswin Mujoo <[email protected]>
ext4: define ext4_journal_destroy wrapper
Zheng Qixing <[email protected]>
md/raid1,raid10: strip REQ_NOWAIT from member bios
Yu Kuai <[email protected]>
md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT
Yu Kuai <[email protected]>
md/raid1,raid10: don't ignore IO flags
Jonas Gorski <[email protected]>
net: dsa: b53: do not enable EEE on bcm63xx
Russell King (Oracle) <[email protected]>
net: dsa: b53/bcm_sf2: implement .support_eee() method
Russell King (Oracle) <[email protected]>
net: dsa: provide implementation of .support_eee()
Russell King (Oracle) <[email protected]>
net: dsa: add hook to determine whether EEE is supported
Al Viro <[email protected]>
fs/fhandle.c: fix a race in call of has_locked_children()
Stefan Wahren <[email protected]>
microchip: lan865x: Fix LAN8651 autoloading
Stefan Wahren <[email protected]>
microchip: lan865x: Fix module autoloading
Lad Prabhakar <[email protected]>
net: pcs: rzn1-miic: Correct MODCTRL register offset
Vitaly Lifshits <[email protected]>
e1000e: fix heap overflow in e1000_set_eeprom
Makar Semyonov <[email protected]>
cifs: prevent NULL pointer dereference in UTF16 conversion
Stanislav Fort <[email protected]>
batman-adv: fix OOB read/write in network-coding decode
John Evans <[email protected]>
scsi: lpfc: Fix buffer free/clear order in deferred receive path
Christoffer Sandberg <[email protected]>
platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list
Ivan Lipski <[email protected]>
drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG
Alex Deucher <[email protected]>
drm/amdgpu: drop hw access in non-DC audio fini
Stefan Wahren <[email protected]>
net: ethernet: oa_tc6: Handle failure of spi_setup
Ming Yen Hsieh <[email protected]>
wifi: mt76: mt7925: fix the wrong bss cleanup for SAP
Nathan Chancellor <[email protected]>
wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data()
Ming Yen Hsieh <[email protected]>
wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete
Qianfeng Rong <[email protected]>
wifi: mwifiex: Initialize the chan_stats array to zero
Bjorn Andersson <[email protected]>
soc: qcom: mdt_loader: Deal with zero e_shentsize
Yin Tirui <[email protected]>
of_numa: fix uninitialized memory nodes causing kernel panic
wangzijie <[email protected]>
proc: fix missing pde_set_flags() for net proc files
Edward Adam Davis <[email protected]>
ocfs2: prevent release journal inode after journal shutdown
Ada Couprie Diaz <[email protected]>
kasan: fix GCC mem-intrinsic prefix with sw tags
Christian Loehle <[email protected]>
sched: Fix sched_numa_find_nth_cpu() if mask offline
yangshiguang <[email protected]>
mm: slub: avoid wake up kswapd in set_track_prepare
Gu Bowen <[email protected]>
mm: fix possible deadlock in kmemleak
Harry Yoo <[email protected]>
mm: move page table sync declarations to linux/pgtable.h
Sasha Levin <[email protected]>
mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
Harry Yoo <[email protected]>
x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings()
Jens Axboe <[email protected]>
io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU
Ma Ke <[email protected]>
pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
panfan <[email protected]>
arm64: ftrace: fix unreachable PLT for ftrace_caller in init_module with CONFIG_DYNAMIC_FTRACE
Miaoqian Lin <[email protected]>
ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
Karol Wachowski <[email protected]>
accel/ivpu: Prevent recovery work from being queued during device removal
Cryolitia PukNgae <[email protected]>
ALSA: usb-audio: Add mute TLV for playback volumes on some devices
Horatiu Vultur <[email protected]>
phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
Kuniyuki Iwashima <[email protected]>
selftest: net: Fix weird setsockopt() in bind_bhash.c.
Qingfang Deng <[email protected]>
ppp: fix memory leak in pad_compress_skb
Abin Joseph <[email protected]>
net: xilinx: axienet: Add error handling for RX metadata pointer retrieval
Wang Liang <[email protected]>
net: atm: fix memory leak in atm_register_sysfs when device_register fail
Eric Dumazet <[email protected]>
ax25: properly unshare skbs in ax25_kiss_rcv()
Alok Tiwari <[email protected]>
mctp: return -ENOPROTOOPT for unknown getsockopt options
Mahanta Jambigi <[email protected]>
net/smc: Remove validation of reserved bits in CLC Decline message
Dan Carpenter <[email protected]>
ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
Rosen Penev <[email protected]>
net: thunder_bgx: decrement cleanup index before use
Rosen Penev <[email protected]>
net: thunder_bgx: add a missing of_node_put
Dan Carpenter <[email protected]>
wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
Dan Carpenter <[email protected]>
wifi: libertas: cap SSID len in lbs_associate()
Dan Carpenter <[email protected]>
wifi: cw1200: cap SSID length in cw1200_do_join()
Ido Schimmel <[email protected]>
vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
Ido Schimmel <[email protected]>
vxlan: Rename FDB Tx lookup function
Ido Schimmel <[email protected]>
vxlan: Add RCU read-side critical sections in the Tx path
Ido Schimmel <[email protected]>
vxlan: Avoid unnecessary updates to FDB 'used' time
Ido Schimmel <[email protected]>
vxlan: Refresh FDB 'updated' time upon 'NTF_USE'
Radu Rendec <[email protected]>
net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE
Menglong Dong <[email protected]>
net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit()
Menglong Dong <[email protected]>
net: vxlan: use kfree_skb_reason() in vxlan_xmit()
Menglong Dong <[email protected]>
net: vxlan: make vxlan_set_mac() return drop reasons
Ido Schimmel <[email protected]>
vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
Menglong Dong <[email protected]>
net: vxlan: make vxlan_snoop() return drop reasons
Menglong Dong <[email protected]>
net: vxlan: add skb drop reasons to vxlan_rcv()
Menglong Dong <[email protected]>
net: tunnel: add pskb_inet_may_pull_reason() helper
Menglong Dong <[email protected]>
net: skb: add pskb_network_may_pull_reason() helper
Felix Fietkau <[email protected]>
net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
Christoph Paasch <[email protected]>
net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6
Rameshkumar Sundaram <[email protected]>
wifi: ath11k: fix group data packet drops during rekey
Alok Tiwari <[email protected]>
ixgbe: fix incorrect map used in eee linkmode
Zhen Ni <[email protected]>
i40e: Fix potential invalid access when MAC list is empty
Jacob Keller <[email protected]>
i40e: remove read access to debugfs files
Emil Tantilov <[email protected]>
idpf: set mac type when adding and removing MAC filters
Jacob Keller <[email protected]>
ice: fix NULL access of tx->in_use in ice_ll_ts_intr
Jeremy Kerr <[email protected]>
net: mctp: mctp_fraq_queue should take ownership of passed skb
Liu Jian <[email protected]>
net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
Sabrina Dubroca <[email protected]>
macsec: read MACSEC_SA_ATTR_PN with nla_get_uint
Sean Anderson <[email protected]>
net: macb: Fix tx_ptr_lock locking
Fabian Bläse <[email protected]>
icmp: fix icmp_ndo_send address translation for reply direction
Alok Tiwari <[email protected]>
bnxt_en: fix incorrect page count in RX aggr ring log
Jakub Kicinski <[email protected]>
selftests: drv-net: csum: fix interface name for remote host
Miaoqian Lin <[email protected]>
mISDN: Fix memory leak in dsp_hwec_enable()
Alok Tiwari <[email protected]>
xirc2ps_cs: fix register access when enabling FullDuplex
Eric Dumazet <[email protected]>
net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y
Florian Westphal <[email protected]>
netfilter: nft_flowtable.sh: re-run with random mtu sizes
Kuniyuki Iwashima <[email protected]>
Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
Ivan Pravdin <[email protected]>
Bluetooth: vhci: Prevent use-after-free by removing debugfs files early
Johannes Berg <[email protected]>
wifi: iwlwifi: uefi: check DSM item validity
Phil Sutter <[email protected]>
netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
Wang Liang <[email protected]>
netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm
Felix Fietkau <[email protected]>
wifi: mt76: fix linked list corruption
Felix Fietkau <[email protected]>
wifi: mt76: free pending offchannel tx frames on wcid cleanup
Felix Fietkau <[email protected]>
wifi: mt76: prevent non-offchannel mgmt tx during scan/roc
Harshit Mogalapalli <[email protected]>
wifi: mt76: mt7925: fix locking in mt7925_change_vif_links()
Duoming Zhou <[email protected]>
wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work
Dmitry Antipov <[email protected]>
wifi: cfg80211: fix use-after-free in cmp_bss()
Sai Krishna Potthuri <[email protected]>
mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up
Paul Alvin <[email protected]>
mmc: sdhci-of-arasan: Support for emmc hardware reset
Wentao Guan <[email protected]>
LoongArch: vDSO: Remove -nostdlib complier flag
Xi Ruoyao <[email protected]>
LoongArch: vDSO: Remove --hash-style=sysv
Fabio Porcedda <[email protected]>
net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition
Fabio Porcedda <[email protected]>
net: usb: qmi_wwan: fix Telit Cinterion FE990A name
Fabio Porcedda <[email protected]>
net: usb: qmi_wwan: fix Telit Cinterion FN990A name
Alan Stern <[email protected]>
HID: core: Harden s32ton() against conversion to 0 bits
Dmitry Torokhov <[email protected]>
HID: stop exporting hid_snto32()
Dmitry Torokhov <[email protected]>
HID: simplify snto32()
Marek Vasut <[email protected]>
arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC
Marek Vasut <[email protected]>
arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM
Markus Niebel <[email protected]>
arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off
Sungbae Yoo <[email protected]>
tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
Peter Robinson <[email protected]>
arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
Pei Xiao <[email protected]>
tee: fix memory leak in tee_dyn_shm_alloc_helper
Pei Xiao <[email protected]>
tee: fix NULL pointer dereference in tee_shm_put
Jiufei Xue <[email protected]>
fs: writeback: fix use-after-free in __mark_inode_dirty()
Johannes Thumshirn <[email protected]>
btrfs: zoned: skip ZONE FINISH of conventional zones
Piotr Zalewski <[email protected]>
drm/rockchip: vop2: make vp registers nonvolatile
Yang Li <[email protected]>
Bluetooth: hci_sync: Avoid adding default advertising on startup
Shinji Nomoto <[email protected]>
cpupower: Fix a bug where the -t option of the set subcommand was not working.
Timur Kristóf <[email protected]>
drm/amd/display: Don't warn when missing DCE encoder caps
Lubomir Rintel <[email protected]>
cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
Huacai Chen <[email protected]>
LoongArch: Save LBT before FPU in setup_sigcontext()
Filipe Manana <[email protected]>
btrfs: avoid load/store tearing races when checking if an inode was logged
Filipe Manana <[email protected]>
btrfs: fix race between setting last_dir_index_offset and inode logging
Filipe Manana <[email protected]>
btrfs: fix race between logging inode and checking if it was logged before
Daniel Borkmann <[email protected]>
bpf: Fix oob access in cgroup local storage
Daniel Borkmann <[email protected]>
bpf: Move cgroup iterator helpers to bpf.h
Daniel Borkmann <[email protected]>
bpf: Move bpf map owner out of common struct
Daniel Borkmann <[email protected]>
bpf: Add cookie object to bpf maps
-------------
Diffstat:
Makefile | 4 +- .../dts/freescale/imx8mp-data-modul-edm-sbc.dts | 1 + .../arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi | 1 + .../freescale/imx8mp-tqma8mpql-mba8mp-ras314.dts | 13 +- .../dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts | 13 +- .../arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi | 22 ++++ .../boot/dts/rockchip/rk3399-pinebook-pro.dts | 1 + arch/arm64/include/asm/module.h | 1 + arch/arm64/include/asm/module.lds.h | 1 + arch/arm64/kernel/ftrace.c | 13 +- arch/arm64/kernel/module-plts.c | 12 +- arch/arm64/kernel/module.c | 11 ++ arch/loongarch/kernel/signal.c | 10 +- arch/loongarch/vdso/Makefile | 3 +- arch/riscv/Kconfig | 2 +- arch/riscv/include/asm/asm.h | 2 +- arch/riscv/kernel/entry.S | 2 +- arch/riscv/net/bpf_jit_comp64.c | 4 +- arch/x86/include/asm/pgtable_64_types.h | 3 + arch/x86/mm/init_64.c | 18 +++ block/blk-integrity.c | 4 +- block/blk-settings.c | 24 ++++ block/blk-zoned.c | 7 +- drivers/accel/ivpu/ivpu_drv.c | 2 +- drivers/accel/ivpu/ivpu_pm.c | 4 +- drivers/accel/ivpu/ivpu_pm.h | 2 +- drivers/acpi/arm64/iort.c | 4 +- drivers/acpi/riscv/cppc.c | 4 +- drivers/block/virtio_blk.c | 4 +- drivers/bluetooth/hci_vhci.c | 57 ++++++--- drivers/dma/mediatek/mtk-cqdma.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +- drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 5 - drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 5 - drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 5 - drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 5 - .../gpu/drm/amd/display/dc/dce/dce_link_encoder.c | 8 +- .../gpu/drm/amd/display/dc/dpp/dcn10/dcn10_dpp.c | 9 ++ .../gpu/drm/amd/display/dc/dpp/dcn10/dcn10_dpp.h | 2 + .../gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c | 1 + .../drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c | 72 +++++++++++ .../drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.h | 2 + .../drm/amd/display/dc/hwss/dcn314/dcn314_init.c | 1 + drivers/gpu/drm/amd/display/dc/inc/hw/dpp.h | 3 + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 11 ++ drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.c | 2 + drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c | 23 ++-- drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/fifo/priv.h | 2 + drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c | 1 + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 9 +- drivers/hid/hid-core.c | 74 +++++------ drivers/hid/hid-logitech-hidpp.c | 6 +- drivers/hwmon/mlxreg-fan.c | 5 +- drivers/isdn/mISDN/dsp_hwec.c | 6 +- drivers/md/md-bitmap.c | 6 +- drivers/md/md.c | 5 + drivers/md/raid1-10.c | 10 ++ drivers/md/raid1.c | 28 ++-- drivers/md/raid10.c | 20 ++- drivers/mmc/host/sdhci-of-arasan.c | 51 +++++++- drivers/net/dsa/b53/b53_common.c | 16 ++- drivers/net/dsa/b53/b53_priv.h | 1 + drivers/net/dsa/bcm_sf2.c | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/cadence/macb_main.c | 28 ++-- drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 20 +-- drivers/net/ethernet/intel/e1000e/ethtool.c | 10 +- drivers/net/ethernet/intel/i40e/i40e_client.c | 4 +- drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 123 +++--------------- drivers/net/ethernet/intel/ice/ice_main.c | 12 +- drivers/net/ethernet/intel/idpf/idpf_lib.c | 9 +- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 12 ++ drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 4 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 10 +- drivers/net/ethernet/microchip/lan865x/lan865x.c | 7 +- drivers/net/ethernet/oa_tc6.c | 3 +- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 10 ++ drivers/net/ethernet/xircom/xirc2ps_cs.c | 2 +- drivers/net/ipvlan/ipvlan_l3s.c | 1 - drivers/net/macsec.c | 8 +- drivers/net/pcs/pcs-rzn1-miic.c | 2 +- drivers/net/phy/mscc/mscc_ptp.c | 18 ++- drivers/net/ppp/ppp_generic.c | 6 +- drivers/net/usb/cdc_ncm.c | 7 + drivers/net/usb/qmi_wwan.c | 5 +- drivers/net/vxlan/vxlan_core.c | 122 +++++++++++------- drivers/net/vxlan/vxlan_mdb.c | 2 +- drivers/net/vxlan/vxlan_private.h | 4 +- drivers/net/wireless/ath/ath11k/core.c | 1 + drivers/net/wireless/ath/ath11k/core.h | 7 +- drivers/net/wireless/ath/ath11k/mac.c | 125 ++++++++++++++++-- drivers/net/wireless/ath/ath11k/reg.c | 107 +++++++++++----- drivers/net/wireless/ath/ath11k/reg.h | 3 +- drivers/net/wireless/ath/ath11k/wmi.h | 1 + .../wireless/broadcom/brcm80211/brcmfmac/btcoex.c | 6 +- drivers/net/wireless/intel/iwlwifi/fw/uefi.c | 6 + drivers/net/wireless/marvell/libertas/cfg.c | 9 +- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 5 +- drivers/net/wireless/marvell/mwifiex/main.c | 4 +- drivers/net/wireless/mediatek/mt76/mac80211.c | 4 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 2 +- drivers/net/wireless/mediatek/mt76/mt7925/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 +- drivers/net/wireless/mediatek/mt76/tx.c | 12 +- drivers/net/wireless/st/cw1200/sta.c | 2 +- drivers/of/of_numa.c | 5 +- drivers/pcmcia/omap_cf.c | 2 + drivers/pcmcia/rsrc_iodyn.c | 3 + drivers/pcmcia/rsrc_nonstatic.c | 4 +- drivers/platform/x86/amd/pmc/pmc-quirks.c | 14 ++ drivers/platform/x86/asus-nb-wmi.c | 2 - drivers/platform/x86/intel/tpmi_power_domains.c | 2 +- drivers/scsi/lpfc/lpfc_nvmet.c | 10 +- drivers/scsi/sd.c | 17 +-- drivers/scsi/sr.c | 19 +-- drivers/soc/qcom/mdt_loader.c | 12 +- drivers/spi/spi-fsl-lpspi.c | 24 ++-- drivers/tee/optee/ffa_abi.c | 4 +- drivers/tee/tee_shm.c | 14 +- drivers/thermal/mediatek/lvts_thermal.c | 50 ++++++-- fs/btrfs/btrfs_inode.h | 2 +- fs/btrfs/inode.c | 1 + fs/btrfs/tree-log.c | 78 +++++++---- fs/btrfs/zoned.c | 55 +++++--- fs/ext4/ext4.h | 3 +- fs/ext4/ext4_jbd2.h | 29 +++++ fs/ext4/super.c | 32 ++--- fs/fs-writeback.c | 9 +- fs/namespace.c | 18 ++- fs/ocfs2/inode.c | 3 + fs/proc/generic.c | 38 +++--- fs/smb/client/cifs_unicode.c | 3 + include/linux/blkdev.h | 2 + include/linux/bpf-cgroup.h | 5 - include/linux/bpf.h | 60 ++++++--- include/linux/hid.h | 1 - include/linux/io_uring_types.h | 12 +- include/linux/pgtable.h | 16 +++ include/linux/skbuff.h | 8 +- include/linux/vmalloc.h | 16 --- include/net/dropreason-core.h | 40 ++++++ include/net/dsa.h | 2 + include/net/ip_tunnels.h | 10 +- io_uring/msg_ring.c | 4 +- kernel/bpf/core.c | 50 +++++--- kernel/bpf/syscall.c | 19 ++- kernel/sched/topology.c | 2 + mm/kasan/kasan_test_c.c | 1 + mm/kmemleak.c | 27 +++- mm/slub.c | 142 +++++++++++++-------- mm/sparse-vmemmap.c | 5 - mm/sparse.c | 15 ++- mm/userfaultfd.c | 9 +- net/atm/resources.c | 6 +- net/ax25/ax25_in.c | 4 + net/batman-adv/network-coding.c | 7 +- net/bluetooth/hci_sync.c | 2 +- net/bluetooth/l2cap_sock.c | 3 + net/bridge/br_netfilter_hooks.c | 3 - net/core/gen_estimator.c | 2 + net/dsa/port.c | 16 +++ net/dsa/user.c | 8 ++ net/ipv4/devinet.c | 7 +- net/ipv4/icmp.c | 6 +- net/ipv6/ip6_icmp.c | 6 +- net/ipv6/tcp_ipv6.c | 32 +++-- net/mctp/af_mctp.c | 2 +- net/mctp/route.c | 35 ++--- net/netfilter/nf_conntrack_helper.c | 4 +- net/smc/smc_clc.c | 2 - net/smc/smc_ib.c | 3 + net/wireless/scan.c | 3 +- net/wireless/sme.c | 5 +- scripts/Makefile.kasan | 12 +- scripts/generate_rust_target.rs | 12 +- sound/pci/hda/patch_hdmi.c | 1 + sound/pci/hda/patch_realtek.c | 2 + sound/usb/mixer_quirks.c | 2 + tools/gpio/Makefile | 2 +- tools/perf/util/bpf-event.c | 39 ++++-- tools/perf/util/bpf-utils.c | 61 +++++---- tools/power/cpupower/utils/cpupower-set.c | 4 +- tools/testing/selftests/drivers/net/hw/csum.py | 4 +- tools/testing/selftests/net/bind_bhash.c | 4 +- .../selftests/net/netfilter/nft_flowtable.sh | 113 ++++++++++------ 187 files changed, 1784 insertions(+), 926 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/175 bpf: Add cookie object to bpf maps
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 12df58ad294253ac1d8df0c9bb9cf726397a671d ]
Add a cookie to BPF maps to uniquely identify BPF maps for the timespan when the node is up. This is different to comparing a pointer or BPF map id which could get rolled over and reused.
--- include/linux/bpf.h | 1 + kernel/bpf/syscall.c | 6 ++++++ 2 files changed, 7 insertions(+)
include/linux/bpf.h +1 -0
@@ -306,6 +306,7 @@ struct bpf_map {bool free_after_rcu_gp;atomic64_t sleepable_refcnt;s64 __percpu *elem_count; +u64 cookie;/* write-once */ };static inline const char *btf_field_type_name (enum btf_field_type type)
kernel/bpf/syscall.c +6 -0
@@ -35,6 +35,7 @@#include <linux/rcupdate_trace.h> #include <linux/memcontrol.h> #include <linux/trace_events.h> +#include <linux/cookie.h> #include <net/netfilter/nf_bpf_link.h> #include <net/netkit.h>
@@ -51,6 +52,7 @@#define BPF_OBJ_FLAG_MASK (BPF_F_RDONLY | BPF_F_WRONLY)DEFINE_PER_CPU (int, bpf_prog_active); +DEFINE_COOKIE (bpf_map_cookie);static DEFINE_IDR (prog_idr);static DEFINE_SPINLOCK (prog_idr_lock);static DEFINE_IDR (map_idr);
@@ -1360,6 +1362,10 @@ static int map_create(union bpf_attr *attr)if (err <0 ) goto free_map; +preempt_disable (); + map->cookie =gen_cookie_next (&bpf_map_cookie); +preempt_enable (); +atomic64_set (&map->refcnt,1 );atomic64_set (&map->usercnt,1 );mutex_init (&map->freeze_mutex);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 2/175 bpf: Move bpf map owner out of common struct
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit fd1c98f0ef5cbcec842209776505d9e70d8fcd53 ]
Given this is only relevant for BPF tail call maps, it is adding up space and penalizing other map types. We also need to extend this with further objects to track / compare to. Therefore, lets move this out into a separate structure and dynamically allocate it only for BPF tail call maps.
Stable-dep-of: abad3d0bad72 ("bpf: Fix oob access in cgroup local storage")
--- include/linux/bpf.h | 36 ++++++++++++++++++++++++------------ kernel/bpf/core.c | 35 ++++++++++++++++++----------------- kernel/bpf/syscall.c | 13 +++++++------ 3 files changed, 49 insertions(+), 35 deletions(-)
include/linux/bpf.h +24 -12
@@ -256,6 +256,18 @@ struct bpf_list_node_kern {void *owner; } __attribute__((aligned(8))); +/* 'Ownership' of program-containing map is claimed by the first program +* that is going to use this map or by the first program which FD is +* stored in the map to make sure that all callers and callees have the +* same prog type, JITed flag and xdp_has_frags flag. +*/ +struct bpf_map_owner { +enum bpf_prog_type type; +bool jited; +bool xdp_has_frags; +const struct btf_type *attach_func_proto; +}; +struct bpf_map {const struct bpf_map_ops *ops;struct bpf_map *inner_map_meta;
@@ -288,18 +300,8 @@ struct bpf_map {struct rcu_head rcu; };atomic64_t writecnt; -/* 'Ownership' of program-containing map is claimed by the first program -* that is going to use this map or by the first program which FD is -* stored in the map to make sure that all callers and callees have the -* same prog type, JITed flag and xdp_has_frags flag. -*/ -struct { -const struct btf_type *attach_func_proto; -spinlock_t lock; -enum bpf_prog_type type; -bool jited; -bool xdp_has_frags; - } owner; +spinlock_t owner_lock; +struct bpf_map_owner *owner;bool bypass_spec_v1;bool frozen;/* write-once; write-protected by freeze_mutex */ bool free_after_mult_rcu_gp;
@@ -1981,6 +1983,16 @@ static inline bool bpf_map_flags_access_ok(u32 access_flags) (BPF_F_RDONLY_PROG |BPF_F_WRONLY_PROG ); } +static inline struct bpf_map_owner *bpf_map_owner_alloc (struct bpf_map *map) +{ +return kzalloc (sizeof (*map->owner),GFP_ATOMIC ); +} + +static inline void bpf_map_owner_free (struct bpf_map *map) +{ +kfree (map->owner); +} +struct bpf_event_entry {struct perf_event *event;struct file *perf_file;
kernel/bpf/core.c +18 -17
@@ -2310,28 +2310,29 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, const struct bpf_prog *fp) {enum bpf_prog_type prog_type =resolve_prog_type (fp); -bool ret;struct bpf_prog_aux *aux = fp->aux; +bool ret = false;if (fp->kprobe_override) -return false; +return ret; -spin_lock (&map->owner.lock); -if (!map->owner.type) { -/* There's no owner yet where we could check for -* compatibility. -*/ - map->owner.type = prog_type; - map->owner.jited = fp->jited; - map->owner.xdp_has_frags = aux->xdp_has_frags; - map->owner.attach_func_proto = aux->attach_func_proto; +spin_lock (&map->owner_lock); +/* There's no owner yet where we could check for compatibility. */ +if (!map->owner) { + map->owner =bpf_map_owner_alloc (map); +if (!map->owner) + goto err; + map->owner->type = prog_type; + map->owner->jited = fp->jited; + map->owner->xdp_has_frags = aux->xdp_has_frags; + map->owner->attach_func_proto = aux->attach_func_proto; ret = true; }else { - ret = map->owner.type == prog_type && - map->owner.jited == fp->jited && - map->owner.xdp_has_frags == aux->xdp_has_frags; + ret = map->owner->type == prog_type && + map->owner->jited == fp->jited && + map->owner->xdp_has_frags == aux->xdp_has_frags;if (ret && - map->owner.attach_func_proto != aux->attach_func_proto) { + map->owner->attach_func_proto != aux->attach_func_proto) {switch (prog_type) {case BPF_PROG_TYPE_TRACING :case BPF_PROG_TYPE_LSM :
@@ -2344,8 +2345,8 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, } } } -spin_unlock (&map->owner.lock); - +err: +spin_unlock (&map->owner_lock);return ret; }
kernel/bpf/syscall.c +7 -6
@@ -767,6 +767,7 @@ static void bpf_map_free_deferred(struct work_struct *work)security_bpf_map_free (map);bpf_map_release_memcg (map); +bpf_map_owner_free (map);bpf_map_free (map); }
@@ -861,12 +862,12 @@ static void bpf_map_show_fdinfo(struct seq_file *m, struct file *filp)struct bpf_map *map = filp->private_data;u32 type =0 , jited =0 ; -if (map_type_contains_progs (map)) { -spin_lock (&map->owner.lock); - type = map->owner.type; - jited = map->owner.jited; -spin_unlock (&map->owner.lock); +spin_lock (&map->owner_lock); +if (map->owner) { + type = map->owner->type; + jited = map->owner->jited; } +spin_unlock (&map->owner_lock);seq_printf (m, "map_type:\t%u\n"
@@ -1369,7 +1370,7 @@ static int map_create(union bpf_attr *attr)atomic64_set (&map->refcnt,1 );atomic64_set (&map->usercnt,1 );mutex_init (&map->freeze_mutex); -spin_lock_init (&map->owner.lock); +spin_lock_init (&map->owner_lock); if (attr->btf_key_type_id || attr->btf_value_type_id ||/* Even the map's value is a kernel's struct,
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 3/175 bpf: Move cgroup iterator helpers to bpf.h
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 9621e60f59eae87eb9ffe88d90f24f391a1ef0f0 ]
Move them into bpf.h given we also need them in core code.
Stable-dep-of: abad3d0bad72 ("bpf: Fix oob access in cgroup local storage")
--- include/linux/bpf-cgroup.h | 5 ----- include/linux/bpf.h | 22 ++++++++++++++-------- 2 files changed, 14 insertions(+), 13 deletions(-)
include/linux/bpf-cgroup.h +0 -5
@@ -77,9 +77,6 @@ to_cgroup_bpf_attach_type(enum bpf_attach_type attach_type)extern struct static_key_false cgroup_bpf_enabled_key[MAX_CGROUP_BPF_ATTACH_TYPE ];#define cgroup_bpf_enabled (atype) static_branch_unlikely(&cgroup_bpf_enabled_key[atype]) -#define for_each_cgroup_storage_type (stype) \ - for (stype = 0; stype < MAX_BPF_CGROUP_STORAGE_TYPE; stype++) -struct bpf_cgroup_storage_map ;struct bpf_storage_buffer {
@@ -518,8 +515,6 @@ static inline int bpf_percpu_cgroup_storage_update(struct bpf_map *map,#define BPF_CGROUP_RUN_PROG_SETSOCKOPT (sock, level, optname, optval, optlen, \ kernel_optval) ({ 0; }) -#define for_each_cgroup_storage_type (stype) for (; false; ) -#endif /* CONFIG_CGROUP_BPF */ #endif /* _BPF_CGROUP_H */
include/linux/bpf.h +14 -8
@@ -205,6 +205,20 @@ enum btf_field_type { BPF_WORKQUEUE = (1 << 10), }; +enum bpf_cgroup_storage_type { +BPF_CGROUP_STORAGE_SHARED , +BPF_CGROUP_STORAGE_PERCPU , + __BPF_CGROUP_STORAGE_MAX +#define MAX_BPF_CGROUP_STORAGE_TYPE __BPF_CGROUP_STORAGE_MAX +}; + +#ifdef CONFIG_CGROUP_BPF +# define for_each_cgroup_storage_type (stype) \ + for (stype = 0; stype < MAX_BPF_CGROUP_STORAGE_TYPE; stype++) +#else +# define for_each_cgroup_storage_type (stype) for (; false; ) +#endif /* CONFIG_CGROUP_BPF */ +typedef void (*btf_dtor_kfunc_t )(void *);struct btf_field_kptr {
@@ -1028,14 +1042,6 @@ struct bpf_prog_offload {u32 jited_len; }; -enum bpf_cgroup_storage_type { -BPF_CGROUP_STORAGE_SHARED , -BPF_CGROUP_STORAGE_PERCPU , - __BPF_CGROUP_STORAGE_MAX -}; - -#define MAX_BPF_CGROUP_STORAGE_TYPE __BPF_CGROUP_STORAGE_MAX -/* The longest tracepoint has 12 args. * See include/trace/bpf_probe.h */
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 4/175 bpf: Fix oob access in cgroup local storage
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit abad3d0bad72a52137e0c350c59542d75ae4f513 ]
Lonial reported that an out-of-bounds access in cgroup local storage can be crafted via tail calls. Given two programs each utilizing a cgroup local storage with a different value size, and one program doing a tail call into the other. The verifier will validate each of the indivial programs just fine. However, in the runtime context the bpf_cg_run_ctx holds an bpf_prog_array_item which contains the BPF program as well as any cgroup local storage flavor the program uses. Helpers such as bpf_get_local_storage() pick this up from the runtime context:
ctx = container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx);
storage = ctx->prog_item->cgroup_storage[stype];
if (stype == BPF_CGROUP_STORAGE_SHARED)
ptr = &READ_ONCE(storage->buf)->data[0];
else
ptr = this_cpu_ptr(storage->percpu_buf);For the second program which was called from the originally attached one, this means bpf_get_local_storage() will pick up the former program's map, not its own. With mismatching sizes, this can result in an unintended out-of-bounds access.
To fix this issue, we need to extend bpf_map_owner with an array of storage_cookie[] to match on i) the exact maps from the original program if the second program was using bpf_get_local_storage(), or ii) allow the tail call combination if the second program was not using any of the cgroup local storage maps.
--- include/linux/bpf.h | 1 + kernel/bpf/core.c | 15 +++++++++++++++ 2 files changed, 16 insertions(+)
include/linux/bpf.h +1 -0
@@ -279,6 +279,7 @@ struct bpf_map_owner {enum bpf_prog_type type;bool jited;bool xdp_has_frags; +u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE ];const struct btf_type *attach_func_proto; };
kernel/bpf/core.c +15 -0
@@ -2311,7 +2311,9 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, {enum bpf_prog_type prog_type =resolve_prog_type (fp);struct bpf_prog_aux *aux = fp->aux; +enum bpf_cgroup_storage_type i;bool ret = false; +u64 cookie;if (fp->kprobe_override)return ret;
@@ -2326,11 +2328,24 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, map->owner->jited = fp->jited; map->owner->xdp_has_frags = aux->xdp_has_frags; map->owner->attach_func_proto = aux->attach_func_proto; +for_each_cgroup_storage_type (i) { + map->owner->storage_cookie[i] = + aux->cgroup_storage[i] ? + aux->cgroup_storage[i]->cookie :0 ; + } ret = true; }else { ret = map->owner->type == prog_type && map->owner->jited == fp->jited && map->owner->xdp_has_frags == aux->xdp_has_frags; +for_each_cgroup_storage_type (i) { +if (!ret) +break ; + cookie = aux->cgroup_storage[i] ? + aux->cgroup_storage[i]->cookie :0 ; + ret = map->owner->storage_cookie[i] == cookie || + !cookie; + }if (ret && map->owner->attach_func_proto != aux->attach_func_proto) {switch (prog_type) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 5/175 btrfs: fix race between logging inode and checking if it was logged before
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit ef07b74e1be56f9eafda6aadebb9ebba0743c9f0 ]
There's a race between checking if an inode was logged before and logging an inode that can cause us to mark an inode as not logged just after it was logged by a concurrent task:
1) We have inode X which was not logged before neither in the current transaction not in past transaction since the inode was loaded into memory, so it's ->logged_trans value is 0;
2) We are at transaction N;
3) Task A calls inode_logged() against inode X, sees that ->logged_trans is 0 and there is a log tree and so it proceeds to search in the log tree for an inode item for inode X. It doesn't see any, but before it sets ->logged_trans to N - 1...
3) Task B calls btrfs_log_inode() against inode X, logs the inode and sets ->logged_trans to N;
4) Task A now sets ->logged_trans to N - 1;
5) At this point anyone calling inode_logged() gets 0 (inode not logged) since ->logged_trans is greater than 0 and less than N, but our inode was really logged. As a consequence operations like rename, unlink and link that happen afterwards in the current transaction end up not updating the log when they should.
Fix this by ensuring inode_logged() only updates ->logged_trans in case the inode item is not found in the log tree if after tacking the inode's lock (spinlock struct btrfs_inode::lock) the ->logged_trans value is still zero, since the inode lock is what protects setting ->logged_trans at btrfs_log_inode().
--- fs/btrfs/tree-log.c | 36 ++++++++++++++++++++++++++++++------ 1 file changed, 30 insertions(+), 6 deletions(-)
fs/btrfs/tree-log.c +30 -6
@@ -3322,6 +3322,31 @@ int btrfs_free_log_root_tree(struct btrfs_trans_handle *trans,return 0 ; } +static bool mark_inode_as_not_logged (const struct btrfs_trans_handle *trans, +struct btrfs_inode *inode) +{ +bool ret = false; + +/* +* Do this only if ->logged_trans is still 0 to prevent races with +* concurrent logging as we may see the inode not logged when +* inode_logged() is called but it gets logged after inode_logged() did +* not find it in the log tree and we end up setting ->logged_trans to a +* value less than trans->transid after the concurrent logging task has +* set it to trans->transid. As a consequence, subsequent rename, unlink +* and link operations may end up not logging new names and removing old +* names from the log. +*/ +spin_lock (&inode->lock); +if (inode->logged_trans ==0 ) + inode->logged_trans = trans->transid -1 ; +else if (inode->logged_trans == trans->transid) + ret = true; +spin_unlock (&inode->lock); + +return ret; +} +/* * Check if an inode was logged in the current transaction. This correctly deals * with the case where the inode was logged but has a logged_trans of 0, which
@@ -3356,10 +3381,8 @@ static int inode_logged(const struct btrfs_trans_handle *trans,* transaction's ID, to avoid the search below in a future call in case * a log tree gets created after this. */ -if (!test_bit (BTRFS_ROOT_HAS_LOG_TREE , &inode->root->state)) { - inode->logged_trans = trans->transid -1 ; -return 0 ; - } +if (!test_bit (BTRFS_ROOT_HAS_LOG_TREE , &inode->root->state)) +return mark_inode_as_not_logged (trans, inode);/* * We have a log tree and the inode's logged_trans is 0. We can't tell
@@ -3413,8 +3436,7 @@ static int inode_logged(const struct btrfs_trans_handle *trans,* Set logged_trans to a value greater than 0 and less then the * current transaction to avoid doing the search in future calls. */ - inode->logged_trans = trans->transid -1 ; -return 0 ; +return mark_inode_as_not_logged (trans, inode); }/*
@@ -3422,7 +3444,9 @@ static int inode_logged(const struct btrfs_trans_handle *trans,* the current transacion's ID, to avoid future tree searches as long as * the inode is not evicted again. */ +spin_lock (&inode->lock); inode->logged_trans = trans->transid; +spin_unlock (&inode->lock);/* * If it's a directory, then we must set last_dir_index_offset to the
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 6/175 btrfs: fix race between setting last_dir_index_offset and inode logging
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 59a0dd4ab98970086fd096281b1606c506ff2698 ]
At inode_logged() if we find that the inode was not logged before we update its ->last_dir_index_offset to (u64)-1 with the goal that the next directory log operation will see the (u64)-1 and then figure out it must check what was the index of the last logged dir index key and update ->last_dir_index_offset to that key's offset (this is done in update_last_dir_index_offset()).
This however has a possibility for a time window where a race can happen and lead to directory logging skipping dir index keys that should be logged. The race happens like this:
1) Task A calls inode_logged(), sees ->logged_trans as 0 and then checks that the inode item was logged before, but before it sets the inode's ->last_dir_index_offset to (u64)-1...
2) Task B is at btrfs_log_inode() which calls inode_logged() early, and that has set ->last_dir_index_offset to (u64)-1;
3) Task B then enters log_directory_changes() which calls update_last_dir_index_offset(). There it sees ->last_dir_index_offset is (u64)-1 and that the inode was logged before (ctx->logged_before is true), and so it searches for the last logged dir index key in the log tree and it finds that it has an offset (index) value of N, so it sets ->last_dir_index_offset to N, so that we can skip index keys that are less than or equal to N (later at process_dir_items_leaf());
4) Task A now sets ->last_dir_index_offset to (u64)-1, undoing the update that task B just did;
5) Task B will now skip every index key when it enters process_dir_items_leaf(), since ->last_dir_index_offset is (u64)-1.
Fix this by making inode_logged() not touch ->last_dir_index_offset and initializing it to 0 when an inode is loaded (at btrfs_alloc_inode()) and then having update_last_dir_index_offset() treat a value of 0 as meaning we must check the log tree and update with the index of the last logged index key. This is fine since the minimum possible value for ->last_dir_index_offset is 1 (BTRFS_DIR_START_INDEX - 1 = 2 - 1 = 1). This also simplifies the management of ->last_dir_index_offset and now all accesses to it are done under the inode's log_mutex.
--- fs/btrfs/btrfs_inode.h | 2 +- fs/btrfs/inode.c | 1 + fs/btrfs/tree-log.c | 17 ++--------------- 3 files changed, 4 insertions(+), 16 deletions(-)
fs/btrfs/btrfs_inode.h +1 -1
@@ -247,7 +247,7 @@ struct btrfs_inode {u64 new_delalloc_bytes;/* * The offset of the last dir index key that was logged. -* This is used only for directories. +* This is used only for directories. Protected by 'log_mutex'. */ u64 last_dir_index_offset; };
fs/btrfs/inode.c +1 -0
@@ -7767,6 +7767,7 @@ struct inode *btrfs_alloc_inode(struct super_block *sb) ei->last_sub_trans =0 ; ei->logged_trans =0 ; ei->delalloc_bytes =0 ; +/* new_delalloc_bytes and last_dir_index_offset are in a union. */ ei->new_delalloc_bytes =0 ; ei->defrag_bytes =0 ; ei->disk_i_size =0 ;
fs/btrfs/tree-log.c +2 -15
@@ -3448,19 +3448,6 @@ static int inode_logged(const struct btrfs_trans_handle *trans, inode->logged_trans = trans->transid;spin_unlock (&inode->lock); -/* -* If it's a directory, then we must set last_dir_index_offset to the -* maximum possible value, so that the next attempt to log the inode does -* not skip checking if dir index keys found in modified subvolume tree -* leaves have been logged before, otherwise it would result in attempts -* to insert duplicate dir index keys in the log tree. This must be done -* because last_dir_index_offset is an in-memory only field, not persisted -* in the inode item or any other on-disk structure, so its value is lost -* once the inode is evicted. -*/ -if (S_ISDIR (inode->vfs_inode.i_mode)) - inode->last_dir_index_offset = (u64)-1 ; -return 1 ; }
@@ -4052,7 +4039,7 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans,/* * If the inode was logged before and it was evicted, then its -* last_dir_index_offset is (u64)-1, so we don't the value of the last index +* last_dir_index_offset is 0, so we don't know the value of the last index * key offset. If that's the case, search for it and update the inode. This * is to avoid lookups in the log tree every time we try to insert a dir index * key from a leaf changed in the current transaction, and to allow us to always
@@ -4068,7 +4055,7 @@ static int update_last_dir_index_offset(struct btrfs_inode *inode,lockdep_assert_held (&inode->log_mutex); -if (inode->last_dir_index_offset != (u64)-1 ) +if (inode->last_dir_index_offset !=0 )return 0 ;if (!ctx->logged_before) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 7/175 btrfs: avoid load/store tearing races when checking if an inode was logged
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 986bf6ed44dff7fbae7b43a0882757ee7f5ba21b ]
At inode_logged() we do a couple lockless checks for ->logged_trans, and these are generally safe except the second one in case we get a load or store tearing due to a concurrent call updating ->logged_trans (either at btrfs_log_inode() or later at inode_logged()).
In the first case it's safe to compare to the current transaction ID since once ->logged_trans is set the current transaction, we never set it to a lower value.
In the second case, where we check if it's greater than zero, we are prone to load/store tearing races, since we can have a concurrent task updating to the current transaction ID with store tearing for example, instead of updating with a single 64 bits write, to update with two 32 bits writes or four 16 bits writes. In that case the reading side at inode_logged() could see a positive value that does not match the current transaction and then return a false negative.
Fix this by doing the second check while holding the inode's spinlock, add some comments about it too. Also add the data_race() annotation to the first check to avoid any reports from KCSAN (or similar tools) and comment about it.
--- fs/btrfs/tree-log.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-)
fs/btrfs/tree-log.c +21 -4
@@ -3364,15 +3364,32 @@ static int inode_logged(const struct btrfs_trans_handle *trans,struct btrfs_key key;int ret; -if (inode->logged_trans == trans->transid) +/* +* Quick lockless call, since once ->logged_trans is set to the current +* transaction, we never set it to a lower value anywhere else. +*/ +if (data_race (inode->logged_trans) == trans->transid)return 1 ;/* -* If logged_trans is not 0, then we know the inode logged was not logged -* in this transaction, so we can return false right away. +* If logged_trans is not 0 and not trans->transid, then we know the +* inode was not logged in this transaction, so we can return false +* right away. We take the lock to avoid a race caused by load/store +* tearing with a concurrent btrfs_log_inode() call or a concurrent task +* in this function further below - an update to trans->transid can be +* teared into two 32 bits updates for example, in which case we could +* see a positive value that is not trans->transid and assume the inode +* was not logged when it was. */ -if (inode->logged_trans >0 ) +spin_lock (&inode->lock); +if (inode->logged_trans == trans->transid) { +spin_unlock (&inode->lock); +return 1 ; + }else if (inode->logged_trans >0 ) { +spin_unlock (&inode->lock);return 0 ; + } +spin_unlock (&inode->lock);/* * If no log tree was created for this root in this transaction, then
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 8/175 LoongArch: Save LBT before FPU in setup_sigcontext()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
[ Upstream commit 112ca94f6c3b3e0b2002a240de43c487a33e0234 ]
Now if preemption happens between protected_save_fpu_context() and protected_save_lbt_context(), FTOP context is lost. Because FTOP is saved by protected_save_lbt_context() but protected_save_fpu_context() disables TM before that. So save LBT before FPU in setup_sigcontext() to avoid this potential risk.
--- arch/loongarch/kernel/signal.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/loongarch/kernel/signal.c +5 -5
@@ -677,6 +677,11 @@ static int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc,for (i =1 ; i <32 ; i++) err |=__put_user (regs->regs[i], &sc->sc_regs[i]); +#ifdef CONFIG_CPU_HAS_LBT +if (extctx->lbt.addr) + err |=protected_save_lbt_context (extctx); +#endif +if (extctx->lasx.addr) err |=protected_save_lasx_context (extctx);else if (extctx->lsx.addr)
@@ -684,11 +689,6 @@ static int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc,else if (extctx->fpu.addr) err |=protected_save_fpu_context (extctx); -#ifdef CONFIG_CPU_HAS_LBT -if (extctx->lbt.addr) - err |=protected_save_lbt_context (extctx); -#endif -/* Set the "end" magic */ info = (struct sctx_info *)extctx->end.addr; err |=__put_user (0 , &info->magic);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 9/175 cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lubomir Rintel <[email protected]>
[ Upstream commit 4a73a36cb704813f588af13d9842d0ba5a185758 ]
This lets NetworkManager/ModemManager know that this is a modem and needs to be connected first.
--- drivers/net/usb/cdc_ncm.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/usb/cdc_ncm.c +7 -0
@@ -2088,6 +2088,13 @@ static const struct usb_device_id cdc_devs[] = { .driver_info = (unsigned long)&wwan_info, }, +/* Intel modem (label from OEM reads Fibocom L850-GL) */ + {USB_DEVICE_AND_INTERFACE_INFO (0x8087 ,0x095a , +USB_CLASS_COMM , + USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE), + .driver_info = (unsigned long)&wwan_info, + }, + /* DisplayLink docking stations */ { .match_flags = USB_DEVICE_ID_MATCH_INT_INFO | USB_DEVICE_ID_MATCH_VENDOR,
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 10/175 drm/amd/display: Dont warn when missing DCE encoder caps
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 8246147f1fbaed522b8bcc02ca34e4260747dcfb ]
On some GPUs the VBIOS just doesn't have encoder caps, or maybe not for every encoder.
This isn't really a problem and it's handled well, so let's not litter the logs with it.
--- drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c +4 -4
@@ -896,13 +896,13 @@ void dce110_link_encoder_construct( enc110->base.id, &bp_cap_info);/* Override features with DCE-specific values */ -if (BP_RESULT_OK == result) { +if (result ==BP_RESULT_OK ) { enc110->base.features.flags.bits.IS_HBR2_CAPABLE = bp_cap_info.DP_HBR2_EN; enc110->base.features.flags.bits.IS_HBR3_CAPABLE = bp_cap_info.DP_HBR3_EN; enc110->base.features.flags.bits.HDMI_6GB_EN = bp_cap_info.HDMI_6GB_EN; - }else { + }else if (result !=BP_RESULT_NORECORD ) {DC_LOG_WARNING ("%s: Failed to get encoder_cap_info from VBIOS with error code %d!\n" , __func__, result);
@@ -1798,13 +1798,13 @@ void dce60_link_encoder_construct( enc110->base.id, &bp_cap_info);/* Override features with DCE-specific values */ -if (BP_RESULT_OK == result) { +if (result ==BP_RESULT_OK ) { enc110->base.features.flags.bits.IS_HBR2_CAPABLE = bp_cap_info.DP_HBR2_EN; enc110->base.features.flags.bits.IS_HBR3_CAPABLE = bp_cap_info.DP_HBR3_EN; enc110->base.features.flags.bits.HDMI_6GB_EN = bp_cap_info.HDMI_6GB_EN; - }else { + }else if (result !=BP_RESULT_NORECORD ) {DC_LOG_WARNING ("%s: Failed to get encoder_cap_info from VBIOS with error code %d!\n" , __func__, result);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 11/175 cpupower: Fix a bug where the -t option of the set subcommand was not working.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shinji Nomoto <[email protected]>
[ Upstream commit b3eaf14f4c63fd6abc7b68c6d7a07c5680a6d8e5 ]
The set subcommand's -t option is documented as being available for boost configuration, but it was not actually functioning due to a bug in the option handling.
--- tools/power/cpupower/utils/cpupower-set.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/power/cpupower/utils/cpupower-set.c +2 -2
@@ -62,8 +62,8 @@ int cmd_set(int argc, char **argv) params.params =0 ;/* parameter parsing */ -while ((ret =getopt_long (argc, argv,"b:e:m:" , - set_opts,NULL )) !=-1 ) { +while ((ret =getopt_long (argc, argv,"b:e:m:t:" , + set_opts,NULL )) !=-1 ) {switch (ret) {case 'b' :if (params.perf_bias)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 12/175 Bluetooth: hci_sync: Avoid adding default advertising on startup
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Li <[email protected]>
[ Upstream commit de5d7d3f27ddd4046736f558a40e252ddda82013 ]
list_empty(&hdev->adv_instances) is always true during startup, so an advertising instance is added by default.
Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 dump_stack+0x18/0x24 hci_setup_ext_adv_instance_sync+0x17c/0x328 hci_powered_update_adv_sync+0xb4/0x12c hci_powered_update_sync+0x54/0x70 hci_power_on_sync+0xe4/0x278 hci_set_powered_sync+0x28/0x34 set_powered_sync+0x40/0x58 hci_cmd_sync_work+0x94/0x100 process_one_work+0x168/0x444 worker_thread+0x378/0x3f4 kthread+0x108/0x10c ret_from_fork+0x10/0x20
--- net/bluetooth/hci_sync.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bluetooth/hci_sync.c +1 -1
@@ -3354,7 +3354,7 @@ static int hci_powered_update_adv_sync(struct hci_dev *hdev)* advertising data. This also applies to the case * where BR/EDR was toggled during the AUTO_OFF phase. */ -if (hci_dev_test_flag (hdev,HCI_ADVERTISING ) || +if (hci_dev_test_flag (hdev,HCI_ADVERTISING ) &&list_empty (&hdev->adv_instances)) {if (ext_adv_capable (hdev)) { err =hci_setup_ext_adv_instance_sync (hdev,0x00 );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 13/175 drm/rockchip: vop2: make vp registers nonvolatile
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Piotr Zalewski <[email protected]>
[ Upstream commit a52dffaa46c2c5ff0b311c4dc1288581f7b9109e ]
Make video port registers nonvolatile. As DSP_CTRL register is written to twice due to gamma LUT enable bit which is set outside of the main DSP_CTRL initialization within atomic_enable (for rk356x case it is also necessary to always disable gamma LUT before writing a new LUT) there is a chance that DSP_CTRL value read-out in gamma LUT init/update code is not the one which was written by the preceding DSP_CTRL initialization code within atomic_enable. This might result in misconfigured DSP_CTRL which leads to no visual output[1]. Since DSP_CTRL write takes effect after VSYNC[1] the issue is not always present. When tested on Pinetab2 with kernel 6.14 it happenes only when DRM is compiled as a module[1]. In order to confirm that it is a timing issue I inserted 18ms udelay before vop2_crtc_atomic_try_set_gamma in atomic enable and compiled DRM as module - this has also fixed the issue.
[1] https://lore.kernel.org/linux-rockchip/[email protected]/
--- drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +5 -4
@@ -3153,12 +3153,13 @@ static int vop2_win_init(struct vop2 *vop2) }/* -* The window registers are only updated when config done is written. -* Until that they read back the old value. As we read-modify-write -* these registers mark them as non-volatile. This makes sure we read -* the new values from the regmap register cache. +* The window and video port registers are only updated when config +* done is written. Until that they read back the old value. As we +* read-modify-write these registers mark them as non-volatile. This +* makes sure we read the new values from the regmap register cache. */ static const struct regmap_range vop2_nonvolatile_range[] = { +regmap_reg_range (RK3568_VP0_CTRL_BASE ,RK3588_VP3_CTRL_BASE +255 ),regmap_reg_range (0x1000 ,0x23ff ), };
Signature · 1 line
2.50.1
Re: [PATCH 6.12 013/175] drm/rockchip: vop2: make vp registers nonvolatile
Quoted 2 lines · Greg Kroah-Hartman
6.12-stable review patch. If anyone has any objections, please let me know.
Hello,
Gamma LUT support in vop2 was added in 6.14[1] and even though this bug fix does not explicitly depend on vop2 gamma LUT code, the bug won't happen if gamma LUT is not implemented.
[1] https://lore.kernel.org/all/CAPM=9tw+ySbm80B=zHVhodMFoS_fqNw_v4yVURCv3cc9ukvYYg@mail.gmail.com/
Best regards, Piotr Zalewski
Greg Kroah-Hartman
maintainerRe: [PATCH 6.12 013/175] drm/rockchip: vop2: make vp registers nonvolatile
Quoted 5 lines · Piotr Zalewski
Quoted 2 lines · Greg Kroah-Hartman
6.12-stable review patch. If anyone has any objections, please let me know.
Quoted 7 lines
Hello,
Gamma LUT support in vop2 was added in 6.14[1] and even though this bug fix does not explicitly depend on vop2 gamma LUT code, the bug won't happen if gamma LUT is not implemented.
[1] https://lore.kernel.org/all/CAPM=9tw+ySbm80B=zHVhodMFoS_fqNw_v4yVURCv3cc9ukvYYg@mail.gmail.com/
Thanks for letting me know, I'll go drop this patch from the 6.12.y queue now.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 14/175 btrfs: zoned: skip ZONE FINISH of conventional zones
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <[email protected]>
[ Upstream commit f0ba0e7172a222ea6043b61ecd86723c46d7bcf2 ]
Don't call ZONE FINISH for conventional zones as this will result in I/O errors. Instead check if the zone that needs finishing is a conventional zone and if yes skip it.
Also factor out the actual handling of finishing a single zone into a helper function, as do_zone_finish() is growing ever bigger and the indentations levels are getting higher.
--- fs/btrfs/zoned.c | 55 ++++++++++++++++++++++++++++++------------------ 1 file changed, 35 insertions(+), 20 deletions(-)
fs/btrfs/zoned.c +35 -20
@@ -2186,6 +2186,40 @@ static void wait_eb_writebacks(struct btrfs_block_group *block_group)rcu_read_unlock (); } +static int call_zone_finish (struct btrfs_block_group *block_group, +struct btrfs_io_stripe *stripe) +{ +struct btrfs_device *device = stripe->dev; +const u64 physical = stripe->physical; +struct btrfs_zoned_device_info *zinfo = device->zone_info; +int ret; + +if (!device->bdev) +return 0 ; + +if (zinfo->max_active_zones ==0 ) +return 0 ; + +if (btrfs_dev_is_sequential (device, physical)) { +unsigned int nofs_flags; + + nofs_flags =memalloc_nofs_save (); + ret =blkdev_zone_mgmt (device->bdev,REQ_OP_ZONE_FINISH , + physical >>SECTOR_SHIFT , + zinfo->zone_size >>SECTOR_SHIFT ); +memalloc_nofs_restore (nofs_flags); + +if (ret) +return ret; + } + +if (!(block_group->flags &BTRFS_BLOCK_GROUP_DATA )) + zinfo->reserved_active_zones++; +btrfs_dev_clear_active_zone (device, physical); + +return 0 ; +} +static int do_zone_finish (struct btrfs_block_group *block_group,bool fully_written) {struct btrfs_fs_info *fs_info = block_group->fs_info;
@@ -2270,31 +2304,12 @@ static int do_zone_finish(struct btrfs_block_group *block_group, bool fully_writdown_read (&dev_replace->rwsem); map = block_group->physical_map;for (i =0 ; i < map->num_stripes; i++) { -struct btrfs_device *device = map->stripes[i].dev; -const u64 physical = map->stripes[i].physical; -struct btrfs_zoned_device_info *zinfo = device->zone_info; -unsigned int nofs_flags; - -if (!device->bdev) -continue ; - -if (zinfo->max_active_zones ==0 ) -continue ; - - nofs_flags =memalloc_nofs_save (); - ret =blkdev_zone_mgmt (device->bdev,REQ_OP_ZONE_FINISH , - physical >>SECTOR_SHIFT , - zinfo->zone_size >>SECTOR_SHIFT ); -memalloc_nofs_restore (nofs_flags); + ret =call_zone_finish (block_group, &map->stripes[i]);if (ret) {up_read (&dev_replace->rwsem);return ret; } - -if (!(block_group->flags &BTRFS_BLOCK_GROUP_DATA )) - zinfo->reserved_active_zones++; -btrfs_dev_clear_active_zone (device, physical); }up_read (&dev_replace->rwsem);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 15/175 fs: writeback: fix use-after-free in __mark_inode_dirty()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiufei Xue <[email protected]>
[ Upstream commit d02d2c98d25793902f65803ab853b592c7a96b29 ]
An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching.
CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1 ...... pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mark_inode_dirty+0x124/0x418 lr : __mark_inode_dirty+0x118/0x418 sp : ffffffc08c9dbbc0 ........ Call trace: __mark_inode_dirty+0x124/0x418 generic_update_time+0x4c/0x60 file_modified+0xcc/0xd0 ext4_buffered_write_iter+0x58/0x124 ext4_file_write_iter+0x54/0x704 vfs_write+0x1c0/0x308 ksys_write+0x74/0x10c __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x40/0xe4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x194/0x198
Root cause is:
systemd-random-seed kworker
----------------------------------------------------------------------___mark_inode_dirty inode_switch_wbs_work_fn
spin_lock(&inode->i_lock);
inode_attach_wb
locked_inode_to_wb_and_lock_list
get inode->i_wb
spin_unlock(&inode->i_lock);
spin_lock(&wb->list_lock)
spin_lock(&inode->i_lock)
inode_io_list_move_locked
spin_unlock(&wb->list_lock)
spin_unlock(&inode->i_lock)
spin_lock(&old_wb->list_lock)
inode_do_switch_wbs
spin_lock(&inode->i_lock)
inode->i_wb = new_wb
spin_unlock(&inode->i_lock)
spin_unlock(&old_wb->list_lock)
wb_put_many(old_wb, nr_switched)
cgwb_release
old wb released
wb_wakeup_delayed() accesses wb,
then trigger the use-after-free
issueFix this race condition by holding inode spinlock until wb_wakeup_delayed() finished.
--- fs/fs-writeback.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
fs/fs-writeback.c +5 -4
@@ -2572,10 +2572,6 @@ void __mark_inode_dirty(struct inode *in wakeup_bdi =inode_io_list_move_locked (inode, wb, dirty_list); -spin_unlock (&wb->list_lock); -spin_unlock (&inode->i_lock); -trace_writeback_dirty_inode_enqueue (inode); -/* * If this is the first dirty inode for this bdi, * we have to wake-up the corresponding bdi thread
@@ -2585,6 +2581,11 @@ void __mark_inode_dirty(struct inode *inif (wakeup_bdi && (wb->bdi->capabilities &BDI_CAP_WRITEBACK ))wb_wakeup_delayed (wb); + +spin_unlock (&wb->list_lock); +spin_unlock (&inode->i_lock); +trace_writeback_dirty_inode_enqueue (inode); +return ; } }
Greg Kroah-Hartman
maintainerPATCH 16/175 tee: fix NULL pointer dereference in tee_shm_put
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <[email protected]>
[ Upstream commit e4a718a3a47e89805c3be9d46a84de1949a98d5d ]
tee_shm_put have NULL pointer dereference:
__optee_disable_shm_cache -->
shm = reg_pair_to_ptr(...);//shm maybe return NULL
tee_shm_free(shm); -->
tee_shm_put(shm);//crashAdd check in tee_shm_put to fix it.
panic log:
Unable to handle kernel paging request at virtual address 0000000000100cca
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 [0000000000100cca] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] SMP CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- 6.6.0-39-generic #38 Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 10/26/2022 pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : tee_shm_put+0x24/0x188 lr : tee_shm_free+0x14/0x28
sp : ffff001f98f9faf0
x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000
x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048
x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88
x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff
x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003
x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101
x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca
Call trace: tee_shm_put+0x24/0x188 tee_shm_free+0x14/0x28 __optee_disable_shm_cache+0xa8/0x108 optee_shutdown+0x28/0x38 platform_shutdown+0x28/0x40 device_shutdown+0x144/0x2b0 kernel_power_off+0x3c/0x80 hibernate+0x35c/0x388 state_store+0x64/0x80 kobj_attr_store+0x14/0x28 sysfs_kf_write+0x48/0x60 kernfs_fop_write_iter+0x128/0x1c0 vfs_write+0x270/0x370 ksys_write+0x6c/0x100 __arm64_sys_write+0x20/0x30 invoke_syscall+0x4c/0x120 el0_svc_common.constprop.0+0x44/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x24/0x88 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x14c/0x15
--- drivers/tee/tee_shm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/tee/tee_shm.c +5 -1
@@ -560,9 +560,13 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id);*/ void tee_shm_put (struct tee_shm *shm) { -struct tee_device *teedev = shm->ctx->teedev; +struct tee_device *teedev;bool do_release = false; +if (!shm || !shm->ctx || !shm->ctx->teedev) +return ; + + teedev = shm->ctx->teedev;mutex_lock (&teedev->mutex);if (refcount_dec_and_test (&shm->refcount)) {/*
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 17/175 tee: fix memory leak in tee_dyn_shm_alloc_helper
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <[email protected]>
[ Upstream commit 50a74d0095cd23d2012133e208df45a298868870 ]
When shm_register() fails in tee_dyn_shm_alloc_helper(), the pre-allocated pages array is not freed, resulting in a memory leak.
--- drivers/tee/tee_shm.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/tee/tee_shm.c +5 -3
@@ -230,7 +230,7 @@ int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align, pages =kcalloc (nr_pages,sizeof (*pages),GFP_KERNEL );if (!pages) { rc = -ENOMEM ; - goto err; + goto err_pages; }for (i =0 ; i < nr_pages; i++)
@@ -243,11 +243,13 @@ int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align, rc =shm_register (shm->ctx, shm, pages, nr_pages, (unsigned long )shm->kaddr);if (rc) - goto err; + goto err_kfree; }return 0 ; -err: +err_kfree: +kfree (pages); +err_pages:free_pages_exact (shm->kaddr, shm->size); shm->kaddr =NULL ;return rc;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 18/175 arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Robinson <[email protected]>
[ Upstream commit d1f9c497618dece06a00e0b2995ed6b38fafe6b5 ]
As described in the pinebookpro_v2.1_mainboard_schematic.pdf page 10, he SPI Flash's VCC connector is connected to VCC_3V0 power source.
This fixes the following warning:
spi-nor spi1.0: supply vcc not found, using dummy regulator
--- arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +1 -0
@@ -966,6 +966,7 @@ spiflash: flash@0 { reg = <0>; m25p,fast-read; spi-max-frequency = <10000000>; + vcc-supply = <&vcc_3v0>; }; };
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 19/175 tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sungbae Yoo <[email protected]>
[ Upstream commit 75dbd4304afe574fcfc4118a5b78776a9f48fdc4 ]
Fixes optee_ffa_api_is_compatbile() to optee_ffa_api_is_compatible() because compatbile is a typo of compatible.
--- drivers/tee/optee/ffa_abi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/tee/optee/ffa_abi.c +2 -2
@@ -657,7 +657,7 @@ static int optee_ffa_do_call_with_arg(struct tee_context *ctx,* with a matching configuration. */ -static bool optee_ffa_api_is_compatbile (struct ffa_device *ffa_dev, +static bool optee_ffa_api_is_compatible (struct ffa_device *ffa_dev,const struct ffa_ops *ops) {const struct ffa_msg_ops *msg_ops = ops->msg_ops;
@@ -908,7 +908,7 @@ static int optee_ffa_probe(struct ffa_device *ffa_dev) ffa_ops = ffa_dev->ops; notif_ops = ffa_ops->notifier_ops; -if (!optee_ffa_api_is_compatbile (ffa_dev, ffa_ops)) +if (!optee_ffa_api_is_compatible (ffa_dev, ffa_ops))return -EINVAL ; if (!optee_ffa_exchange_caps(ffa_dev, ffa_ops, &sec_caps,
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 20/175 arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Niebel <[email protected]>
[ Upstream commit 5245dc5ff9b1f6c02ef948f623432805ea148fca ]
Fix SD card removal caused by automatic LDO5 power off after boot:
LDO5: disabling
mmc1: card 59b4 removed
EXT4-fs (mmcblk1p2): shut down requested (2)
Aborting journal on device mmcblk1p2-8.
JBD2: I/O error when updating journal superblock for mmcblk1p2-8.
To prevent this, add vqmmc regulator for USDHC, using a GPIO-controlled regulator that is supplied by LDO5. Since this is implemented on SoM but used on baseboards with SD-card interface, implement the functionality on SoM part and optionally enable it on baseboards if needed.
--- .../imx8mp-tqma8mpql-mba8mp-ras314.dts | 13 ++++++----- .../freescale/imx8mp-tqma8mpql-mba8mpxl.dts | 13 ++++++----- .../boot/dts/freescale/imx8mp-tqma8mpql.dtsi | 22 +++++++++++++++++++ 3 files changed, 36 insertions(+), 12 deletions(-)
arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mp-ras314.dts +7 -6
@@ -467,6 +467,10 @@ &pwm4 { status = "okay"; }; +®_usdhc2_vqmmc { + status = "okay"; +}; + &sai5 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_sai5>;
@@ -876,8 +880,7 @@ pinctrl_usdhc2: usdhc2grp { <MX8MP_IOMUXC_SD2_DATA0__USDHC2_DATA0 0x1d2>, <MX8MP_IOMUXC_SD2_DATA1__USDHC2_DATA1 0x1d2>, <MX8MP_IOMUXC_SD2_DATA2__USDHC2_DATA2 0x1d2>, - <MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3 0x1d2>, - <MX8MP_IOMUXC_GPIO1_IO04__USDHC2_VSELECT 0xc0>; + <MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3 0x1d2>; }; pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
@@ -886,8 +889,7 @@ pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp { <MX8MP_IOMUXC_SD2_DATA0__USDHC2_DATA0 0x1d4>, <MX8MP_IOMUXC_SD2_DATA1__USDHC2_DATA1 0x1d4>, <MX8MP_IOMUXC_SD2_DATA2__USDHC2_DATA2 0x1d4>, - <MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3 0x1d4>, - <MX8MP_IOMUXC_GPIO1_IO04__USDHC2_VSELECT 0xc0>; + <MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3 0x1d4>; }; pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
@@ -896,8 +898,7 @@ pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp { <MX8MP_IOMUXC_SD2_DATA0__USDHC2_DATA0 0x1d4>, <MX8MP_IOMUXC_SD2_DATA1__USDHC2_DATA1 0x1d4>, <MX8MP_IOMUXC_SD2_DATA2__USDHC2_DATA2 0x1d4>, - <MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3 0x1d4>, - <MX8MP_IOMUXC_GPIO1_IO04__USDHC2_VSELECT 0xc0>; + <MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3 0x1d4>; }; pinctrl_usdhc2_gpio: usdhc2-gpiogrp {
arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts +7 -6
@@ -603,6 +603,10 @@ &pwm3 { status = "okay"; }; +®_usdhc2_vqmmc { + status = "okay"; +}; + &sai3 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_sai3>;
@@ -982,8 +986,7 @@ pinctrl_usdhc2: usdhc2grp { <MX8MP_IOMUXC_SD2_DATA0__USDHC2_DATA0 0x1d2>, <MX8MP_IOMUXC_SD2_DATA1__USDHC2_DATA1 0x1d2>, <MX8MP_IOMUXC_SD2_DATA2__USDHC2_DATA2 0x1d2>, - <MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3 0x1d2>, - <MX8MP_IOMUXC_GPIO1_IO04__USDHC2_VSELECT 0xc0>; + <MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3 0x1d2>; }; pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
@@ -992,8 +995,7 @@ pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp { <MX8MP_IOMUXC_SD2_DATA0__USDHC2_DATA0 0x1d4>, <MX8MP_IOMUXC_SD2_DATA1__USDHC2_DATA1 0x1d4>, <MX8MP_IOMUXC_SD2_DATA2__USDHC2_DATA2 0x1d4>, - <MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3 0x1d4>, - <MX8MP_IOMUXC_GPIO1_IO04__USDHC2_VSELECT 0xc0>; + <MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3 0x1d4>; }; pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
@@ -1002,8 +1004,7 @@ pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp { <MX8MP_IOMUXC_SD2_DATA0__USDHC2_DATA0 0x1d4>, <MX8MP_IOMUXC_SD2_DATA1__USDHC2_DATA1 0x1d4>, <MX8MP_IOMUXC_SD2_DATA2__USDHC2_DATA2 0x1d4>, - <MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3 0x1d4>, - <MX8MP_IOMUXC_GPIO1_IO04__USDHC2_VSELECT 0xc0>; + <MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3 0x1d4>; }; pinctrl_usdhc2_gpio: usdhc2-gpiogrp {
arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi +22 -0
@@ -24,6 +24,20 @@ reg_vcc3v3: regulator-vcc3v3 { regulator-max-microvolt = <3300000>; regulator-always-on; }; + + reg_usdhc2_vqmmc: regulator-usdhc2-vqmmc { + compatible = "regulator-gpio"; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_reg_usdhc2_vqmmc>; + regulator-name = "V_SD2"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; + gpios = <&gpio1 4 GPIO_ACTIVE_HIGH>; + states = <1800000 0x1>, + <3300000 0x0>; + vin-supply = <&ldo5_reg>; + status = "disabled"; + }; }; &A53_0 {
@@ -179,6 +193,10 @@ m24c64: eeprom@57 { }; }; +&usdhc2 { + vqmmc-supply = <®_usdhc2_vqmmc>; +}; + &usdhc3 { pinctrl-names = "default", "state_100mhz", "state_200mhz"; pinctrl-0 = <&pinctrl_usdhc3>;
@@ -228,6 +246,10 @@ pinctrl_reg_usdhc2_vmmc: regusdhc2vmmcgrp { fsl,pins = <MX8MP_IOMUXC_SD2_RESET_B__GPIO2_IO19 0x10>; }; + pinctrl_reg_usdhc2_vqmmc: regusdhc2vqmmcgrp { + fsl,pins = <MX8MP_IOMUXC_GPIO1_IO04__GPIO1_IO04 0xc0>; + }; + pinctrl_usdhc3: usdhc3grp { fsl,pins = <MX8MP_IOMUXC_NAND_WE_B__USDHC3_CLK 0x194>, <MX8MP_IOMUXC_NAND_WP_B__USDHC3_CMD 0x1d4>,
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 21/175 arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit c53cf8ce3bfe1309cb4fd4d74c5be27c26a86e52 ]
Add missing microSD slot vqmmc-supply property, otherwise the kernel might shut down LDO5 regulator and that would power off the microSD card slot, possibly while it is in use. Add the property to make sure the kernel is aware of the LDO5 regulator which supplies the microSD slot and keeps the LDO5 enabled.
--- arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi +1 -0
@@ -609,6 +609,7 @@ &usdhc2 { pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>; cd-gpios = <&gpio2 12 GPIO_ACTIVE_LOW>; vmmc-supply = <®_usdhc2_vmmc>; + vqmmc-supply = <&ldo5>; bus-width = <4>; status = "okay"; };
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 22/175 arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 80733306290f6d2e05f0632e5d3e98cd16105c3c ]
Add missing microSD slot vqmmc-supply property, otherwise the kernel might shut down LDO5 regulator and that would power off the microSD card slot, possibly while it is in use. Add the property to make sure the kernel is aware of the LDO5 regulator which supplies the microSD slot and keeps the LDO5 enabled.
--- arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts +1 -0
@@ -555,6 +555,7 @@ &usdhc2 { pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>; cd-gpios = <&gpio2 12 GPIO_ACTIVE_LOW>; vmmc-supply = <®_usdhc2_vmmc>; + vqmmc-supply = <&ldo5>; bus-width = <4>; status = "okay"; };
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 23/175 HID: simplify snto32()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit ae9b956cb26c0fd5a365629f2d723ab2fb14df79 ]
snto32() does exactly what sign_extend32() does, but handles potentially malformed data coming from the device. Keep the checks, but then call sign_extend32() to perform the actual conversion.
Stable-dep-of: a6b87bfc2ab5 ("HID: core: Harden s32ton() against conversion to 0 bits")
--- drivers/hid/hid-core.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
drivers/hid/hid-core.c +2 -9
@@ -1318,9 +1318,7 @@ int hid_open_report(struct hid_device *device)EXPORT_SYMBOL_GPL (hid_open_report);/* -* Convert a signed n-bit integer to signed 32-bit integer. Common -* cases are done through the compiler, the screwed things has to be -* done by hand. +* Convert a signed n-bit integer to signed 32-bit integer. */ static s32 snto32 (__u32 value,unsigned n)
@@ -1331,12 +1329,7 @@ static s32 snto32(__u32 value, unsigned n)if (n >32 ) n =32 ; -switch (n) { -case 8 :return ((__s8 )value); -case 16 :return ((__s16 )value); -case 32 :return ((__s32 )value); - } -return value & (1 << (n -1 )) ? value | (~0U << n) : value; +return sign_extend32 (value, n -1 ); }s32 hid_snto32 (__u32 value,unsigned n)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 24/175 HID: stop exporting hid_snto32()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit c653ffc283404a6c1c0e65143a833180c7ff799b ]
The only user of hid_snto32() is Logitech HID++ driver, which always calls hid_snto32() with valid size (constant, either 12 or 8) and therefore can simply use sign_extend32().
Make the switch and remove hid_snto32(). Move snto32() and s32ton() to avoid introducing forward declaration.
Stable-dep-of: a6b87bfc2ab5 ("HID: core: Harden s32ton() against conversion to 0 bits")
--- drivers/hid/hid-core.c | 63 +++++++++++++++----------------- drivers/hid/hid-logitech-hidpp.c | 6 +-- include/linux/hid.h | 1 - 3 files changed, 32 insertions(+), 38 deletions(-)
drivers/hid/hid-core.c +29 -34
@@ -45,6 +45,34 @@ static int hid_ignore_special_drivers = 0;module_param_named (ignore_special_drivers, hid_ignore_special_drivers, int,0600 );MODULE_PARM_DESC (ignore_special_drivers,"Ignore any special drivers and handle all devices by generic driver" ); +/* +* Convert a signed n-bit integer to signed 32-bit integer. +*/ + +static s32 snto32 (__u32 value,unsigned int n) +{ +if (!value || !n) +return 0 ; + +if (n >32 ) + n =32 ; + +return sign_extend32 (value, n -1 ); +} + +/* +* Convert a signed 32-bit integer to a signed n-bit integer. +*/ + +static u32 s32ton (__s32 value,unsigned int n) +{ +s32 a = value >> (n -1 ); + +if (a && a !=-1 ) +return value <0 ?1 << (n -1 ) : (1 << (n -1 )) -1 ; +return value & ((1 << n) -1 ); +} +/* * Register a new report for a device. */
@@ -425,7 +453,7 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)* both this and the standard encoding. */ raw_value =item_sdata (item);if (!(raw_value &0xfffffff0 )) - parser->global.unit_exponent =hid_snto32 (raw_value,4 ); + parser->global.unit_exponent =snto32 (raw_value,4 );else parser->global.unit_exponent = raw_value;return 0 ;
@@ -1317,39 +1345,6 @@ int hid_open_report(struct hid_device *device) }EXPORT_SYMBOL_GPL (hid_open_report); -/* -* Convert a signed n-bit integer to signed 32-bit integer. -*/ - -static s32 snto32 (__u32 value,unsigned n) -{ -if (!value || !n) -return 0 ; - -if (n >32 ) - n =32 ; - -return sign_extend32 (value, n -1 ); -} - -s32 hid_snto32 (__u32 value,unsigned n) -{ -return snto32 (value, n); -} -EXPORT_SYMBOL_GPL (hid_snto32); - -/* -* Convert a signed 32-bit integer to a signed n-bit integer. -*/ - -static u32 s32ton (__s32 value,unsigned n) -{ -s32 a = value >> (n -1 ); -if (a && a !=-1 ) -return value <0 ?1 << (n -1 ) : (1 << (n -1 )) -1 ; -return value & ((1 << n) -1 ); -} -/* * Extract/implement a data field from/to a little endian report (bit array). *
drivers/hid/hid-logitech-hidpp.c +3 -3
@@ -3296,13 +3296,13 @@ static int m560_raw_event(struct hid_device *hdev, u8 *data, int size) 120); } - v =hid_snto32 (hid_field_extract (hdev, data+3 ,0 ,12 ),12 ); + v =sign_extend32 (hid_field_extract (hdev, data +3 ,0 ,12 ),11 );input_report_rel (hidpp->input,REL_X , v); - v =hid_snto32 (hid_field_extract (hdev, data+3 ,12 ,12 ),12 ); + v =sign_extend32 (hid_field_extract (hdev, data +3 ,12 ,12 ),11 );input_report_rel (hidpp->input,REL_Y , v); - v =hid_snto32 (data[6 ],8 ); + v =sign_extend32 (data[6 ],7 );if (v !=0 )hidpp_scroll_counter_handle_scroll (hidpp->input, &hidpp->vertical_wheel_counter, v);
include/linux/hid.h +0 -1
@@ -978,7 +978,6 @@ const struct hid_device_id *hid_match_device(struct hid_device *hdev, struct hid_driver *hdrv);bool hid_compare_device_paths (struct hid_device *hdev_a,struct hid_device *hdev_b,char separator); -s32 hid_snto32 (__u32 value,unsigned n);__u32 hid_field_extract (const struct hid_device *hid,__u8 *report,unsigned offset,unsigned n);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 25/175 HID: core: Harden s32ton() against conversion to 0 bits
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
[ Upstream commit a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd ]
Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that.
Instead, harden the s32ton() routine so that it returns a reasonable result instead of crashing when it is called with the number of bits set to 0 -- the same as what snto32() does.
--- drivers/hid/hid-core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/hid/hid-core.c +5 -1
@@ -66,8 +66,12 @@ static s32 snto32(__u32 value, unsigned int n)static u32 s32ton (__s32 value,unsigned int n) { -s32 a = value >> (n -1 ); +s32 a; +if (!value || !n) +return 0 ; + + a = value >> (n -1 );if (a && a !=-1 )return value <0 ?1 << (n -1 ) : (1 << (n -1 )) -1 ;return value & ((1 << n) -1 );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 26/175 net: usb: qmi_wwan: fix Telit Cinterion FN990A name
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
[ Upstream commit ad1664fb699006f552dceeba331ef1e8874309a8 ]
The correct name for FN990 is FN990A so use it in order to avoid confusion with FN990B.
Stable-dep-of: 61aaca8b89fb ("net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition")
--- drivers/net/usb/qmi_wwan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/usb/qmi_wwan.c +1 -1
@@ -1363,7 +1363,7 @@ static const struct usb_device_id products[] = { {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1057, 2)}, /* Telit FN980 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */ - {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990A */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 27/175 net: usb: qmi_wwan: fix Telit Cinterion FE990A name
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
[ Upstream commit 5728b289abbb4e1faf7b5eb264624f08442861f4 ]
The correct name for FE990 is FE990A so use it in order to avoid confusion with FE990B.
Stable-dep-of: 61aaca8b89fb ("net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition")
--- drivers/net/usb/qmi_wwan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/usb/qmi_wwan.c +1 -1
@@ -1364,7 +1364,7 @@ static const struct usb_device_id products[] = { {QMI_QUIRK_SET_DTR(0x1bc7, 0x1057, 2)}, /* Telit FN980 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990A */ - {QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990A */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a9, 0)}, /* Telit FN920C04 */
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 28/175 net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
[ Upstream commit 61aaca8b89fb98be58b8df19f01181bb983cccff ]
Add the following Telit Cinterion FN990A w/audio composition:
0x1077: tty (diag) + adb + rmnet + audio + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT)
T: Bus=01 Lev=01 Prnt=01 Port=09 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1077 Rev=05.04 S: Manufacturer=Telit Wireless Solutions S: Product=FN990 S: SerialNumber=67e04c35 C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 0 Cls=01(audio) Sub=01 Prot=20 Driver=snd-usb-audio I: If#= 4 Alt= 1 #EPs= 1 Cls=01(audio) Sub=02 Prot=20 Driver=snd-usb-audio E: Ad=03(O) Atr=0d(Isoc) MxPS= 68 Ivl=1ms I: If#= 5 Alt= 1 #EPs= 1 Cls=01(audio) Sub=02 Prot=20 Driver=snd-usb-audio E: Ad=84(I) Atr=0d(Isoc) MxPS= 68 Ivl=1ms I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 7 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 8 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 9 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8c(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1364,6 +1364,7 @@ static const struct usb_device_id products[] = { {QMI_QUIRK_SET_DTR(0x1bc7, 0x1057, 2)}, /* Telit FN980 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990A */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1077, 2)}, /* Telit FN990A w/audio */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990A */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 29/175 LoongArch: vDSO: Remove --hash-style=sysv
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xi Ruoyao <[email protected]>
[ Upstream commit c271c86a4c72c771b313fd9c3b06db61ab8ab8bf ]
Glibc added support for .gnu.hash in 2006 and .hash has been obsoleted far before the first LoongArch CPU was taped. Using --hash-style=sysv might imply unaddressed issues and confuse readers.
Some architectures use an explicit --hash-style=both for vDSO here, but DT_GNU_HASH has already been supported by Glibc and Musl and become the de-facto standard of the distros when the first LoongArch CPU was taped. So DT_HASH seems just wasting storage space for LoongArch.
Just drop the option and rely on the linker default, which is likely "gnu" (Arch, Debian, Gentoo, LFS) on all LoongArch distros (confirmed on Arch, Debian, Gentoo, and LFS; AOSC now defaults to "both" but it seems just an oversight).
Following the logic of commit 48f6430505c0b049 ("arm64/vdso: Remove --hash-style=sysv").
Stable-dep-of: d35ec48fa6c8 ("LoongArch: vDSO: Remove -nostdlib complier flag")
--- arch/loongarch/vdso/Makefile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/loongarch/vdso/Makefile +1 -2
@@ -36,8 +36,7 @@ endif # VDSO linker flags. ldflags-y := -Bsymbolic --no-undefined -soname=linux-vdso.so.1 \ - $(filter -E%,$(KBUILD_CFLAGS)) -nostdlib -shared \ - --hash-style=sysv --build-id -T + $(filter -E%,$(KBUILD_CFLAGS)) -nostdlib -shared --build-id -T # # Shared build commands.
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 30/175 LoongArch: vDSO: Remove -nostdlib complier flag
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Guan <[email protected]>
[ Upstream commit d35ec48fa6c8fe0cfa4a03155109fec7677911d4 ]
Since $(LD) is directly used, hence -nostdlib is unneeded, MIPS has removed this, we should remove it too.
bdbf2038fbf4 ("MIPS: VDSO: remove -nostdlib compiler flag").
In fact, other architectures also use $(LD) now.
fe00e50b2db8 ("ARM: 8858/1: vdso: use $(LD) instead of $(CC) to link VDSO") 691efbedc60d ("arm64: vdso: use $(LD) instead of $(CC) to link VDSO") 2ff906994b6c ("MIPS: VDSO: Use $(LD) instead of $(CC) to link VDSO") 2b2a25845d53 ("s390/vdso: Use $(LD) instead of $(CC) to link vDSO")
--- arch/loongarch/vdso/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/loongarch/vdso/Makefile +1 -1
@@ -36,7 +36,7 @@ endif # VDSO linker flags. ldflags-y := -Bsymbolic --no-undefined -soname=linux-vdso.so.1 \ - $(filter -E%,$(KBUILD_CFLAGS)) -nostdlib -shared --build-id -T + $(filter -E%,$(KBUILD_CFLAGS)) -shared --build-id -T # # Shared build commands.
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 31/175 mmc: sdhci-of-arasan: Support for emmc hardware reset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Alvin <[email protected]>
[ Upstream commit 11c7d665181c1879b0d5561102c3834ff14a5615 ]
Add hw_reset callback to support emmc hardware reset, this callback get called from the mmc core only when "cap-mmc-hw-reset" property is defined in the DT.
Stable-dep-of: e251709aaddb ("mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up")
--- drivers/mmc/host/sdhci-of-arasan.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/mmc/host/sdhci-of-arasan.c +18 -0
@@ -76,6 +76,8 @@#define FREQSEL_225M_200M 0x7#define PHY_DLL_TIMEOUT_MS 100 +#define SDHCI_HW_RST_EN BIT(4) +/* Default settings for ZynqMP Clock Phases */ #define ZYNQMP_ICLK_PHASE {0, 63, 63, 0, 63, 0, 0, 183, 54, 0, 0}#define ZYNQMP_OCLK_PHASE {0, 72, 60, 0, 60, 72, 135, 48, 72, 135, 0}
@@ -475,6 +477,21 @@ static void sdhci_arasan_reset(struct sdhci_host *host, u8 mask) } } +static void sdhci_arasan_hw_reset (struct sdhci_host *host) +{ +u8 reg; + + reg =sdhci_readb (host,SDHCI_POWER_CONTROL ); + reg |=SDHCI_HW_RST_EN ; +sdhci_writeb (host, reg,SDHCI_POWER_CONTROL ); +/* As per eMMC spec, minimum 1us is required but give it 2us for good measure */ +usleep_range (2 ,5 ); + reg &= ~SDHCI_HW_RST_EN ; +sdhci_writeb (host, reg,SDHCI_POWER_CONTROL ); +/* As per eMMC spec, minimum 200us is required but give it 300us for good measure */ +usleep_range (300 ,500 ); +} +static int sdhci_arasan_voltage_switch (struct mmc_host *mmc,struct mmc_ios *ios) {
@@ -505,6 +522,7 @@ static const struct sdhci_ops sdhci_arasan_ops = { .reset = sdhci_arasan_reset, .set_uhs_signaling = sdhci_set_uhs_signaling, .set_power = sdhci_set_power_and_bus_voltage, + .hw_reset = sdhci_arasan_hw_reset, };static u32 sdhci_arasan_cqhci_irq (struct sdhci_host *host,u32 intmask)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 32/175 mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sai Krishna Potthuri <[email protected]>
[ Upstream commit e251709aaddb3ee1e8ac1ed5e361a608a1cc92de ]
During SD suspend/resume without a full card rescan (when using non-removable SD cards for rootfs), the SD card initialization may fail after resume. This occurs because, after a host controller reset, the card detect logic may take time to stabilize due to debounce logic. Without waiting for stabilization, the host may attempt powering up the card prematurely, leading to command timeouts during resume flow. Add sdhci_arasan_set_power_and_bus_voltage() to wait for the card detect stable bit before power up the card. Since the stabilization time is not fixed, a maximum timeout of one second is used to ensure sufficient wait time for the card detect signal to stabilize.
--- drivers/mmc/host/sdhci-of-arasan.c | 33 ++++++++++++++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-)
drivers/mmc/host/sdhci-of-arasan.c +31 -2
@@ -99,6 +99,9 @@#define HIWORD_UPDATE (val, mask, shift) \ ((val) << (shift) | (mask) << ((shift) + 16)) +#define CD_STABLE_TIMEOUT_US 1000000 +#define CD_STABLE_MAX_SLEEP_US 10 +/** * struct sdhci_arasan_soc_ctl_field - Field used in sdhci_arasan_soc_ctl_map *
@@ -206,12 +209,15 @@ struct sdhci_arasan_data {* 19MHz instead */ #define SDHCI_ARASAN_QUIRK_CLOCK_25_BROKEN BIT(2) +/* Enable CD stable check before power-up */ +#define SDHCI_ARASAN_QUIRK_ENSURE_CD_STABLE BIT(3) };struct sdhci_arasan_of_data {const struct sdhci_arasan_soc_ctl_map *soc_ctl_map;const struct sdhci_pltfm_data *pdata;const struct sdhci_arasan_clk_ops *clk_ops; +u32 quirks; };static const struct sdhci_arasan_soc_ctl_map rk3399_soc_ctl_map = {
@@ -514,6 +520,24 @@ static int sdhci_arasan_voltage_switch(struct mmc_host *mmc,return -EINVAL ; } +static void sdhci_arasan_set_power_and_bus_voltage (struct sdhci_host *host,unsigned char mode, +unsigned short vdd) +{ +struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host); +struct sdhci_arasan_data *sdhci_arasan =sdhci_pltfm_priv (pltfm_host); +u32 reg; + +/* +* Ensure that the card detect logic has stabilized before powering up, this is +* necessary after a host controller reset. +*/ +if (mode ==MMC_POWER_UP && sdhci_arasan->quirks &SDHCI_ARASAN_QUIRK_ENSURE_CD_STABLE ) +read_poll_timeout (sdhci_readl, reg, reg &SDHCI_CD_STABLE ,CD_STABLE_MAX_SLEEP_US , +CD_STABLE_TIMEOUT_US , false, host,SDHCI_PRESENT_STATE ); + +sdhci_set_power_and_bus_voltage (host, mode, vdd); +} +static const struct sdhci_ops sdhci_arasan_ops = { .set_clock = sdhci_arasan_set_clock, .get_max_clock = sdhci_pltfm_clk_get_max_clock,
@@ -521,7 +545,7 @@ static const struct sdhci_ops sdhci_arasan_ops = { .set_bus_width = sdhci_set_bus_width, .reset = sdhci_arasan_reset, .set_uhs_signaling = sdhci_set_uhs_signaling, - .set_power = sdhci_set_power_and_bus_voltage, + .set_power = sdhci_arasan_set_power_and_bus_voltage, .hw_reset = sdhci_arasan_hw_reset, };
@@ -570,7 +594,7 @@ static const struct sdhci_ops sdhci_arasan_cqe_ops = { .set_bus_width = sdhci_set_bus_width, .reset = sdhci_arasan_reset, .set_uhs_signaling = sdhci_set_uhs_signaling, - .set_power = sdhci_set_power_and_bus_voltage, + .set_power = sdhci_arasan_set_power_and_bus_voltage, .irq = sdhci_arasan_cqhci_irq, };
@@ -1447,6 +1471,7 @@ static const struct sdhci_arasan_clk_ops zynqmp_clk_ops = {static struct sdhci_arasan_of_data sdhci_arasan_zynqmp_data = { .pdata = &sdhci_arasan_zynqmp_pdata, .clk_ops = &zynqmp_clk_ops, + .quirks =SDHCI_ARASAN_QUIRK_ENSURE_CD_STABLE , };static const struct sdhci_arasan_clk_ops versal_clk_ops = {
@@ -1457,6 +1482,7 @@ static const struct sdhci_arasan_clk_ops versal_clk_ops = {static struct sdhci_arasan_of_data sdhci_arasan_versal_data = { .pdata = &sdhci_arasan_zynqmp_pdata, .clk_ops = &versal_clk_ops, + .quirks =SDHCI_ARASAN_QUIRK_ENSURE_CD_STABLE , };static const struct sdhci_arasan_clk_ops versal_net_clk_ops = {
@@ -1467,6 +1493,7 @@ static const struct sdhci_arasan_clk_ops versal_net_clk_ops = {static struct sdhci_arasan_of_data sdhci_arasan_versal_net_data = { .pdata = &sdhci_arasan_versal_net_pdata, .clk_ops = &versal_net_clk_ops, + .quirks =SDHCI_ARASAN_QUIRK_ENSURE_CD_STABLE , };static struct sdhci_arasan_of_data intel_keembay_emmc_data = {
@@ -1945,6 +1972,8 @@ static int sdhci_arasan_probe(struct platform_device *pdev)if (of_device_is_compatible (np,"rockchip,rk3399-sdhci-5.1" ))sdhci_arasan_update_clockmultiplier (host,0x0 ); + sdhci_arasan->quirks |= data->quirks; +if (of_device_is_compatible (np,"intel,keembay-sdhci-5.1-emmc" ) ||of_device_is_compatible (np,"intel,keembay-sdhci-5.1-sd" ) ||of_device_is_compatible (np,"intel,keembay-sdhci-5.1-sdio" )) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 33/175 wifi: cfg80211: fix use-after-free in cmp_bss()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 26e84445f02ce6b2fe5f3e0e28ff7add77f35e08 ]
Following bss_free() quirk introduced in commit 776b3580178f ("cfg80211: track hidden SSID networks properly"), adjust cfg80211_update_known_bss() to free the last beacon frame elements only if they're not shared via the corresponding 'hidden_beacon_bss' pointer.
--- net/wireless/scan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/wireless/scan.c +2 -1
@@ -1868,7 +1868,8 @@ cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,*/ f =rcu_access_pointer (new->pub.beacon_ies); -kfree_rcu ((struct cfg80211_bss_ies *)f, rcu_head); +if (!new->pub.hidden_beacon_bss) +kfree_rcu ((struct cfg80211_bss_ies *)f, rcu_head);return false; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 34/175 wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit 9cb83d4be0b9b697eae93d321e0da999f9cdfcfc ]
The brcmf_btcoex_detach() only shuts down the btcoex timer, if the flag timer_on is false. However, the brcmf_btcoex_timerfunc(), which runs as timer handler, sets timer_on to false. This creates critical race conditions:
1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc() is executing, it may observe timer_on as false and skip the call to timer_shutdown_sync().
2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info worker after the cancel_work_sync() has been executed, resulting in use-after-free bugs.
The use-after-free bugs occur in two distinct scenarios, depending on the timing of when the brcmf_btcoex_info struct is freed relative to the execution of its worker thread.
Scenario 1: Freed before the worker is scheduled
The brcmf_btcoex_info is deallocated before the worker is scheduled. A race condition can occur when schedule_work(&bt_local->work) is called after the target memory has been freed. The sequence of events is detailed below:
CPU0 | CPU1
brcmf_btcoex_detach | brcmf_btcoex_timerfunc
| bt_local->timer_on = false;
if (cfg->btcoex->timer_on) |
... |
cancel_work_sync(); |
... |
kfree(cfg->btcoex); // FREE |
| schedule_work(&bt_local->work); // USEScenario 2: Freed after the worker is scheduled
The brcmf_btcoex_info is freed after the worker has been scheduled but before or during its execution. In this case, statements within the brcmf_btcoex_handler() — such as the container_of macro and subsequent dereferences of the brcmf_btcoex_info object will cause a use-after-free access. The following timeline illustrates this scenario:
CPU0 | CPU1
brcmf_btcoex_detach | brcmf_btcoex_timerfunc
| bt_local->timer_on = false;
if (cfg->btcoex->timer_on) |
... |
cancel_work_sync(); |
... | schedule_work(); // Reschedule
|
kfree(cfg->btcoex); // FREE | brcmf_btcoex_handler() // Worker
/* | btci = container_of(....); // USE
The kfree() above could | ...
also occur at any point | btci-> // USE
during the worker's execution|
*/ |To resolve the race conditions, drop the conditional check and call timer_shutdown_sync() directly. It can deactivate the timer reliably, regardless of its current state. Once stopped, the timer_on state is then set to false.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c +2 -4
@@ -392,10 +392,8 @@ void brcmf_btcoex_detach(struct brcmf_cfg80211_info *cfg)if (!cfg->btcoex)return ; -if (cfg->btcoex->timer_on) { - cfg->btcoex->timer_on = false; -timer_shutdown_sync (&cfg->btcoex->timer); - } +timer_shutdown_sync (&cfg->btcoex->timer); + cfg->btcoex->timer_on = false;cancel_work_sync (&cfg->btcoex->work);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 35/175 wifi: mt76: mt7925: fix locking in mt7925_change_vif_links()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshit Mogalapalli <[email protected]>
[ Upstream commit 9f15701370ec15fbf1f6a1cbbf584b0018d036b5 ]
&dev->mt76.mutex lock is taken using mt792x_mutex_acquire(dev) but not released in one of the error paths, add the unlock to fix it.
--- drivers/net/wireless/mediatek/mt76/mt7925/main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7925/main.c +3 -1
@@ -2005,8 +2005,10 @@ mt7925_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif, GFP_KERNEL); mlink =devm_kzalloc (dev->mt76.dev,sizeof (*mlink),GFP_KERNEL ); -if (!mconf || !mlink) +if (!mconf || !mlink) { +mt792x_mutex_release (dev);return -ENOMEM ; + } } mconfs[link_id] = mconf;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 36/175 wifi: mt76: prevent non-offchannel mgmt tx during scan/roc
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 4c2334587b0a13b8f4eda1336ae657297fcd743b ]
Only put probe request packets in the offchannel queue if IEEE80211_TX_CTRL_DONT_USE_RATE_MASK is set and IEEE80211_TX_CTL_TX_OFFCHAN is unset.
--- drivers/net/wireless/mediatek/mt76/tx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/tx.c +3 -1
@@ -334,6 +334,7 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta, struct mt76_wcid *wcid, struct sk_buff *skb) { struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); +struct ieee80211_hdr *hdr = (void *)skb->data;struct sk_buff_head *head;if (mt76_testmode_enabled (phy)) {
@@ -351,7 +352,8 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta, info->hw_queue |=FIELD_PREP (MT_TX_HW_QUEUE_PHY , phy->band_idx);if ((info->flags &IEEE80211_TX_CTL_TX_OFFCHAN ) || - (info->control.flags &IEEE80211_TX_CTRL_DONT_USE_RATE_MASK )) + ((info->control.flags &IEEE80211_TX_CTRL_DONT_USE_RATE_MASK ) && +ieee80211_is_probe_req (hdr->frame_control))) head = &wcid->tx_offchannel;else head = &wcid->tx_pending;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 37/175 wifi: mt76: free pending offchannel tx frames on wcid cleanup
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit bdeac7815629c1a32b8784922368742e183747ea ]
Avoid leaking them or keeping the wcid on the tx list
--- drivers/net/wireless/mediatek/mt76/mac80211.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/mediatek/mt76/mac80211.c +4 -0
@@ -1586,6 +1586,10 @@ void mt76_wcid_cleanup(struct mt76_dev *dev, struct mt76_wcid *wcid)skb_queue_splice_tail_init (&wcid->tx_pending, &list);spin_unlock (&wcid->tx_pending.lock); +spin_lock (&wcid->tx_offchannel.lock); +skb_queue_splice_tail_init (&wcid->tx_offchannel, &list); +spin_unlock (&wcid->tx_offchannel.lock); +spin_unlock_bh (&phy->tx_lock);while ((skb =__skb_dequeue (&list)) !=NULL ) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 38/175 wifi: mt76: fix linked list corruption
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 49fba87205bec14a0f6bd997635bf3968408161e ]
Never leave scheduled wcid entries on the temporary on-stack list
--- drivers/net/wireless/mediatek/mt76/tx.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/net/wireless/mediatek/mt76/tx.c +3 -5
@@ -645,6 +645,7 @@ mt76_txq_schedule_pending_wcid(struct mt76_phy *phy, struct mt76_wcid *wcid,static void mt76_txq_schedule_pending (struct mt76_phy *phy) {LIST_HEAD (tx_list); +int ret =0 ;if (list_empty (&phy->tx_list))return ;
@@ -656,13 +657,13 @@ static void mt76_txq_schedule_pending(struct mt76_phy *phy)list_splice_init (&phy->tx_list, &tx_list);while (!list_empty (&tx_list)) {struct mt76_wcid *wcid; -int ret; wcid = list_first_entry(&tx_list, struct mt76_wcid, tx_list);list_del_init (&wcid->tx_list);spin_unlock (&phy->tx_lock); - ret =mt76_txq_schedule_pending_wcid (phy, wcid, &wcid->tx_offchannel); +if (ret >=0 ) + ret =mt76_txq_schedule_pending_wcid (phy, wcid, &wcid->tx_offchannel);if (ret >=0 && !phy->offchannel) ret =mt76_txq_schedule_pending_wcid (phy, wcid, &wcid->tx_pending);spin_lock (&phy->tx_lock);
@@ -671,9 +672,6 @@ static void mt76_txq_schedule_pending(struct mt76_phy *phy) !skb_queue_empty(&wcid->tx_offchannel) && list_empty(&wcid->tx_list))list_add_tail (&wcid->tx_list, &phy->tx_list); - -if (ret <0 ) -break ; }spin_unlock (&phy->tx_lock);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 39/175 netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <[email protected]>
[ Upstream commit 479a54ab92087318514c82428a87af2d7af1a576 ]
When send a broadcast packet to a tap device, which was added to a bridge, br_nf_local_in() is called to confirm the conntrack. If another conntrack with the same hash value is added to the hash table, which can be triggered by a normal packet to a non-bridge device, the below warning may happen.
------------[ cut here ]------------ WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200 CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary) RIP: 0010:br_nf_local_in+0x168/0x200 Call Trace: <TASK> nf_hook_slow+0x3e/0xf0 br_pass_frame_up+0x103/0x180 br_handle_frame_finish+0x2de/0x5b0 br_nf_hook_thresh+0xc0/0x120 br_nf_pre_routing_finish+0x168/0x3a0 br_nf_pre_routing+0x237/0x5e0 br_handle_frame+0x1ec/0x3c0 __netif_receive_skb_core+0x225/0x1210 __netif_receive_skb_one_core+0x37/0xa0 netif_receive_skb+0x36/0x160 tun_get_user+0xa54/0x10c0 tun_chr_write_iter+0x65/0xb0 vfs_write+0x305/0x410 ksys_write+0x60/0xd0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> ---[ end trace 0000000000000000 ]---
To solve the hash conflict, nf_ct_resolve_clash() try to merge the conntracks, and update skb->_nfct. However, br_nf_local_in() still use the old ct from local variable 'nfct' after confirm(), which leads to this warning.
If confirm() does not insert the conntrack entry and return NF_DROP, the warning may also occur. There is no need to reserve the WARN_ON_ONCE, just remove it.
--- net/bridge/br_netfilter_hooks.c | 3 --- 1 file changed, 3 deletions(-)
net/bridge/br_netfilter_hooks.c +0 -3
@@ -653,9 +653,6 @@ static unsigned int br_nf_local_in(void *priv, break; } - ct = container_of(nfct, struct nf_conn, ct_general); -WARN_ON_ONCE (!nf_ct_is_confirmed (ct)); -return ret; }#endif
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 40/175 netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Sutter <[email protected]>
[ Upstream commit 54416fd76770bd04fc3c501810e8d673550bab26 ]
The helper registration return value is passed-through by module_init callbacks which modprobe confuses with the harmless -EEXIST returned when trying to load an already loaded module.
Make sure modprobe fails so users notice their helper has not been registered and won't work.
--- net/netfilter/nf_conntrack_helper.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/nf_conntrack_helper.c +2 -2
@@ -368,7 +368,7 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me) (cur->tuple.src.l3num == NFPROTO_UNSPEC || cur->tuple.src.l3num == me->tuple.src.l3num) && cur->tuple.dst.protonum == me->tuple.dst.protonum) { - ret = -EEXIST ; + ret = -EBUSY ; goto out; } }
@@ -379,7 +379,7 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)hlist_for_each_entry (cur, &nf_ct_helper_hash[h], hnode) {if (nf_ct_tuple_src_mask_cmp (&cur->tuple, &me->tuple, &mask)) { - ret = -EEXIST ; + ret = -EBUSY ; goto out; } }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 41/175 wifi: iwlwifi: uefi: check DSM item validity
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 1d33694462fa7da451846c39d653585b61375992 ]
The first array index is a bitmap indicating which of the other values are valid. Check that bitmap before returning a value.
--- drivers/net/wireless/intel/iwlwifi/fw/uefi.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/wireless/intel/iwlwifi/fw/uefi.c +6 -0
@@ -741,6 +741,12 @@ int iwl_uefi_get_dsm(struct iwl_fw_runtime *fwrt, enum iwl_dsm_funcs func, goto out; } +if (!(data->functions[DSM_FUNC_QUERY ] &BIT (func))) { +IWL_DEBUG_RADIO (fwrt,"DSM func %d not in 0x%x\n" , + func, data->functions[DSM_FUNC_QUERY ]); + goto out; + } + *value = data->functions[func]; ret =0 ; out:
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 42/175 Bluetooth: vhci: Prevent use-after-free by removing debugfs files early
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Pravdin <[email protected]>
[ Upstream commit 28010791193a4503f054e8d69a950ef815deb539 ]
Move the creation of debugfs files into a dedicated function, and ensure they are explicitly removed during vhci_release(), before associated data structures are freed.
Previously, debugfs files such as "force_suspend", "force_wakeup", and others were created under hdev->debugfs but not removed in vhci_release(). Since vhci_release() frees the backing vhci_data structure, any access to these files after release would result in use-after-free errors.
Although hdev->debugfs is later freed in hci_release_dev(), user can access files after vhci_data is freed but before hdev->debugfs is released.
--- drivers/bluetooth/hci_vhci.c | 57 ++++++++++++++++++++++++++---------- 1 file changed, 41 insertions(+), 16 deletions(-)
drivers/bluetooth/hci_vhci.c +41 -16
@@ -380,6 +380,28 @@ static const struct file_operations force_devcoredump_fops = { .write = force_devcd_write, }; +static void vhci_debugfs_init (struct vhci_data *data) +{ +struct hci_dev *hdev = data->hdev; + +debugfs_create_file ("force_suspend" ,0644 , hdev->debugfs, data, + &force_suspend_fops); + +debugfs_create_file ("force_wakeup" ,0644 , hdev->debugfs, data, + &force_wakeup_fops); + +if (IS_ENABLED (CONFIG_BT_MSFTEXT )) +debugfs_create_file ("msft_opcode" ,0644 , hdev->debugfs, data, + &msft_opcode_fops); + +if (IS_ENABLED (CONFIG_BT_AOSPEXT )) +debugfs_create_file ("aosp_capable" ,0644 , hdev->debugfs, data, + &aosp_capable_fops); + +debugfs_create_file ("force_devcoredump" ,0644 , hdev->debugfs, data, + &force_devcoredump_fops); +} +static int __vhci_create_device (struct vhci_data *data,__u8 opcode) {struct hci_dev *hdev;
@@ -433,22 +455,8 @@ static int __vhci_create_device(struct vhci_data *data, __u8 opcode)return -EBUSY ; } -debugfs_create_file ("force_suspend" ,0644 , hdev->debugfs, data, - &force_suspend_fops); - -debugfs_create_file ("force_wakeup" ,0644 , hdev->debugfs, data, - &force_wakeup_fops); - -if (IS_ENABLED (CONFIG_BT_MSFTEXT )) -debugfs_create_file ("msft_opcode" ,0644 , hdev->debugfs, data, - &msft_opcode_fops); - -if (IS_ENABLED (CONFIG_BT_AOSPEXT )) -debugfs_create_file ("aosp_capable" ,0644 , hdev->debugfs, data, - &aosp_capable_fops); - -debugfs_create_file ("force_devcoredump" ,0644 , hdev->debugfs, data, - &force_devcoredump_fops); +if (!IS_ERR_OR_NULL (hdev->debugfs)) +vhci_debugfs_init (data);hci_skb_pkt_type (skb) =HCI_VENDOR_PKT ;
@@ -650,6 +658,21 @@ static int vhci_open(struct inode *inode, struct file *file)return 0 ; } +static void vhci_debugfs_remove (struct hci_dev *hdev) +{ +debugfs_lookup_and_remove ("force_suspend" , hdev->debugfs); + +debugfs_lookup_and_remove ("force_wakeup" , hdev->debugfs); + +if (IS_ENABLED (CONFIG_BT_MSFTEXT )) +debugfs_lookup_and_remove ("msft_opcode" , hdev->debugfs); + +if (IS_ENABLED (CONFIG_BT_AOSPEXT )) +debugfs_lookup_and_remove ("aosp_capable" , hdev->debugfs); + +debugfs_lookup_and_remove ("force_devcoredump" , hdev->debugfs); +} +static int vhci_release (struct inode *inode,struct file *file) {struct vhci_data *data = file->private_data;
@@ -661,6 +684,8 @@ static int vhci_release(struct inode *inode, struct file *file) hdev = data->hdev;if (hdev) { +if (!IS_ERR_OR_NULL (hdev->debugfs)) +vhci_debugfs_remove (hdev);hci_unregister_dev (hdev);hci_free_dev (hdev); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 43/175 Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 862c628108562d8c7a516a900034823b381d3cba ]
syzbot reported the splat below without a repro.
In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that.
The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit.
bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release().
Two threads could see the same socket during the list iteration in bt_accept_dequeue():
CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk);
lock_sock(sk) <-- block close()
sock_put(sk)
bt_accept_unlink(sk)
sock_put(sk) <-- refcnt by bt_accept_enqueue()
release_sock(sk)
lock_sock(sk) sock_put(sk) bt_accept_unlink(sk)
sock_put(sk) <-- last refcnt
bt_accept_unlink(sk) <-- UAF
Depending on the timing, the other thread could show up in the "Freed by task" part.
Let's call l2cap_sock_cleanup_listen() under lock_sock() in l2cap_sock_release().
[0]:
BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 Read of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995 CPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 spin_lock_bh include/linux/spinlock.h:356 [inline] release_sock+0x21/0x220 net/core/sock.c:3746 bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312 l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x3ff/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2accf8ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00000000000426fb RCX: 00007f2accf8ebe9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f R10: 0000001b30e20000 R11: 0000000000000246 R12: 00007f2acd1b609c R13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490 </TASK> Allocated by task 5326: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4365 [inline] __kmalloc_noprof+0x223/0x510 mm/slub.c:4377 kmalloc_noprof include/linux/slab.h:909 [inline] sk_prot_alloc+0x1a8/0x2a0 net/core/sock.c:2239 sk_alloc+0x36/0xc20 net/core/sock.c:2295 bt_sock_alloc+0x3b/0x3a0 net/bluetooth/af_bluetooth.c:151 l2cap_sock_alloc.constprop.0+0x33/0x1d0 net/bluetooth/l2cap_sock.c:1894 l2cap_sock_new_connection_cb+0x101/0x240 net/bluetooth/l2cap_sock.c:1482 l2cap_connect_cfm+0x4c4/0xf80 net/bluetooth/l2cap_core.c:7287 hci_connect_cfm include/net/bluetooth/hci_core.h:2050 [inline] hci_remote_features_evt+0x4dd/0x970 net/bluetooth/hci_event.c:3712 hci_event_func net/bluetooth/hci_event.c:7519 [inline] hci_event_packet+0xa0d/0x11c0 net/bluetooth/hci_event.c:7573 hci_rx_work+0x2c5/0x16b0 net/bluetooth/hci_core.c:4071 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:463 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 16995: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline] __kasan_slab_free+0x60/0x70 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2417 [inline] slab_free mm/slub.c:4680 [inline] kfree+0x2b4/0x4d0 mm/slub.c:4879 sk_prot_free net/core/sock.c:2278 [inline] __sk_destruct+0x75f/0x9a0 net/core/sock.c:2373 sk_destruct+0xc2/0xf0 net/core/sock.c:2401 __sk_free+0xf4/0x3e0 net/core/sock.c:2412 sk_free+0x6a/0x90 net/core/sock.c:2423 sock_put include/net/sock.h:1960 [inline] bt_accept_unlink+0x245/0x2e0 net/bluetooth/af_bluetooth.c:262 bt_accept_dequeue+0x517/0x600 net/bluetooth/af_bluetooth.c:308 l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x3ff/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- net/bluetooth/l2cap_sock.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/l2cap_sock.c +3 -0
@@ -1409,7 +1409,10 @@ static int l2cap_sock_release(struct socket *sock)if (!sk)return 0 ; +lock_sock_nested (sk,L2CAP_NESTING_PARENT );l2cap_sock_cleanup_listen (sk); +release_sock (sk); +bt_sock_unlink (&l2cap_sk_list, sk); err =l2cap_sock_shutdown (sock,SHUT_RDWR );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 44/175 netfilter: nft_flowtable.sh: re-run with random mtu sizes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit d6a367ec6c96fc8e61b4d67e69df03565ec69fb7 ]
Jakub says:
nft_flowtable.sh is one of the most flake-atious test for netdev CI currently :(
The root cause is two-fold:
1. the failing part of the test is supposed to make sure that ip fragments are forwarded for offloaded flows. (flowtable has to pass them to classic forward path). path mtu discovery for these subtests is disabled.
2. nft_flowtable.sh has two passes. One with fixed mtus/file size and one where link mtus and file sizes are random.
The CI failures all have same pattern:
re-run with random mtus and file size: -o 27663 -l 4117 -r 10089 -s 54384840 [..]
PASS: dscp_egress: dscp packet counters match
FAIL: file mismatch for ns1 -> ns2
In some cases this error triggers a bit ealier, sometimes in a later subtest:
re-run with random mtus and file size: -o 20201 -l 4555 -r 12657 -s 9405856 [..]
PASS: dscp_egress: dscp packet counters match
PASS: dscp_fwd: dscp packet counters match
2025/08/17 20:37:52 socat[18954] E write(7, 0x560716b96000, 8192): Broken pipe
FAIL: file mismatch for ns1 -> ns2
-rw------- 1 root root 9405856 Aug 17 20:36 /tmp/tmp.2n63vlTrQe
But all logs I saw show same scenario:
1. Failing tests have pmtu discovery off (i.e., ip fragmentation)
2. The test file is much larger than first-pass default (2M Byte)
3. peers have much larger MTUs compared to the 'network'.
These errors are very reproducible when re-running the test with the same commandline arguments.
The timeout became much more prominent with1d2fbaad7cd8 ("tcp: stronger sk_rcvbuf checks"): reassembled packets typically have a skb->truesize more than double the skb length.
As that commit is intentional and pmtud-off with large-tcp-packets-as-fragments is not normal adjust the test to use a smaller file for the pmtu-off subtests.
While at it, add more information to pass/fail messages and also run the dscp alteration subtest with pmtu discovery enabled.
--- .../selftests/net/netfilter/nft_flowtable.sh | 113 ++++++++++++------ 1 file changed, 76 insertions(+), 37 deletions(-)
tools/testing/selftests/net/netfilter/nft_flowtable.sh +76 -37
@@ -20,6 +20,7 @@ ret=0 SOCAT_TIMEOUT=60 nsin="" +nsin_small="" ns1out="" ns2out=""
@@ -36,7 +37,7 @@ cleanup() { cleanup_all_ns - rm -f "$nsin" "$ns1out" "$ns2out" + rm -f "$nsin" "$nsin_small" "$ns1out" "$ns2out" [ "$log_netns" -eq 0 ] && sysctl -q net.netfilter.nf_log_all_netns="$log_netns" }
@@ -72,6 +73,7 @@ lmtu=1500 rmtu=2000 filesize=$((2 * 1024 * 1024)) +filesize_small=$((filesize / 16)) usage(){ echo "nft_flowtable.sh [OPTIONS]"
@@ -89,7 +91,10 @@ do o) omtu=$OPTARG;; l) lmtu=$OPTARG;; r) rmtu=$OPTARG;; - s) filesize=$OPTARG;; + s) + filesize=$OPTARG + filesize_small=$((OPTARG / 16)) + ;; *) usage;; esac done
@@ -215,6 +220,7 @@ if ! ip netns exec "$ns2" ping -c 1 -q 10.0.1.99 > /dev/null; then fi nsin=$(mktemp) +nsin_small=$(mktemp) ns1out=$(mktemp) ns2out=$(mktemp)
@@ -265,6 +271,7 @@ check_counters() check_dscp() { local what=$1 + local pmtud="$2" local ok=1 local counter
@@ -277,37 +284,39 @@ check_dscp() local pc4z=${counter%*bytes*} local pc4z=${pc4z#*packets} + local failmsg="FAIL: pmtu $pmtu: $what counters do not match, expected" + case "$what" in "dscp_none") if [ "$pc4" -gt 0 ] || [ "$pc4z" -eq 0 ]; then - echo "FAIL: dscp counters do not match, expected dscp3 == 0, dscp0 > 0, but got $pc4,$pc4z" 1>&2 + echo "$failmsg dscp3 == 0, dscp0 > 0, but got $pc4,$pc4z" 1>&2 ret=1 ok=0 fi ;; "dscp_fwd") if [ "$pc4" -eq 0 ] || [ "$pc4z" -eq 0 ]; then - echo "FAIL: dscp counters do not match, expected dscp3 and dscp0 > 0 but got $pc4,$pc4z" 1>&2 + echo "$failmsg dscp3 and dscp0 > 0 but got $pc4,$pc4z" 1>&2 ret=1 ok=0 fi ;; "dscp_ingress") if [ "$pc4" -eq 0 ] || [ "$pc4z" -gt 0 ]; then - echo "FAIL: dscp counters do not match, expected dscp3 > 0, dscp0 == 0 but got $pc4,$pc4z" 1>&2 + echo "$failmsg dscp3 > 0, dscp0 == 0 but got $pc4,$pc4z" 1>&2 ret=1 ok=0 fi ;; "dscp_egress") if [ "$pc4" -eq 0 ] || [ "$pc4z" -gt 0 ]; then - echo "FAIL: dscp counters do not match, expected dscp3 > 0, dscp0 == 0 but got $pc4,$pc4z" 1>&2 + echo "$failmsg dscp3 > 0, dscp0 == 0 but got $pc4,$pc4z" 1>&2 ret=1 ok=0 fi ;; *) - echo "FAIL: Unknown DSCP check" 1>&2 + echo "$failmsg: Unknown DSCP check" 1>&2 ret=1 ok=0 esac
@@ -319,9 +328,9 @@ check_dscp() check_transfer() { - in=$1 - out=$2 - what=$3 + local in=$1 + local out=$2 + local what=$3 if ! cmp "$in" "$out" > /dev/null 2>&1; then echo "FAIL: file mismatch for $what" 1>&2
@@ -342,25 +351,39 @@ test_tcp_forwarding_ip() { local nsa=$1 local nsb=$2 - local dstip=$3 - local dstport=$4 + local pmtu=$3 + local dstip=$4 + local dstport=$5 local lret=0 + local socatc + local socatl + local infile="$nsin" + + if [ $pmtu -eq 0 ]; then + infile="$nsin_small" + fi - timeout "$SOCAT_TIMEOUT" ip netns exec "$nsb" socat -4 TCP-LISTEN:12345,reuseaddr STDIO < "$nsin" > "$ns2out" & + timeout "$SOCAT_TIMEOUT" ip netns exec "$nsb" socat -4 TCP-LISTEN:12345,reuseaddr STDIO < "$infile" > "$ns2out" & lpid=$! busywait 1000 listener_ready - timeout "$SOCAT_TIMEOUT" ip netns exec "$nsa" socat -4 TCP:"$dstip":"$dstport" STDIO < "$nsin" > "$ns1out" + timeout "$SOCAT_TIMEOUT" ip netns exec "$nsa" socat -4 TCP:"$dstip":"$dstport" STDIO < "$infile" > "$ns1out" + socatc=$? wait $lpid + socatl=$? - if ! check_transfer "$nsin" "$ns2out" "ns1 -> ns2"; then + if [ $socatl -ne 0 ] || [ $socatc -ne 0 ];then + rc=1 + fi + + if ! check_transfer "$infile" "$ns2out" "ns1 -> ns2"; then lret=1 ret=1 fi - if ! check_transfer "$nsin" "$ns1out" "ns1 <- ns2"; then + if ! check_transfer "$infile" "$ns1out" "ns1 <- ns2"; then lret=1 ret=1 fi
@@ -370,14 +393,16 @@ test_tcp_forwarding_ip() test_tcp_forwarding() { - test_tcp_forwarding_ip "$1" "$2" 10.0.2.99 12345 + local pmtu="$3" + + test_tcp_forwarding_ip "$1" "$2" "$pmtu" 10.0.2.99 12345 return $? } test_tcp_forwarding_set_dscp() { - check_dscp "dscp_none" + local pmtu="$3" ip netns exec "$nsr1" nft -f - <<EOF table netdev dscpmangle {
@@ -388,8 +413,8 @@ table netdev dscpmangle { } EOF if [ $? -eq 0 ]; then - test_tcp_forwarding_ip "$1" "$2" 10.0.2.99 12345 - check_dscp "dscp_ingress" + test_tcp_forwarding_ip "$1" "$2" "$3" 10.0.2.99 12345 + check_dscp "dscp_ingress" "$pmtu" ip netns exec "$nsr1" nft delete table netdev dscpmangle else
@@ -405,10 +430,10 @@ table netdev dscpmangle { } EOF if [ $? -eq 0 ]; then - test_tcp_forwarding_ip "$1" "$2" 10.0.2.99 12345 - check_dscp "dscp_egress" + test_tcp_forwarding_ip "$1" "$2" "$pmtu" 10.0.2.99 12345 + check_dscp "dscp_egress" "$pmtu" - ip netns exec "$nsr1" nft flush table netdev dscpmangle + ip netns exec "$nsr1" nft delete table netdev dscpmangle else echo "SKIP: Could not load netdev:egress for veth1" fi
@@ -416,48 +441,53 @@ fi # partial. If flowtable really works, then both dscp-is-0 and dscp-is-cs3 # counters should have seen packets (before and after ft offload kicks in). ip netns exec "$nsr1" nft -a insert rule inet filter forward ip dscp set cs3 - test_tcp_forwarding_ip "$1" "$2" 10.0.2.99 12345 - check_dscp "dscp_fwd" + test_tcp_forwarding_ip "$1" "$2" "$pmtu" 10.0.2.99 12345 + check_dscp "dscp_fwd" "$pmtu" } test_tcp_forwarding_nat() { + local nsa="$1" + local nsb="$2" + local pmtu="$3" + local what="$4" local lret - local pmtu - test_tcp_forwarding_ip "$1" "$2" 10.0.2.99 12345 - lret=$? + [ "$pmtu" -eq 0 ] && what="$what (pmtu disabled)" - pmtu=$3 - what=$4 + test_tcp_forwarding_ip "$nsa" "$nsb" "$pmtu" 10.0.2.99 12345 + lret=$? if [ "$lret" -eq 0 ] ; then if [ "$pmtu" -eq 1 ] ;then - check_counters "flow offload for ns1/ns2 with masquerade and pmtu discovery $what" + check_counters "flow offload for ns1/ns2 with masquerade $what" else echo "PASS: flow offload for ns1/ns2 with masquerade $what" fi - test_tcp_forwarding_ip "$1" "$2" 10.6.6.6 1666 + test_tcp_forwarding_ip "$1" "$2" "$pmtu" 10.6.6.6 1666 lret=$? if [ "$pmtu" -eq 1 ] ;then - check_counters "flow offload for ns1/ns2 with dnat and pmtu discovery $what" + check_counters "flow offload for ns1/ns2 with dnat $what" elif [ "$lret" -eq 0 ] ; then echo "PASS: flow offload for ns1/ns2 with dnat $what" fi + else + echo "FAIL: flow offload for ns1/ns2 with dnat $what" fi return $lret } make_file "$nsin" "$filesize" +make_file "$nsin_small" "$filesize_small" # First test: # No PMTU discovery, nsr1 is expected to fragment packets from ns1 to ns2 as needed. # Due to MTU mismatch in both directions, all packets (except small packets like pure # acks) have to be handled by normal forwarding path. Therefore, packet counters # are not checked. -if test_tcp_forwarding "$ns1" "$ns2"; then +if test_tcp_forwarding "$ns1" "$ns2" 0; then echo "PASS: flow offloaded for ns1/ns2" else echo "FAIL: flow offload for ns1/ns2:" 1>&2
@@ -489,8 +519,9 @@ table ip nat { } EOF +check_dscp "dscp_none" "0" if ! test_tcp_forwarding_set_dscp "$ns1" "$ns2" 0 ""; then - echo "FAIL: flow offload for ns1/ns2 with dscp update" 1>&2 + echo "FAIL: flow offload for ns1/ns2 with dscp update and no pmtu discovery" 1>&2 exit 0 fi
@@ -512,6 +543,14 @@ ip netns exec "$ns2" sysctl net.ipv4.ip_no_pmtu_disc=0 > /dev/null # are lower than file size and packets were forwarded via flowtable layer. # For earlier tests (large mtus), packets cannot be handled via flowtable # (except pure acks and other small packets). +ip netns exec "$nsr1" nft reset counters table inet filter >/dev/null +ip netns exec "$ns2" nft reset counters table inet filter >/dev/null + +if ! test_tcp_forwarding_set_dscp "$ns1" "$ns2" 1 ""; then + echo "FAIL: flow offload for ns1/ns2 with dscp update and pmtu discovery" 1>&2 + exit 0 +fi + ip netns exec "$nsr1" nft reset counters table inet filter >/dev/null if ! test_tcp_forwarding_nat "$ns1" "$ns2" 1 ""; then
@@ -644,7 +683,7 @@ ip -net "$ns2" route del 192.168.10.1 via 10.0.2.1 ip -net "$ns2" route add default via 10.0.2.1 ip -net "$ns2" route add default via dead:2::1 -if test_tcp_forwarding "$ns1" "$ns2"; then +if test_tcp_forwarding "$ns1" "$ns2" 1; then check_counters "ipsec tunnel mode for ns1/ns2" else echo "FAIL: ipsec tunnel mode for ns1/ns2"
@@ -668,7 +707,7 @@ if [ "$1" = "" ]; then fi echo "re-run with random mtus and file size: -o $o -l $l -r $r -s $filesize" - $0 -o "$o" -l "$l" -r "$r" -s "$filesize" + $0 -o "$o" -l "$l" -r "$r" -s "$filesize" || ret=1 fi exit $ret
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 45/175 net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 9f74c0ea9b26d1505d55b61e36b1623dd347e1d1 ]
syzbot reported a WARNING in est_timer() [1]
Problem here is that with CONFIG_PREEMPT_RT=y, timer callbacks can be preempted.
Adopt preempt_disable_nested()/preempt_enable_nested() to fix this.
[1]
WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 __seqprop_assert include/linux/seqlock.h:221 [inline]
WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93
Modules linked in:
CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:__seqprop_assert include/linux/seqlock.h:221 [inline]
RIP: 0010:est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93
Call Trace:
<TASK>
call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers kernel/time/timer.c:2372 [inline]
__run_timer_base+0x648/0x970 kernel/time/timer.c:2384
run_timer_base kernel/time/timer.c:2393 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
handle_softirqs+0x22c/0x710 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
run_ktimerd+0xcf/0x190 kernel/softirq.c:1043
smpboot_thread_fn+0x53f/0xa60 kernel/smpboot.c:160
kthread+0x70e/0x8a0 kernel/kthread.c:463
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>--- net/core/gen_estimator.c | 2 ++ 1 file changed, 2 insertions(+)
net/core/gen_estimator.c +2 -0
@@ -90,10 +90,12 @@ static void est_timer(struct timer_list *t) rate = (b_packets - est->last_packets) << (10 - est->intvl_log); rate = (rate >> est->ewma_log) - (est->avpps >> est->ewma_log); +preempt_disable_nested ();write_seqcount_begin (&est->seq); est->avbps += brate; est->avpps += rate;write_seqcount_end (&est->seq); +preempt_enable_nested (); est->last_bytes = b_bytes; est->last_packets = b_packets;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 46/175 xirc2ps_cs: fix register access when enabling FullDuplex
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit b79e498080b170fd94fc83bca2471f450811549b ]
The current code incorrectly passes (XIRCREG1_ECR | FullDuplex) as the register address to GetByte(), instead of fetching the register value and OR-ing it with FullDuplex. This results in an invalid register access.
Fix it by reading XIRCREG1_ECR first, then or-ing with FullDuplex before writing it back.
--- drivers/net/ethernet/xircom/xirc2ps_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/xircom/xirc2ps_cs.c +1 -1
@@ -1576,7 +1576,7 @@ do_reset(struct net_device *dev, int full)msleep (40 );/* wait 40 msec to let it complete */ }if (full_duplex) -PutByte (XIRCREG1_ECR ,GetByte (XIRCREG1_ECR | FullDuplex)); +PutByte (XIRCREG1_ECR ,GetByte (XIRCREG1_ECR ) | FullDuplex); }else {/* No MII */ SelectPage (0 ); value =GetByte (XIRCREG_ESR );/* read the ESR */
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 47/175 mISDN: Fix memory leak in dsp_hwec_enable()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
[ Upstream commit 0704a3da7ce50f972e898bbda88d2692a22922d9 ]
dsp_hwec_enable() allocates dup pointer by kstrdup(arg), but then it updates dup variable by strsep(&dup, ","). As a result when it calls kfree(dup), the dup variable may be a modified pointer that no longer points to the original allocated memory, causing a memory leak.
The issue is the same pattern as fixed in commit c6a502c22999 ("mISDN: Fix memory leak in dsp_pipeline_build()").
--- drivers/isdn/mISDN/dsp_hwec.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/isdn/mISDN/dsp_hwec.c +3 -3
@@ -51,14 +51,14 @@ void dsp_hwec_enable(struct dsp *dsp, const char *arg) goto _do; { -char *dup, *tok, *name, *val; +char *dup, *next, *tok, *name, *val;int tmp; - dup =kstrdup (arg,GFP_ATOMIC ); + dup = next =kstrdup (arg,GFP_ATOMIC );if (!dup)return ; -while ((tok =strsep (&dup,"," ))) { +while ((tok =strsep (&next,"," ))) {if (!strlen (tok))continue ; name =strsep (&tok,"=" );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 48/175 selftests: drv-net: csum: fix interface name for remote host
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 49c2502b5946ebf454d7e16fd0189769a82b6117 ]
Use cfg.remote_ifname for arguments of remote command. Without this UDP tests fail in NIPA where local interface is called enp1s0 and remote enp0s4.
--- tools/testing/selftests/drivers/net/hw/csum.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/drivers/net/hw/csum.py +2 -2
@@ -20,7 +20,7 @@ def test_receive(cfg, ipv4=False, extra_args=None): ip_args = f"-6 -S {cfg.remote_v6} -D {cfg.v6}" rx_cmd = f"{cfg.bin_local} -i {cfg.ifname} -n 100 {ip_args} -r 1 -R {extra_args}" - tx_cmd = f"{cfg.bin_remote} -i {cfg.ifname} -n 100 {ip_args} -r 1 -T {extra_args}" + tx_cmd = f"{cfg.bin_remote} -i {cfg.remote_ifname} -n 100 {ip_args} -r 1 -T {extra_args}" with bkg(rx_cmd, exit_wait=True): wait_port_listen(34000, proto="udp")
@@ -43,7 +43,7 @@ def test_transmit(cfg, ipv4=False, extra_args=None): if extra_args != "-U -Z": extra_args += " -r 1" - rx_cmd = f"{cfg.bin_remote} -i {cfg.ifname} -L 1 -n 100 {ip_args} -R {extra_args}" + rx_cmd = f"{cfg.bin_remote} -i {cfg.remote_ifname} -L 1 -n 100 {ip_args} -R {extra_args}" tx_cmd = f"{cfg.bin_local} -i {cfg.ifname} -L 1 -n 100 {ip_args} -T {extra_args}" with bkg(rx_cmd, host=cfg.remote, exit_wait=True):
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 49/175 bnxt_en: fix incorrect page count in RX aggr ring log
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 7000f4fa9b24ae2511b07babd0d49e888db5d265 ]
The warning in bnxt_alloc_one_rx_ring_netmem() reports the number of pages allocated for the RX aggregation ring. However, it mistakenly used bp->rx_ring_size instead of bp->rx_agg_ring_size, leading to confusing or misleading log output.
Use the correct bp->rx_agg_ring_size value to fix this.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +1 -1
@@ -4207,7 +4207,7 @@ static void bnxt_alloc_one_rx_ring_page(struct bnxt *bp,for (i =0 ; i < bp->rx_agg_ring_size; i++) {if (bnxt_alloc_rx_page (bp, rxr, prod,GFP_KERNEL )) {netdev_warn (bp->dev,"init'ed rx ring %d with %d/%d pages only\n" , - ring_nr, i, bp->rx_ring_size); + ring_nr, i, bp->rx_agg_ring_size);break ; } prod =NEXT_RX_AGG (prod);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 50/175 icmp: fix icmp_ndo_send address translation for reply direction
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabian Bläse <[email protected]>
[ Upstream commit c6dd1aa2cbb72b33e0569f3e71d95792beab5042 ]
The icmp_ndo_send function was originally introduced to ensure proper rate limiting when icmp_send is called by a network device driver, where the packet's source address may have already been transformed by SNAT.
However, the original implementation only considers the IP_CT_DIR_ORIGINAL direction for SNAT and always replaced the packet's source address with that of the original-direction tuple. This causes two problems:
1. For SNAT:
Reply-direction packets were incorrectly translated using the source address of the CT original direction, even though no translation is required.
2. For DNAT:
Reply-direction packets were not handled at all. In DNAT, the original direction's destination is translated. Therefore, in the reply direction the source address must be set to the reply-direction source, so rate limiting works as intended.
Fix this by using the connection direction to select the correct tuple for source address translation, and adjust the pre-checks to handle reply-direction packets in case of DNAT.
Additionally, wrap the ct->status access in READ_ONCE(). This avoids possible KCSAN reports about concurrent updates to ct->status.
--- net/ipv4/icmp.c | 6 ++++-- net/ipv6/ip6_icmp.c | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-)
net/ipv4/icmp.c +4 -2
@@ -799,11 +799,12 @@ void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info)struct sk_buff *cloned_skb =NULL ;struct ip_options opts = {0 };enum ip_conntrack_info ctinfo; +enum ip_conntrack_dir dir;struct nf_conn *ct;__be32 orig_ip; ct =nf_ct_get (skb_in, &ctinfo); -if (!ct || !(ct->status &IPS_SRC_NAT )) { +if (!ct || !(READ_ONCE (ct->status) &IPS_NAT_MASK )) {__icmp_send (skb_in, type, code, info, &opts);return ; }
@@ -818,7 +819,8 @@ void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info) goto out; orig_ip =ip_hdr (skb_in)->saddr; -ip_hdr (skb_in)->saddr = ct->tuplehash[0 ].tuple.src.u3.ip; + dir =CTINFO2DIR (ctinfo); +ip_hdr (skb_in)->saddr = ct->tuplehash[dir].tuple.src.u3.ip;__icmp_send (skb_in, type, code, info, &opts);ip_hdr (skb_in)->saddr = orig_ip; out:
net/ipv6/ip6_icmp.c +4 -2
@@ -54,11 +54,12 @@ void icmpv6_ndo_send(struct sk_buff *skb_in, u8 type, u8 code, __u32 info)struct inet6_skb_parm parm = {0 };struct sk_buff *cloned_skb =NULL ;enum ip_conntrack_info ctinfo; +enum ip_conntrack_dir dir;struct in6_addr orig_ip;struct nf_conn *ct; ct =nf_ct_get (skb_in, &ctinfo); -if (!ct || !(ct->status &IPS_SRC_NAT )) { +if (!ct || !(READ_ONCE (ct->status) &IPS_NAT_MASK )) {__icmpv6_send (skb_in, type, code, info, &parm);return ; }
@@ -73,7 +74,8 @@ void icmpv6_ndo_send(struct sk_buff *skb_in, u8 type, u8 code, __u32 info) goto out; orig_ip =ipv6_hdr (skb_in)->saddr; -ipv6_hdr (skb_in)->saddr = ct->tuplehash[0 ].tuple.src.u3.in6; + dir =CTINFO2DIR (ctinfo); +ipv6_hdr (skb_in)->saddr = ct->tuplehash[dir].tuple.src.u3.in6;__icmpv6_send (skb_in, type, code, info, &parm);ipv6_hdr (skb_in)->saddr = orig_ip; out:
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 51/175 net: macb: Fix tx_ptr_lock locking
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit 6bc8a5098bf4a365c4086a4a4130bfab10a58260 ]
macb_start_xmit and macb_tx_poll can be called with bottom-halves disabled (e.g. from softirq) as well as with interrupts disabled (with netpoll). Because of this, all other functions taking tx_ptr_lock must use spin_lock_irqsave.
--- drivers/net/ethernet/cadence/macb_main.c | 28 ++++++++++++++---------- 1 file changed, 16 insertions(+), 12 deletions(-)
drivers/net/ethernet/cadence/macb_main.c +16 -12
@@ -1234,11 +1234,12 @@ static int macb_tx_complete(struct macb_queue *queue, int budget) {struct macb *bp = queue->bp;u16 queue_index = queue - bp->queues; +unsigned long flags;unsigned int tail;unsigned int head;int packets =0 ; -spin_lock (&queue->tx_ptr_lock); +spin_lock_irqsave (&queue->tx_ptr_lock, flags); head = queue->tx_head;for (tail = queue->tx_tail; tail != head && packets < budget; tail++) {struct macb_tx_skb *tx_skb;
@@ -1297,7 +1298,7 @@ static int macb_tx_complete(struct macb_queue *queue, int budget) CIRC_CNT(queue->tx_head, queue->tx_tail, bp->tx_ring_size) <= MACB_TX_WAKEUP_THRESH(bp))netif_wake_subqueue (bp->dev, queue_index); -spin_unlock (&queue->tx_ptr_lock); +spin_unlock_irqrestore (&queue->tx_ptr_lock, flags);return packets; }
@@ -1713,8 +1714,9 @@ static void macb_tx_restart(struct macb_queue *queue) {struct macb *bp = queue->bp;unsigned int head_idx, tbqp; +unsigned long flags; -spin_lock (&queue->tx_ptr_lock); +spin_lock_irqsave (&queue->tx_ptr_lock, flags);if (queue->tx_head == queue->tx_tail) goto out_tx_ptr_unlock;
@@ -1726,19 +1728,20 @@ static void macb_tx_restart(struct macb_queue *queue)if (tbqp == head_idx) goto out_tx_ptr_unlock; -spin_lock_irq (&bp->lock); +spin_lock (&bp->lock);macb_writel (bp,NCR ,macb_readl (bp,NCR ) |MACB_BIT (TSTART )); -spin_unlock_irq (&bp->lock); +spin_unlock (&bp->lock); out_tx_ptr_unlock: -spin_unlock (&queue->tx_ptr_lock); +spin_unlock_irqrestore (&queue->tx_ptr_lock, flags); }static bool macb_tx_complete_pending (struct macb_queue *queue) {bool retval = false; +unsigned long flags; -spin_lock (&queue->tx_ptr_lock); +spin_lock_irqsave (&queue->tx_ptr_lock, flags);if (queue->tx_head != queue->tx_tail) {/* Make hw descriptor updates visible to CPU */ rmb ();
@@ -1746,7 +1749,7 @@ static bool macb_tx_complete_pending(struct macb_queue *queue)if (macb_tx_desc (queue, queue->tx_tail)->ctrl &MACB_BIT (TX_USED )) retval = true; } -spin_unlock (&queue->tx_ptr_lock); +spin_unlock_irqrestore (&queue->tx_ptr_lock, flags);return retval; }
@@ -2314,6 +2317,7 @@ static netdev_tx_t macb_start_xmit(struct sk_buff *skb, struct net_device *dev)struct macb_queue *queue = &bp->queues[queue_index];unsigned int desc_cnt, nr_frags, frag_size, f;unsigned int hdrlen; +unsigned long flags;bool is_lso;netdev_tx_t ret =NETDEV_TX_OK ;
@@ -2374,7 +2378,7 @@ static netdev_tx_t macb_start_xmit(struct sk_buff *skb, struct net_device *dev) desc_cnt +=DIV_ROUND_UP (frag_size, bp->max_tx_length); } -spin_lock_bh (&queue->tx_ptr_lock); +spin_lock_irqsave (&queue->tx_ptr_lock, flags);/* This is a hard error, log it. */ if (CIRC_SPACE(queue->tx_head, queue->tx_tail,
@@ -2396,15 +2400,15 @@ static netdev_tx_t macb_start_xmit(struct sk_buff *skb, struct net_device *dev)wmb ();skb_tx_timestamp (skb); -spin_lock_irq (&bp->lock); +spin_lock (&bp->lock);macb_writel (bp,NCR ,macb_readl (bp,NCR ) |MACB_BIT (TSTART )); -spin_unlock_irq (&bp->lock); +spin_unlock (&bp->lock);if (CIRC_SPACE (queue->tx_head, queue->tx_tail, bp->tx_ring_size) <1 )netif_stop_subqueue (dev, queue_index); unlock: -spin_unlock_bh (&queue->tx_ptr_lock); +spin_unlock_irqrestore (&queue->tx_ptr_lock, flags);return ret; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 52/175 macsec: read MACSEC_SA_ATTR_PN with nla_get_uint
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 030e1c45666629f72d0fc1d040f9d2915680de8e ]
The code currently reads both U32 attributes and U64 attributes as U64, so when a U32 attribute is provided by userspace (ie, when not using XPN), on big endian systems, we'll load that value into the upper 32bits of the next_pn field instead of the lower 32bits. This means that the value that userspace provided is ignored (we only care about the lower 32bits for non-XPN), and we'll start using PNs from 0.
Switch to nla_get_uint, which will read the value correctly on all arches, whether it's 32b or 64b.
--- drivers/net/macsec.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/macsec.c +4 -4
@@ -1843,7 +1843,7 @@ static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info)if (tb_sa[MACSEC_SA_ATTR_PN ]) {spin_lock_bh (&rx_sa->lock); - rx_sa->next_pn =nla_get_u64 (tb_sa[MACSEC_SA_ATTR_PN ]); + rx_sa->next_pn =nla_get_uint (tb_sa[MACSEC_SA_ATTR_PN ]);spin_unlock_bh (&rx_sa->lock); }
@@ -2085,7 +2085,7 @@ static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info) }spin_lock_bh (&tx_sa->lock); - tx_sa->next_pn =nla_get_u64 (tb_sa[MACSEC_SA_ATTR_PN ]); + tx_sa->next_pn =nla_get_uint (tb_sa[MACSEC_SA_ATTR_PN ]);spin_unlock_bh (&tx_sa->lock);if (tb_sa[MACSEC_SA_ATTR_ACTIVE ])
@@ -2397,7 +2397,7 @@ static int macsec_upd_txsa(struct sk_buff *skb, struct genl_info *info)spin_lock_bh (&tx_sa->lock); prev_pn = tx_sa->next_pn_halves; - tx_sa->next_pn =nla_get_u64 (tb_sa[MACSEC_SA_ATTR_PN ]); + tx_sa->next_pn =nla_get_uint (tb_sa[MACSEC_SA_ATTR_PN ]);spin_unlock_bh (&tx_sa->lock); }
@@ -2495,7 +2495,7 @@ static int macsec_upd_rxsa(struct sk_buff *skb, struct genl_info *info)spin_lock_bh (&rx_sa->lock); prev_pn = rx_sa->next_pn_halves; - rx_sa->next_pn =nla_get_u64 (tb_sa[MACSEC_SA_ATTR_PN ]); + rx_sa->next_pn =nla_get_uint (tb_sa[MACSEC_SA_ATTR_PN ]);spin_unlock_bh (&rx_sa->lock); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 53/175 net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Jian <[email protected]>
[ Upstream commit ba1e9421cf1a8369d25c3832439702a015d6b5f9 ]
BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded Tainted: G OE 6.17.0-rc2+ #9 NONE Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Workqueue: smc_hs_wq smc_listen_work [smc] RIP: 0010:smc_ib_is_sg_need_sync+0x9e/0xd0 [smc] ... Call Trace: <TASK> smcr_buf_map_link+0x211/0x2a0 [smc] __smc_buf_create+0x522/0x970 [smc] smc_buf_create+0x3a/0x110 [smc] smc_find_rdma_v2_device_serv+0x18f/0x240 [smc] ? smc_vlan_by_tcpsk+0x7e/0xe0 [smc] smc_listen_find_device+0x1dd/0x2b0 [smc] smc_listen_work+0x30f/0x580 [smc] process_one_work+0x18c/0x340 worker_thread+0x242/0x360 kthread+0xe7/0x220 ret_from_fork+0x13a/0x160 ret_from_fork_asm+0x1a/0x30 </TASK>
If the software RoCE device is used, ibdev->dma_device is a null pointer. As a result, the problem occurs. Null pointer detection is added to prevent problems.
--- net/smc/smc_ib.c | 3 +++ 1 file changed, 3 insertions(+)
net/smc/smc_ib.c +3 -0
@@ -743,6 +743,9 @@ bool smc_ib_is_sg_need_sync(struct smc_link *lnk,unsigned int i;bool ret = false; +if (!lnk->smcibdev->ibdev->dma_device) +return ret; +/* for now there is just one DMA address */ for_each_sg (buf_slot->sgt[lnk->link_idx].sgl, sg, buf_slot->sgt[lnk->link_idx].nents, i) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 54/175 net: mctp: mctp_fraq_queue should take ownership of passed skb
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Kerr <[email protected]>
[ Upstream commit 773b27a8a2f00ce3134e92e50ea4794a98ba2b76 ]
As of commit f5d83cf0eeb9 ("net: mctp: unshare packets when reassembling"), we skb_unshare() in mctp_frag_queue(). The unshare may invalidate the original skb pointer, so we need to treat the skb as entirely owned by the fraq queue, even on failure.
--- net/mctp/route.c | 35 +++++++++++++++++++---------------- 1 file changed, 19 insertions(+), 16 deletions(-)
net/mctp/route.c +19 -16
@@ -325,6 +325,7 @@ static void mctp_skb_set_flow(struct sk_buff *skb, struct mctp_sk_key *key) {}static void mctp_flow_prepare_output (struct sk_buff *skb,struct mctp_dev *dev) {}#endif +/* takes ownership of skb, both in success and failure cases */ static int mctp_frag_queue (struct mctp_sk_key *key,struct sk_buff *skb) {struct mctp_hdr *hdr =mctp_hdr (skb);
@@ -334,8 +335,10 @@ static int mctp_frag_queue(struct mctp_sk_key *key, struct sk_buff *skb) &MCTP_HDR_SEQ_MASK ;if (!key->reasm_head) { -/* Since we're manipulating the shared frag_list, ensure it isn't -* shared with any other SKBs. +/* Since we're manipulating the shared frag_list, ensure it +* isn't shared with any other SKBs. In the cloned case, +* this will free the skb; callers can no longer access it +* safely. */ key->reasm_head =skb_unshare (skb,GFP_ATOMIC );if (!key->reasm_head)
@@ -349,10 +352,10 @@ static int mctp_frag_queue(struct mctp_sk_key *key, struct sk_buff *skb) exp_seq = (key->last_seq +1 ) &MCTP_HDR_SEQ_MASK ;if (this_seq != exp_seq) -return -EINVAL ; + goto err_free;if (key->reasm_head->len + skb->len > mctp_message_maxlen) -return -EINVAL ; + goto err_free; skb->next =NULL ; skb->sk =NULL ;
@@ -366,6 +369,10 @@ static int mctp_frag_queue(struct mctp_sk_key *key, struct sk_buff *skb) key->reasm_head->truesize += skb->truesize;return 0 ; + +err_free: +kfree_skb (skb); +return -EINVAL ; }static int mctp_route_input (struct mctp_route *route,struct sk_buff *skb)
@@ -476,18 +483,16 @@ static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb)* key isn't observable yet */ mctp_frag_queue (key, skb); + skb =NULL ;/* if the key_add fails, we've raced with another * SOM packet with the same src, dest and tag. There's * no way to distinguish future packets, so all we -* can do is drop; we'll free the skb on exit from -* this function. +* can do is drop. */ rc =mctp_key_add (key, msk); -if (!rc) { +if (!rc)trace_mctp_key_acquire (key); - skb =NULL ; - }/* we don't need to release key->lock on exit, so * clean up here and suppress the unlock via
@@ -505,8 +510,7 @@ static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb) key =NULL ; }else { rc =mctp_frag_queue (key, skb); -if (!rc) - skb =NULL ; + skb =NULL ; } }
@@ -516,17 +520,16 @@ static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb)*/ /* we need to be continuing an existing reassembly... */ -if (!key->reasm_head) +if (!key->reasm_head) { rc = -EINVAL ; -else + }else { rc =mctp_frag_queue (key, skb); + skb =NULL ; + }if (rc) goto out_unlock; -/* we've queued; the queue owns the skb now */ - skb =NULL ; -/* end of message? deliver to socket, and we're done with * the reassembly/response key */
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 55/175 ice: fix NULL access of tx->in_use in ice_ll_ts_intr
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <[email protected]>
[ Upstream commit f6486338fde3f04ed0ec59fe67a69a208c32734f ]
Recent versions of the E810 firmware have support for an extra interrupt to handle report of the "low latency" Tx timestamps coming from the specialized low latency firmware interface. Instead of polling the registers, software can wait until the low latency interrupt is fired.
This logic makes use of the Tx timestamp tracking structure, ice_ptp_tx, as it uses the same "ready" bitmap to track which Tx timestamps complete.
Unfortunately, the ice_ll_ts_intr() function does not check if the tracker is initialized before its first access. This results in NULL dereference or use-after-free bugs similar to the issues fixed in the ice_ptp_ts_irq() function.
Fix this by only checking the in_use bitmap (and other fields) if the tracker is marked as initialized. The reset flow will clear the init field under lock before it tears the tracker down, thus preventing any use-after-free or NULL access.
--- drivers/net/ethernet/intel/ice/ice_main.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/net/ethernet/intel/ice/ice_main.c +7 -5
@@ -3193,12 +3193,14 @@ static irqreturn_t ice_ll_ts_intr(int __always_unused irq, void *data) hw = &pf->hw; tx = &pf->ptp.port.tx;spin_lock_irqsave (&tx->lock, flags); -ice_ptp_complete_tx_single_tstamp (tx); +if (tx->init) { +ice_ptp_complete_tx_single_tstamp (tx); - idx =find_next_bit_wrap (tx->in_use, tx->len, - tx->last_ll_ts_idx_read +1 ); -if (idx != tx->len) -ice_ptp_req_tx_single_tstamp (tx, idx); + idx =find_next_bit_wrap (tx->in_use, tx->len, + tx->last_ll_ts_idx_read +1 ); +if (idx != tx->len) +ice_ptp_req_tx_single_tstamp (tx, idx); + }spin_unlock_irqrestore (&tx->lock, flags); val = GLINT_DYN_CTL_INTENA_M | GLINT_DYN_CTL_CLEARPBA_M |
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 56/175 idpf: set mac type when adding and removing MAC filters
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Tantilov <[email protected]>
[ Upstream commit acf3a5c8be80fe238c1a7629db1c21c74a1f9dd4 ]
On control planes that allow changing the MAC address of the interface, the driver must provide a MAC type to avoid errors such as:
idpf 0000:0a:00.0: Transaction failed (op 535)
idpf 0000:0a:00.0: Received invalid MAC filter payload (op 535) (len 0) idpf 0000:0a:00.0: Transaction failed (op 536)
These errors occur during driver load or when changing the MAC via:
ip link set <iface> address <mac>
Add logic to set the MAC type when sending ADD/DEL (opcodes 535/536) to the control plane. Since only one primary MAC is supported per vport, the driver only needs to send an ADD opcode when setting it. Remove the old address by calling __idpf_del_mac_filter(), which skips the message and just clears the entry from the internal list. This avoids an error on DEL as it attempts to remove an address already cleared by the preceding ADD opcode.
--- drivers/net/ethernet/intel/idpf/idpf_lib.c | 9 ++++++--- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 12 ++++++++++++ 2 files changed, 18 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/idpf/idpf_lib.c +6 -3
@@ -2278,6 +2278,7 @@ static int idpf_set_mac(struct net_device *netdev, void *p)struct idpf_netdev_priv *np =netdev_priv (netdev);struct idpf_vport_config *vport_config;struct sockaddr *addr = p; +u8 old_mac_addr[ETH_ALEN ];struct idpf_vport *vport;int err =0 ;
@@ -2301,17 +2302,19 @@ static int idpf_set_mac(struct net_device *netdev, void *p)if (ether_addr_equal (netdev->dev_addr, addr->sa_data)) goto unlock_mutex; +ether_addr_copy (old_mac_addr, vport->default_mac_addr); +ether_addr_copy (vport->default_mac_addr, addr->sa_data); vport_config = vport->adapter->vport_config[vport->idx]; err =idpf_add_mac_filter (vport, np, addr->sa_data, false);if (err) {__idpf_del_mac_filter (vport_config, addr->sa_data); +ether_addr_copy (vport->default_mac_addr, netdev->dev_addr); goto unlock_mutex; } -if (is_valid_ether_addr (vport->default_mac_addr)) -idpf_del_mac_filter (vport, np, vport->default_mac_addr, false); +if (is_valid_ether_addr (old_mac_addr)) +__idpf_del_mac_filter (vport_config, old_mac_addr); -ether_addr_copy (vport->default_mac_addr, addr->sa_data);eth_hw_addr_set (netdev, addr->sa_data); unlock_mutex:
drivers/net/ethernet/intel/idpf/idpf_virtchnl.c +12 -0
@@ -3513,6 +3513,16 @@ u32 idpf_get_vport_id(struct idpf_vport *vport)return le32_to_cpu (vport_msg->vport_id); } +static void idpf_set_mac_type (struct idpf_vport *vport, +struct virtchnl2_mac_addr *mac_addr) +{ +bool is_primary; + + is_primary =ether_addr_equal (vport->default_mac_addr, mac_addr->addr); + mac_addr->type = is_primary ?VIRTCHNL2_MAC_ADDR_PRIMARY : +VIRTCHNL2_MAC_ADDR_EXTRA ; +} +/** * idpf_mac_filter_async_handler - Async callback for mac filters * @adapter: private data struct
@@ -3642,6 +3652,7 @@ int idpf_add_del_mac_filters(struct idpf_vport *vport, list) {if (add && f->add) {ether_addr_copy (mac_addr[i].addr, f->macaddr); +idpf_set_mac_type (vport, &mac_addr[i]); i++; f->add = false;if (i == total_filters)
@@ -3649,6 +3660,7 @@ int idpf_add_del_mac_filters(struct idpf_vport *vport, }if (!add && f->remove) {ether_addr_copy (mac_addr[i].addr, f->macaddr); +idpf_set_mac_type (vport, &mac_addr[i]); i++; f->remove = false;if (i == total_filters)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 57/175 i40e: remove read access to debugfs files
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <[email protected]>
[ Upstream commit 9fcdb1c3c4ba134434694c001dbff343f1ffa319 ]
The 'command' and 'netdev_ops' debugfs files are a legacy debugging interface supported by the i40e driver since its early days by commit 02e9c290814c ("i40e: debugfs interface").
Both of these debugfs files provide a read handler which is mostly useless, and which is implemented with questionable logic. They both use a static 256 byte buffer which is initialized to the empty string. In the case of the 'command' file this buffer is literally never used and simply wastes space. In the case of the 'netdev_ops' file, the last command written is saved here.
On read, the files contents are presented as the name of the device followed by a colon and then the contents of their respective static buffer. For 'command' this will always be "<device>: ". For 'netdev_ops', this will be "<device>: <last command written>". But note the buffer is shared between all devices operated by this module. At best, it is mostly meaningless information, and at worse it could be accessed simultaneously as there doesn't appear to be any locking mechanism.
We have also recently received multiple reports for both read functions about their use of snprintf and potential overflow that could result in reading arbitrary kernel memory. For the 'command' file, this is definitely impossible, since the static buffer is always zero and never written to. For the 'netdev_ops' file, it does appear to be possible, if the user carefully crafts the command input, it will be copied into the buffer, which could be large enough to cause snprintf to truncate, which then causes the copy_to_user to read beyond the length of the buffer allocated by kzalloc.
A minimal fix would be to replace snprintf() with scnprintf() which would cap the return to the number of bytes written, preventing an overflow. A more involved fix would be to drop the mostly useless static buffers, saving 512 bytes and modifying the read functions to stop needing those as input.
Instead, lets just completely drop the read access to these files. These are debug interfaces exposed as part of debugfs, and I don't believe that dropping read access will break any script, as the provided output is pretty useless. You can find the netdev name through other more standard interfaces, and the 'netdev_ops' interface can easily result in garbage if you issue simultaneous writes to multiple devices at once.
In order to properly remove the i40e_dbg_netdev_ops_buf, we need to refactor its write function to avoid using the static buffer. Instead, use the same logic as the i40e_dbg_command_write, with an allocated buffer. Update the code to use this instead of the static buffer, and ensure we free the buffer on exit. This fixes simultaneous writes to 'netdev_ops' on multiple devices, and allows us to remove the now unused static buffer along with removing the read access.
--- .../net/ethernet/intel/i40e/i40e_debugfs.c | 123 +++--------------- 1 file changed, 19 insertions(+), 104 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_debugfs.c +19 -104
@@ -40,48 +40,6 @@ static struct i40e_vsi *i40e_dbg_find_vsi(struct i40e_pf *pf, int seid)* setup, adding or removing filters, or other things. Many of * these will be useful for some forms of unit testing. **************************************************************/ -static char i40e_dbg_command_buf[256 ] ="" ; - -/** -* i40e_dbg_command_read - read for command datum -* @filp: the opened file -* @buffer: where to write the data for the user to read -* @count: the size of the user's buffer -* @ppos: file position offset -**/ -static ssize_t i40e_dbg_command_read (struct file *filp,char __user *buffer, -size_t count,loff_t *ppos) -{ -struct i40e_pf *pf = filp->private_data; -struct i40e_vsi *main_vsi; -int bytes_not_copied; -int buf_size =256 ; -char *buf; -int len; - -/* don't allow partial reads */ -if (*ppos !=0 ) -return 0 ; -if (count < buf_size) -return -ENOSPC ; - - buf =kzalloc (buf_size,GFP_KERNEL ); -if (!buf) -return -ENOSPC ; - - main_vsi =i40e_pf_get_main_vsi (pf); - len =snprintf (buf, buf_size,"%s: %s\n" , main_vsi->netdev->name, - i40e_dbg_command_buf); - - bytes_not_copied =copy_to_user (buffer, buf, len); -kfree (buf); - -if (bytes_not_copied) -return -EFAULT ; - - *ppos = len; -return len; -}static char *i40e_filter_state_string[] = {"INVALID" ,
@@ -1621,7 +1579,6 @@ static ssize_t i40e_dbg_command_write(struct file *filp,static const struct file_operations i40e_dbg_command_fops = { .owner =THIS_MODULE , .open = simple_open, - .read = i40e_dbg_command_read, .write = i40e_dbg_command_write, };
@@ -1630,48 +1587,6 @@ static const struct file_operations i40e_dbg_command_fops = {* The netdev_ops entry in debugfs is for giving the driver commands * to be executed from the netdev operations. **************************************************************/ -static char i40e_dbg_netdev_ops_buf[256 ] ="" ; - -/** -* i40e_dbg_netdev_ops_read - read for netdev_ops datum -* @filp: the opened file -* @buffer: where to write the data for the user to read -* @count: the size of the user's buffer -* @ppos: file position offset -**/ -static ssize_t i40e_dbg_netdev_ops_read (struct file *filp,char __user *buffer, -size_t count,loff_t *ppos) -{ -struct i40e_pf *pf = filp->private_data; -struct i40e_vsi *main_vsi; -int bytes_not_copied; -int buf_size =256 ; -char *buf; -int len; - -/* don't allow partal reads */ -if (*ppos !=0 ) -return 0 ; -if (count < buf_size) -return -ENOSPC ; - - buf =kzalloc (buf_size,GFP_KERNEL ); -if (!buf) -return -ENOSPC ; - - main_vsi =i40e_pf_get_main_vsi (pf); - len =snprintf (buf, buf_size,"%s: %s\n" , main_vsi->netdev->name, - i40e_dbg_netdev_ops_buf); - - bytes_not_copied =copy_to_user (buffer, buf, len); -kfree (buf); - -if (bytes_not_copied) -return -EFAULT ; - - *ppos = len; -return len; -}/** * i40e_dbg_netdev_ops_write - write into netdev_ops datum
@@ -1685,35 +1600,36 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp, size_t count, loff_t *ppos) { struct i40e_pf *pf = filp->private_data; +char *cmd_buf, *buf_tmp;int bytes_not_copied;struct i40e_vsi *vsi; -char *buf_tmp;int vsi_seid;int i, cnt;/* don't allow partial writes */ if (*ppos !=0 )return 0 ; -if (count >=sizeof (i40e_dbg_netdev_ops_buf)) -return -ENOSPC ; -memset (i40e_dbg_netdev_ops_buf,0 ,sizeof (i40e_dbg_netdev_ops_buf)); - bytes_not_copied =copy_from_user (i40e_dbg_netdev_ops_buf, - buffer, count); -if (bytes_not_copied) + cmd_buf =kzalloc (count +1 ,GFP_KERNEL ); +if (!cmd_buf) +return count; + bytes_not_copied =copy_from_user (cmd_buf, buffer, count); +if (bytes_not_copied) { +kfree (cmd_buf);return -EFAULT ; - i40e_dbg_netdev_ops_buf[count] ='\0' ; + } + cmd_buf[count] ='\0' ; - buf_tmp =strchr (i40e_dbg_netdev_ops_buf,'\n' ); + buf_tmp =strchr (cmd_buf,'\n' );if (buf_tmp) { *buf_tmp ='\0' ; - count = buf_tmp - i40e_dbg_netdev_ops_buf +1 ; + count = buf_tmp - cmd_buf +1 ; } -if (strncmp (i40e_dbg_netdev_ops_buf,"change_mtu" ,10 ) ==0 ) { +if (strncmp (cmd_buf,"change_mtu" ,10 ) ==0 ) {int mtu; - cnt =sscanf (&i40e_dbg_netdev_ops_buf[11 ],"%i %i" , + cnt =sscanf (&cmd_buf[11 ],"%i %i" , &vsi_seid, &mtu);if (cnt !=2 ) {dev_info (&pf->pdev->dev,"change_mtu <vsi_seid> <mtu>\n" );
@@ -1735,8 +1651,8 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp,dev_info (&pf->pdev->dev,"Could not acquire RTNL - please try again\n" ); } - }else if (strncmp (i40e_dbg_netdev_ops_buf,"set_rx_mode" ,11 ) ==0 ) { - cnt =sscanf (&i40e_dbg_netdev_ops_buf[11 ],"%i" , &vsi_seid); + }else if (strncmp (cmd_buf,"set_rx_mode" ,11 ) ==0 ) { + cnt =sscanf (&cmd_buf[11 ],"%i" , &vsi_seid);if (cnt !=1 ) {dev_info (&pf->pdev->dev,"set_rx_mode <vsi_seid>\n" ); goto netdev_ops_write_done;
@@ -1756,8 +1672,8 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp,dev_info (&pf->pdev->dev,"Could not acquire RTNL - please try again\n" ); } - }else if (strncmp (i40e_dbg_netdev_ops_buf,"napi" ,4 ) ==0 ) { - cnt =sscanf (&i40e_dbg_netdev_ops_buf[4 ],"%i" , &vsi_seid); + }else if (strncmp (cmd_buf,"napi" ,4 ) ==0 ) { + cnt =sscanf (&cmd_buf[4 ],"%i" , &vsi_seid);if (cnt !=1 ) {dev_info (&pf->pdev->dev,"napi <vsi_seid>\n" ); goto netdev_ops_write_done;
@@ -1775,21 +1691,20 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp,dev_info (&pf->pdev->dev,"napi called\n" ); } }else { -dev_info (&pf->pdev->dev,"unknown command '%s'\n" , - i40e_dbg_netdev_ops_buf); +dev_info (&pf->pdev->dev,"unknown command '%s'\n" , cmd_buf);dev_info (&pf->pdev->dev,"available commands\n" );dev_info (&pf->pdev->dev," change_mtu <vsi_seid> <mtu>\n" );dev_info (&pf->pdev->dev," set_rx_mode <vsi_seid>\n" );dev_info (&pf->pdev->dev," napi <vsi_seid>\n" ); } netdev_ops_write_done: +kfree (cmd_buf);return count; }static const struct file_operations i40e_dbg_netdev_ops_fops = { .owner =THIS_MODULE , .open = simple_open, - .read = i40e_dbg_netdev_ops_read, .write = i40e_dbg_netdev_ops_write, };
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 58/175 i40e: Fix potential invalid access when MAC list is empty
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
[ Upstream commit a556f06338e1d5a85af0e32ecb46e365547f92b9 ]
list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced.
Fix this by using list_first_entry_or_null instead of list_first_entry.
--- drivers/net/ethernet/intel/i40e/i40e_client.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_client.c +2 -2
@@ -359,8 +359,8 @@ static void i40e_client_add_instance(struct i40e_pf *pf)if (i40e_client_get_params (vsi, &cdev->lan_info.params)) goto free_cdev; - mac =list_first_entry (&cdev->lan_info.netdev->dev_addrs.list, - struct netdev_hw_addr, list); + mac =list_first_entry_or_null (&cdev->lan_info.netdev->dev_addrs.list, + struct netdev_hw_addr, list);if (mac)ether_addr_copy (cdev->lan_info.lanmac, mac->addr);else
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 59/175 ixgbe: fix incorrect map used in eee linkmode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit b7e5c3e3bfa9dc8af75ff6d8633ad7070e1985e4 ]
incorrectly used ixgbe_lp_map in loops intended to populate the supported and advertised EEE linkmode bitmaps based on ixgbe_ls_map. This results in incorrect bit setting and potential out-of-bounds access, since ixgbe_lp_map and ixgbe_ls_map have different sizes and purposes.
ixgbe_lp_map[i] -> ixgbe_ls_map[i]
Use ixgbe_ls_map for supported and advertised linkmodes, and keep ixgbe_lp_map usage only for link partner (lp_advertised) mapping.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +2 -2
@@ -3443,13 +3443,13 @@ ixgbe_get_eee_fw(struct ixgbe_adapter *adapter, struct ethtool_keee *edata)for (i =0 ; i <ARRAY_SIZE (ixgbe_ls_map); ++i) {if (hw->phy.eee_speeds_supported & ixgbe_ls_map[i].mac_speed) -linkmode_set_bit (ixgbe_lp_map[i].link_mode, +linkmode_set_bit (ixgbe_ls_map[i].link_mode, edata->supported); }for (i =0 ; i <ARRAY_SIZE (ixgbe_ls_map); ++i) {if (hw->phy.eee_speeds_advertised & ixgbe_ls_map[i].mac_speed) -linkmode_set_bit (ixgbe_lp_map[i].link_mode, +linkmode_set_bit (ixgbe_ls_map[i].link_mode, edata->advertised); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 60/175 wifi: ath11k: fix group data packet drops during rekey
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rameshkumar Sundaram <[email protected]>
[ Upstream commit 97acb0259cc9cbfbd7ab689e25684f3d8ce10e26 ]
During GTK rekey, mac80211 issues a clear key (if the old key exists) followed by an install key operation in the same context. This causes ath11k to send two WMI commands in quick succession: one to clear the old key and another to install the new key in the same slot.
Under certain conditions—especially under high load or time sensitive scenarios, firmware may process these commands asynchronously in a way that firmware assumes the key is cleared whereas hardware has a valid key. This inconsistency between hardware and firmware leads to group addressed packet drops. Only setting the same key again can restore a valid key in firmware and allow packets to be transmitted.
This issue remained latent because the host's clear key commands were not effective in firmware until commit 436a4e886598 ("ath11k: clear the keys properly via DISABLE_KEY"). That commit enabled the host to explicitly clear group keys, which inadvertently exposed the race.
To mitigate this, restrict group key clearing across all modes (AP, STA, MESH). During rekey, the new key can simply be set on top of the previous one, avoiding the need for a clear followed by a set.
However, in AP mode specifically, permit group key clearing when no stations are associated. This exception supports transitions from secure modes (e.g., WPA2/WPA3) to open mode, during which all associated peers are removed and the group key is cleared as part of the transition.
Add a per-BSS station counter to track the presence of stations during set key operations. Also add a reset_group_keys flag to track the key re-installation state and avoid repeated installation of the same key when the number of connected stations transitions to non-zero within a rekey period.
Additionally, for AP and Mesh modes, when the first station associates, reinstall the same group key that was last set. This ensures that the firmware recovers from any race that may have occurred during a previous key clear when no stations were associated.
This change ensures that key clearing is permitted only when no clients are connected, avoiding packet loss while enabling dynamic security mode transitions.
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
--- drivers/net/wireless/ath/ath11k/core.h | 2 + drivers/net/wireless/ath/ath11k/mac.c | 111 +++++++++++++++++++++++-- 2 files changed, 104 insertions(+), 9 deletions(-)
drivers/net/wireless/ath/ath11k/core.h +2 -0
@@ -409,6 +409,8 @@ struct ath11k_vif {bool do_not_send_tmpl;struct ath11k_arp_ns_offload arp_ns_offload;struct ath11k_rekey_data rekey_data; +u32 num_stations; +bool reinstall_group_keys;struct ath11k_reg_tpc_power_info reg_tpc_info;
drivers/net/wireless/ath/ath11k/mac.c +102 -9
148 lines not on this page · raw message
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 61/175 net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Paasch <[email protected]>
[ Upstream commit fa390321aba0a54d0f7ae95ee4ecde1358bb9234 ]
When tcp_ao_copy_all_matching() fails in tcp_v6_syn_recv_sock() it just exits the function. This ends up causing a memory-leak:
unreferenced object 0xffff0000281a8200 (size 2496):
comm "softirq", pid 0, jiffies 4295174684 hex dump (first 32 bytes):
7f 00 00 06 7f 00 00 06 00 00 00 00 cb a8 88 13 ................
0a 00 03 61 00 00 00 00 00 00 00 00 00 00 00 00 ...a............
backtrace (crc 5ebdbe15):
kmemleak_alloc+0x44/0xe0
kmem_cache_alloc_noprof+0x248/0x470
sk_prot_alloc+0x48/0x120
sk_clone_lock+0x38/0x3b0
inet_csk_clone_lock+0x34/0x150
tcp_create_openreq_child+0x3c/0x4a8
tcp_v6_syn_recv_sock+0x1c0/0x620
tcp_check_req+0x588/0x790
tcp_v6_rcv+0x5d0/0xc18
ip6_protocol_deliver_rcu+0x2d8/0x4c0
ip6_input_finish+0x74/0x148
ip6_input+0x50/0x118
ip6_sublist_rcv+0x2fc/0x3b0
ipv6_list_rcv+0x114/0x170
__netif_receive_skb_list_core+0x16c/0x200
netif_receive_skb_list_internal+0x1f0/0x2d0This is because in tcp_v6_syn_recv_sock (and the IPv4 counterpart), when exiting upon error, inet_csk_prepare_forced_close() and tcp_done() need to be called. They make sure the newsk will end up being correctly free'd.
tcp_v4_syn_recv_sock() makes this very clear by having the put_and_exit label that takes care of things. So, this patch here makes sure tcp_v4_syn_recv_sock and tcp_v6_syn_recv_sock have similar error-handling and thus fixes the leak for TCP-AO.
--- net/ipv6/tcp_ipv6.c | 32 +++++++++++++++----------------- 1 file changed, 15 insertions(+), 17 deletions(-)
net/ipv6/tcp_ipv6.c +15 -17
@@ -1417,17 +1417,17 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * ireq =inet_rsk (req);if (sk_acceptq_is_full (sk)) - goto out_overflow; + goto exit_overflow;if (!dst) { dst =inet6_csk_route_req (sk, &fl6, req,IPPROTO_TCP );if (!dst) - goto out; + goto exit; } newsk =tcp_create_openreq_child (sk, req, skb);if (!newsk) - goto out_nonewsk; + goto exit_nonewsk;/* * No need to charge this sock to the relevant IPv6 refcnt debug socks
@@ -1517,25 +1517,19 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *const union tcp_md5_addr *addr; addr = (union tcp_md5_addr *)&newsk->sk_v6_daddr; -if (tcp_md5_key_copy (newsk, addr,AF_INET6 ,128 , l3index, key)) { -inet_csk_prepare_forced_close (newsk); -tcp_done (newsk); - goto out; - } +if (tcp_md5_key_copy (newsk, addr,AF_INET6 ,128 , l3index, key)) + goto put_and_exit; } }#endif #ifdef CONFIG_TCP_AO /* Copy over tcp_ao_info if any */ if (tcp_ao_copy_all_matching (sk, newsk, req, skb,AF_INET6 )) - goto out;/* OOM */ + goto put_and_exit;/* OOM */ #endif -if (__inet_inherit_port (sk, newsk) <0 ) { -inet_csk_prepare_forced_close (newsk); -tcp_done (newsk); - goto out; - } +if (__inet_inherit_port (sk, newsk) <0 ) + goto put_and_exit; *own_req =inet_ehash_nolisten (newsk,req_to_sk (req_unhash), &found_dup_sk);if (*own_req) {
@@ -1562,13 +1556,17 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *return newsk; -out_overflow: +exit_overflow:__NET_INC_STATS (sock_net (sk),LINUX_MIB_LISTENOVERFLOWS ); -out_nonewsk: +exit_nonewsk:dst_release (dst); -out: +exit:tcp_listendrop (sk);return NULL ; +put_and_exit: +inet_csk_prepare_forced_close (newsk); +tcp_done (newsk); + goto exit; } INDIRECT_CALLABLE_DECLARE(struct dst_entry *ipv4_dst_check(struct dst_entry *,
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 62/175 net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit d4736737110ffa83d29f1c5d17b26113864205f6 ]
When sending llc packets with vlan tx offload, the hardware fails to actually add the tag. Deal with this by fixing it up in software.
--- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/net/ethernet/mediatek/mtk_eth_soc.c +9 -1
@@ -1606,6 +1606,13 @@ static netdev_tx_t mtk_start_xmit(struct sk_buff *skb, struct net_device *dev)bool gso = false;int tx_num; +if (skb_vlan_tag_present (skb) && + !eth_proto_is_802_3 (eth_hdr (skb)->h_proto)) { + skb =__vlan_hwaccel_push_inside (skb); +if (!skb) + goto dropped; + } +/* normally we can rely on the stack not calling this more than once, * however we have 2 queues running on the same ring so we need to lock * the ring access
@@ -1651,8 +1658,9 @@ static netdev_tx_t mtk_start_xmit(struct sk_buff *skb, struct net_device *dev) drop:spin_unlock (ð->page_lock); - stats->tx_dropped++;dev_kfree_skb_any (skb); +dropped: + stats->tx_dropped++;return NETDEV_TX_OK ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 63/175 net: skb: add pskb_network_may_pull_reason() helper
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Menglong Dong <[email protected]>
[ Upstream commit 454bbde8f0d465e93e5a3a4003ac6c7e62fa4473 ]
Introduce the function pskb_network_may_pull_reason() and make pskb_network_may_pull() a simple inline call to it. The drop reasons of it just come from pskb_may_pull_reason.
Stable-dep-of: 6ead38147ebb ("vxlan: Fix NPD when refreshing an FDB entry with a nexthop object")
--- include/linux/skbuff.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
include/linux/skbuff.h +7 -1
@@ -3153,9 +3153,15 @@ static inline int skb_inner_network_offset(const struct sk_buff *skb)return skb_inner_network_header (skb) - skb->data; } +static inline enum skb_drop_reason +pskb_network_may_pull_reason (struct sk_buff *skb,unsigned int len) +{ +return pskb_may_pull_reason (skb,skb_network_offset (skb) + len); +} +static inline int pskb_network_may_pull (struct sk_buff *skb,unsigned int len) { -return pskb_may_pull (skb,skb_network_offset (skb) + len); +return pskb_network_may_pull_reason (skb, len) ==SKB_NOT_DROPPED_YET ; }/*
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 64/175 net: tunnel: add pskb_inet_may_pull_reason() helper
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Menglong Dong <[email protected]>
[ Upstream commit 7f20dbd7de7b9b2804e6bf54b0c22f2bc447cd64 ]
Introduce the function pskb_inet_may_pull_reason() and make pskb_inet_may_pull a simple inline call to it. The drop reasons of it just come from pskb_may_pull_reason().
Stable-dep-of: 6ead38147ebb ("vxlan: Fix NPD when refreshing an FDB entry with a nexthop object")
--- include/net/ip_tunnels.h | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
include/net/ip_tunnels.h +8 -2
@@ -439,7 +439,8 @@ int ip_tunnel_encap_del_ops(const struct ip_tunnel_encap_ops *op,int ip_tunnel_encap_setup (struct ip_tunnel *t,struct ip_tunnel_encap *ipencap); -static inline bool pskb_inet_may_pull (struct sk_buff *skb) +static inline enum skb_drop_reason +pskb_inet_may_pull_reason (struct sk_buff *skb) {int nhlen;
@@ -456,7 +457,12 @@ static inline bool pskb_inet_may_pull(struct sk_buff *skb) nhlen =0 ; } -return pskb_network_may_pull (skb, nhlen); +return pskb_network_may_pull_reason (skb, nhlen); +} + +static inline bool pskb_inet_may_pull (struct sk_buff *skb) +{ +return pskb_inet_may_pull_reason (skb) ==SKB_NOT_DROPPED_YET ; }/* Variant of pskb_inet_may_pull().
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 65/175 net: vxlan: add skb drop reasons to vxlan_rcv()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Menglong Dong <[email protected]>
[ Upstream commit 4c06d9daf8e6215447ca8a2ddd59fa09862c9bae ]
Introduce skb drop reasons to the function vxlan_rcv(). Following new drop reasons are added:
SKB_DROP_REASON_VXLAN_INVALID_HDR
SKB_DROP_REASON_VXLAN_VNI_NOT_FOUND
SKB_DROP_REASON_IP_TUNNEL_ECN
Stable-dep-of: 6ead38147ebb ("vxlan: Fix NPD when refreshing an FDB entry with a nexthop object")
--- drivers/net/vxlan/vxlan_core.c | 26 ++++++++++++++++++++------ include/net/dropreason-core.h | 16 ++++++++++++++++ 2 files changed, 36 insertions(+), 6 deletions(-)
drivers/net/vxlan/vxlan_core.c +20 -6
@@ -1671,13 +1671,15 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)struct vxlan_metadata _md;struct vxlan_metadata *md = &_md;__be16 protocol =htons (ETH_P_TEB ); +enum skb_drop_reason reason;bool raw_proto = false;void *oiph;__be32 vni =0 ;int nh;/* Need UDP and VXLAN header to be present */ -if (!pskb_may_pull (skb,VXLAN_HLEN )) + reason =pskb_may_pull_reason (skb,VXLAN_HLEN ); +if (reason) goto drop; unparsed = *vxlan_hdr (skb);
@@ -1686,6 +1688,7 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)netdev_dbg (skb->dev,"invalid vxlan flags=%#x vni=%#x\n" ,ntohl (vxlan_hdr (skb)->vx_flags),ntohl (vxlan_hdr (skb)->vx_vni)); + reason =SKB_DROP_REASON_VXLAN_INVALID_HDR ;/* Return non vxlan pkt */ goto drop; }
@@ -1699,8 +1702,10 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb) vni =vxlan_vni (vxlan_hdr (skb)->vx_vni); vxlan =vxlan_vs_find_vni (vs, skb->dev->ifindex, vni, &vninode); -if (!vxlan) +if (!vxlan) { + reason =SKB_DROP_REASON_VXLAN_VNI_NOT_FOUND ; goto drop; + }/* For backwards compatibility, only allow reserved fields to be * used by VXLAN extensions if explicitly requested.
@@ -1713,8 +1718,10 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb) }if (__iptunnel_pull_header (skb,VXLAN_HLEN , protocol, raw_proto, - !net_eq (vxlan->net,dev_net (vxlan->dev)))) + !net_eq (vxlan->net,dev_net (vxlan->dev)))) { + reason =SKB_DROP_REASON_NOMEM ; goto drop; + }if (vs->flags &VXLAN_F_REMCSUM_RX )if (unlikely (!vxlan_remcsum (&unparsed, skb, vs->flags)))
@@ -1728,8 +1735,10 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb) tun_dst =udp_tun_rx_dst (skb,vxlan_get_sk_family (vs), flags,key32_to_tunnel_id (vni),sizeof (*md)); -if (!tun_dst) +if (!tun_dst) { + reason =SKB_DROP_REASON_NOMEM ; goto drop; + } md =ip_tunnel_info_opts (&tun_dst->u.tun_info);
@@ -1753,6 +1762,7 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)* is more robust and provides a little more security in * adding extensions to VXLAN. */ + reason =SKB_DROP_REASON_VXLAN_INVALID_HDR ; goto drop; }
@@ -1773,7 +1783,8 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)skb_reset_network_header (skb); -if (!pskb_inet_may_pull (skb)) { + reason =pskb_inet_may_pull_reason (skb); +if (reason) {DEV_STATS_INC (vxlan->dev, rx_length_errors);DEV_STATS_INC (vxlan->dev, rx_errors); vxlan_vnifilter_count(vxlan, vni, vninode,
@@ -1785,6 +1796,7 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb) oiph = skb->head + nh;if (!vxlan_ecn_decapsulate (vs, oiph, skb)) { + reason =SKB_DROP_REASON_IP_TUNNEL_ECN ;DEV_STATS_INC (vxlan->dev, rx_frame_errors);DEV_STATS_INC (vxlan->dev, rx_errors); vxlan_vnifilter_count(vxlan, vni, vninode,
@@ -1799,6 +1811,7 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)dev_core_stats_rx_dropped_inc (vxlan->dev);vxlan_vnifilter_count (vxlan, vni, vninode,VXLAN_VNI_STATS_RX_DROPS ,0 ); + reason =SKB_DROP_REASON_DEV_READY ; goto drop; }
@@ -1811,8 +1824,9 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)return 0 ; drop: + reason = reason ?:SKB_DROP_REASON_NOT_SPECIFIED ;/* Consume bad packet */ -kfree_skb (skb); +kfree_skb_reason (skb, reason);return 0 ; }
include/net/dropreason-core.h +16 -0
@@ -92,6 +92,9 @@ FN(PACKET_SOCK_ERROR) \ FN(TC_CHAIN_NOTFOUND) \ FN(TC_RECLASSIFY_LOOP) \ + FN(VXLAN_INVALID_HDR) \ + FN(VXLAN_VNI_NOT_FOUND) \ + FN(IP_TUNNEL_ECN) \ FNe(MAX)/**
@@ -418,6 +421,19 @@ enum skb_drop_reason {* iterations. */ SKB_DROP_REASON_TC_RECLASSIFY_LOOP , +/** +* @SKB_DROP_REASON_VXLAN_INVALID_HDR: VXLAN header is invalid. E.g.: +* 1) reserved fields are not zero +* 2) "I" flag is not set +*/ +SKB_DROP_REASON_VXLAN_INVALID_HDR , +/** @SKB_DROP_REASON_VXLAN_VNI_NOT_FOUND: no VXLAN device found for VNI */ +SKB_DROP_REASON_VXLAN_VNI_NOT_FOUND , +/** +* @SKB_DROP_REASON_IP_TUNNEL_ECN: skb is dropped according to +* RFC 6040 4.2, see __INET_ECN_decapsulate() for detail. +*/ +SKB_DROP_REASON_IP_TUNNEL_ECN ,/** * @SKB_DROP_REASON_MAX: the maximum of core drop reasons, which * shouldn't be used as a real 'reason' - only for tracing code gen
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 66/175 net: vxlan: make vxlan_snoop() return drop reasons
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Menglong Dong <[email protected]>
[ Upstream commit 289fd4e75219a96f77c5d679166035cd5118d139 ]
Change the return type of vxlan_snoop() from bool to enum skb_drop_reason. In this commit, two drop reasons are introduced:
SKB_DROP_REASON_MAC_INVALID_SOURCE
SKB_DROP_REASON_VXLAN_ENTRY_EXISTS
Stable-dep-of: 6ead38147ebb ("vxlan: Fix NPD when refreshing an FDB entry with a nexthop object")
--- drivers/net/vxlan/vxlan_core.c | 17 +++++++++-------- include/net/dropreason-core.h | 9 +++++++++ 2 files changed, 18 insertions(+), 8 deletions(-)
drivers/net/vxlan/vxlan_core.c +9 -8
@@ -1437,9 +1437,10 @@ static int vxlan_fdb_get(struct sk_buff *skb,* and Tunnel endpoint. * Return true if packet is bogus and should be dropped. */ -static bool vxlan_snoop (struct net_device *dev, -union vxlan_addr *src_ip,const u8 *src_mac, -u32 src_ifindex,__be32 vni) +static enum skb_drop_reason vxlan_snoop (struct net_device *dev, +union vxlan_addr *src_ip, +const u8 *src_mac,u32 src_ifindex, +__be32 vni) {struct vxlan_dev *vxlan =netdev_priv (dev);struct vxlan_fdb *f;
@@ -1447,7 +1448,7 @@ static bool vxlan_snoop(struct net_device *dev,/* Ignore packets from invalid src-address */ if (!is_valid_ether_addr (src_mac)) -return true; +return SKB_DROP_REASON_MAC_INVALID_SOURCE ;#if IS_ENABLED (CONFIG_IPV6 ) if (src_ip->sa.sa_family == AF_INET6 &&
@@ -1461,15 +1462,15 @@ static bool vxlan_snoop(struct net_device *dev,if (likely (vxlan_addr_equal (&rdst->remote_ip, src_ip) && rdst->remote_ifindex == ifindex)) -return false; +return SKB_NOT_DROPPED_YET ;/* Don't migrate static entries, drop packets */ if (f->state & (NUD_PERMANENT |NUD_NOARP )) -return true; +return SKB_DROP_REASON_VXLAN_ENTRY_EXISTS ;/* Don't override an fdb with nexthop with a learnt entry */ if (rcu_access_pointer (f->nh)) -return true; +return SKB_DROP_REASON_VXLAN_ENTRY_EXISTS ;if (net_ratelimit ()) netdev_info(dev,
@@ -1497,7 +1498,7 @@ static bool vxlan_snoop(struct net_device *dev,spin_unlock (&vxlan->hash_lock[hash_index]); } -return false; +return SKB_NOT_DROPPED_YET ; }static bool __vxlan_sock_release_prep (struct vxlan_sock *vs)
include/net/dropreason-core.h +9 -0
@@ -94,6 +94,8 @@ FN(TC_RECLASSIFY_LOOP) \ FN(VXLAN_INVALID_HDR) \ FN(VXLAN_VNI_NOT_FOUND) \ + FN(MAC_INVALID_SOURCE) \ + FN(VXLAN_ENTRY_EXISTS) \ FN(IP_TUNNEL_ECN) \ FNe(MAX)
@@ -429,6 +431,13 @@ enum skb_drop_reason {SKB_DROP_REASON_VXLAN_INVALID_HDR ,/** @SKB_DROP_REASON_VXLAN_VNI_NOT_FOUND: no VXLAN device found for VNI */ SKB_DROP_REASON_VXLAN_VNI_NOT_FOUND , +/** @SKB_DROP_REASON_MAC_INVALID_SOURCE: source mac is invalid */ +SKB_DROP_REASON_MAC_INVALID_SOURCE , +/** +* @SKB_DROP_REASON_VXLAN_ENTRY_EXISTS: trying to migrate a static +* entry or an entry pointing to a nexthop. +*/ +SKB_DROP_REASON_VXLAN_ENTRY_EXISTS ,/** * @SKB_DROP_REASON_IP_TUNNEL_ECN: skb is dropped according to * RFC 6040 4.2, see __INET_ECN_decapsulate() for detail.
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 67/175 vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 6ead38147ebb813f08be6ea8ef547a0e4c09559a ]
VXLAN FDB entries can point to either a remote destination or an FDB nexthop group. The latter is usually used in EVPN deployments where learning is disabled.
However, when learning is enabled, an incoming packet might try to refresh an FDB entry that points to an FDB nexthop group and therefore does not have a remote. Such packets should be dropped, but they are only dropped after dereferencing the non-existent remote, resulting in a NPD [1] which can be reproduced using [2].
Fix by dropping such packets earlier. Remove the misleading comment from first_remote_rcu().
[1]
BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 13 UID: 0 PID: 361 Comm: mausezahn Not tainted 6.17.0-rc1-virtme-g9f6b606b6b37 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:vxlan_snoop+0x98/0x1e0 [...] Call Trace: <TASK> vxlan_encap_bypass+0x209/0x240 encap_bypass_if_local+0xb1/0x100 vxlan_xmit_one+0x1375/0x17e0 vxlan_xmit+0x6b4/0x15f0 dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 packet_sendmsg+0x113a/0x1850 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53
[2]
#!/bin/bash
ip address add 192.0.2.1/32 dev lo
ip address add 192.0.2.2/32 dev lo
ip nexthop add id 1 via 192.0.2.3 fdb
ip nexthop add id 10 group 1 fdb
ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 12345 localbypass ip link add name vx1 up type vxlan id 10020 local 192.0.2.2 dstport 54321 learning
bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 192.0.2.2 port 54321 vni 10020 bridge fdb add 00:aa:bb:cc:dd:ee dev vx1 self static nhid 10
mausezahn vx0 -a 00:aa:bb:cc:dd:ee -b 00:11:22:33:44:55 -c 1 -q
--- drivers/net/vxlan/vxlan_core.c | 8 ++++---- drivers/net/vxlan/vxlan_private.h | 4 +--- 2 files changed, 5 insertions(+), 7 deletions(-)
drivers/net/vxlan/vxlan_core.c +4 -4
@@ -1460,6 +1460,10 @@ static enum skb_drop_reason vxlan_snoop(struct net_device *dev,if (likely (f)) {struct vxlan_rdst *rdst =first_remote_rcu (f); +/* Don't override an fdb with nexthop with a learnt entry */ +if (rcu_access_pointer (f->nh)) +return SKB_DROP_REASON_VXLAN_ENTRY_EXISTS ; +if (likely (vxlan_addr_equal (&rdst->remote_ip, src_ip) && rdst->remote_ifindex == ifindex))return SKB_NOT_DROPPED_YET ;
@@ -1468,10 +1472,6 @@ static enum skb_drop_reason vxlan_snoop(struct net_device *dev,if (f->state & (NUD_PERMANENT |NUD_NOARP ))return SKB_DROP_REASON_VXLAN_ENTRY_EXISTS ; -/* Don't override an fdb with nexthop with a learnt entry */ -if (rcu_access_pointer (f->nh)) -return SKB_DROP_REASON_VXLAN_ENTRY_EXISTS ; -if (net_ratelimit ()) netdev_info(dev, "%pM migrated from %pIS to %pIS\n",
drivers/net/vxlan/vxlan_private.h +1 -3
@@ -56,9 +56,7 @@ static inline struct hlist_head *vs_head(struct net *net, __be16 port)return &vn->sock_list[hash_32 (ntohs (port),PORT_HASH_BITS )]; } -/* First remote destination for a forwarding entry. -* Guaranteed to be non-NULL because remotes are never deleted. -*/ +/* First remote destination for a forwarding entry. */ static inline struct vxlan_rdst *first_remote_rcu (struct vxlan_fdb *fdb) {if (rcu_access_pointer (fdb->nh))
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 68/175 net: vxlan: make vxlan_set_mac() return drop reasons
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Menglong Dong <[email protected]>
[ Upstream commit d209706f562ee4fa81bdf24cf6b679c3222aa06c ]
Change the return type of vxlan_set_mac() from bool to enum skb_drop_reason. In this commit, the drop reason "SKB_DROP_REASON_LOCAL_MAC" is introduced for the case that the source mac of the packet is a local mac.
Stable-dep-of: 1f5d2fd1ca04 ("vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects")
--- drivers/net/vxlan/vxlan_core.c | 19 ++++++++++--------- include/net/dropreason-core.h | 6 ++++++ 2 files changed, 16 insertions(+), 9 deletions(-)
drivers/net/vxlan/vxlan_core.c +10 -9
@@ -1605,9 +1605,9 @@ static void vxlan_parse_gbp_hdr(struct vxlanhdr *unparsed, unparsed->vx_flags &= ~VXLAN_GBP_USED_BITS ; } -static bool vxlan_set_mac (struct vxlan_dev *vxlan, -struct vxlan_sock *vs, -struct sk_buff *skb,__be32 vni) +static enum skb_drop_reason vxlan_set_mac (struct vxlan_dev *vxlan, +struct vxlan_sock *vs, +struct sk_buff *skb,__be32 vni) {union vxlan_addr saddr;u32 ifindex = skb->dev->ifindex;
@@ -1618,7 +1618,7 @@ static bool vxlan_set_mac(struct vxlan_dev *vxlan,/* Ignore packet loops (and multicast echo) */ if (ether_addr_equal (eth_hdr (skb)->h_source, vxlan->dev->dev_addr)) -return false; +return SKB_DROP_REASON_LOCAL_MAC ;/* Get address from the outer IP header */ if (vxlan_get_sk_family (vs) ==AF_INET ) {
@@ -1631,11 +1631,11 @@ static bool vxlan_set_mac(struct vxlan_dev *vxlan,#endif } -if ((vxlan->cfg.flags &VXLAN_F_LEARN ) && -vxlan_snoop (skb->dev, &saddr,eth_hdr (skb)->h_source, ifindex, vni)) -return false; +if (!(vxlan->cfg.flags &VXLAN_F_LEARN )) +return SKB_NOT_DROPPED_YET ; -return true; +return vxlan_snoop (skb->dev, &saddr,eth_hdr (skb)->h_source, + ifindex, vni); } static bool vxlan_ecn_decapsulate(struct vxlan_sock *vs, void *oiph,
@@ -1768,7 +1768,8 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb) }if (!raw_proto) { -if (!vxlan_set_mac (vxlan, vs, skb, vni)) + reason =vxlan_set_mac (vxlan, vs, skb, vni); +if (reason) goto drop; }else {skb_reset_mac_header (skb);
include/net/dropreason-core.h +6 -0
@@ -97,6 +97,7 @@ FN(MAC_INVALID_SOURCE) \ FN(VXLAN_ENTRY_EXISTS) \ FN(IP_TUNNEL_ECN) \ + FN(LOCAL_MAC) \ FNe(MAX)/**
@@ -443,6 +444,11 @@ enum skb_drop_reason {* RFC 6040 4.2, see __INET_ECN_decapsulate() for detail. */ SKB_DROP_REASON_IP_TUNNEL_ECN , +/** +* @SKB_DROP_REASON_LOCAL_MAC: the source MAC address is equal to +* the MAC address of the local netdev. +*/ + SKB_DROP_REASON_LOCAL_MAC,/** * @SKB_DROP_REASON_MAX: the maximum of core drop reasons, which * shouldn't be used as a real 'reason' - only for tracing code gen
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 69/175 net: vxlan: use kfree_skb_reason() in vxlan_xmit()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Menglong Dong <[email protected]>
[ Upstream commit b71a576e452b800efeac49ecca116d954601d911 ]
Replace kfree_skb() with kfree_skb_reason() in vxlan_xmit(). Following new skb drop reasons are introduced for vxlan:
/* no remote found for xmit */ SKB_DROP_REASON_VXLAN_NO_REMOTE
/* packet without necessary metadata reached a device which is
* in "external" mode
*/SKB_DROP_REASON_TUNNEL_TXINFO
Stable-dep-of: 1f5d2fd1ca04 ("vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects")
--- drivers/net/vxlan/vxlan_core.c | 6 +++--- include/net/dropreason-core.h | 9 +++++++++ 2 files changed, 12 insertions(+), 3 deletions(-)
drivers/net/vxlan/vxlan_core.c +3 -3
@@ -2724,7 +2724,7 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev)if (info && info->mode &IP_TUNNEL_INFO_TX )vxlan_xmit_one (skb, dev, vni,NULL , false);else -kfree_skb (skb); +kfree_skb_reason (skb,SKB_DROP_REASON_TUNNEL_TXINFO );return NETDEV_TX_OK ; } }
@@ -2787,7 +2787,7 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev)dev_core_stats_tx_dropped_inc (dev);vxlan_vnifilter_count (vxlan, vni,NULL ,VXLAN_VNI_STATS_TX_DROPS ,0 ); -kfree_skb (skb); +kfree_skb_reason (skb,SKB_DROP_REASON_VXLAN_NO_REMOTE );return NETDEV_TX_OK ; } }
@@ -2810,7 +2810,7 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev)if (fdst)vxlan_xmit_one (skb, dev, vni, fdst, did_rsc);else -kfree_skb (skb); +kfree_skb_reason (skb,SKB_DROP_REASON_VXLAN_NO_REMOTE ); }return NETDEV_TX_OK ;
include/net/dropreason-core.h +9 -0
@@ -96,7 +96,9 @@ FN(VXLAN_VNI_NOT_FOUND) \ FN(MAC_INVALID_SOURCE) \ FN(VXLAN_ENTRY_EXISTS) \ + FN(VXLAN_NO_REMOTE) \ FN(IP_TUNNEL_ECN) \ + FN(TUNNEL_TXINFO) \ FN(LOCAL_MAC) \ FNe(MAX)
@@ -439,11 +441,18 @@ enum skb_drop_reason {* entry or an entry pointing to a nexthop. */ SKB_DROP_REASON_VXLAN_ENTRY_EXISTS , +/** @SKB_DROP_REASON_VXLAN_NO_REMOTE: no remote found for xmit */ +SKB_DROP_REASON_VXLAN_NO_REMOTE ,/** * @SKB_DROP_REASON_IP_TUNNEL_ECN: skb is dropped according to * RFC 6040 4.2, see __INET_ECN_decapsulate() for detail. */ SKB_DROP_REASON_IP_TUNNEL_ECN , +/** +* @SKB_DROP_REASON_TUNNEL_TXINFO: packet without necessary metadata +* reached a device which is in "external" mode. +*/ +SKB_DROP_REASON_TUNNEL_TXINFO ,/** * @SKB_DROP_REASON_LOCAL_MAC: the source MAC address is equal to * the MAC address of the local netdev.
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 70/175 net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Menglong Dong <[email protected]>
[ Upstream commit 03483dbde80d102146a61ec09b9e90cfc4bb8be0 ]
Replace kfree_skb() with kfree_skb_reason() in vxlan_mdb_xmit. No drop reasons are introduced in this commit.
Stable-dep-of: 1f5d2fd1ca04 ("vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects")
--- drivers/net/vxlan/vxlan_mdb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/vxlan/vxlan_mdb.c +1 -1
@@ -1712,7 +1712,7 @@ netdev_tx_t vxlan_mdb_xmit(struct vxlan_dev *vxlan,vxlan_xmit_one (skb, vxlan->dev, src_vni,rcu_dereference (fremote->rd), false); else -kfree_skb (skb ); +kfree_skb_reason (skb ,SKB_DROP_REASON_VXLAN_NO_REMOTE );return NETDEV_TX_OK ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 71/175 net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radu Rendec <[email protected]>
[ Upstream commit 46e0ccfb88f02ab2eb20a41d519d6e4c028652f2 ]
The SKB_DROP_REASON_VXLAN_NO_REMOTE skb drop reason was introduced in the specific context of vxlan. As it turns out, there are similar cases when a packet needs to be dropped in other parts of the network stack, such as the bridge module.
Rename SKB_DROP_REASON_VXLAN_NO_REMOTE and give it a more generic name, so that it can be used in other parts of the network stack. This is not a functional change, and the numeric value of the drop reason even remains unchanged.
Stable-dep-of: 1f5d2fd1ca04 ("vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects")
--- drivers/net/vxlan/vxlan_core.c | 4 ++-- drivers/net/vxlan/vxlan_mdb.c | 2 +- include/net/dropreason-core.h | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-)
drivers/net/vxlan/vxlan_core.c +2 -2
@@ -2787,7 +2787,7 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev)dev_core_stats_tx_dropped_inc (dev);vxlan_vnifilter_count (vxlan, vni,NULL ,VXLAN_VNI_STATS_TX_DROPS ,0 ); -kfree_skb_reason (skb,SKB_DROP_REASON_VXLAN_NO_REMOTE ); +kfree_skb_reason (skb,SKB_DROP_REASON_NO_TX_TARGET );return NETDEV_TX_OK ; } }
@@ -2810,7 +2810,7 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev)if (fdst)vxlan_xmit_one (skb, dev, vni, fdst, did_rsc);else -kfree_skb_reason (skb,SKB_DROP_REASON_VXLAN_NO_REMOTE ); +kfree_skb_reason (skb,SKB_DROP_REASON_NO_TX_TARGET ); }return NETDEV_TX_OK ;
drivers/net/vxlan/vxlan_mdb.c +1 -1
@@ -1712,7 +1712,7 @@ netdev_tx_t vxlan_mdb_xmit(struct vxlan_dev *vxlan,vxlan_xmit_one (skb, vxlan->dev, src_vni,rcu_dereference (fremote->rd), false); else -kfree_skb_reason (skb ,SKB_DROP_REASON_VXLAN_NO_REMOTE ); +kfree_skb_reason (skb ,SKB_DROP_REASON_NO_TX_TARGET );return NETDEV_TX_OK ; }
include/net/dropreason-core.h +3 -3
@@ -96,7 +96,7 @@ FN(VXLAN_VNI_NOT_FOUND) \ FN(MAC_INVALID_SOURCE) \ FN(VXLAN_ENTRY_EXISTS) \ - FN(VXLAN_NO_REMOTE) \ + FN(NO_TX_TARGET) \ FN(IP_TUNNEL_ECN) \ FN(TUNNEL_TXINFO) \ FN(LOCAL_MAC) \
@@ -441,8 +441,8 @@ enum skb_drop_reason {* entry or an entry pointing to a nexthop. */ SKB_DROP_REASON_VXLAN_ENTRY_EXISTS , -/** @SKB_DROP_REASON_VXLAN_NO_REMOTE: no remote found for xmit */ - SKB_DROP_REASON_VXLAN_NO_REMOTE, +/** @SKB_DROP_REASON_NO_TX_TARGET: no target found for xmit */ + SKB_DROP_REASON_NO_TX_TARGET,/** * @SKB_DROP_REASON_IP_TUNNEL_ECN: skb is dropped according to * RFC 6040 4.2, see __INET_ECN_decapsulate() for detail.
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 72/175 vxlan: Refresh FDB updated time upon NTF_USE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 40a9994f2fbddf299655073be947e9cfc57dfdf1 ]
The 'NTF_USE' flag can be used by user space to refresh FDB entries so that they will not age out. Currently, the VXLAN driver implements it by refreshing the 'used' field in the FDB entry as this is the field according to which FDB entries are aged out.
Subsequent patches will switch the VXLAN driver to age out entries based on the 'updated' field. Prepare for this change by refreshing the 'updated' field upon 'NTF_USE'. This is consistent with the bridge driver's FDB:
# ip link add name br1 up type bridge # ip link add name swp1 master br1 up type dummy # bridge fdb add 00:11:22:33:44:55 dev swp1 master dynamic vlan 1 # sleep 10 # bridge fdb replace 00:11:22:33:44:55 dev swp1 master dynamic vlan 1 # bridge -s -j fdb get 00:11:22:33:44:55 br br1 vlan 1 | jq '.[]["updated"]' 10 # sleep 10 # bridge fdb replace 00:11:22:33:44:55 dev swp1 master use dynamic vlan 1 # bridge -s -j fdb get 00:11:22:33:44:55 br br1 vlan 1 | jq '.[]["updated"]' 0
Before:
# ip link add name vx1 up type vxlan id 10010 dstport 4789 # bridge fdb add 00:11:22:33:44:55 dev vx1 self dynamic dst 198.51.100.1 # sleep 10 # bridge fdb replace 00:11:22:33:44:55 dev vx1 self dynamic dst 198.51.100.1 # bridge -s -j -p fdb get 00:11:22:33:44:55 br vx1 self | jq '.[]["updated"]' 10 # sleep 10 # bridge fdb replace 00:11:22:33:44:55 dev vx1 self use dynamic dst 198.51.100.1 # bridge -s -j -p fdb get 00:11:22:33:44:55 br vx1 self | jq '.[]["updated"]' 20
After:
# ip link add name vx1 up type vxlan id 10010 dstport 4789 # bridge fdb add 00:11:22:33:44:55 dev vx1 self dynamic dst 198.51.100.1 # sleep 10 # bridge fdb replace 00:11:22:33:44:55 dev vx1 self dynamic dst 198.51.100.1 # bridge -s -j -p fdb get 00:11:22:33:44:55 br vx1 self | jq '.[]["updated"]' 10 # sleep 10 # bridge fdb replace 00:11:22:33:44:55 dev vx1 self use dynamic dst 198.51.100.1 # bridge -s -j -p fdb get 00:11:22:33:44:55 br vx1 self | jq '.[]["updated"]' 0
Stable-dep-of: 1f5d2fd1ca04 ("vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects")
--- drivers/net/vxlan/vxlan_core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/vxlan/vxlan_core.c +3 -1
@@ -1047,8 +1047,10 @@ static int vxlan_fdb_update_existing(struct vxlan_dev *vxlan, notify |= rc; } -if (ndm_flags &NTF_USE ) +if (ndm_flags &NTF_USE ) {WRITE_ONCE (f->used, jiffies); +WRITE_ONCE (f->updated, jiffies); + }if (notify) {if (rd ==NULL )
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 73/175 vxlan: Avoid unnecessary updates to FDB used time
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 9722f834fe9a7c583591defa2cab3f652f50a5f0 ]
Now that the VXLAN driver ages out FDB entries based on their 'updated' time we can remove unnecessary updates of the 'used' time from the Rx path and the control path, so that the 'used' time is only updated by the Tx path.
Stable-dep-of: 1f5d2fd1ca04 ("vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects")
--- drivers/net/vxlan/vxlan_core.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/net/vxlan/vxlan_core.c +5 -7
@@ -1047,10 +1047,8 @@ static int vxlan_fdb_update_existing(struct vxlan_dev *vxlan, notify |= rc; } -if (ndm_flags &NTF_USE ) { -WRITE_ONCE (f->used, jiffies); +if (ndm_flags &NTF_USE )WRITE_ONCE (f->updated, jiffies); - }if (notify) {if (rd ==NULL )
@@ -1294,7 +1292,7 @@ int __vxlan_fdb_delete(struct vxlan_dev *vxlan,struct vxlan_fdb *f;int err = -ENOENT ; - f =vxlan_find_mac (vxlan, addr, src_vni); + f =__vxlan_find_mac (vxlan, addr, src_vni);if (!f)return err;
@@ -1458,7 +1456,7 @@ static enum skb_drop_reason vxlan_snoop(struct net_device *dev, ifindex = src_ifindex;#endif - f =vxlan_find_mac (vxlan, src_mac, vni); + f =__vxlan_find_mac (vxlan, src_mac, vni);if (likely (f)) {struct vxlan_rdst *rdst =first_remote_rcu (f);
@@ -4718,7 +4716,7 @@ vxlan_fdb_offloaded_set(struct net_device *dev,spin_lock_bh (&vxlan->hash_lock[hash_index]); - f =vxlan_find_mac (vxlan, fdb_info->eth_addr, fdb_info->vni); + f =__vxlan_find_mac (vxlan, fdb_info->eth_addr, fdb_info->vni);if (!f) goto out;
@@ -4774,7 +4772,7 @@ vxlan_fdb_external_learn_del(struct net_device *dev, hash_index =fdb_head_index (vxlan, fdb_info->eth_addr, fdb_info->vni);spin_lock_bh (&vxlan->hash_lock[hash_index]); - f =vxlan_find_mac (vxlan, fdb_info->eth_addr, fdb_info->vni); + f =__vxlan_find_mac (vxlan, fdb_info->eth_addr, fdb_info->vni);if (!f) err = -ENOENT ;else if (f->flags &NTF_EXT_LEARNED )
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 74/175 vxlan: Add RCU read-side critical sections in the Tx path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 804b09be09f8af4eda5346a72361459ba21fcf1b ]
The Tx path does not run from an RCU read-side critical section which makes the current lockless accesses to FDB entries invalid. As far as I am aware, this has not been a problem in practice, but traces will be generated once we transition the FDB lookup to rhashtable_lookup().
Add rcu_read_{lock,unlock}() around the handling of FDB entries in the Tx path. Remove the RCU read-side critical section from vxlan_xmit_nh() as now the function is always called from an RCU read-side critical section.
Stable-dep-of: 1f5d2fd1ca04 ("vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects")
--- drivers/net/vxlan/vxlan_core.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/net/vxlan/vxlan_core.c +8 -6
@@ -1909,12 +1909,15 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) goto out; } +rcu_read_lock (); f =vxlan_find_mac (vxlan, n->ha, vni);if (f &&vxlan_addr_any (&(first_remote_rcu (f)->remote_ip))) {/* bridge-local neighbor */ neigh_release (n); +rcu_read_unlock (); goto out; } +rcu_read_unlock (); reply =arp_create (ARPOP_REPLY ,ETH_P_ARP , sip, dev, tip, sha, n->ha, sha);
@@ -2632,14 +2635,10 @@ static void vxlan_xmit_nh(struct sk_buff *skb, struct net_device *dev,memset (&nh_rdst,0 ,sizeof (struct vxlan_rdst )); hash =skb_get_hash (skb); -rcu_read_lock (); nh =rcu_dereference (f->nh); -if (!nh) { -rcu_read_unlock (); +if (!nh) goto drop; - } do_xmit =vxlan_fdb_nh_path_select (nh, hash, &nh_rdst); -rcu_read_unlock ();if (likely (do_xmit))vxlan_xmit_one (skb, dev, vni, &nh_rdst, did_rsc);
@@ -2766,6 +2765,7 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev) } eth =eth_hdr (skb); +rcu_read_lock (); f =vxlan_find_mac (vxlan, eth->h_dest, vni); did_rsc = false;
@@ -2788,7 +2788,7 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev)vxlan_vnifilter_count (vxlan, vni,NULL ,VXLAN_VNI_STATS_TX_DROPS ,0 );kfree_skb_reason (skb,SKB_DROP_REASON_NO_TX_TARGET ); -return NETDEV_TX_OK ; + goto out; } }
@@ -2813,6 +2813,8 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev)kfree_skb_reason (skb,SKB_DROP_REASON_NO_TX_TARGET ); } +out: +rcu_read_unlock ();return NETDEV_TX_OK ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 75/175 vxlan: Rename FDB Tx lookup function
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 5cde39ea38813ebb5bf07922a3ba60871edebf99 ]
vxlan_find_mac() is only expected to be called from the Tx path as it updates the 'used' timestamp. Rename it to vxlan_find_mac_tx() to reflect that and to avoid incorrect updates of this timestamp like those addressed by commit 9722f834fe9a ("vxlan: Avoid unnecessary updates to FDB 'used' time").
No functional changes intended.
Stable-dep-of: 1f5d2fd1ca04 ("vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects")
--- drivers/net/vxlan/vxlan_core.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/net/vxlan/vxlan_core.c +7 -7
@@ -428,8 +428,8 @@ static struct vxlan_fdb *__vxlan_find_mac(struct vxlan_dev *vxlan,return NULL ; } -static struct vxlan_fdb *vxlan_find_mac (struct vxlan_dev *vxlan, -const u8 *mac,__be32 vni) +static struct vxlan_fdb *vxlan_find_mac_tx (struct vxlan_dev *vxlan, +const u8 *mac,__be32 vni) {struct vxlan_fdb *f;
@@ -1910,7 +1910,7 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) }rcu_read_lock (); - f =vxlan_find_mac (vxlan, n->ha, vni); + f =vxlan_find_mac_tx (vxlan, n->ha, vni);if (f &&vxlan_addr_any (&(first_remote_rcu (f)->remote_ip))) {/* bridge-local neighbor */ neigh_release (n);
@@ -2076,7 +2076,7 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) goto out; } - f =vxlan_find_mac (vxlan, n->ha, vni); + f =vxlan_find_mac_tx (vxlan, n->ha, vni);if (f &&vxlan_addr_any (&(first_remote_rcu (f)->remote_ip))) {/* bridge-local neighbor */ neigh_release (n);
@@ -2766,7 +2766,7 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev) eth =eth_hdr (skb);rcu_read_lock (); - f =vxlan_find_mac (vxlan, eth->h_dest, vni); + f =vxlan_find_mac_tx (vxlan, eth->h_dest, vni); did_rsc = false; if (f && (f->flags & NTF_ROUTER) && (vxlan->cfg.flags & VXLAN_F_RSC) &&
@@ -2774,11 +2774,11 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev) ntohs(eth->h_proto) == ETH_P_IPV6)) { did_rsc =route_shortcircuit (dev, skb);if (did_rsc) - f =vxlan_find_mac (vxlan, eth->h_dest, vni); + f =vxlan_find_mac_tx (vxlan, eth->h_dest, vni); }if (f ==NULL ) { - f =vxlan_find_mac (vxlan, all_zeros_mac, vni); + f =vxlan_find_mac_tx (vxlan, all_zeros_mac, vni);if (f ==NULL ) {if ((vxlan->cfg.flags &VXLAN_F_L2MISS ) && !is_multicast_ether_addr (eth->h_dest))
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 76/175 vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 1f5d2fd1ca04a23c18b1bde9a43ce2fa2ffa1bce ]
When the "proxy" option is enabled on a VXLAN device, the device will suppress ARP requests and IPv6 Neighbor Solicitation messages if it is able to reply on behalf of the remote host. That is, if a matching and valid neighbor entry is configured on the VXLAN device whose MAC address is not behind the "any" remote (0.0.0.0 / ::).
The code currently assumes that the FDB entry for the neighbor's MAC address points to a valid remote destination, but this is incorrect if the entry is associated with an FDB nexthop group. This can result in a NPD [1][3] which can be reproduced using [2][4].
Fix by checking that the remote destination exists before dereferencing it.
[1]
BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 4 UID: 0 PID: 365 Comm: arping Not tainted 6.17.0-rc2-virtme-g2a89cb21162c #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:vxlan_xmit+0xb58/0x15f0 [...] Call Trace: <TASK> dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 packet_sendmsg+0x113a/0x1850 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53
[2]
#!/bin/bash
ip address add 192.0.2.1/32 dev lo
ip nexthop add id 1 via 192.0.2.2 fdb
ip nexthop add id 10 group 1 fdb
ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 4789 proxy
ip neigh add 192.0.2.3 lladdr 00:11:22:33:44:55 nud perm dev vx0
bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10
arping -b -c 1 -s 192.0.2.1 -I vx0 192.0.2.3
[3]
BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 13 UID: 0 PID: 372 Comm: ndisc6 Not tainted 6.17.0-rc2-virtmne-g6ee90cb26014 #3 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1v996), BIOS 1.17.0-4.fc41 04/01/2x014 RIP: 0010:vxlan_xmit+0x803/0x1600 [...] Call Trace: <TASK> dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 ip6_finish_output2+0x210/0x6c0 ip6_finish_output+0x1af/0x2b0 ip6_mr_output+0x92/0x3e0 ip6_send_skb+0x30/0x90 rawv6_sendmsg+0xe6e/0x12e0 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f383422ec77
[4]
#!/bin/bash
ip address add 2001:db8:1::1/128 dev lo
ip nexthop add id 1 via 2001:db8:1::1 fdb
ip nexthop add id 10 group 1 fdb
ip link add name vx0 up type vxlan id 10010 local 2001:db8:1::1 dstport 4789 proxy
ip neigh add 2001:db8:1::3 lladdr 00:11:22:33:44:55 nud perm dev vx0
bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10
ndisc6 -r 1 -s 2001:db8:1::1 -w 1 2001:db8:1::3 vx0
--- drivers/net/vxlan/vxlan_core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/vxlan/vxlan_core.c +8 -2
@@ -1901,6 +1901,7 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) n =neigh_lookup (&arp_tbl, &tip, dev);if (n) { +struct vxlan_rdst *rdst =NULL ;struct vxlan_fdb *f;struct sk_buff *reply;
@@ -1911,7 +1912,9 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni)rcu_read_lock (); f =vxlan_find_mac_tx (vxlan, n->ha, vni); -if (f &&vxlan_addr_any (&(first_remote_rcu (f)->remote_ip))) { +if (f) + rdst =first_remote_rcu (f); +if (rdst &&vxlan_addr_any (&rdst->remote_ip)) {/* bridge-local neighbor */ neigh_release (n);rcu_read_unlock ();
@@ -2068,6 +2071,7 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) n =neigh_lookup (ipv6_stub->nd_tbl, &msg->target, dev);if (n) { +struct vxlan_rdst *rdst =NULL ;struct vxlan_fdb *f;struct sk_buff *reply;
@@ -2077,7 +2081,9 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) } f =vxlan_find_mac_tx (vxlan, n->ha, vni); -if (f &&vxlan_addr_any (&(first_remote_rcu (f)->remote_ip))) { +if (f) + rdst =first_remote_rcu (f); +if (rdst &&vxlan_addr_any (&rdst->remote_ip)) {/* bridge-local neighbor */ neigh_release (n); goto out;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 77/175 wifi: cw1200: cap SSID length in cw1200_do_join()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit f8f15f6742b8874e59c9c715d0af3474608310ad ]
If the ssidie[1] length is more that 32 it leads to memory corruption.
--- drivers/net/wireless/st/cw1200/sta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/st/cw1200/sta.c +1 -1
@@ -1290,7 +1290,7 @@ static void cw1200_do_join(struct cw1200_common *priv)rcu_read_lock (); ssidie =ieee80211_bss_get_ie (bss,WLAN_EID_SSID );if (ssidie) { - join.ssid_len = ssidie[1 ]; + join.ssid_len =min (ssidie[1 ],IEEE80211_MAX_SSID_LEN );memcpy (join.ssid, &ssidie[2 ], join.ssid_len); }rcu_read_unlock ();
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 78/175 wifi: libertas: cap SSID len in lbs_associate()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit c786794bd27b0d7a5fd9063695df83206009be59 ]
If the ssid_eid[1] length is more that 32 it leads to memory corruption.
--- drivers/net/wireless/marvell/libertas/cfg.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/wireless/marvell/libertas/cfg.c +6 -3
@@ -1150,10 +1150,13 @@ static int lbs_associate(struct lbs_private *priv,/* add SSID TLV */ rcu_read_lock (); ssid_eid =ieee80211_bss_get_ie (bss,WLAN_EID_SSID ); -if (ssid_eid) - pos +=lbs_add_ssid_tlv (pos, ssid_eid +2 , ssid_eid[1 ]); -else +if (ssid_eid) { +u32 ssid_len =min (ssid_eid[1 ],IEEE80211_MAX_SSID_LEN ); + + pos +=lbs_add_ssid_tlv (pos, ssid_eid +2 , ssid_len); + }else {lbs_deb_assoc ("no SSID\n" ); + }rcu_read_unlock ();/* add DS param TLV */
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 79/175 wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 62b635dcd69c4fde7ce1de4992d71420a37e51e3 ]
If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checking.
--- net/wireless/sme.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/wireless/sme.c +4 -1
@@ -903,13 +903,16 @@ void __cfg80211_connect_result(struct net_device *dev,if (!wdev->u.client.ssid_len) {rcu_read_lock ();for_each_valid_link (cr, link) { +u32 ssid_len; + ssid =ieee80211_bss_get_elem (cr->links[link].bss,WLAN_EID_SSID );if (!ssid || !ssid->datalen)continue ; -memcpy (wdev->u.client.ssid, ssid->data, ssid->datalen); + ssid_len =min (ssid->datalen,IEEE80211_MAX_SSID_LEN ); +memcpy (wdev->u.client.ssid, ssid->data, ssid_len); wdev->u.client.ssid_len = ssid->datalen;break ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 80/175 net: thunder_bgx: add a missing of_node_put
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit 9d28f94912589f04ab51fbccaef287d4f40e0d1f ]
phy_np needs to get freed, just like the other child nodes.
--- .../net/ethernet/cavium/thunder/thunder_bgx.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
drivers/net/ethernet/cavium/thunder/thunder_bgx.c +11 -7
@@ -1493,13 +1493,17 @@ static int bgx_init_of_phy(struct bgx *bgx)* this cortina phy, for which there is no driver * support, ignore it. */ -if (phy_np && - !of_device_is_compatible (phy_np,"cortina,cs4223-slice" )) { -/* Wait until the phy drivers are available */ - pd =of_phy_find_device (phy_np); -if (!pd) - goto defer; - bgx->lmac[lmac].phydev = pd; +if (phy_np) { +if (!of_device_is_compatible (phy_np,"cortina,cs4223-slice" )) { +/* Wait until the phy drivers are available */ + pd =of_phy_find_device (phy_np); +if (!pd) { +of_node_put (phy_np); + goto defer; + } + bgx->lmac[lmac].phydev = pd; + } +of_node_put (phy_np); } lmac++;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 81/175 net: thunder_bgx: decrement cleanup index before use
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit 9e3d71a92e561ccc77025689dab25d201fee7a3e ]
All paths in probe that call goto defer do so before assigning phydev and thus it makes sense to cleanup the prior index. It also fixes a bug where index 0 does not get cleaned up.
--- drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cavium/thunder/thunder_bgx.c +1 -1
@@ -1519,11 +1519,11 @@ static int bgx_init_of_phy(struct bgx *bgx)* for phy devices we may have already found. */ while (lmac) { + lmac--;if (bgx->lmac[lmac].phydev) {put_device (&bgx->lmac[lmac].phydev->mdio.dev); bgx->lmac[lmac].phydev =NULL ; } - lmac--; }of_node_put (node);return -EPROBE_DEFER ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 82/175 ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit a51160f8da850a65afbf165f5bbac7ffb388bf74 ]
The inetdev_init() function never returns NULL. Check for error pointers instead.
--- net/ipv4/devinet.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
net/ipv4/devinet.c +3 -4
@@ -351,14 +351,13 @@ static void inetdev_destroy(struct in_device *in_dev)static int __init inet_blackhole_dev_init (void ) { -int err =0 ; +struct in_device *in_dev;rtnl_lock (); -if (!inetdev_init (blackhole_netdev)) - err = -ENOMEM ; + in_dev =inetdev_init (blackhole_netdev);rtnl_unlock (); -return err; +return PTR_ERR_OR_ZERO (in_dev); }late_initcall (inet_blackhole_dev_init);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 83/175 net/smc: Remove validation of reserved bits in CLC Decline message
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahanta Jambigi <[email protected]>
[ Upstream commit cc282f73bc0cbdf3ee7af2f2d3a2ef4e6b19242d ]
Currently SMC code is validating the reserved bits while parsing the incoming CLC decline message & when this validation fails, its treated as a protocol error. As a result, the SMC connection is terminated instead of falling back to TCP. As per RFC7609[1] specs we shouldn't be validating the reserved bits that is part of CLC message. This patch fixes this issue.
CLC Decline message format can viewed here[2].
[1] https://datatracker.ietf.org/doc/html/rfc7609#page-92
[2] https://datatracker.ietf.org/doc/html/rfc7609#page-105
--- net/smc/smc_clc.c | 2 -- 1 file changed, 2 deletions(-)
net/smc/smc_clc.c +0 -2
@@ -426,8 +426,6 @@ smc_clc_msg_decl_valid(struct smc_clc_msg_decline *dclc) {struct smc_clc_msg_hdr *hdr = &dclc->hdr; -if (hdr->typev1 !=SMC_TYPE_R && hdr->typev1 !=SMC_TYPE_D ) -return false;if (hdr->version ==SMC_V1 ) {if (ntohs (hdr->length) !=sizeof (struct smc_clc_msg_decline ))return false;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 84/175 mctp: return -ENOPROTOOPT for unknown getsockopt options
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit a125c8fb9ddbcb0602103a50727a476fd30dec01 ]
In mctp_getsockopt(), unrecognized options currently return -EINVAL. In contrast, mctp_setsockopt() returns -ENOPROTOOPT for unknown options.
Update mctp_getsockopt() to also return -ENOPROTOOPT for unknown options. This aligns the behavior of getsockopt() and setsockopt(), and matches the standard kernel socket API convention for handling unsupported options.
--- net/mctp/af_mctp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mctp/af_mctp.c +1 -1
@@ -346,7 +346,7 @@ static int mctp_getsockopt(struct socket *sock, int level, int optname,return 0 ; } -return -EINVAL ; +return -ENOPROTOOPT ; }/* helpers for reading/writing the tag ioc, handling compatibility across the
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 85/175 ax25: properly unshare skbs in ax25_kiss_rcv()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 8156210d36a43e76372312c87eb5ea3dbb405a85 ]
Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d ("net: introduce per netns packet chains").
skb->dev becomes NULL and we crash in __netif_receive_skb_core().
Before above commit, different kind of bugs or corruptions could happen without a major crash.
But the root cause is that ax25_kiss_rcv() can queue/mangle input skb without checking if this skb is shared or not.
Many thanks to Bernard Pidoux for his help, diagnosis and tests.
We had a similar issue years ago fixed with commit 7aaed57c5c28 ("phonet: properly unshare skbs in phonet_rcv()").
--- net/ax25/ax25_in.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ax25/ax25_in.c +4 -0
@@ -433,6 +433,10 @@ static int ax25_rcv(struct sk_buff *skb, struct net_device *dev,int ax25_kiss_rcv (struct sk_buff *skb,struct net_device *dev,struct packet_type *ptype,struct net_device *orig_dev) { + skb =skb_share_check (skb,GFP_ATOMIC ); +if (!skb) +return NET_RX_DROP ; +skb_orphan (skb);if (!net_eq (dev_net (dev), &init_net)) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 86/175 net: atm: fix memory leak in atm_register_sysfs when device_register fail
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <[email protected]>
[ Upstream commit 0a228624bcc00af41f281a2a84c928595a74c17d ]
When device_register() return error in atm_register_sysfs(), which can be triggered by kzalloc fail in device_private_init() or other reasons, kmemleak reports the following memory leaks:
unreferenced object 0xffff88810182fb80 (size 8):
comm "insmod", pid 504, jiffies 4294852464
hex dump (first 8 bytes):
61 64 75 6d 6d 79 30 00 adummy0.
backtrace (crc 14dfadaf):
__kmalloc_node_track_caller_noprof+0x335/0x450
kvasprintf+0xb3/0x130
kobject_set_name_vargs+0x45/0x120
dev_set_name+0xa9/0xe0
atm_register_sysfs+0xf3/0x220
atm_dev_register+0x40b/0x780
0xffffffffa000b089
do_one_initcall+0x89/0x300
do_init_module+0x27b/0x7d0
load_module+0x54cd/0x5ff0
init_module_from_file+0xe4/0x150
idempotent_init_module+0x32c/0x610
__x64_sys_finit_module+0xbd/0x120
do_syscall_64+0xa8/0x270
entry_SYSCALL_64_after_hwframe+0x77/0x7fWhen device_create_file() return error in atm_register_sysfs(), the same issue also can be triggered.
Function put_device() should be called to release kobj->name memory and other device resource, instead of kfree().
--- net/atm/resources.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/atm/resources.c +4 -2
@@ -112,7 +112,9 @@ struct atm_dev *atm_dev_register(const char *type, struct device *parent,if (atm_proc_dev_register (dev) <0 ) {pr_err ("atm_proc_dev_register failed for dev %s\n" , type); - goto out_fail; +mutex_unlock (&atm_dev_mutex); +kfree (dev); +return NULL ; }if (atm_register_sysfs (dev, parent) <0 ) {
@@ -128,7 +130,7 @@ struct atm_dev *atm_dev_register(const char *type, struct device *parent,return dev; out_fail: -kfree (dev); +put_device (&dev->class_dev); dev =NULL ; goto out; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 87/175 net: xilinx: axienet: Add error handling for RX metadata pointer retrieval
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abin Joseph <[email protected]>
[ Upstream commit 8bbceba7dc5090c00105e006ce28d1292cfda8dd ]
Add proper error checking for dmaengine_desc_get_metadata_ptr() which can return an error pointer and lead to potential crashes or undefined behaviour if the pointer retrieval fails.
Properly handle the error by unmapping DMA buffer, freeing the skb and returning early to prevent further processing with invalid data.
--- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/xilinx/xilinx_axienet_main.c +10 -0
@@ -1127,6 +1127,15 @@ static void axienet_dma_rx_cb(void *data, const struct dmaengine_result *result) &meta_max_len);dma_unmap_single (lp->dev, skbuf_dma->dma_address, lp->max_frm_size,DMA_FROM_DEVICE ); + +if (IS_ERR (app_metadata)) { +if (net_ratelimit ()) +netdev_err (lp->ndev,"Failed to get RX metadata pointer\n" ); +dev_kfree_skb_any (skb); + lp->ndev->stats.rx_dropped++; + goto rx_submit; + } +/* TODO: Derive app word index programmatically */ rx_len = (app_metadata[LEN_APP ] &0xFFFF );skb_put (skb, rx_len);
@@ -1139,6 +1148,7 @@ static void axienet_dma_rx_cb(void *data, const struct dmaengine_result *result)u64_stats_add (&lp->rx_bytes, rx_len);u64_stats_update_end (&lp->rx_stat_sync); +rx_submit:for (i =0 ; i <CIRC_SPACE (lp->rx_ring_head, lp->rx_ring_tail,RX_BUF_NUM_DEFAULT ); i++)axienet_rx_submit_desc (lp->ndev);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 88/175 ppp: fix memory leak in pad_compress_skb
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingfang Deng <[email protected]>
[ Upstream commit 4844123fe0b853a4982c02666cb3fd863d701d50 ]
If alloc_skb() fails in pad_compress_skb(), it returns NULL without releasing the old skb. The caller does:
skb = pad_compress_skb(ppp, skb);
if (!skb)
goto drop;drop:
kfree_skb(skb);
When pad_compress_skb() returns NULL, the reference to the old skb is lost and kfree_skb(skb) ends up doing nothing, leading to a memory leak.
Align pad_compress_skb() semantics with realloc(): only free the old skb if allocation and compression succeed. At the call site, use the new_skb variable so the original skb is not lost when pad_compress_skb() fails.
--- drivers/net/ppp/ppp_generic.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ppp/ppp_generic.c +3 -3
@@ -1753,7 +1753,6 @@ pad_compress_skb(struct ppp *ppp, struct sk_buff *skb)*/ if (net_ratelimit ())netdev_err (ppp->dev,"ppp: compressor dropped pkt\n" ); -kfree_skb (skb);consume_skb (new_skb); new_skb =NULL ; }
@@ -1855,9 +1854,10 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb) "down - pkt dropped.\n"); goto drop; } - skb =pad_compress_skb (ppp, skb); -if (!skb) + new_skb =pad_compress_skb (ppp, skb); +if (!new_skb) goto drop; + skb = new_skb; }/*
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 89/175 selftest: net: Fix weird setsockopt() in bind_bhash.c.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit fd2004d82d8d8faa94879e3de3096c8511728637 ]
bind_bhash.c passes (SO_REUSEADDR | SO_REUSEPORT) to setsockopt().
In the asm-generic definition, the value happens to match with the bare SO_REUSEPORT, (2 | 15) == 15, but not on some arch.
arch/alpha/include/uapi/asm/socket.h:18:#define SO_REUSEADDR 0x0004
arch/alpha/include/uapi/asm/socket.h:24:#define SO_REUSEPORT 0x0200
arch/mips/include/uapi/asm/socket.h:24:#define SO_REUSEADDR 0x0004 /* Allow reuse of local addresses. */
arch/mips/include/uapi/asm/socket.h:33:#define SO_REUSEPORT 0x0200 /* Allow local address and port reuse. */
arch/parisc/include/uapi/asm/socket.h:12:#define SO_REUSEADDR 0x0004
arch/parisc/include/uapi/asm/socket.h:18:#define SO_REUSEPORT 0x0200
arch/sparc/include/uapi/asm/socket.h:13:#define SO_REUSEADDR 0x0004
arch/sparc/include/uapi/asm/socket.h:20:#define SO_REUSEPORT 0x0200
include/uapi/asm-generic/socket.h:12:#define SO_REUSEADDR 2
include/uapi/asm-generic/socket.h:27:#define SO_REUSEPORT 15
Let's pass SO_REUSEPORT only.
--- tools/testing/selftests/net/bind_bhash.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/net/bind_bhash.c +2 -2
@@ -75,7 +75,7 @@ static void *setup(void *arg)int *array = (int *)arg;for (i =0 ; i <MAX_CONNECTIONS ; i++) { - sock_fd =bind_socket (SO_REUSEADDR |SO_REUSEPORT , setup_addr); + sock_fd =bind_socket (SO_REUSEPORT , setup_addr);if (sock_fd <0 ) { ret = sock_fd;pthread_exit (&ret);
@@ -103,7 +103,7 @@ int main(int argc, const char *argv[]) setup_addr = use_v6 ? setup_addr_v6 : setup_addr_v4; - listener_fd =bind_socket (SO_REUSEADDR |SO_REUSEPORT , setup_addr); + listener_fd =bind_socket (SO_REUSEPORT , setup_addr);if (listen (listener_fd,100 ) <0 ) {perror ("listen failed" );return -1 ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 90/175 phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <[email protected]>
[ Upstream commit 9b2bfdbf43adb9929c5ddcdd96efedbf1c88cf53 ]
When transmitting a PTP frame which is timestamp using 2 step, the
following warning appears if CONFIG_PROVE_LOCKING is enabled:
=============================
[ BUG: Invalid wait context ]
6.17.0-rc1-00326-ge6160462704e #427 Not tainted
-----------------------------
ptp4l/119 is trying to lock:c2a44ed4 (&vsc8531->ts_lock){+.+.}-{3:3}, at: vsc85xx_txtstamp+0x50/0xac
other info that might help us debug this:
context-{4:4}
4 locks held by ptp4l/119:
#0: c145f068 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x58/0x1440
#1: c29df974 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x5c4/0x1440 #2: c2aaaad0 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x108/0x350
#3: c2aac170 (&lan966x->tx_lock){+.-.}-{2:2}, at: lan966x_port_xmit+0xd0/0x350
stack backtrace: CPU: 0 UID: 0 PID: 119 Comm: ptp4l Not tainted 6.17.0-rc1-00326-ge6160462704e #427 NONE Hardware name: Generic DT based system Call trace: unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x7c/0xac dump_stack_lvl from __lock_acquire+0x8e8/0x29dc __lock_acquire from lock_acquire+0x108/0x38c lock_acquire from __mutex_lock+0xb0/0xe78 __mutex_lock from mutex_lock_nested+0x1c/0x24 mutex_lock_nested from vsc85xx_txtstamp+0x50/0xac vsc85xx_txtstamp from lan966x_fdma_xmit+0xd8/0x3a8 lan966x_fdma_xmit from lan966x_port_xmit+0x1bc/0x350 lan966x_port_xmit from dev_hard_start_xmit+0xc8/0x2c0 dev_hard_start_xmit from sch_direct_xmit+0x8c/0x350 sch_direct_xmit from __dev_queue_xmit+0x680/0x1440 __dev_queue_xmit from packet_sendmsg+0xfa4/0x1568 packet_sendmsg from __sys_sendto+0x110/0x19c __sys_sendto from sys_send+0x18/0x20 sys_send from ret_fast_syscall+0x0/0x1c Exception stack(0xf0b05fa8 to 0xf0b05ff0)
5fa0: 00000001 0000000e 0000000e 0004b47a 0000003a 00000000
5fc0: 00000001 0000000e 00000000 00000121 0004af58 00044874 00000000 00000000 5fe0: 00000001 bee9d420 00025a10 b6e75c7c
So, instead of using the ts_lock for tx_queue, use the spinlock that skb_buff_head has.
--- drivers/net/phy/mscc/mscc_ptp.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-)
drivers/net/phy/mscc/mscc_ptp.c +8 -10
@@ -455,12 +455,12 @@ static void vsc85xx_dequeue_skb(struct vsc85xx_ptp *ptp) *p++ = (reg >>24 ) &0xff ; } - len =skb_queue_len (&ptp->tx_queue); + len =skb_queue_len_lockless (&ptp->tx_queue);if (len <1 )return ;while (len--) { - skb =__skb_dequeue (&ptp->tx_queue); + skb =skb_dequeue (&ptp->tx_queue);if (!skb)return ;
@@ -485,7 +485,7 @@ static void vsc85xx_dequeue_skb(struct vsc85xx_ptp *ptp)* packet in the FIFO right now, reschedule it for later * packets. */ -__skb_queue_tail (&ptp->tx_queue, skb); +skb_queue_tail (&ptp->tx_queue, skb); } }
@@ -1065,6 +1065,7 @@ static int vsc85xx_hwtstamp(struct mii_timestamper *mii_ts,case HWTSTAMP_TX_ON :break ;case HWTSTAMP_TX_OFF : +skb_queue_purge (&vsc8531->ptp->tx_queue);break ;default :return -ERANGE ;
@@ -1089,9 +1090,6 @@ static int vsc85xx_hwtstamp(struct mii_timestamper *mii_ts,mutex_lock (&vsc8531->ts_lock); -__skb_queue_purge (&vsc8531->ptp->tx_queue); -__skb_queue_head_init (&vsc8531->ptp->tx_queue); -/* Disable predictor while configuring the 1588 block */ val =vsc85xx_ts_read_csr (phydev,PROCESSOR ,MSCC_PHY_PTP_INGR_PREDICTOR );
@@ -1177,9 +1175,7 @@ static void vsc85xx_txtstamp(struct mii_timestamper *mii_ts,skb_shinfo (skb)->tx_flags |=SKBTX_IN_PROGRESS ; -mutex_lock (&vsc8531->ts_lock); -__skb_queue_tail (&vsc8531->ptp->tx_queue, skb); -mutex_unlock (&vsc8531->ts_lock); +skb_queue_tail (&vsc8531->ptp->tx_queue, skb);return ; out:
@@ -1545,6 +1541,7 @@ void vsc8584_ptp_deinit(struct phy_device *phydev)if (vsc8531->ptp->ptp_clock) {ptp_clock_unregister (vsc8531->ptp->ptp_clock);skb_queue_purge (&vsc8531->rx_skbs_list); +skb_queue_purge (&vsc8531->ptp->tx_queue); } }
@@ -1568,7 +1565,7 @@ irqreturn_t vsc8584_handle_ts_interrupt(struct phy_device *phydev)if (rc &VSC85XX_1588_INT_FIFO_ADD ) {vsc85xx_get_tx_ts (priv->ptp); }else if (rc &VSC85XX_1588_INT_FIFO_OVERFLOW ) { -__skb_queue_purge (&priv->ptp->tx_queue); +skb_queue_purge (&priv->ptp->tx_queue);vsc85xx_ts_reset_fifo (phydev); }
@@ -1588,6 +1585,7 @@ int vsc8584_ptp_probe(struct phy_device *phydev)mutex_init (&vsc8531->phc_lock);mutex_init (&vsc8531->ts_lock);skb_queue_head_init (&vsc8531->rx_skbs_list); +skb_queue_head_init (&vsc8531->ptp->tx_queue);/* Retrieve the shared load/save GPIO. Request it as non exclusive as * the same GPIO can be requested by all the PHYs of the same package.
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 91/175 ALSA: usb-audio: Add mute TLV for playback volumes on some devices
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cryolitia PukNgae <[email protected]>
commit 9c6182843b0d02ca04cc1d946954a65a2286c7db upstream.
Applying the quirk of that, the lowest Playback mixer volume setting mutes the audio output, on more devices.
--- sound/usb/mixer_quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/mixer_quirks.c +2 -0
@@ -4212,9 +4212,11 @@ void snd_usb_mixer_fu_apply_quirk(structsnd_dragonfly_quirk_db_scale (mixer, cval, kctl);break ;/* lowest playback value is muted on some devices */ +case USB_ID (0x0572 ,0x1b09 ):/* Conexant Systems (Rockwell), Inc. */ case USB_ID (0x0d8c ,0x000c ):/* C-Media */ case USB_ID (0x0d8c ,0x0014 ):/* C-Media */ case USB_ID (0x19f7 ,0x0003 ):/* RODE NT-USB */ +case USB_ID (0x2d99 ,0x0026 ):/* HECATE G2 GAMING HEADSET */ if (strstr (kctl->id.name,"Playback" )) cval->min_mute =1 ;break ;
Greg Kroah-Hartman
maintainerPATCH 92/175 accel/ivpu: Prevent recovery work from being queued during device removal
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karol Wachowski <[email protected]>
commit 69a79ada8eb034ce016b5b78fb7d08d8687223de upstream.
Use disable_work_sync() instead of cancel_work_sync() in ivpu_dev_fini() to ensure that no new recovery work items can be queued after device removal has started. Previously, recovery work could be scheduled even after canceling existing work, potentially leading to use-after-free bugs if recovery accessed freed resources.
Rename ivpu_pm_cancel_recovery() to ivpu_pm_disable_recovery() to better reflect its new behavior.
--- drivers/accel/ivpu/ivpu_drv.c | 2 +- drivers/accel/ivpu/ivpu_pm.c | 4 ++-- drivers/accel/ivpu/ivpu_pm.h | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)
drivers/accel/ivpu/ivpu_drv.c +1 -1
@@ -689,7 +689,7 @@ static void ivpu_bo_unbind_all_user_contstatic void ivpu_dev_fini (struct ivpu_device *vdev) {ivpu_jobs_abort_all (vdev); -ivpu_pm_cancel_recovery (vdev); +ivpu_pm_disable_recovery (vdev);ivpu_pm_disable (vdev);ivpu_prepare_for_reset (vdev);ivpu_shutdown (vdev);
drivers/accel/ivpu/ivpu_pm.c +2 -2
@@ -382,10 +382,10 @@ void ivpu_pm_init(struct ivpu_device *vdivpu_dbg (vdev,PM ,"Autosuspend delay = %d\n" , delay); } -void ivpu_pm_cancel_recovery (struct ivpu_device *vdev) +void ivpu_pm_disable_recovery (struct ivpu_device *vdev) {drm_WARN_ON (&vdev->drm,delayed_work_pending (&vdev->pm->job_timeout_work)); -cancel_work_sync (&vdev->pm->recovery_work); +disable_work_sync (&vdev->pm->recovery_work); }void ivpu_pm_enable (struct ivpu_device *vdev)
drivers/accel/ivpu/ivpu_pm.h +1 -1
@@ -25,7 +25,7 @@ struct ivpu_pm_info {void ivpu_pm_init (struct ivpu_device *vdev);void ivpu_pm_enable (struct ivpu_device *vdev);void ivpu_pm_disable (struct ivpu_device *vdev); -void ivpu_pm_cancel_recovery (struct ivpu_device *vdev); +void ivpu_pm_disable_recovery (struct ivpu_device *vdev);int ivpu_pm_suspend_cb (struct device *dev);int ivpu_pm_resume_cb (struct device *dev);
Greg Kroah-Hartman
maintainerPATCH 93/175 ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit f3ef7110924b897f4b79db9f7ac75d319ec09c4a upstream.
If krealloc_array() fails in iort_rmr_alloc_sids(), the function returns NULL but does not free the original 'sids' allocation. This results in a memory leak since the caller overwrites the original pointer with the NULL return value.
--- drivers/acpi/arm64/iort.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/acpi/arm64/iort.c +3 -1
@@ -937,8 +937,10 @@ static u32 *iort_rmr_alloc_sids(u32 *sid new_sids =krealloc_array (sids, count + new_count,sizeof (*new_sids),GFP_KERNEL ); -if (!new_sids) +if (!new_sids) { +kfree (sids);return NULL ; + }for (i = count; i < total_count; i++) new_sids[i] = id_start++;
Greg Kroah-Hartman
maintainerPATCH 94/175 arm64: ftrace: fix unreachable PLT for ftrace_caller in init_module with CONFIG_DYNAMIC_FTRACE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: panfan <[email protected]>
commit a7ed7b9d0ebb038db9963d574da0311cab0b666a upstream.
On arm64, it has been possible for a module's sections to be placed more than 128M away from each other since commit:
commit 3e35d303ab7d ("arm64: module: rework module VA range selection")
Due to this, an ftrace callsite in a module's .init.text section can be out of branch range for the module's ftrace PLT entry (in the module's .text section). Any attempt to enable tracing of that callsite will result in a BRK being patched into the callsite, resulting in a fatal exception when the callsite is later executed.
Fix this by adding an additional trampoline for .init.text, which will be within range.
No additional trampolines are necessary due to the way a given module's executable sections are packed together. Any executable section beginning with ".init" will be placed in MOD_INIT_TEXT, and any other executable section, including those beginning with ".exit",
will be placed in MOD_TEXT.
--- arch/arm64/include/asm/module.h | 1 + arch/arm64/include/asm/module.lds.h | 1 + arch/arm64/kernel/ftrace.c | 13 ++++++++++--- arch/arm64/kernel/module-plts.c | 12 +++++++++++- arch/arm64/kernel/module.c | 11 +++++++++++ 5 files changed, 34 insertions(+), 4 deletions(-)
arch/arm64/include/asm/module.h +1 -0
@@ -19,6 +19,7 @@ struct mod_arch_specific {/* for CONFIG_DYNAMIC_FTRACE */ struct plt_entry *ftrace_trampolines; +struct plt_entry *init_ftrace_trampolines; }; u64 module_emit_plt_entry(struct module *mod, Elf64_Shdr *sechdrs,
arch/arm64/include/asm/module.lds.h +1 -0
@@ -2,6 +2,7 @@ SECTIONS { .plt 0 : { BYTE(0) } .init.plt 0 : { BYTE(0) } .text.ftrace_trampoline 0 : { BYTE(0) } + .init.text.ftrace_trampoline 0 : { BYTE(0) } #ifdef CONFIG_KASAN_SW_TAGS /*
arch/arm64/kernel/ftrace.c +10 -3
@@ -195,10 +195,17 @@ int ftrace_update_ftrace_func(ftrace_funreturn ftrace_modify_code (pc,0 , new, false); } -static struct plt_entry *get_ftrace_plt (struct module *mod) +static struct plt_entry *get_ftrace_plt (struct module *mod,unsigned long addr) {#ifdef CONFIG_MODULES -struct plt_entry *plt = mod->arch.ftrace_trampolines; +struct plt_entry *plt =NULL ; + +if (within_module_mem_type (addr, mod,MOD_INIT_TEXT )) + plt = mod->arch.init_ftrace_trampolines; +else if (within_module_mem_type (addr, mod,MOD_TEXT )) + plt = mod->arch.ftrace_trampolines; +else +return NULL ;return &plt[FTRACE_PLT_IDX ];#else
@@ -270,7 +277,7 @@ static bool ftrace_find_callable_addr(stif (WARN_ON (!mod))return false; - plt =get_ftrace_plt (mod); + plt =get_ftrace_plt (mod, pc);if (!plt) {pr_err ("ftrace: no module PLT for %ps\n" , (void *)*addr);return false;
arch/arm64/kernel/module-plts.c +11 -1
@@ -283,7 +283,7 @@ int module_frob_arch_sections(Elf_Ehdr *unsigned long core_plts =0 ;unsigned long init_plts =0 ;Elf64_Sym *syms =NULL ; -Elf_Shdr *pltsec, *tramp =NULL ; +Elf_Shdr *pltsec, *tramp =NULL , *init_tramp =NULL ;int i;/*
@@ -298,6 +298,9 @@ int module_frob_arch_sections(Elf_Ehdr *else if (!strcmp (secstrings + sechdrs[i].sh_name,".text.ftrace_trampoline" )) tramp = sechdrs + i; +else if (!strcmp (secstrings + sechdrs[i].sh_name, +".init.text.ftrace_trampoline" )) + init_tramp = sechdrs + i;else if (sechdrs[i].sh_type ==SHT_SYMTAB ) syms = (Elf64_Sym *)sechdrs[i].sh_addr; }
@@ -363,5 +366,12 @@ int module_frob_arch_sections(Elf_Ehdr * tramp->sh_size =NR_FTRACE_PLTS *sizeof (struct plt_entry ); } +if (init_tramp) { + init_tramp->sh_type =SHT_NOBITS ; + init_tramp->sh_flags =SHF_EXECINSTR |SHF_ALLOC ; + init_tramp->sh_addralign = __alignof__(struct plt_entry ); + init_tramp->sh_size =NR_FTRACE_PLTS *sizeof (struct plt_entry ); + } +return 0 ; }
arch/arm64/kernel/module.c +11 -0
@@ -453,6 +453,17 @@ static int module_init_ftrace_plt(const__init_plt (&plts[FTRACE_PLT_IDX ],FTRACE_ADDR ); mod->arch.ftrace_trampolines = plts; + + s =find_section (hdr, sechdrs,".init.text.ftrace_trampoline" ); +if (!s) +return -ENOEXEC ; + + plts = (void *)s->sh_addr; + +__init_plt (&plts[FTRACE_PLT_IDX ],FTRACE_ADDR ); + + mod->arch.init_ftrace_trampolines = plts; +#endif return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 95/175 pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 44822df89e8f3386871d9cad563ece8e2fd8f0e7 upstream.
In __iodyn_find_io_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There is a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference on failure of pcmcia_make_resource().
Fix this bug by adding a check of res.
--- drivers/pcmcia/rsrc_iodyn.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/pcmcia/rsrc_iodyn.c +3 -0
@@ -62,6 +62,9 @@ static struct resource *__iodyn_find_io_unsigned long min = base;int ret; +if (!res) +return NULL ; + data.mask = align -1 ; data.offset = base & data.mask;
Greg Kroah-Hartman
maintainerPATCH 96/175 io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
Commit fc582cd26e888b0652bc1494f252329453fd3b23 upstream.
syzbot reports that defer/local task_work adding via msg_ring can hit a request that has been freed:
CPU: 1 UID: 0 PID: 19356 Comm: iou-wrk-19354 Not tainted 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xd2/0x2b0 mm/kasan/report.c:521 kasan_report+0x118/0x150 mm/kasan/report.c:634 io_req_local_work_add io_uring/io_uring.c:1184 [inline] __io_req_task_work_add+0x589/0x950 io_uring/io_uring.c:1252 io_msg_remote_post io_uring/msg_ring.c:103 [inline] io_msg_data_remote io_uring/msg_ring.c:133 [inline] __io_msg_ring_data+0x820/0xaa0 io_uring/msg_ring.c:151 io_msg_ring_data io_uring/msg_ring.c:173 [inline] io_msg_ring+0x134/0xa00 io_uring/msg_ring.c:314 __io_issue_sqe+0x17e/0x4b0 io_uring/io_uring.c:1739 io_issue_sqe+0x165/0xfd0 io_uring/io_uring.c:1762 io_wq_submit_work+0x6e9/0xb90 io_uring/io_uring.c:1874 io_worker_handle_work+0x7cd/0x1180 io_uring/io-wq.c:642 io_wq_worker+0x42f/0xeb0 io_uring/io-wq.c:696 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK>
which is supposed to be safe with how requests are allocated. But msg ring requests alloc and free on their own, and hence must defer freeing to a sane time.
Add an rcu_head and use kfree_rcu() in both spots where requests are freed. Only the one in io_msg_tw_complete() is strictly required as it has been visible on the other ring, but use it consistently in the other spot as well.
This should not cause any other issues outside of KASAN rightfully complaining about it.
--- include/linux/io_uring_types.h | 12 ++++++++++-- io_uring/msg_ring.c | 4 ++-- 2 files changed, 12 insertions(+), 4 deletions(-)
include/linux/io_uring_types.h +10 -2
@@ -646,8 +646,16 @@ struct io_kiocb {atomic_t refs;bool cancel_seq_set;struct io_task_work io_task_work; -/* for polled requests, i.e. IORING_OP_POLL_ADD and async armed poll */ -struct hlist_node hash_node; +union { +/* +* for polled requests, i.e. IORING_OP_POLL_ADD and async armed +* poll +*/ +struct hlist_node hash_node; + +/* for private io_kiocb freeing */ +struct rcu_head rcu_head; + };/* internal polling, see IORING_FEAT_FAST_POLL */ struct async_poll *apoll;/* opcode allocated if it needs to store data for async defer */
io_uring/msg_ring.c +2 -2
@@ -82,7 +82,7 @@ static void io_msg_tw_complete(struct iospin_unlock (&ctx->msg_lock); }if (req) -kmem_cache_free (req_cachep, req); +kfree_rcu (req, rcu_head);percpu_ref_put (&ctx->refs); }
@@ -91,7 +91,7 @@ static int io_msg_remote_post(struct io_ { req->task =READ_ONCE (ctx->submitter_task);if (!req->task) { -kmem_cache_free (req_cachep, req); +kfree_rcu (req, rcu_head);return -EOWNERDEAD ; } req->opcode =IORING_OP_NOP ;
Greg Kroah-Hartman
maintainerPATCH 97/175 x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harry Yoo <[email protected]>
commit 6659d027998083fbb6d42a165b0c90dc2e8ba989 upstream.
Define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() to ensure page tables are properly synchronized when calling p*d_populate_kernel().
For 5-level paging, synchronization is performed via pgd_populate_kernel(). In 4-level paging, pgd_populate() is a no-op, so synchronization is instead performed at the P4D level via p4d_populate_kernel().
This fixes intermittent boot failures on systems using 4-level paging and a large amount of persistent memory:
BUG: unable to handle page fault for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace: <TASK> __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax] dax_bus_probe+0x6d/0xc9 [... snip ...] </TASK>
It also fixes a crash in vmemmap_set_pmd() caused by accessing vmemmap before sync_global_pgds() [1]:
BUG: unable to handle page fault for address: ffffeb3ff1200000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: Oops: 0002 [#1] PREEMPT SMP NOPTI Tainted: [W]=WARN RIP: 0010:vmemmap_set_pmd+0xff/0x230 <TASK> vmemmap_populate_hugepages+0x176/0x180 vmemmap_populate+0x34/0x80 __populate_section_memmap+0x41/0x90 sparse_add_section+0x121/0x3e0 __add_pages+0xba/0x150 add_pages+0x1d/0x70 memremap_pages+0x3dc/0x810 devm_memremap_pages+0x1c/0x60 xe_devm_add+0x8b/0x100 [xe] xe_tile_init_noalloc+0x6a/0x70 [xe] xe_device_probe+0x48c/0x740 [xe] [... snip ...]
--- arch/x86/include/asm/pgtable_64_types.h | 3 +++ arch/x86/mm/init_64.c | 18 ++++++++++++++++++ 2 files changed, 21 insertions(+)
arch/x86/include/asm/pgtable_64_types.h +3 -0
@@ -41,6 +41,9 @@ static inline bool pgtable_l5_enabled(vo#define pgtable_l5_enabled () 0#endif /* CONFIG_X86_5LEVEL */ +#define ARCH_PAGE_TABLE_SYNC_MASK \ + (pgtable_l5_enabled() ? PGTBL_PGD_MODIFIED : PGTBL_P4D_MODIFIED) +extern unsigned int pgdir_shift;extern unsigned int ptrs_per_p4d;
arch/x86/mm/init_64.c +18 -0
@@ -224,6 +224,24 @@ static void sync_global_pgds(unsigned lo }/* +* Make kernel mappings visible in all page tables in the system. +* This is necessary except when the init task populates kernel mappings +* during the boot process. In that case, all processes originating from +* the init task copies the kernel mappings, so there is no issue. +* Otherwise, missing synchronization could lead to kernel crashes due +* to missing page table entries for certain kernel mappings. +* +* Synchronization is performed at the top level, which is the PGD in +* 5-level paging systems. But in 4-level paging systems, however, +* pgd_populate() is a no-op, so synchronization is done at the P4D level. +* sync_global_pgds() handles this difference between paging levels. +*/ +void arch_sync_kernel_mappings (unsigned long start,unsigned long end) +{ +sync_global_pgds (start, end); +} + +/* * NOTE: This function is marked __ref because it calls __init function * (alloc_bootmem_pages). It's safe to do it ONLY when after_bootmem == 0. */
Greg Kroah-Hartman
maintainerPATCH 98/175 mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Levin <[email protected]>
commit 9614d8bee66387501f48718fa306e17f2aa3f2f3 upstream.
With CONFIG_HIGHPTE on 32-bit ARM, move_pages_pte() maps PTE pages using kmap_local_page(), which requires unmapping in Last-In-First-Out order.
The current code maps dst_pte first, then src_pte, but unmaps them in the same order (dst_pte, src_pte), violating the LIFO requirement. This causes the warning in kunmap_local_indexed():
WARNING: CPU: 0 PID: 604 at mm/highmem.c:622 kunmap_local_indexed+0x178/0x17c addr \!= __fix_to_virt(FIX_KMAP_BEGIN + idx)
Fix this by reversing the unmap order to respect LIFO ordering.
This issue follows the same pattern as similar fixes:
- commit eca6828403b8 ("crypto: skcipher - fix mismatch between mapping and unmapping order")
- commit 8cf57c6df818 ("nilfs2: eliminate staggered calls to kunmap in nilfs_rename")
Both of which addressed the same fundamental requirement that kmap_local operations must follow LIFO ordering.
--- mm/userfaultfd.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
mm/userfaultfd.c +7 -2
@@ -1432,10 +1432,15 @@ out:folio_unlock (src_folio);folio_put (src_folio); } -if (dst_pte) -pte_unmap (dst_pte); +/* +* Unmap in reverse order (LIFO) to maintain proper kmap_local +* index ordering when CONFIG_HIGHPTE is enabled. We mapped dst_pte +* first, then src_pte, so we must unmap src_pte first, then dst_pte. +*/ if (src_pte)pte_unmap (src_pte); +if (dst_pte) +pte_unmap (dst_pte);mmu_notifier_invalidate_range_end (&range);if (si)put_swap_device (si);
Greg Kroah-Hartman
maintainerPATCH 99/175 mm: move page table sync declarations to linux/pgtable.h
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harry Yoo <[email protected]>
commit 7cc183f2e67d19b03ee5c13a6664b8c6cc37ff9d upstream.
During our internal testing, we started observing intermittent boot failures when the machine uses 4-level paging and has a large amount of persistent memory:
BUG: unable to handle page fault for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace: <TASK> __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax] dax_bus_probe+0x6d/0xc9 [... snip ...] </TASK>
It turns out that the kernel panics while initializing vmemmap (struct page array) when the vmemmap region spans two PGD entries, because the new PGD entry is only installed in init_mm.pgd, but not in the page tables of other tasks.
And looking at __populate_section_memmap():
if (vmemmap_can_optimize(altmap, pgmap))
// does not sync top level page tables
r = vmemmap_populate_compound_pages(pfn, start, end, nid, pgmap);
else
// sync top level page tables in x86
r = vmemmap_populate(start, end, nid, altmap);In the normal path, vmemmap_populate() in arch/x86/mm/init_64.c synchronizes the top level page table (See commit 9b861528a801 ("x86-64,
mem: Update all PGDs for direct mapping and vmemmap mapping changes")) so that all tasks in the system can see the new vmemmap area.
However, when vmemmap_can_optimize() returns true, the optimized path skips synchronization of top-level page tables. This is because vmemmap_populate_compound_pages() is implemented in core MM code, which does not handle synchronization of the top-level page tables. Instead, the core MM has historically relied on each architecture to perform this synchronization manually.
We're not the first party to encounter a crash caused by not-sync'd top level page tables: earlier this year, Gwan-gyeong Mun attempted to address the issue [1] [2] after hitting a kernel panic when x86 code accessed the vmemmap area before the corresponding top-level entries were synced. At that time, the issue was believed to be triggered only when struct page was enlarged for debugging purposes, and the patch did not get further updates.
It turns out that current approach of relying on each arch to handle the page table sync manually is fragile because 1) it's easy to forget to sync the top level page table, and 2) it's also easy to overlook that the kernel should not access the vmemmap and direct mapping areas before the sync.
# The solution: Make page table sync more code robust and harder to miss
To address this, Dave Hansen suggested [3] [4] introducing {pgd,p4d}_populate_kernel() for updating kernel portion of the page tables and allow each architecture to explicitly perform synchronization when installing top-level entries. With this approach, we no longer need to worry about missing the sync step, reducing the risk of future regressions.
The new interface reuses existing ARCH_PAGE_TABLE_SYNC_MASK, PGTBL_P*D_MODIFIED and arch_sync_kernel_mappings() facility used by vmalloc and ioremap to synchronize page tables.
pgd_populate_kernel() looks like this:
static inline void pgd_populate_kernel(unsigned long addr, pgd_t *pgd,
p4d_t *p4d)
{
pgd_populate(&init_mm, pgd, p4d);
if (ARCH_PAGE_TABLE_SYNC_MASK & PGTBL_PGD_MODIFIED)
arch_sync_kernel_mappings(addr, addr);
}It is worth noting that vmalloc() and apply_to_range() carefully synchronizes page tables by calling p*d_alloc_track() and arch_sync_kernel_mappings(), and thus they are not affected by this patch series.
This series was hugely inspired by Dave Hansen's suggestion and hence added Suggested-by: Dave Hansen.
Cc stable because lack of this series opens the door to intermittent boot failures.
This patch (of 3):
Move ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() to linux/pgtable.h so that they can be used outside of vmalloc and ioremap.
--- include/linux/pgtable.h | 16 ++++++++++++++++ include/linux/vmalloc.h | 16 ---------------- 2 files changed, 16 insertions(+), 16 deletions(-)
include/linux/pgtable.h +16 -0
@@ -1697,6 +1697,22 @@ static inline int pmd_protnone(pmd_t pmd }#endif /* CONFIG_NUMA_BALANCING */ +/* +* Architectures can set this mask to a combination of PGTBL_P?D_MODIFIED values +* and let generic vmalloc and ioremap code know when arch_sync_kernel_mappings() +* needs to be called. +*/ +#ifndef ARCH_PAGE_TABLE_SYNC_MASK +#define ARCH_PAGE_TABLE_SYNC_MASK 0 +#endif + +/* +* There is no default implementation for arch_sync_kernel_mappings(). It is +* relied upon the compiler to optimize calls out if ARCH_PAGE_TABLE_SYNC_MASK +* is 0. +*/ +void arch_sync_kernel_mappings (unsigned long start,unsigned long end); +#endif /* CONFIG_MMU */ #ifdef CONFIG_HAVE_ARCH_HUGE_VMAP
include/linux/vmalloc.h +0 -16
@@ -210,22 +210,6 @@ extern int remap_vmalloc_range(struct vm unsigned long pgoff);/* -* Architectures can set this mask to a combination of PGTBL_P?D_MODIFIED values -* and let generic vmalloc and ioremap code know when arch_sync_kernel_mappings() -* needs to be called. -*/ -#ifndef ARCH_PAGE_TABLE_SYNC_MASK -#define ARCH_PAGE_TABLE_SYNC_MASK 0 -#endif - -/* -* There is no default implementation for arch_sync_kernel_mappings(). It is -* relied upon the compiler to optimize calls out if ARCH_PAGE_TABLE_SYNC_MASK -* is 0. -*/ -void arch_sync_kernel_mappings (unsigned long start,unsigned long end); - -/* * Lowlevel-APIs (not for driver use!) */
Greg Kroah-Hartman
maintainerPATCH 100/175 mm: fix possible deadlock in kmemleak
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gu Bowen <[email protected]>
commit c873ccbb2f8db46ad9b4a989ea924b6d8f19abf1 upstream.
There are some AA deadlock issues in kmemleak, similar to the situation reported by Breno [1]. The deadlock path is as follows:
mem_pool_alloc()
-> raw_spin_lock_irqsave(&kmemleak_lock, flags);
-> pr_warn()
-> netconsole subsystem
-> netpoll
-> __alloc_skb
-> __create_object
-> raw_spin_lock_irqsave(&kmemleak_lock, flags);To solve this problem, switch to printk_safe mode before printing warning message, this will redirect all printk()-s to a special per-CPU buffer, which will be flushed later from a safe context (irq work), and this deadlock problem can be avoided. The proper API to use should be printk_deferred_enter()/printk_deferred_exit() [2]. Another way is to place the warn print after kmemleak is released.
--- mm/kmemleak.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-)
mm/kmemleak.c +20 -7
@@ -432,9 +432,15 @@ static struct kmemleak_object *__lookup_else if (untagged_objp == untagged_ptr || alias)return object;else { +/* +* Printk deferring due to the kmemleak_lock held. +* This is done to avoid deadlock. +*/ +printk_deferred_enter ();kmemleak_warn ("Found object by alias at 0x%08lx\n" , ptr);dump_object_info (object); +printk_deferred_exit ();break ; } }
@@ -731,6 +737,11 @@ static int __link_object(struct kmemleakelse if (untagged_objp + parent->size <= untagged_ptr) link = &parent->rb_node.rb_right;else { +/* +* Printk deferring due to the kmemleak_lock held. +* This is done to avoid deadlock. +*/ +printk_deferred_enter ();kmemleak_stop ("Cannot insert 0x%lx into the object search tree (overlaps existing)\n" , ptr);/*
@@ -738,6 +749,7 @@ static int __link_object(struct kmemleak* be freed while the kmemleak_lock is held. */ dump_object_info (parent); +printk_deferred_exit ();return -EEXIST ; } }
@@ -851,13 +863,8 @@ static void delete_object_part(unsignedraw_spin_lock_irqsave (&kmemleak_lock, flags); object =__find_and_remove_object (ptr,1 , objflags); -if (!object) { -#ifdef DEBUG -kmemleak_warn ("Partially freeing unknown object at 0x%08lx (size %zu)\n" , - ptr, size); -#endif +if (!object) goto unlock; - }/* * Create one or two objects that may result from the memory block
@@ -877,8 +884,14 @@ static void delete_object_part(unsigned unlock:raw_spin_unlock_irqrestore (&kmemleak_lock, flags); -if (object) +if (object) {__delete_object (object); + }else { +#ifdef DEBUG +kmemleak_warn ("Partially freeing unknown object at 0x%08lx (size %zu)\n" , + ptr, size); +#endif + } out:if (object_l)
Greg Kroah-Hartman
maintainerPATCH 101/175 mm: slub: avoid wake up kswapd in set_track_prepare
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: yangshiguang <[email protected]>
commit 850470a8413a8a78e772c4f6bd9fe81ec6bd5b0f upstream.
set_track_prepare() can incur lock recursion.
The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)[n].lock, but when enabled CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare, and try to hold the per_cpu(hrtimer_bases)[n].lock.
Avoid deadlock caused by implicitly waking up kswapd by passing in allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the debug_objects_fill_pool() case. Inside stack depot they are processed by gfp_nested_mask().
Since ___slab_alloc() has preemption disabled, we mask out __GFP_DIRECT_RECLAIM from the flags there.
The oops looks something like:
BUG: spinlock recursion on CPU#3, swapper/3/0 lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3 Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT) Call trace: spin_bug+0x0 _raw_spin_lock_irqsave+0x80 hrtimer_try_to_cancel+0x94 task_contending+0x10c enqueue_dl_entity+0x2a4 dl_server_start+0x74 enqueue_task_fair+0x568 enqueue_task+0xac do_activate_task+0x14c ttwu_do_activate+0xcc try_to_wake_up+0x6c8 default_wake_function+0x20 autoremove_wake_function+0x1c __wake_up+0xac wakeup_kswapd+0x19c wake_all_kswapds+0x78 __alloc_pages_slowpath+0x1ac __alloc_pages_noprof+0x298 stack_depot_save_flags+0x6b0 stack_depot_save+0x14 set_track_prepare+0x5c ___slab_alloc+0xccc __kmalloc_cache_noprof+0x470 __set_page_owner+0x2bc post_alloc_hook[jt]+0x1b8 prep_new_page+0x28 get_page_from_freelist+0x1edc __alloc_pages_noprof+0x13c alloc_slab_page+0x244 allocate_slab+0x7c ___slab_alloc+0x8e8 kmem_cache_alloc_noprof+0x450 debug_objects_fill_pool+0x22c debug_object_activate+0x40 enqueue_hrtimer[jt]+0xdc hrtimer_start_range_ns+0x5f8
...
--- mm/slub.c | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-)
mm/slub.c +20 -10
@@ -935,19 +935,19 @@ static struct track *get_track(struct km }#ifdef CONFIG_STACKDEPOT -static noinline depot_stack_handle_t set_track_prepare(void) +static noinline depot_stack_handle_t set_track_prepare(gfp_t gfp_flags) {depot_stack_handle_t handle;unsigned long entries[TRACK_ADDRS_COUNT ];unsigned int nr_entries; nr_entries =stack_trace_save (entries,ARRAY_SIZE (entries),3 ); - handle =stack_depot_save (entries, nr_entries,GFP_NOWAIT ); + handle =stack_depot_save (entries, nr_entries, gfp_flags);return handle; }#else -static inline depot_stack_handle_t set_track_prepare (void ) +static inline depot_stack_handle_t set_track_prepare (gfp_t gfp_flags) {return 0 ; }
@@ -969,9 +969,9 @@ static void set_track_update(struct kmem } static __always_inline void set_track(struct kmem_cache *s, void *object, -enum track_item alloc,unsigned long addr) +enum track_item alloc,unsigned long addr,gfp_t gfp_flags) { -depot_stack_handle_t handle =set_track_prepare (); +depot_stack_handle_t handle =set_track_prepare (gfp_flags);set_track_update (s, object, alloc, addr, handle); }
@@ -1872,9 +1872,9 @@ static inline bool free_debug_processingstatic inline void slab_pad_check (struct kmem_cache *s,struct slab *slab) {}static inline int check_object (struct kmem_cache *s,struct slab *slab,void *object,u8 val) {return 1 ; } -static inline depot_stack_handle_t set_track_prepare (void ) {return 0 ; } +static inline depot_stack_handle_t set_track_prepare (gfp_t gfp_flags) {return 0 ; }static inline void set_track (struct kmem_cache *s,void *object, -enum track_item alloc,unsigned long addr) {} +enum track_item alloc,unsigned long addr,gfp_t gfp_flags) {}static inline void add_full (struct kmem_cache *s,struct kmem_cache_node *n,struct slab *slab) {} static inline void remove_full(struct kmem_cache *s, struct kmem_cache_node *n,
@@ -3822,9 +3822,14 @@ new_objects:* For debug caches here we had to go through * alloc_single_from_partial() so just store the * tracking info and return the object. +* +* Due to disabled preemption we need to disallow +* blocking. The flags are further adjusted by +* gfp_nested_mask() in stack_depot itself. */ if (s->flags &SLAB_STORE_USER ) -set_track (s, freelist,TRACK_ALLOC , addr); +set_track (s, freelist,TRACK_ALLOC , addr, + gfpflags & ~(__GFP_DIRECT_RECLAIM));return freelist; }
@@ -3856,7 +3861,8 @@ new_objects: goto new_objects;if (s->flags &SLAB_STORE_USER ) -set_track (s, freelist,TRACK_ALLOC , addr); +set_track (s, freelist,TRACK_ALLOC , addr, + gfpflags & ~(__GFP_DIRECT_RECLAIM));return freelist; }
@@ -4344,8 +4350,12 @@ static noinline void free_to_partial_lisunsigned long flags;depot_stack_handle_t handle =0 ; +/* +* We cannot use GFP_NOWAIT as there are callsites where waking up +* kswapd could deadlock +*/ if (s->flags &SLAB_STORE_USER ) - handle =set_track_prepare (); + handle =set_track_prepare (__GFP_NOWARN);spin_lock_irqsave (&n->list_lock, flags);
Greg Kroah-Hartman
maintainerPATCH 102/175 sched: Fix sched_numa_find_nth_cpu() if mask offline
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Loehle <[email protected]>
commit 5ebf512f335053a42482ebff91e46c6dc156bf8c upstream.
sched_numa_find_nth_cpu() uses a bsearch to look for the 'closest' CPU in sched_domains_numa_masks and given cpus mask. However they might not intersect if all CPUs in the cpus mask are offline. bsearch will return NULL in that case, bail out instead of dereferencing a bogus pointer.
The previous behaviour lead to this bug when using maxcpus=4 on an rk3399 (LLLLbb) (i.e. booting with all big CPUs offline):
[ 1.422922] Unable to handle kernel paging request at virtual address ffffff8000000000 [ 1.423635] Mem abort info: [ 1.423889] ESR = 0x0000000096000006 [ 1.424227] EC = 0x25: DABT (current EL), IL = 32 bits [ 1.424715] SET = 0, FnV = 0 [ 1.424995] EA = 0, S1PTW = 0 [ 1.425279] FSC = 0x06: level 2 translation fault [ 1.425735] Data abort info: [ 1.425998] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 [ 1.426499] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 1.426952] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 1.427428] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000004a9f000 [ 1.428038] [ffffff8000000000] pgd=18000000f7fff403, p4d=18000000f7fff403, pud=18000000f7fff403, pmd=0000000000000000 [ 1.429014] Internal error: Oops: 0000000096000006 [#1] SMP [ 1.429525] Modules linked in: [ 1.429813] CPU: 3 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc4-dirty #343 PREEMPT [ 1.430559] Hardware name: Pine64 RockPro64 v2.1 (DT) [ 1.431012] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1.431634] pc : sched_numa_find_nth_cpu+0x2a0/0x488 [ 1.432094] lr : sched_numa_find_nth_cpu+0x284/0x488 [ 1.432543] sp : ffffffc084e1b960 [ 1.432843] x29: ffffffc084e1b960 x28: ffffff80078a8800 x27: ffffffc0846eb1d0 [ 1.433495] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 [ 1.434144] x23: 0000000000000000 x22: fffffffffff7f093 x21: ffffffc081de6378 [ 1.434792] x20: 0000000000000000 x19: 0000000ffff7f093 x18: 00000000ffffffff [ 1.435441] x17: 3030303866666666 x16: 66663d736b73616d x15: ffffffc104e1b5b7 [ 1.436091] x14: 0000000000000000 x13: ffffffc084712860 x12: 0000000000000372 [ 1.436739] x11: 0000000000000126 x10: ffffffc08476a860 x9 : ffffffc084712860 [ 1.437389] x8 : 00000000ffffefff x7 : ffffffc08476a860 x6 : 0000000000000000 [ 1.438036] x5 : 000000000000bff4 x4 : 0000000000000000 x3 : 0000000000000000 [ 1.438683] x2 : 0000000000000000 x1 : ffffffc0846eb000 x0 : ffffff8000407b68 [ 1.439332] Call trace: [ 1.439559] sched_numa_find_nth_cpu+0x2a0/0x488 (P) [ 1.440016] smp_call_function_any+0xc8/0xd0 [ 1.440416] armv8_pmu_init+0x58/0x27c [ 1.440770] armv8_cortex_a72_pmu_init+0x20/0x2c [ 1.441199] arm_pmu_device_probe+0x1e4/0x5e8 [ 1.441603] armv8_pmu_device_probe+0x1c/0x28 [ 1.442007] platform_probe+0x5c/0xac [ 1.442347] really_probe+0xbc/0x298 [ 1.442683] __driver_probe_device+0x78/0x12c [ 1.443087] driver_probe_device+0xdc/0x160 [ 1.443475] __driver_attach+0x94/0x19c [ 1.443833] bus_for_each_dev+0x74/0xd4 [ 1.444190] driver_attach+0x24/0x30 [ 1.444525] bus_add_driver+0xe4/0x208 [ 1.444874] driver_register+0x60/0x128 [ 1.445233] __platform_driver_register+0x24/0x30 [ 1.445662] armv8_pmu_driver_init+0x28/0x4c [ 1.446059] do_one_initcall+0x44/0x25c [ 1.446416] kernel_init_freeable+0x1dc/0x3bc [ 1.446820] kernel_init+0x20/0x1d8 [ 1.447151] ret_from_fork+0x10/0x20 [ 1.447493] Code: 90022e21 f000e5f5 910de2b5 2a1703e2 (f8767803) [ 1.448040] ---[ end trace 0000000000000000 ]--- [ 1.448483] note: swapper/0[1] exited with preempt_count 1 [ 1.449047] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b [ 1.449741] SMP: stopping secondary CPUs [ 1.450105] Kernel Offset: disabled [ 1.450419] CPU features: 0x000000,00080000,20002001,0400421b [ 1.450935] Memory Limit: none [ 1.451217] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---
Yury: with the fix, the function returns cpu == nr_cpu_ids, and later in
smp_call_function_any -> smp_call_function_single -> generic_exec_single
we test the cpu for '>= nr_cpu_ids' and return -ENXIO. So everything is handled correctly.
--- kernel/sched/topology.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/sched/topology.c +2 -0
@@ -2174,6 +2174,8 @@ int sched_numa_find_nth_cpu(const struct goto unlock; hop_masks =bsearch (&k, k.masks, sched_domains_numa_levels,sizeof (k.masks[0 ]), hop_cmp); +if (!hop_masks) + goto unlock; hop = hop_masks - k.masks; ret = hop ?
Greg Kroah-Hartman
maintainerPATCH 103/175 kasan: fix GCC mem-intrinsic prefix with sw tags
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ada Couprie Diaz <[email protected]>
commit 51337a9a3a404fde0f5337662ffc7699793dfeb5 upstream.
GCC doesn't support "hwasan-kernel-mem-intrinsic-prefix", only "asan-kernel-mem-intrinsic-prefix"[0], while LLVM supports both. This is already taken into account when checking "CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX", but not in the KASAN Makefile adding those parameters when "CONFIG_KASAN_SW_TAGS" is enabled.
Replace the version check with "CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX", which already validates that mem-intrinsic prefix parameter can be used, and choose the correct name depending on compiler.
GCC 13 and above trigger "CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX" which prevents mem{cpy,move,set}() being redefined in "mm/kasan/shadow.c" since commit 36be5cba99f6 ("kasan: treat meminstrinsic as builtins in uninstrumented files"), as we expect the compiler to prefix those calls with __(hw)asan_ instead. But as the option passed to GCC has been incorrect, the compiler has not been emitting those prefixes, effectively never calling the instrumented versions of mem{cpy,move,set}() with "CONFIG_KASAN_SW_TAGS" enabled.
If "CONFIG_FORTIFY_SOURCES" is enabled, this issue would be mitigated as it redefines mem{cpy,move,set}() and properly aliases the __underlying_mem*() that will be called to the instrumented versions.
--- scripts/Makefile.kasan | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
scripts/Makefile.kasan +8 -4
@@ -86,10 +86,14 @@ kasan_params += hwasan-instrument-stack= hwasan-use-short-granules=0 \ hwasan-inline-all-checks=0 -# Instrument memcpy/memset/memmove calls by using instrumented __hwasan_mem*(). -ifeq ($(call clang-min-version, 150000)$(call gcc-min-version, 130000),y) - kasan_params += hwasan-kernel-mem-intrinsic-prefix=1 -endif +# Instrument memcpy/memset/memmove calls by using instrumented __(hw)asan_mem*(). +ifdef CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX + ifdef CONFIG_CC_IS_GCC + kasan_params += asan-kernel-mem-intrinsic-prefix=1 + else + kasan_params += hwasan-kernel-mem-intrinsic-prefix=1 + endif +endif # CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX endif # CONFIG_KASAN_SW_TAGS
Greg Kroah-Hartman
maintainerPATCH 104/175 ocfs2: prevent release journal inode after journal shutdown
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
commit f46e8ef8bb7b452584f2e75337b619ac51a7cadf upstream.
Before calling ocfs2_delete_osb(), ocfs2_journal_shutdown() has already been executed in ocfs2_dismount_volume(), so osb->journal must be NULL. Therefore, the following calltrace will inevitably fail when it reaches jbd2_journal_release_jbd_inode().
ocfs2_dismount_volume()->
ocfs2_delete_osb()->
ocfs2_free_slot_info()->
__ocfs2_free_slot_info()->
evict()->
ocfs2_evict_inode()->
ocfs2_clear_inode()->
jbd2_journal_release_jbd_inode(osb->journal->j_journal,Adding osb->journal checks will prevent null-ptr-deref during the above execution path.
--- fs/ocfs2/inode.c | 3 +++ 1 file changed, 3 insertions(+)
fs/ocfs2/inode.c +3 -0
@@ -1205,6 +1205,9 @@ static void ocfs2_clear_inode(struct ino* the journal is flushed before journal shutdown. Thus it is safe to * have inodes get cleaned up after journal shutdown. */ +if (!osb->journal) +return ; +jbd2_journal_release_jbd_inode (osb->journal->j_journal, &oi->ip_jinode); }
Greg Kroah-Hartman
maintainerPATCH 105/175 proc: fix missing pde_set_flags() for net proc files
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: wangzijie <[email protected]>
commit 2ce3d282bd5050fca8577defeff08ada0d55d062 upstream.
To avoid potential UAF issues during module removal races, we use pde_set_flags() to save proc_ops flags in PDE itself before proc_register(), and then use pde_has_proc_*() helpers instead of directly dereferencing pde->proc_ops->*.
However, the pde_set_flags() call was missing when creating net related proc files. This omission caused incorrect behavior which FMODE_LSEEK was being cleared inappropriately in proc_reg_open() for net proc files. Lars reported it in this link[1].
Fix this by ensuring pde_set_flags() is called when register proc entry, and add NULL check for proc_ops in pde_set_flags().
Tested by: Lars Wendler <[email protected]>
--- fs/proc/generic.c | 38 +++++++++++++++++++++----------------- 1 file changed, 21 insertions(+), 17 deletions(-)
fs/proc/generic.c +21 -17
@@ -362,6 +362,25 @@ static const struct inode_operations pro .setattr = proc_notify_change, }; +static void pde_set_flags (struct proc_dir_entry *pde) +{ +const struct proc_ops *proc_ops = pde->proc_ops; + +if (!proc_ops) +return ; + +if (proc_ops->proc_flags &PROC_ENTRY_PERMANENT ) + pde->flags |=PROC_ENTRY_PERMANENT ; +if (proc_ops->proc_read_iter) + pde->flags |= PROC_ENTRY_proc_read_iter; +#ifdef CONFIG_COMPAT +if (proc_ops->proc_compat_ioctl) + pde->flags |= PROC_ENTRY_proc_compat_ioctl; +#endif +if (proc_ops->proc_lseek) + pde->flags |= PROC_ENTRY_proc_lseek; +} +/* returns the registered entry, or frees dp and returns NULL on failure */ struct proc_dir_entry *proc_register (struct proc_dir_entry *dir,struct proc_dir_entry *dp)
@@ -369,6 +388,8 @@ struct proc_dir_entry *proc_register(strif (proc_alloc_inum (&dp->low_ino)) goto out_free_entry; +pde_set_flags (dp); +write_lock (&proc_subdir_lock); dp->parent = dir;if (pde_subdir_insert (dir, dp) == false) {
@@ -557,20 +578,6 @@ struct proc_dir_entry *proc_create_reg(creturn p; } -static void pde_set_flags (struct proc_dir_entry *pde) -{ -if (pde->proc_ops->proc_flags &PROC_ENTRY_PERMANENT ) - pde->flags |=PROC_ENTRY_PERMANENT ; -if (pde->proc_ops->proc_read_iter) - pde->flags |= PROC_ENTRY_proc_read_iter; -#ifdef CONFIG_COMPAT -if (pde->proc_ops->proc_compat_ioctl) - pde->flags |= PROC_ENTRY_proc_compat_ioctl; -#endif -if (pde->proc_ops->proc_lseek) - pde->flags |= PROC_ENTRY_proc_lseek; -} -struct proc_dir_entry *proc_create_data (const char *name,umode_t mode,struct proc_dir_entry *parent,const struct proc_ops *proc_ops,void *data)
@@ -581,7 +588,6 @@ struct proc_dir_entry *proc_create_data(if (!p)return NULL ; p->proc_ops = proc_ops; -pde_set_flags (p);return proc_register (parent, p); }EXPORT_SYMBOL (proc_create_data);
@@ -632,7 +638,6 @@ struct proc_dir_entry *proc_create_seq_p p->proc_ops = &proc_seq_ops; p->seq_ops = ops; p->state_size = state_size; -pde_set_flags (p);return proc_register (parent, p); }EXPORT_SYMBOL (proc_create_seq_private);
@@ -663,7 +668,6 @@ struct proc_dir_entry *proc_create_singlreturn NULL ; p->proc_ops = &proc_single_ops; p->single_show = show; -pde_set_flags (p);return proc_register (parent, p); }EXPORT_SYMBOL (proc_create_single_data);
Greg Kroah-Hartman
maintainerPATCH 106/175 of_numa: fix uninitialized memory nodes causing kernel panic
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yin Tirui <[email protected]>
commit ee4d098cbc9160f573b5c1b5a51d6158efdb2896 upstream.
When there are memory-only nodes (nodes without CPUs), these nodes are not properly initialized, causing kernel panic during boot.
of_numa_init
of_numa_parse_cpu_nodes node_set(nid, numa_nodes_parsed); of_numa_parse_memory_nodes
In of_numa_parse_cpu_nodes, numa_nodes_parsed gets updated only for nodes containing CPUs. Memory-only nodes should have been updated in of_numa_parse_memory_nodes, but they weren't.
Subsequently, when free_area_init() attempts to access NODE_DATA() for these uninitialized memory nodes, the kernel panics due to NULL pointer dereference.
This can be reproduced on ARM64 QEMU with 1 CPU and 2 memory nodes:
qemu-system-aarch64 \
-cpu host -nographic \
-m 4G -smp 1 \
-machine virt,accel=kvm,gic-version=3,iommu=smmuv3 \
-object memory-backend-ram,size=2G,id=mem0 \
-object memory-backend-ram,size=2G,id=mem1 \
-numa node,nodeid=0,memdev=mem0 \
-numa node,nodeid=1,memdev=mem1 \
-kernel $IMAGE \
-hda $DISK \
-append "console=ttyAMA0 root=/dev/vda rw earlycon"
[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x481fd010] [ 0.000000] Linux version 6.17.0-rc1-00001-gabb4b3daf18c-dirty (yintirui@local) (gcc (GCC) 12.3.1, GNU ld (GNU Binutils) 2.41) #52 SMP PREEMPT Mon Aug 18 09:49:40 CST 2025 [ 0.000000] KASLR enabled [ 0.000000] random: crng init done [ 0.000000] Machine model: linux,dummy-virt [ 0.000000] efi: UEFI not found. [ 0.000000] earlycon: pl11 at MMIO 0x0000000009000000 (options '') [ 0.000000] printk: legacy bootconsole [pl11] enabled [ 0.000000] OF: reserved mem: Reserved memory: No reserved-memory node in the DT [ 0.000000] NODE_DATA(0) allocated [mem 0xbfffd9c0-0xbfffffff] [ 0.000000] node 1 must be removed before remove section 23 [ 0.000000] Zone ranges: [ 0.000000] DMA [mem 0x0000000040000000-0x00000000ffffffff] [ 0.000000] DMA32 empty [ 0.000000] Normal [mem 0x0000000100000000-0x000000013fffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000040000000-0x00000000bfffffff] [ 0.000000] node 1: [mem 0x00000000c0000000-0x000000013fffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x00000000bfffffff] [ 0.000000] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0 [ 0.000000] Mem abort info: [ 0.000000] ESR = 0x0000000096000004 [ 0.000000] EC = 0x25: DABT (current EL), IL = 32 bits [ 0.000000] SET = 0, FnV = 0 [ 0.000000] EA = 0, S1PTW = 0 [ 0.000000] FSC = 0x04: level 0 translation fault [ 0.000000] Data abort info: [ 0.000000] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 0.000000] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 0.000000] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 0.000000] [00000000000000a0] user address but active_mm is swapper [ 0.000000] Internal error: Oops: 0000000096000004 [#1] SMP [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 6.17.0-rc1-00001-g760c6dabf762-dirty #54 PREEMPT [ 0.000000] Hardware name: linux,dummy-virt (DT) [ 0.000000] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 0.000000] pc : free_area_init+0x50c/0xf9c [ 0.000000] lr : free_area_init+0x5c0/0xf9c [ 0.000000] sp : ffffa02ca0f33c00 [ 0.000000] x29: ffffa02ca0f33cb0 x28: 0000000000000000 x27: 0000000000000000 [ 0.000000] x26: 4ec4ec4ec4ec4ec5 x25: 00000000000c0000 x24: 00000000000c0000 [ 0.000000] x23: 0000000000040000 x22: 0000000000000000 x21: ffffa02ca0f3b368 [ 0.000000] x20: ffffa02ca14c7b98 x19: 0000000000000000 x18: 0000000000000002 [ 0.000000] x17: 000000000000cacc x16: 0000000000000001 x15: 0000000000000001 [ 0.000000] x14: 0000000080000000 x13: 0000000000000018 x12: 0000000000000002 [ 0.000000] x11: ffffa02ca0fd4f00 x10: ffffa02ca14bab20 x9 : ffffa02ca14bab38 [ 0.000000] x8 : 00000000000c0000 x7 : 0000000000000001 x6 : 0000000000000002 [ 0.000000] x5 : 0000000140000000 x4 : ffffa02ca0f33c90 x3 : ffffa02ca0f33ca0 [ 0.000000] x2 : ffffa02ca0f33c98 x1 : 0000000080000000 x0 : 0000000000000001 [ 0.000000] Call trace: [ 0.000000] free_area_init+0x50c/0xf9c (P) [ 0.000000] bootmem_init+0x110/0x1dc [ 0.000000] setup_arch+0x278/0x60c [ 0.000000] start_kernel+0x70/0x748 [ 0.000000] __primary_switched+0x88/0x90 [ 0.000000] Code: d503201f b98093e0 52800016 f8607a93 (f9405260) [ 0.000000] ---[ end trace 0000000000000000 ]--- [ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task! [ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---
--- drivers/of/of_numa.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/of/of_numa.c +4 -1
@@ -62,8 +62,11 @@ static int __init of_numa_parse_memory_n r = -EINVAL ; } -for (i =0 ; !r && !of_address_to_resource (np, i, &rsrc); i++) +for (i =0 ; !r && !of_address_to_resource (np, i, &rsrc); i++) { r =numa_add_memblk (nid, rsrc.start, rsrc.end +1 ); +if (!r) +node_set (nid, numa_nodes_parsed); + }if (!i || r) {of_node_put (np);
Greg Kroah-Hartman
maintainerPATCH 107/175 soc: qcom: mdt_loader: Deal with zero e_shentsize
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Andersson <[email protected]>
commit 25daf9af0ac1bf12490b723b5efaf8dcc85980bc upstream.
Firmware that doesn't provide section headers leave both e_shentsize and e_shnum 0, which obvious isn't compatible with the newly introduced stricter checks.
Make the section-related checks conditional on either of these values being non-zero.
--- drivers/soc/qcom/mdt_loader.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/soc/qcom/mdt_loader.c +7 -5
@@ -39,12 +39,14 @@ static bool mdt_header_valid(const strucif (phend > fw->size)return false; -if (ehdr->e_shentsize !=sizeof (struct elf32_shdr )) -return false; +if (ehdr->e_shentsize || ehdr->e_shnum) { +if (ehdr->e_shentsize !=sizeof (struct elf32_shdr )) +return false; - shend =size_add (size_mul (sizeof (struct elf32_shdr ), ehdr->e_shnum), ehdr->e_shoff); -if (shend > fw->size) -return false; + shend =size_add (size_mul (sizeof (struct elf32_shdr ), ehdr->e_shnum), ehdr->e_shoff); +if (shend > fw->size) +return false; + }return true; }
Greg Kroah-Hartman
maintainerPATCH 108/175 wifi: mwifiex: Initialize the chan_stats array to zero
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
commit 0e20450829ca3c1dbc2db536391537c57a40fe0b upstream.
The adapter->chan_stats[] array is initialized in mwifiex_init_channel_scan_gap() with vmalloc(), which doesn't zero out memory. The array is filled in mwifiex_update_chan_statistics() and then the user can query the data in mwifiex_cfg80211_dump_survey().
There are two potential issues here. What if the user calls mwifiex_cfg80211_dump_survey() before the data has been filled in. Also the mwifiex_update_chan_statistics() function doesn't necessarily initialize the whole array. Since the array was not initialized at the start that could result in an information leak.
Also this array is pretty small. It's a maximum of 900 bytes so it's more appropriate to use kcalloc() instead vmalloc().
--- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 5 +++-- drivers/net/wireless/marvell/mwifiex/main.c | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-)
drivers/net/wireless/marvell/mwifiex/cfg80211.c +3 -2
@@ -4680,8 +4680,9 @@ int mwifiex_init_channel_scan_gap(struct* additional active scan request for hidden SSIDs on passive channels. */ adapter->num_in_chan_stats =2 * (n_channels_bg + n_channels_a); - adapter->chan_stats =vmalloc (array_size (sizeof (*adapter->chan_stats), - adapter->num_in_chan_stats)); + adapter->chan_stats =kcalloc (adapter->num_in_chan_stats, +sizeof (*adapter->chan_stats), +GFP_KERNEL );if (!adapter->chan_stats)return -ENOMEM ;
drivers/net/wireless/marvell/mwifiex/main.c +2 -2
@@ -667,7 +667,7 @@ static int _mwifiex_fw_dpc(const struct goto done; err_add_intf: -vfree (adapter->chan_stats); +kfree (adapter->chan_stats); err_init_chan_scan:wiphy_unregister (adapter->wiphy);wiphy_free (adapter->wiphy);
@@ -1515,7 +1515,7 @@ static void mwifiex_uninit_sw(struct mwiwiphy_free (adapter->wiphy); adapter->wiphy =NULL ; -vfree (adapter->chan_stats); +kfree (adapter->chan_stats);mwifiex_free_cmd_buffers (adapter); }
Greg Kroah-Hartman
maintainerPATCH 109/175 wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Yen Hsieh <[email protected]>
commit c22769de25095c6777e8acb68a1349a3257fc955 upstream.
MT7925 is a connac3 device; using the connac2 helper mis-parses TXWI and breaks AMPDU/BA accounting. Use the connac3-specific helper mt7925_tx_check_aggr() instead,
Tested-on: Netgear A9000 USB WiFi adapter
--- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7925/mac.c +1 -1
@@ -1459,7 +1459,7 @@ void mt7925_usb_sdio_tx_complete_skb(str sta =wcid_to_sta (wcid);if (sta &&likely (e->skb->protocol !=cpu_to_be16 (ETH_P_PAE ))) -mt76_connac2_tx_check_aggr (sta, txwi); +mt7925_tx_check_aggr (sta, e->skb, wcid);skb_pull (e->skb, headroom);mt76_tx_complete_skb (mdev, e->wcid, e->skb);
Greg Kroah-Hartman
maintainerPATCH 110/175 wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 87b07a1fbc6b5c23d3b3584ab4288bc9106d3274 upstream.
A new warning in clang [1] points out a couple of places where a hdr variable is not initialized then passed along to skb_put_data().
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c:1894:21: warning: variable 'hdr' is uninitialized when passed as a const pointer argument here [-Wuninitialized-const-pointer]
1894 | skb_put_data(skb, &hdr, sizeof(hdr));
| ^~~
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c:3386:21: warning: variable 'hdr' is uninitialized when passed as a const pointer argument here [-Wuninitialized-const-pointer]
3386 | skb_put_data(skb, &hdr, sizeof(hdr));
| ^~~
Zero initialize these headers as done in other places in the driver when there is nothing stored in the header.
--- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +2 -2
@@ -1834,8 +1834,8 @@ mt7996_mcu_get_mmps_mode(enum ieee80211_int mt7996_mcu_set_fixed_rate_ctrl (struct mt7996_dev *dev,void *data,u16 version) { +struct uni_header hdr = {};struct ra_fixed_rate *req; -struct uni_header hdr;struct sk_buff *skb;struct tlv *tlv;int len;
@@ -3115,7 +3115,7 @@ int mt7996_mcu_set_hdr_trans(struct mt79 {struct {u8 __rsv[4 ]; - } __packed hdr; + } __packed hdr = {};struct hdr_trans_blacklist *req_blacklist;struct hdr_trans_en *req_en;struct sk_buff *skb;
Greg Kroah-Hartman
maintainerPATCH 111/175 wifi: mt76: mt7925: fix the wrong bss cleanup for SAP
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Yen Hsieh <[email protected]>
commit 55424e7b9eeb141d9c8d8a8740ee131c28490425 upstream.
When in SAP mode, if a STA disconnect, the SAP's BSS should not be cleared.
--- drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7925/main.c +3 -0
@@ -1187,6 +1187,9 @@ mt7925_mac_sta_remove_links(struct mt792struct mt792x_bss_conf *mconf;struct mt792x_link_sta *mlink; +if (vif->type ==NL80211_IFTYPE_AP ) +break ; + link_sta =mt792x_sta_to_link_sta (vif, sta, link_id);if (!link_sta)continue ;
Greg Kroah-Hartman
maintainerPATCH 112/175 net: ethernet: oa_tc6: Handle failure of spi_setup
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
commit b3852ae3105ec1048535707545d23c1e519c190f upstream.
There is no guarantee that spi_setup succeed, so properly handle the error case.
--- drivers/net/ethernet/oa_tc6.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/oa_tc6.c +2 -1
@@ -1249,7 +1249,8 @@ struct oa_tc6 *oa_tc6_init(struct spi_de/* Set the SPI controller to pump at realtime priority */ tc6->spi->rt = true; -spi_setup (tc6->spi); +if (spi_setup (tc6->spi) <0 ) +return NULL ; tc6->spi_ctrl_tx_buf = devm_kzalloc(&tc6->spi->dev, OA_TC6_CTRL_SPI_BUF_SIZE,
Greg Kroah-Hartman
maintainerPATCH 113/175 drm/amdgpu: drop hw access in non-DC audio fini
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 71403f58b4bb6c13b71c05505593a355f697fd94 upstream.
We already disable the audio pins in hw_fini so
there is no need to do it again in sw_fini.
--- drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 5 ----- drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 5 ----- drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 5 ----- drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 5 ----- 4 files changed, 20 deletions(-)
drivers/gpu/drm/amd/amdgpu/dce_v10_0.c +0 -5
@@ -1462,17 +1462,12 @@ static int dce_v10_0_audio_init(struct astatic void dce_v10_0_audio_fini (struct amdgpu_device *adev) { -int i; -if (!amdgpu_audio)return ;if (!adev->mode_info.audio.enabled)return ; -for (i =0 ; i < adev->mode_info.audio.num_pins; i++) -dce_v10_0_audio_enable (adev, &adev->mode_info.audio.pin[i], false); - adev->mode_info.audio.enabled = false; }
drivers/gpu/drm/amd/amdgpu/dce_v11_0.c +0 -5
@@ -1511,17 +1511,12 @@ static int dce_v11_0_audio_init(struct astatic void dce_v11_0_audio_fini (struct amdgpu_device *adev) { -int i; -if (!amdgpu_audio)return ;if (!adev->mode_info.audio.enabled)return ; -for (i =0 ; i < adev->mode_info.audio.num_pins; i++) -dce_v11_0_audio_enable (adev, &adev->mode_info.audio.pin[i], false); - adev->mode_info.audio.enabled = false; }
drivers/gpu/drm/amd/amdgpu/dce_v6_0.c +0 -5
@@ -1394,17 +1394,12 @@ static int dce_v6_0_audio_init(struct amstatic void dce_v6_0_audio_fini (struct amdgpu_device *adev) { -int i; -if (!amdgpu_audio)return ;if (!adev->mode_info.audio.enabled)return ; -for (i =0 ; i < adev->mode_info.audio.num_pins; i++) -dce_v6_0_audio_enable (adev, &adev->mode_info.audio.pin[i], false); - adev->mode_info.audio.enabled = false; }
drivers/gpu/drm/amd/amdgpu/dce_v8_0.c +0 -5
@@ -1443,17 +1443,12 @@ static int dce_v8_0_audio_init(struct amstatic void dce_v8_0_audio_fini (struct amdgpu_device *adev) { -int i; -if (!amdgpu_audio)return ;if (!adev->mode_info.audio.enabled)return ; -for (i =0 ; i < adev->mode_info.audio.num_pins; i++) -dce_v8_0_audio_enable (adev, &adev->mode_info.audio.pin[i], false); - adev->mode_info.audio.enabled = false; }
Greg Kroah-Hartman
maintainerPATCH 114/175 drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Lipski <[email protected]>
commit 3ebf766c35464ebdeefb6068246267147503dc04 upstream.
[Why&How]
ON DCN314, clearing DPP SW structure without power gating it can cause a double cursor in full screen with non-native scaling.
A W/A that clears CURSOR0_CONTROL cursor_enable flag if dcn10_plane_atomic_power_down is called and DPP power gating is disabled.
--- drivers/gpu/drm/amd/display/dc/dpp/dcn10/dcn10_dpp.c | 9 + drivers/gpu/drm/amd/display/dc/dpp/dcn10/dcn10_dpp.h | 2 drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c | 1 drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c | 72 ++++++++++++++ drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.h | 2 drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_init.c | 1 drivers/gpu/drm/amd/display/dc/inc/hw/dpp.h | 3 7 files changed, 90 insertions(+)
drivers/gpu/drm/amd/display/dc/dpp/dcn10/dcn10_dpp.c +9 -0
@@ -520,6 +520,15 @@ void dpp1_dppclk_control(REG_UPDATE (DPP_CONTROL ,DPP_CLOCK_ENABLE ,0 ); } +void dpp_force_disable_cursor (struct dpp *dpp_base) +{ +struct dcn10_dpp *dpp =TO_DCN10_DPP (dpp_base); + +/* Force disable cursor */ +REG_UPDATE (CURSOR0_CONTROL ,CUR0_ENABLE ,0 ); + dpp_base->pos.cur0_ctl.bits.cur0_enable =0 ; +} +static const struct dpp_funcs dcn10_dpp_funcs = { .dpp_read_state = dpp_read_state, .dpp_reset = dpp_reset,
drivers/gpu/drm/amd/display/dc/dpp/dcn10/dcn10_dpp.h +2 -0
@@ -1525,4 +1525,6 @@ void dpp1_construct(struct dcn10_dpp *dpvoid dpp1_cm_get_gamut_remap (struct dpp *dpp_base,struct dpp_grph_csc_adjustment *adjust); +void dpp_force_disable_cursor (struct dpp *dpp_base); +#endif
drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c +1 -0
@@ -1497,6 +1497,7 @@ static struct dpp_funcs dcn30_dpp_funcs .dpp_dppclk_control = dpp1_dppclk_control, .dpp_set_hdr_multiplier = dpp3_set_hdr_multiplier, .dpp_get_gamut_remap = dpp3_cm_get_gamut_remap, + .dpp_force_disable_cursor = dpp_force_disable_cursor, };
drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c +72 -0
75 lines not on this page · raw message
drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.h +2 -0
@@ -47,4 +47,6 @@ void dcn314_dpp_root_clock_control(strucvoid dcn314_disable_link_output (struct dc_link *link,const struct link_resource *link_res,enum signal_type signal); +void dcn314_dpp_pg_control (struct dce_hwseq *hws,unsigned int dpp_inst,bool power_on); +#endif /* __DC_HWSS_DCN314_H__ */
drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_init.c +1 -0
@@ -141,6 +141,7 @@ static const struct hwseq_private_funcs .enable_power_gating_plane = dcn314_enable_power_gating_plane, .dpp_root_clock_control = dcn314_dpp_root_clock_control, .hubp_pg_control = dcn31_hubp_pg_control, + .dpp_pg_control = dcn314_dpp_pg_control, .program_all_writeback_pipes_in_tree = dcn30_program_all_writeback_pipes_in_tree, .update_odm = dcn314_update_odm, .dsc_pg_control = dcn314_dsc_pg_control,
drivers/gpu/drm/amd/display/dc/inc/hw/dpp.h +3 -0
@@ -349,6 +349,9 @@ struct dpp_funcs {struct dpp *dpp_base, enum dc_color_space color_space, struct dc_csc_transform cursor_csc_color_matrix); + +void (*dpp_force_disable_cursor)(struct dpp *dpp_base); + };
Greg Kroah-Hartman
maintainerPATCH 115/175 platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoffer Sandberg <[email protected]>
commit c96f86217bb28e019403bb8f59eacd8ad5a7ad1a upstream.
Prevents instant wakeup ~1s after suspend.
It seems to be kernel/system dependent if the IRQ actually manages to wake the system every time or if it gets ignored (and everything works as expected).
--- drivers/platform/x86/amd/pmc/pmc-quirks.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/platform/x86/amd/pmc/pmc-quirks.c +14 -0
@@ -242,6 +242,20 @@ static const struct dmi_system_id fwbug_ DMI_MATCH(DMI_PRODUCT_NAME, "Lafite Pro V 14M"), } }, + { + .ident = "TUXEDO InfinityBook Pro 14/15 AMD Gen10", + .driver_data = &quirk_spurious_8042, + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "XxHP4NAx"), + } + }, + { + .ident = "TUXEDO InfinityBook Pro 14/15 AMD Gen10", + .driver_data = &quirk_spurious_8042, + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "XxKK4NAx_XxSP4NAx"), + } + }, {} };
Greg Kroah-Hartman
maintainerPATCH 116/175 scsi: lpfc: Fix buffer free/clear order in deferred receive path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Evans <[email protected]>
commit 9dba9a45c348e8460da97c450cddf70b2056deb3 upstream.
Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF.
Note that the repost path already uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The deferred path should do the same.
--- drivers/scsi/lpfc/lpfc_nvmet.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/scsi/lpfc/lpfc_nvmet.c +6 -4
@@ -1243,7 +1243,7 @@ lpfc_nvmet_defer_rcv(struct nvmet_fc_tarstruct lpfc_nvmet_tgtport *tgtp;struct lpfc_async_xchg_ctx *ctxp = container_of(rsp, struct lpfc_async_xchg_ctx, hdlrctx.fcp_req); -struct rqb_dmabuf *nvmebuf = ctxp->rqb_buffer; +struct rqb_dmabuf *nvmebuf;struct lpfc_hba *phba = ctxp->phba;unsigned long iflag;
@@ -1251,13 +1251,18 @@ lpfc_nvmet_defer_rcv(struct nvmet_fc_tarlpfc_nvmeio_data (phba,"NVMET DEFERRCV: xri x%x sz %d CPU %02x\n" , ctxp->oxid, ctxp->size,raw_smp_processor_id ()); +spin_lock_irqsave (&ctxp->ctxlock, iflag); + nvmebuf = ctxp->rqb_buffer;if (!nvmebuf) { +spin_unlock_irqrestore (&ctxp->ctxlock, iflag);lpfc_printf_log (phba,KERN_INFO ,LOG_NVME_IOERR ,"6425 Defer rcv: no buffer oxid x%x: " "flg %x ste %x\n" , ctxp->oxid, ctxp->flag, ctxp->state);return ; } + ctxp->rqb_buffer =NULL ; +spin_unlock_irqrestore (&ctxp->ctxlock, iflag); tgtp = phba->targetport->private;if (tgtp)
@@ -1265,9 +1270,6 @@ lpfc_nvmet_defer_rcv(struct nvmet_fc_tar/* Free the nvmebuf since a new buffer already replaced it */ nvmebuf->hrq->rqbp->rqb_free_buffer (phba, nvmebuf); -spin_lock_irqsave (&ctxp->ctxlock, iflag); - ctxp->rqb_buffer =NULL ; -spin_unlock_irqrestore (&ctxp->ctxlock, iflag); }/**
Greg Kroah-Hartman
maintainerPATCH 117/175 batman-adv: fix OOB read/write in network-coding decode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Fort <[email protected]>
commit d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087 upstream.
batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write.
Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing.
--- net/batman-adv/network-coding.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/batman-adv/network-coding.c +6 -1
@@ -1687,7 +1687,12 @@ batadv_nc_skb_decode_packet(struct batad coding_len =ntohs (coded_packet_tmp.coded_len); -if (coding_len > skb->len) +/* ensure dst buffer is large enough (payload only) */ +if (coding_len + h_size > skb->len) +return NULL ; + +/* ensure src buffer is large enough (payload only) */ +if (coding_len + h_size > nc_packet->skb->len)return NULL ;/* Here the magic is reversed:
Greg Kroah-Hartman
maintainerPATCH 118/175 cifs: prevent NULL pointer dereference in UTF16 conversion
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Makar Semyonov <[email protected]>
commit 70bccd9855dae56942f2b18a08ba137bb54093a0 upstream.
There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked to cifs_strndup_to_utf16, which in turn passes it to cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash.
This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and returns NULL early to prevent dereferencing NULL pointer.
Found by Linux Verification Center (linuxtesting.org) with SVACE
--- fs/smb/client/cifs_unicode.c | 3 +++ 1 file changed, 3 insertions(+)
fs/smb/client/cifs_unicode.c +3 -0
@@ -629,6 +629,9 @@ cifs_strndup_to_utf16(const char *src, cint len;__le16 *dst; +if (!src) +return NULL ; + len =cifs_local_to_utf16_bytes (src, maxlen, cp); len +=2 ;/* NULL */ dst =kmalloc (len,GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 119/175 e1000e: fix heap overflow in e1000_set_eeprom
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Lifshits <[email protected]>
commit 90fb7db49c6dbac961c6b8ebfd741141ffbc8545 upstream.
Fix a possible heap overflow in e1000_set_eeprom function by adding input validation for the requested length of the change in the EEPROM. In addition, change the variable type from int to size_t for better code practices and rearrange declarations to RCT.
--- drivers/net/ethernet/intel/e1000e/ethtool.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/e1000e/ethtool.c +7 -3
@@ -549,12 +549,12 @@ static int e1000_set_eeprom(struct net_d {struct e1000_adapter *adapter =netdev_priv (netdev);struct e1000_hw *hw = &adapter->hw; +size_t total_len, max_len;u16 *eeprom_buff; -void *ptr; -int max_len; +int ret_val =0 ;int first_word;int last_word; -int ret_val =0 ; +void *ptr;u16 i;if (eeprom->len ==0 )
@@ -569,6 +569,10 @@ static int e1000_set_eeprom(struct net_d max_len = hw->nvm.word_size *2 ; +if (check_add_overflow (eeprom->offset, eeprom->len, &total_len) || + total_len > max_len) +return -EFBIG ; + first_word = eeprom->offset >>1 ; last_word = (eeprom->offset + eeprom->len -1 ) >>1 ; eeprom_buff =kmalloc (max_len,GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 120/175 net: pcs: rzn1-miic: Correct MODCTRL register offset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
commit a7195a3d67dace056af7ca65144a11874df79562 upstream.
Correct the Mode Control Register (MODCTRL) offset for RZ/N MIIC. According to the R-IN Engine and Ethernet Peripherals Manual (Rev.1.30) [0], Table 10.1 "Ethernet Accessory Register List", MODCTRL is at offset 0x8, not 0x20 as previously defined.
Offset 0x20 actually maps to the Port Trigger Control Register (PTCTRL), which controls PTP_MODE[3:0] and RGMII_CLKSEL[4]. Using this incorrect definition prevented the driver from configuring the SW_MODE[4:0] bits in MODCTRL, which control the internal connection of Ethernet ports. As a result, the MIIC could not be switched into the correct mode, leading to link setup failures and non-functional Ethernet ports on affected systems.
--- drivers/net/pcs/pcs-rzn1-miic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/pcs/pcs-rzn1-miic.c +1 -1
@@ -19,7 +19,7 @@#define MIIC_PRCMD 0x0#define MIIC_ESID_CODE 0x4 -#define MIIC_MODCTRL 0x20 +#define MIIC_MODCTRL 0x8#define MIIC_MODCTRL_SW_MODE GENMASK(4, 0)#define MIIC_CONVCTRL (port) (0x100 + (port) * 4)
Greg Kroah-Hartman
maintainerPATCH 121/175 microchip: lan865x: Fix module autoloading
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
commit c7217963eb779be0a7627dd2121152fa6786ecf7 upstream.
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from spi_device_id table. While at this, fix the misleading variable name (spidev is unrelated to this driver).
--- drivers/net/ethernet/microchip/lan865x/lan865x.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/microchip/lan865x/lan865x.c +3 -2
@@ -423,10 +423,11 @@ static void lan865x_remove(struct spi_device *spi)free_netdev (priv->netdev); } -static const struct spi_device_id spidev_spi_ids[] = { +static const struct spi_device_id lan865x_ids[] = { { .name ="lan8650" }, {}, }; +MODULE_DEVICE_TABLE (spi, lan865x_ids);static const struct of_device_id lan865x_dt_ids[] = { { .compatible ="microchip,lan8650" },
@@ -441,7 +442,7 @@ static struct spi_driver lan865x_driver = { }, .probe = lan865x_probe, .remove = lan865x_remove, - .id_table = spidev_spi_ids, + .id_table = lan865x_ids, };module_spi_driver (lan865x_driver);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/175 microchip: lan865x: Fix LAN8651 autoloading
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
commit ca47c44d36a9ad3268d17f89789104a471c07f81 upstream.
Add missing IDs for LAN8651 devices, which are also defined in the DT bindings.
--- drivers/net/ethernet/microchip/lan865x/lan865x.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/microchip/lan865x/lan865x.c +2 -0
@@ -425,12 +425,14 @@ static void lan865x_remove(struct spi_device *spi)static const struct spi_device_id lan865x_ids[] = { { .name ="lan8650" }, + { .name ="lan8651" }, {}, };MODULE_DEVICE_TABLE (spi, lan865x_ids);static const struct of_device_id lan865x_dt_ids[] = { { .compatible ="microchip,lan8650" }, + { .compatible ="microchip,lan8651" }, {/* Sentinel */ } };MODULE_DEVICE_TABLE (of, lan865x_dt_ids);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 123/175 fs/fhandle.c: fix a race in call of has_locked_children()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit 1f282cdc1d219c4a557f7009e81bc792820d9d9a upstream.
may_decode_fh() is calling has_locked_children() while holding no locks. That's an oopsable race...
The rest of the callers are safe since they are holding namespace_sem and are guaranteed a positive refcount on the mount in question.
Rename the current has_locked_children() to __has_locked_children(), make it static and switch the fs/namespace.c users to it.
Make has_locked_children() a wrapper for __has_locked_children(), calling the latter under read_seqlock_excl(&mount_lock).
[ Harshit: Resolved conflicts due to missing commit:
db04662e2f4f ("fs: allow detached mounts in clone_private_mount()") in linux-6.12.y ]
--- fs/namespace.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
fs/namespace.c +14 -4
@@ -2227,7 +2227,7 @@ void drop_collected_mounts(struct vfsmounamespace_unlock (); } -bool has_locked_children (struct mount *mnt,struct dentry *dentry) +static bool __has_locked_children (struct mount *mnt,struct dentry *dentry) {struct mount *child;
@@ -2241,6 +2241,16 @@ bool has_locked_children(struct mount *mreturn false; } +bool has_locked_children (struct mount *mnt,struct dentry *dentry) +{ +bool res; + +read_seqlock_excl (&mount_lock); + res =__has_locked_children (mnt, dentry); +read_sequnlock_excl (&mount_lock); +return res; +} +/** * clone_private_mount - create a private clone of a path * @path: path to clone
@@ -2268,7 +2278,7 @@ struct vfsmount *clone_private_mount(conreturn ERR_PTR (-EPERM ); } -if (has_locked_children (old_mnt, path->dentry)) +if (__has_locked_children (old_mnt, path->dentry)) goto invalid; new_mnt =clone_mnt (old_mnt, path->dentry,CL_PRIVATE );
@@ -2762,7 +2772,7 @@ static struct mount *__do_loopback(strucif (!check_mnt (old) && old_path->dentry->d_op != &ns_dentry_operations)return mnt; -if (!recurse &&has_locked_children (old, old_path->dentry)) +if (!recurse &&__has_locked_children (old, old_path->dentry))return mnt;if (recurse)
@@ -3152,7 +3162,7 @@ static int do_set_group(struct path *fro goto out;/* From mount should not have locked children in place of To's root */ -if (has_locked_children (from, to->mnt.mnt_root)) +if (__has_locked_children (from, to->mnt.mnt_root)) goto out;/* Setting sharing groups is only allowed on private mounts */
Greg Kroah-Hartman
maintainerPATCH 124/175 net: dsa: add hook to determine whether EEE is supported
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King (Oracle) <[email protected]>
commit 9723a77318b7c0cfd06ea207e52a042f8c815318 upstream.
Add a hook to determine whether the switch supports EEE. This will return false if the switch does not, or true if it does. If the method is not implemented, we assume (currently) that the switch supports EEE.
--- include/net/dsa.h | 1 + net/dsa/user.c | 8 ++++++++ 2 files changed, 9 insertions(+)
include/net/dsa.h +1 -0
@@ -1003,6 +1003,7 @@ struct dsa_switch_ops {/* * Port's MAC EEE settings */ +bool (*support_eee)(struct dsa_switch *ds,int port);int (*set_mac_eee)(struct dsa_switch *ds,int port,struct ethtool_keee *e); int (*get_mac_eee)(struct dsa_switch *ds, int port,
net/dsa/user.c +8 -0
@@ -1231,6 +1231,10 @@ static int dsa_user_set_eee(struct net_dstruct dsa_switch *ds = dp->ds;int ret; +/* Check whether the switch supports EEE */ +if (ds->ops->support_eee && !ds->ops->support_eee (ds, dp->index)) +return -EOPNOTSUPP ; +/* Port's PHY and MAC both need to be EEE capable */ if (!dev->phydev || !dp->pl)return -ENODEV ;
@@ -1251,6 +1255,10 @@ static int dsa_user_get_eee(struct net_dstruct dsa_switch *ds = dp->ds;int ret; +/* Check whether the switch supports EEE */ +if (ds->ops->support_eee && !ds->ops->support_eee (ds, dp->index)) +return -EOPNOTSUPP ; +/* Port's PHY and MAC both need to be EEE capable */ if (!dev->phydev || !dp->pl)return -ENODEV ;
Greg Kroah-Hartman
maintainerPATCH 125/175 net: dsa: provide implementation of .support_eee()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King (Oracle) <[email protected]>
commit 99379f587278c818777cb4778e2c79c6c1440c65 upstream.
Provide a trivial implementation for the .support_eee() method which switch drivers can use to simply indicate that they support EEE on all their user ports.
[ Harshit: Resolve contextual conflicts due to missing commit:
539770616521 ("net: dsa: remove obsolete phylink dsa_switch operations") and commit: ecb595ebba0e ("net: dsa: remove dsa_port_phylink_mac_select_pcs()") in 6.12.y ]
--- include/net/dsa.h | 1 + net/dsa/port.c | 16 ++++++++++++++++ 2 files changed, 17 insertions(+)
include/net/dsa.h +1 -0
@@ -1399,5 +1399,6 @@ static inline bool dsa_user_dev_check(conetdev_tx_t dsa_enqueue_skb (struct sk_buff *skb,struct net_device *dev);void dsa_port_phylink_mac_change (struct dsa_switch *ds,int port,bool up); +bool dsa_supports_eee (struct dsa_switch *ds,int port);#endif
net/dsa/port.c +16 -0
@@ -1589,6 +1589,22 @@ dsa_port_phylink_mac_select_pcs(struct preturn pcs; } +/* dsa_supports_eee - indicate that EEE is supported +* @ds: pointer to &struct dsa_switch +* @port: port index +* +* A default implementation for the .support_eee() DSA operations member, +* which drivers can use to indicate that they support EEE on all of their +* user ports. +* +* Returns: true +*/ +bool dsa_supports_eee (struct dsa_switch *ds,int port) +{ +return true; +} +EXPORT_SYMBOL_GPL (dsa_supports_eee); +static void dsa_port_phylink_mac_config (struct phylink_config *config,unsigned int mode,const struct phylink_link_state *state)
Greg Kroah-Hartman
maintainerPATCH 126/175 net: dsa: b53/bcm_sf2: implement .support_eee() method
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King (Oracle) <[email protected]>
commit c86692fc2cb77d94dd8c166c2b9017f196d02a84 upstream.
Implement the .support_eee() method to indicate that EEE is not supported by two switch variants, rather than making these checks in the .set_mac_eee() and .get_mac_eee() methods.
--- drivers/net/dsa/b53/b53_common.c | 13 +++++++------ drivers/net/dsa/b53/b53_priv.h | 1 + drivers/net/dsa/bcm_sf2.c | 1 + 3 files changed, 9 insertions(+), 6 deletions(-)
drivers/net/dsa/b53/b53_common.c +7 -6
@@ -2388,13 +2388,16 @@ int b53_eee_init(struct dsa_switch *ds, }EXPORT_SYMBOL (b53_eee_init); -int b53_get_mac_eee (struct dsa_switch *ds,int port,struct ethtool_keee *e) +bool b53_support_eee (struct dsa_switch *ds,int port) {struct b53_device *dev = ds->priv; -if (is5325 (dev) ||is5365 (dev)) -return -EOPNOTSUPP ; +return !is5325 (dev) && !is5365 (dev); +} +EXPORT_SYMBOL (b53_support_eee); +int b53_get_mac_eee (struct dsa_switch *ds,int port,struct ethtool_keee *e) +{return 0 ; }EXPORT_SYMBOL (b53_get_mac_eee);
@@ -2404,9 +2407,6 @@ int b53_set_mac_eee(struct dsa_switch *dstruct b53_device *dev = ds->priv;struct ethtool_keee *p = &dev->ports[port].eee; -if (is5325 (dev) ||is5365 (dev)) -return -EOPNOTSUPP ; - p->eee_enabled = e->eee_enabled;b53_eee_enable_set (ds, port, e->eee_enabled);
@@ -2463,6 +2463,7 @@ static const struct dsa_switch_ops b53_s .port_setup = b53_setup_port, .port_enable = b53_enable_port, .port_disable = b53_disable_port, + .support_eee = b53_support_eee, .get_mac_eee = b53_get_mac_eee, .set_mac_eee = b53_set_mac_eee, .port_bridge_join = b53_br_join,
drivers/net/dsa/b53/b53_priv.h +1 -0
@@ -387,6 +387,7 @@ int b53_enable_port(struct dsa_switch *dvoid b53_disable_port (struct dsa_switch *ds,int port);void b53_brcm_hdr_setup (struct dsa_switch *ds,int port);int b53_eee_init (struct dsa_switch *ds,int port,struct phy_device *phy); +bool b53_support_eee (struct dsa_switch *ds,int port);int b53_get_mac_eee (struct dsa_switch *ds,int port,struct ethtool_keee *e);int b53_set_mac_eee (struct dsa_switch *ds,int port,struct ethtool_keee *e);
drivers/net/dsa/bcm_sf2.c +1 -0
@@ -1233,6 +1233,7 @@ static const struct dsa_switch_ops bcm_s .port_setup = b53_setup_port, .port_enable = bcm_sf2_port_setup, .port_disable = bcm_sf2_port_disable, + .support_eee = b53_support_eee, .get_mac_eee = b53_get_mac_eee, .set_mac_eee = b53_set_mac_eee, .port_bridge_join = b53_br_join,
Greg Kroah-Hartman
maintainerPATCH 127/175 net: dsa: b53: do not enable EEE on bcm63xx
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
commit 1237c2d4a8db79dfd4369bff6930b0e385ed7d5c upstream.
BCM63xx internal switches do not support EEE, but provide multiple RGMII ports where external PHYs may be connected. If one of these PHYs are EEE capable, we may try to enable EEE for the MACs, which then hangs the system on access of the (non-existent) EEE registers.
Fix this by checking if the switch actually supports EEE before attempting to configure it.
--- drivers/net/dsa/b53/b53_common.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +4 -1
@@ -2378,6 +2378,9 @@ int b53_eee_init(struct dsa_switch *ds, {int ret; +if (!b53_support_eee (ds, port)) +return 0 ; + ret =phy_init_eee (phy, false);if (ret)return 0 ;
@@ -2392,7 +2395,7 @@ bool b53_support_eee(struct dsa_switch * {struct b53_device *dev = ds->priv; -return !is5325 (dev) && !is5365 (dev); +return !is5325 (dev) && !is5365 (dev) && !is63xx (dev); }EXPORT_SYMBOL (b53_support_eee);
Greg Kroah-Hartman
maintainerPATCH 128/175 md/raid1,raid10: dont ignore IO flags
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
commit e879a0d9cb086c8e52ce6c04e5bfa63825a6213c upstream.
If blk-wbt is enabled by default, it's found that raid write performance is quite bad because all IO are throttled by wbt of underlying disks, due to flag REQ_IDLE is ignored. And turns out this behaviour exist since blk-wbt is introduced.
Other than REQ_IDLE, other flags should not be ignored as well, for example REQ_META can be set for filesystems, clearing it can cause priority reverse problems; And REQ_NOWAIT should not be cleared as well, because io will wait instead of failing directly in underlying disks.
Fix those problems by keep IO flags from master bio.
Fises: f51d46d0e7cb ("md: add support for REQ_NOWAIT")
[ Harshit: Resolve conflicts due to missing commit: f2a38abf5f1c
("md/raid1: Atomic write support") and commit: a1d9b4fd42d9 ("md/raid10: Atomic write support") in 6.12.y, we don't have Atomic writes feature in 6.12.y ]
--- drivers/md/raid1.c | 4 ---- drivers/md/raid10.c | 7 ------- 2 files changed, 11 deletions(-)
drivers/md/raid1.c +0 -4
@@ -1315,8 +1315,6 @@ static void raid1_read_request(struct mdstruct r1conf *conf = mddev->private;struct raid1_info *mirror;struct bio *read_bio; -const enum req_op op =bio_op (bio); -const blk_opf_t do_sync = bio->bi_opf &REQ_SYNC ;int max_sectors;int rdisk;bool r1bio_existed = !!r1_bio;
@@ -1399,7 +1397,6 @@ static void raid1_read_request(struct md read_bio->bi_iter.bi_sector = r1_bio->sector + mirror->rdev->data_offset; read_bio->bi_end_io = raid1_end_read_request; - read_bio->bi_opf = op | do_sync;if (test_bit (FailFast, &mirror->rdev->flags) &&test_bit (R1BIO_FailFast, &r1_bio->state)) read_bio->bi_opf |=MD_FAILFAST ;
@@ -1619,7 +1616,6 @@ static void raid1_write_request(struct m mbio->bi_iter.bi_sector = (r1_bio->sector + rdev->data_offset); mbio->bi_end_io = raid1_end_write_request; - mbio->bi_opf =bio_op (bio) | (bio->bi_opf & (REQ_SYNC |REQ_FUA ));if (test_bit (FailFast, &rdev->flags) && !test_bit (WriteMostly, &rdev->flags) && conf->raid_disks - mddev->degraded >1 )
drivers/md/raid10.c +0 -7
@@ -1146,8 +1146,6 @@ static void raid10_read_request(struct m {struct r10conf *conf = mddev->private;struct bio *read_bio; -const enum req_op op =bio_op (bio); -const blk_opf_t do_sync = bio->bi_opf &REQ_SYNC ;int max_sectors;struct md_rdev *rdev;char b[BDEVNAME_SIZE ];
@@ -1226,7 +1224,6 @@ static void raid10_read_request(struct m read_bio->bi_iter.bi_sector = r10_bio->devs[slot].addr +choose_data_offset (r10_bio, rdev); read_bio->bi_end_io = raid10_end_read_request; - read_bio->bi_opf = op | do_sync;if (test_bit (FailFast, &rdev->flags) &&test_bit (R10BIO_FailFast, &r10_bio->state)) read_bio->bi_opf |=MD_FAILFAST ;
@@ -1240,9 +1237,6 @@ static void raid10_write_one_disk(struct struct bio *bio, bool replacement, int n_copy) { - const enum req_op op = bio_op(bio); -const blk_opf_t do_sync = bio->bi_opf &REQ_SYNC ; -const blk_opf_t do_fua = bio->bi_opf &REQ_FUA ; unsigned long flags;struct r10conf *conf = mddev->private;struct md_rdev *rdev;
@@ -1261,7 +1255,6 @@ static void raid10_write_one_disk(struct mbio->bi_iter.bi_sector = (r10_bio->devs[n_copy].addr +choose_data_offset (r10_bio, rdev)); mbio->bi_end_io = raid10_end_write_request; - mbio->bi_opf = op | do_sync | do_fua;if (!replacement &&test_bit (FailFast, &conf->mirrors[devnum].rdev->flags) &&enough (conf, devnum))
Greg Kroah-Hartman
maintainerPATCH 129/175 md/raid1,raid10: dont handle IO error for REQ_RAHEAD and REQ_NOWAIT
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
commit 9f346f7d4ea73692b82f5102ca8698e4040469ea upstream.
IO with REQ_RAHEAD or REQ_NOWAIT can fail early, even if the storage medium is fine, hence record badblocks or remove the disk from array does not make sense.
This problem if found by lvm2 test lvcreate-large-raid, where dm-zero will fail read ahead IO directly.
--- drivers/md/raid1-10.c | 10 ++++++++++ drivers/md/raid1.c | 19 ++++++++++--------- drivers/md/raid10.c | 11 ++++++----- 3 files changed, 26 insertions(+), 14 deletions(-)
drivers/md/raid1-10.c +10 -0
@@ -293,3 +293,13 @@ static inline bool raid1_should_read_firreturn false; } + +/* +* bio with REQ_RAHEAD or REQ_NOWAIT can fail at anytime, before such IO is +* submitted to the underlying disks, hence don't record badblocks or retry +* in this case. +*/ +static inline bool raid1_should_handle_error (struct bio *bio) +{ +return !(bio->bi_opf & (REQ_RAHEAD |REQ_NOWAIT )); +}
drivers/md/raid1.c +10 -9
@@ -371,14 +371,16 @@ static void raid1_end_read_request(struc*/ update_head_pos (r1_bio->read_disk, r1_bio); -if (uptodate) +if (uptodate) {set_bit (R1BIO_Uptodate, &r1_bio->state); -else if (test_bit (FailFast, &rdev->flags) && -test_bit (R1BIO_FailFast, &r1_bio->state)) + }else if (test_bit (FailFast, &rdev->flags) && +test_bit (R1BIO_FailFast, &r1_bio->state)) {/* This was a fail-fast read so we definitely * want to retry */ ; -else { + }else if (!raid1_should_handle_error (bio)) { + uptodate =1 ; + }else {/* If all other devices have failed, we want to return * the error upwards rather than fail the last device. * Here we redefine "uptodate" to mean "Don't want to retry"
@@ -449,16 +451,15 @@ static void raid1_end_write_request(strustruct bio *to_put =NULL ;int mirror =find_bio_disk (r1_bio, bio);struct md_rdev *rdev = conf->mirrors[mirror].rdev; -bool discard_error;sector_t lo = r1_bio->sector;sector_t hi = r1_bio->sector + r1_bio->sectors; - - discard_error = bio->bi_status &&bio_op (bio) ==REQ_OP_DISCARD ; +bool ignore_error = !raid1_should_handle_error (bio) || + (bio->bi_status &&bio_op (bio) ==REQ_OP_DISCARD );/* * 'one mirror IO has finished' event handler: */ -if (bio->bi_status && !discard_error) { +if (bio->bi_status && !ignore_error) {set_bit (WriteErrorSeen, &rdev->flags);if (!test_and_set_bit (WantReplacement, &rdev->flags)) set_bit(MD_RECOVERY_NEEDED, &
@@ -509,7 +510,7 @@ static void raid1_end_write_request(stru/* Maybe we can clear some bad blocks. */ if (rdev_has_badblock (rdev, r1_bio->sector, r1_bio->sectors) && - !discard_error) { + !ignore_error) { r1_bio->bios[mirror] =IO_MADE_GOOD ;set_bit (R1BIO_MadeGood, &r1_bio->state); }
drivers/md/raid10.c +6 -5
@@ -398,6 +398,8 @@ static void raid10_end_read_request(stru* wait for the 'master' bio. */ set_bit (R10BIO_Uptodate, &r10_bio->state); + }else if (!raid1_should_handle_error (bio)) { + uptodate =1 ; }else {/* If all other devices that store this block have * failed, we want to return the error upwards rather
@@ -455,9 +457,8 @@ static void raid10_end_write_request(strint slot, repl;struct md_rdev *rdev =NULL ;struct bio *to_put =NULL ; -bool discard_error; - - discard_error = bio->bi_status &&bio_op (bio) ==REQ_OP_DISCARD ; +bool ignore_error = !raid1_should_handle_error (bio) || + (bio->bi_status &&bio_op (bio) ==REQ_OP_DISCARD ); dev =find_bio_disk (conf, r10_bio, bio, &slot, &repl);
@@ -471,7 +472,7 @@ static void raid10_end_write_request(str/* * this branch is our 'one mirror IO has finished' event handler: */ -if (bio->bi_status && !discard_error) { +if (bio->bi_status && !ignore_error) {if (repl)/* Never record new bad blocks to replacement, * just fail it.
@@ -526,7 +527,7 @@ static void raid10_end_write_request(str/* Maybe we can clear some bad blocks. */ if (rdev_has_badblock (rdev, r10_bio->devs[slot].addr, r10_bio->sectors) && - !discard_error) { + !ignore_error) {bio_put (bio);if (repl) r10_bio->devs[slot].repl_bio =IO_MADE_GOOD ;
Greg Kroah-Hartman
maintainerPATCH 130/175 md/raid1,raid10: strip REQ_NOWAIT from member bios
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <[email protected]>
commit 5fa31c49928139fa948f078b094d80f12ed83f5f upstream.
RAID layers don't implement proper non-blocking semantics for REQ_NOWAIT, making the flag potentially misleading when propagated to member disks.
This patch clear REQ_NOWAIT from cloned bios in raid1/raid10. Retain original bio's REQ_NOWAIT flag for upper layer error handling.
Maybe we can implement non-blocking I/O handling mechanisms within RAID in future work.
--- drivers/md/raid1.c | 3 ++- drivers/md/raid10.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-)
drivers/md/raid1.c +2 -1
@@ -1392,7 +1392,7 @@ static void raid1_read_request(struct md } read_bio =bio_alloc_clone (mirror->rdev->bdev, bio, gfp, &mddev->bio_set); - + read_bio->bi_opf &= ~REQ_NOWAIT ; r1_bio->bios[rdisk] = read_bio; read_bio->bi_iter.bi_sector = r1_bio->sector +
@@ -1613,6 +1613,7 @@ static void raid1_write_request(struct mwait_for_serialization (rdev, r1_bio); } + mbio->bi_opf &= ~REQ_NOWAIT ; r1_bio->bios[i] = mbio; mbio->bi_iter.bi_sector = (r1_bio->sector + rdev->data_offset);
drivers/md/raid10.c +2 -0
@@ -1218,6 +1218,7 @@ static void raid10_read_request(struct m r10_bio->master_bio = bio; } read_bio =bio_alloc_clone (rdev->bdev, bio, gfp, &mddev->bio_set); + read_bio->bi_opf &= ~REQ_NOWAIT ; r10_bio->devs[slot].bio = read_bio; r10_bio->devs[slot].rdev = rdev;
@@ -1248,6 +1249,7 @@ static void raid10_write_one_disk(struct conf->mirrors[devnum].rdev; mbio =bio_alloc_clone (rdev->bdev, bio,GFP_NOIO , &mddev->bio_set); + mbio->bi_opf &= ~REQ_NOWAIT ;if (replacement) r10_bio->devs[n_copy].repl_bio = mbio;else
Greg Kroah-Hartman
maintainerPATCH 131/175 ext4: define ext4_journal_destroy wrapper
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ojaswin Mujoo <[email protected]>
commit 5a02a6204ca37e7c22fbb55a789c503f05e8e89a upstream.
Define an ext4 wrapper over jbd2_journal_destroy to make sure we have consistent behavior during journal destruction. This will also come useful in the next patch where we add some ext4 specific logic in the destroy path.
--- fs/ext4/ext4_jbd2.h | 14 ++++++++++++++ fs/ext4/super.c | 16 ++++++---------- 2 files changed, 20 insertions(+), 10 deletions(-)
fs/ext4/ext4_jbd2.h +14 -0
@@ -513,4 +513,18 @@ static inline int ext4_should_dioread_no return 1; } +/* +* Pass journal explicitly as it may not be cached in the sbi->s_journal in some +* cases +*/ +static inline int ext4_journal_destroy (struct ext4_sb_info *sbi,journal_t *journal) +{ +int err =0 ; + + err =jbd2_journal_destroy (journal); + sbi->s_journal =NULL ; + +return err; +} +#endif /* _EXT4_JBD2_H */
fs/ext4/super.c +6 -10
@@ -1312,8 +1312,7 @@ static void ext4_put_super(struct super_if (sbi->s_journal) { aborted =is_journal_aborted (sbi->s_journal); - err =jbd2_journal_destroy (sbi->s_journal); - sbi->s_journal =NULL ; + err =ext4_journal_destroy (sbi, sbi->s_journal);if ((err <0 ) && !aborted) {ext4_abort (sb, -err,"Couldn't clean up the journal" ); }
@@ -4957,8 +4956,7 @@ static int ext4_load_and_init_journal(st out:/* flush s_sb_upd_work before destroying the journal. */ flush_work (&sbi->s_sb_upd_work); -jbd2_journal_destroy (sbi->s_journal); - sbi->s_journal =NULL ; +ext4_journal_destroy (sbi, sbi->s_journal);return -EINVAL ; }
@@ -5649,8 +5647,7 @@ failed_mount_wq:if (sbi->s_journal) {/* flush s_sb_upd_work before journal destroy. */ flush_work (&sbi->s_sb_upd_work); -jbd2_journal_destroy (sbi->s_journal); - sbi->s_journal =NULL ; +ext4_journal_destroy (sbi, sbi->s_journal); } failed_mount3a:ext4_es_unregister_shrinker (sbi);
@@ -5958,7 +5955,7 @@ static journal_t *ext4_open_dev_journal(return journal; out_journal: -jbd2_journal_destroy (journal); +ext4_journal_destroy (EXT4_SB (sb), journal); out_bdev:bdev_fput (bdev_file);return ERR_PTR (errno);
@@ -6075,8 +6072,7 @@ static int ext4_load_journal(struct supeEXT4_SB (sb)->s_journal = journal; err =ext4_clear_journal_err (sb, es);if (err) { -EXT4_SB (sb)->s_journal =NULL ; -jbd2_journal_destroy (journal); +ext4_journal_destroy (EXT4_SB (sb), journal);return err; }
@@ -6094,7 +6090,7 @@ static int ext4_load_journal(struct supereturn 0 ; err_out: -jbd2_journal_destroy (journal); +ext4_journal_destroy (EXT4_SB (sb), journal);return err; }
Greg Kroah-Hartman
maintainerPATCH 132/175 ext4: avoid journaling sb update on error if journal is destroying
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ojaswin Mujoo <[email protected]>
commit ce2f26e73783b4a7c46a86e3af5b5c8de0971790 upstream.
Presently we always BUG_ON if trying to start a transaction on a journal marked with JBD2_UNMOUNT, since this should never happen. However, while ltp running stress tests, it was observed that in case of some error handling paths, it is possible for update_super_work to start a transaction after the journal is destroyed eg:
(umount)ext4_kill_sb
kill_block_super
generic_shutdown_super
sync_filesystem /* commits all txns */
evict_inodes
/* might start a new txn */
ext4_put_super
flush_work(&sbi->s_sb_upd_work) /* flush the workqueue */
jbd2_journal_destroy
journal_kill_thread
journal->j_flags |= JBD2_UNMOUNT;
jbd2_journal_commit_transaction
jbd2_journal_get_descriptor_buffer
jbd2_journal_bmap
ext4_journal_bmap
ext4_map_blocks
...
ext4_inode_error
ext4_handle_error
schedule_work(&sbi->s_sb_upd_work)
/* work queue kicks in */
update_super_work
jbd2_journal_start
start_this_handle
BUG_ON(journal->j_flags &
JBD2_UNMOUNT)Hence, introduce a new mount flag to indicate journal is destroying and only do a journaled (and deferred) update of sb if this flag is not set. Otherwise, just fallback to an un-journaled commit.
Further, in the journal destroy path, we have the following sequence:
1. Set mount flag indicating journal is destroying
2. force a commit and wait for it
3. flush pending sb updates
This sequence is important as it ensures that, after this point, there is no sb update that might be journaled so it is safe to update the sb outside the journal. (To avoid race discussed in 2d01ddc86606)
Also, we don't need a similar check in ext4_grp_locked_error since it is only called from mballoc and AFAICT it would be always valid to schedule work here.
--- fs/ext4/ext4.h | 3 ++- fs/ext4/ext4_jbd2.h | 15 +++++++++++++++ fs/ext4/super.c | 16 ++++++++-------- 3 files changed, 25 insertions(+), 9 deletions(-)
fs/ext4/ext4.h +2 -1
@@ -1823,7 +1823,8 @@ static inline int ext4_valid_inum(struct*/ enum {EXT4_MF_MNTDIR_SAMPLED , -EXT4_MF_FC_INELIGIBLE /* Fast commit ineligible */ +EXT4_MF_FC_INELIGIBLE ,/* Fast commit ineligible */ +EXT4_MF_JOURNAL_DESTROY /* Journal is in process of destroying */ };static inline void ext4_set_mount_flag (struct super_block *sb,int bit)
fs/ext4/ext4_jbd2.h +15 -0
@@ -521,6 +521,21 @@ static inline int ext4_journal_destroy(s {int err =0 ; +/* +* At this point only two things can be operating on the journal. +* JBD2 thread performing transaction commit and s_sb_upd_work +* issuing sb update through the journal. Once we set +* EXT4_JOURNAL_DESTROY, new ext4_handle_error() calls will not +* queue s_sb_upd_work and ext4_force_commit() makes sure any +* ext4_handle_error() calls from the running transaction commit are +* finished. Hence no new s_sb_upd_work can be queued after we +* flush it here. +*/ +ext4_set_mount_flag (sbi->s_sb,EXT4_MF_JOURNAL_DESTROY ); + +ext4_force_commit (sbi->s_sb); +flush_work (&sbi->s_sb_upd_work); + err =jbd2_journal_destroy (journal); sbi->s_journal =NULL ;
fs/ext4/super.c +8 -8
@@ -719,9 +719,13 @@ static void ext4_handle_error(struct sup* In case the fs should keep running, we need to writeout * superblock through the journal. Due to lock ordering * constraints, it may not be safe to do it right here so we -* defer superblock flushing to a workqueue. +* defer superblock flushing to a workqueue. We just need to be +* careful when the journal is already shutting down. If we get +* here in that case, just update the sb directly as the last +* transaction won't commit anyway. */ -if (continue_fs && journal) +if (continue_fs && journal && + !ext4_test_mount_flag (sb,EXT4_MF_JOURNAL_DESTROY ))schedule_work (&EXT4_SB (sb)->s_sb_upd_work);else ext4_commit_super (sb);
@@ -1306,7 +1310,6 @@ static void ext4_put_super(struct super_ext4_unregister_li_request (sb);ext4_quotas_off (sb,EXT4_MAXQUOTAS ); -flush_work (&sbi->s_sb_upd_work);destroy_workqueue (sbi->rsv_conversion_wq);ext4_release_orphan_info (sb);
@@ -1316,7 +1319,8 @@ static void ext4_put_super(struct super_if ((err <0 ) && !aborted) {ext4_abort (sb, -err,"Couldn't clean up the journal" ); } - } + }else +flush_work (&sbi->s_sb_upd_work);ext4_es_unregister_shrinker (sbi);timer_shutdown_sync (&sbi->s_err_report);
@@ -4954,8 +4958,6 @@ static int ext4_load_and_init_journal(streturn 0 ; out: -/* flush s_sb_upd_work before destroying the journal. */ -flush_work (&sbi->s_sb_upd_work);ext4_journal_destroy (sbi, sbi->s_journal);return -EINVAL ; }
@@ -5645,8 +5647,6 @@ failed_mount_wq: sbi->s_ea_block_cache =NULL ;if (sbi->s_journal) { -/* flush s_sb_upd_work before journal destroy. */ -flush_work (&sbi->s_sb_upd_work);ext4_journal_destroy (sbi, sbi->s_journal); } failed_mount3a:
Greg Kroah-Hartman
maintainerPATCH 133/175 wifi: ath11k: update channel list in reg notifier instead reg worker
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wen Gong <[email protected]>
commit 933ab187e679e6fbdeea1835ae39efcc59c022d2 upstream.
Currently when ath11k gets a new channel list, it will be processed according to the following steps:
1. update new channel list to cfg80211 and queue reg_work.
2. cfg80211 handles new channel list during reg_work.
3. update cfg80211's handled channel list to firmware by ath11k_reg_update_chan_list().
But ath11k will immediately execute step 3 after reg_work is just queued. Since step 2 is asynchronous, cfg80211 may not have completed handling the new channel list, which may leading to an out-of-bounds write error:
BUG: KASAN: slab-out-of-bounds in ath11k_reg_update_chan_list
Call Trace:
ath11k_reg_update_chan_list+0xbfe/0xfe0 [ath11k]
kfree+0x109/0x3a0
ath11k_regd_update+0x1cf/0x350 [ath11k]
ath11k_regd_update_work+0x14/0x20 [ath11k]
process_one_work+0xe35/0x14c0Should ensure step 2 is completely done before executing step 3. Thus Wen raised patch[1]. When flag NL80211_REGDOM_SET_BY_DRIVER is set, cfg80211 will notify ath11k after step 2 is done.
So enable the flag NL80211_REGDOM_SET_BY_DRIVER then cfg80211 will notify ath11k after step 2 is done. At this time, there will be no KASAN bug during the execution of the step 3.
[1] https://patchwork.kernel.org/project/linux-wireless/patch/[email protected]/
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
--- drivers/net/wireless/ath/ath11k/reg.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-)
drivers/net/wireless/ath/ath11k/reg.c +15 -7
@@ -1,7 +1,7 @@// SPDX-License-Identifier: BSD-3-Clause-Clear /* * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. -* Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved. +* Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved. */ #include <linux/rtnetlink.h>
@@ -55,6 +55,19 @@ ath11k_reg_notifier(struct wiphy *wiphy,ath11k_dbg (ar->ab,ATH11K_DBG_REG ,"Regulatory Notification received for %s\n" ,wiphy_name (wiphy)); +if (request->initiator ==NL80211_REGDOM_SET_BY_DRIVER ) { +ath11k_dbg (ar->ab,ATH11K_DBG_REG , +"driver initiated regd update\n" ); +if (ar->state !=ATH11K_STATE_ON ) +return ; + + ret =ath11k_reg_update_chan_list (ar, true); +if (ret) +ath11k_warn (ar->ab,"failed to update channel list: %d\n" , ret); + +return ; + } +/* Currently supporting only General User Hints. Cell base user * hints to be handled later. * Hints from other sources like Core, Beacons are not expected for
@@ -293,12 +306,6 @@ int ath11k_regd_update(struct ath11k *arif (ret) goto err; -if (ar->state ==ATH11K_STATE_ON ) { - ret =ath11k_reg_update_chan_list (ar, true); -if (ret) - goto err; - } -return 0 ; err:ath11k_warn (ab,"failed to perform regd update : %d\n" , ret);
@@ -977,6 +984,7 @@ void ath11k_regd_update_work(struct workvoid ath11k_reg_init (struct ath11k *ar) { ar->hw->wiphy->regulatory_flags =REGULATORY_WIPHY_SELF_MANAGED ; + ar->hw->wiphy->flags |=WIPHY_FLAG_NOTIFY_REGDOM_BY_DRIVER ; ar->hw->wiphy->reg_notifier = ath11k_reg_notifier; }
Greg Kroah-Hartman
maintainerPATCH 134/175 wifi: ath11k: update channel list in worker when wait flag is set
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wen Gong <[email protected]>
commit 02aae8e2f957adc1b15b6b8055316f8a154ac3f5 upstream.
With previous patch "wifi: ath11k: move update channel list from update reg worker to reg notifier", ath11k_reg_update_chan_list() will be called during reg_process_self_managed_hint().
reg_process_self_managed_hint() will hold rtnl_lock all the time. But ath11k_reg_update_chan_list() may increase the occupation time of rtnl_lock, because when wait flag is set, wait_for_completion_timeout() will be called during 11d/hw scan.
Should minimize the occupation time of rtnl_lock as much as possible to avoid interfering with rest of the system. So move the update channel list operation to a new worker, so that wait_for_completion_timeout() won't be called and will not increase the occupation time of rtnl_lock.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
--- drivers/net/wireless/ath/ath11k/core.c | 1 drivers/net/wireless/ath/ath11k/core.h | 5 + drivers/net/wireless/ath/ath11k/mac.c | 14 +++++ drivers/net/wireless/ath/ath11k/reg.c | 85 ++++++++++++++++++++++----------- drivers/net/wireless/ath/ath11k/reg.h | 3 - drivers/net/wireless/ath/ath11k/wmi.h | 1 6 files changed, 81 insertions(+), 28 deletions(-)
drivers/net/wireless/ath/ath11k/core.c +1 -0
@@ -1972,6 +1972,7 @@ void ath11k_core_halt(struct ath11k *ar)ath11k_mac_scan_finish (ar);ath11k_mac_peer_cleanup_all (ar);cancel_delayed_work_sync (&ar->scan.timeout); +cancel_work_sync (&ar->channel_update_work);cancel_work_sync (&ar->regd_update_work);cancel_work_sync (&ab->update_11d_work);
drivers/net/wireless/ath/ath11k/core.h +4 -1
@@ -691,7 +691,7 @@ struct ath11k {struct mutex conf_mutex;/* protects the radio specific data like debug stats, ppdu_stats_info stats, * vdev_stop_status info, scan data, ath11k_sta info, ath11k_vif info, -* channel context data, survey info, test mode data. +* channel context data, survey info, test mode data, channel_update_queue. */ spinlock_t data_lock;
@@ -749,6 +749,9 @@ struct ath11k {struct completion bss_survey_done;struct work_struct regd_update_work; +struct work_struct channel_update_work; +/* protected with data_lock */ +struct list_head channel_update_queue;struct work_struct wmi_mgmt_tx_work;struct sk_buff_head wmi_mgmt_tx_queue;
drivers/net/wireless/ath/ath11k/mac.c +14 -0
@@ -6367,6 +6367,7 @@ static void ath11k_mac_op_stop(struct ie {struct ath11k *ar = hw->priv;struct htt_ppdu_stats_info *ppdu_stats, *tmp; +struct scan_chan_list_params *params;int ret;ath11k_mac_drain_tx (ar);
@@ -6382,6 +6383,7 @@ static void ath11k_mac_op_stop(struct iemutex_unlock (&ar->conf_mutex);cancel_delayed_work_sync (&ar->scan.timeout); +cancel_work_sync (&ar->channel_update_work);cancel_work_sync (&ar->regd_update_work);cancel_work_sync (&ar->ab->update_11d_work);
@@ -6391,10 +6393,19 @@ static void ath11k_mac_op_stop(struct ie }spin_lock_bh (&ar->data_lock); +list_for_each_entry_safe (ppdu_stats, tmp, &ar->ppdu_stats_info, list) {list_del (&ppdu_stats->list);kfree (ppdu_stats); } + +while ((params =list_first_entry_or_null (&ar->channel_update_queue, + struct scan_chan_list_params, + list))) { +list_del (¶ms->list); +kfree (params); + } +spin_unlock_bh (&ar->data_lock);rcu_assign_pointer (ar->ab->pdevs_active[ar->pdev_idx],NULL );
@@ -10194,6 +10205,7 @@ static const struct wiphy_iftype_ext_capstatic void __ath11k_mac_unregister (struct ath11k *ar) { +cancel_work_sync (&ar->channel_update_work);cancel_work_sync (&ar->regd_update_work);ieee80211_unregister_hw (ar->hw);
@@ -10593,6 +10605,8 @@ int ath11k_mac_allocate(struct ath11k_bainit_completion (&ar->thermal.wmi_sync);INIT_DELAYED_WORK (&ar->scan.timeout, ath11k_scan_timeout_work); +INIT_WORK (&ar->channel_update_work, ath11k_regd_update_chan_list_work); +INIT_LIST_HEAD (&ar->channel_update_queue);INIT_WORK (&ar->regd_update_work, ath11k_regd_update_work);INIT_WORK (&ar->wmi_mgmt_tx_work, ath11k_mgmt_over_wmi_tx_work);
drivers/net/wireless/ath/ath11k/reg.c +59 -26
103 lines not on this page · raw message
drivers/net/wireless/ath/ath11k/reg.h +2 -1
@@ -1,7 +1,7 @@/* SPDX-License-Identifier: BSD-3-Clause-Clear */ /* * Copyright (c) 2019 The Linux Foundation. All rights reserved. -* Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved. +* Copyright (c) 2022-2025 Qualcomm Innovation Center, Inc. All rights reserved. */ #ifndef ATH11K_REG_H
@@ -33,6 +33,7 @@ void ath11k_reg_init(struct ath11k *ar);void ath11k_reg_reset_info (struct cur_regulatory_info *reg_info);void ath11k_reg_free (struct ath11k_base *ab);void ath11k_regd_update_work (struct work_struct *work); +void ath11k_regd_update_chan_list_work (struct work_struct *work);struct ieee80211_regdomain * ath11k_reg_build_regd(struct ath11k_base *ab, struct cur_regulatory_info *reg_info, bool intersect,
drivers/net/wireless/ath/ath11k/wmi.h +1 -0
@@ -3817,6 +3817,7 @@ struct wmi_stop_scan_cmd { };struct scan_chan_list_params { +struct list_head list;u32 pdev_id;u16 nallchans;struct channel_param ch_param[];
Greg Kroah-Hartman
maintainerPATCH 135/175 net: fix NULL pointer dereference in l3mdev_l3_rcv
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <[email protected]>
commit 0032c99e83b9ce6d5995d65900aa4b6ffb501cce upstream.
When delete l3s ipvlan:
ip link del link eth0 ipvlan1 type ipvlan mode l3s
This may cause a null pointer dereference:
Call trace:
ip_rcv_finish+0x48/0xd0
ip_rcv+0x5c/0x100
__netif_receive_skb_one_core+0x64/0xb0
__netif_receive_skb+0x20/0x80
process_backlog+0xb4/0x204
napi_poll+0xe8/0x294
net_rx_action+0xd8/0x22c
__do_softirq+0x12c/0x354This is because l3mdev_l3_rcv() visit dev->l3mdev_ops after ipvlan_l3s_unregister() assign the dev->l3mdev_ops to NULL. The process like this:
(CPU1) | (CPU2)
l3mdev_l3_rcv() |
check dev->priv_flags: |
master = skb->dev; |
|
| ipvlan_l3s_unregister()
| set dev->priv_flags
| dev->l3mdev_ops = NULL;
|
visit master->l3mdev_ops |To avoid this by do not set dev->l3mdev_ops when unregister l3s ipvlan.
--- drivers/net/ipvlan/ipvlan_l3s.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ipvlan/ipvlan_l3s.c +0 -1
@@ -224,5 +224,4 @@ void ipvlan_l3s_unregister(struct ipvl_p dev->priv_flags &= ~IFF_L3MDEV_RX_HANDLER ;ipvlan_unregister_nf_hook (read_pnet (&port->pnet)); - dev->l3mdev_ops =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 136/175 md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Yue <[email protected]>
commit 6130825f34d41718c98a9b1504a79a23e379701e upstream.
In clustermd, separate write-intent-bitmaps are used for each cluster node:
0 4k 8k 12k
-------------------------------------------------------------------
| idle | md super | bm super [0] + bits | | bm bits[0, contd] | bm super[1] + bits | bm bits[1, contd] | | bm super[2] + bits | bm bits [2, contd] | bm super[3] + bits | | bm bits [3, contd] | | |
So in node 1, pg_index in __write_sb_page() could equal to bitmap->storage.file_pages. Then bitmap_limit will be calculated to
0. md_super_write() will be called with 0 size.
That means the first 4k sb area of node 1 will never be updated through filemap_write_page().
This bug causes hang of mdadm/clustermd_tests/01r1_Grow_resize.
Here use (pg_index % bitmap->storage.file_pages) to make calculation of bitmap_limit correct.
--- drivers/md/md-bitmap.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/md/md-bitmap.c +3 -3
@@ -426,8 +426,8 @@ static int __write_sb_page(struct md_rdestruct block_device *bdev;struct mddev *mddev = bitmap->mddev;struct bitmap_storage *store = &bitmap->storage; -unsigned int bitmap_limit = (bitmap->storage.file_pages - pg_index) << -PAGE_SHIFT ; +unsigned long num_pages = bitmap->storage.file_pages; +unsigned int bitmap_limit = (num_pages - pg_index % num_pages) <<PAGE_SHIFT ;loff_t sboff, offset = mddev->bitmap_info.offset;sector_t ps = pg_index *PAGE_SIZE /SECTOR_SIZE ;unsigned int size =PAGE_SIZE ;
@@ -436,7 +436,7 @@ static int __write_sb_page(struct md_rde bdev = (rdev->meta_bdev) ? rdev->meta_bdev : rdev->bdev;/* we compare length (page numbers), not page offset. */ -if ((pg_index - store->sb_index) == store->file_pages -1 ) { +if ((pg_index - store->sb_index) == num_pages -1 ) {unsigned int last_page_size = store->bytes & (PAGE_SIZE -1 );if (last_page_size ==0 )
Greg Kroah-Hartman
maintainerPATCH 137/175 mm: slub: Print the broken data before restoring them
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyesoo Yu <[email protected]>
[ Upstream commit ed5ec2e952595a469eae1f6dce040737359b6da2 ]
Previously, the restore occurred after printing the object in slub. After commit 47d911b02cbe ("slab: make check_object() more consistent"), the bytes are printed after the restore. This information about the bytes before the restore is highly valuable for debugging purpose. For instance, in a event of cache issue, it displays byte patterns by breaking them down into 64-bytes units. Without this information, we can only speculate on how it was broken. Hence the corrupted regions should be printed prior to the restoration process. However if an object breaks in multiple places, the same log may be output multiple times. Therefore the slub log is reported only once to prevent redundant printing, by sending a parameter indicating whether an error has occurred previously.
Stable-dep-of: b4efccec8d06 ("mm/slub: avoid accessing metadata when pointer is invalid in object_err()")
--- mm/slub.c | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-)
mm/slub.c +14 -18
@@ -1191,8 +1191,8 @@ static void restore_bytes(struct kmem_ca static pad_check_attributes intcheck_bytes_and_report (struct kmem_cache *s,struct slab *slab, -u8 *object,char *what, -u8 *start,unsigned int value,unsigned int bytes) +u8 *object,char *what,u8 *start,unsigned int value, +unsigned int bytes,bool slab_obj_print) {u8 *fault;u8 *end;
@@ -1211,10 +1211,11 @@ check_bytes_and_report(struct kmem_cacheif (slab_add_kunit_errors ()) goto skip_bug_print; -slab_bug (s,"%s overwritten" , what); -pr_err ("0x%p-0x%p @offset=%tu. First byte 0x%x instead of 0x%x\n" , - fault, end -1 , fault - addr, - fault[0 ], value); +pr_err ("[%s overwritten] 0x%p-0x%p @offset=%tu. First byte 0x%x instead of 0x%x\n" , + what, fault, end -1 , fault - addr, fault[0 ], value); + +if (slab_obj_print) +object_err (s, slab, object,"Object corrupt" ); skip_bug_print:restore_bytes (s, what, value, fault, end);
@@ -1278,7 +1279,7 @@ static int check_pad_bytes(struct kmem_creturn 1 ;return check_bytes_and_report (s, slab, p,"Object padding" , - p + off,POISON_INUSE ,size_from_object (s) - off); + p + off,POISON_INUSE ,size_from_object (s) - off, true); }/* Check the pad bytes at the end of a slab page */
@@ -1328,11 +1329,11 @@ static int check_object(struct kmem_cachif (s->flags &SLAB_RED_ZONE ) {if (!check_bytes_and_report (s, slab, object,"Left Redzone" , - object - s->red_left_pad, val, s->red_left_pad)) + object - s->red_left_pad, val, s->red_left_pad, ret)) ret =0 ;if (!check_bytes_and_report (s, slab, object,"Right Redzone" , - endobject, val, s->inuse - s->object_size)) + endobject, val, s->inuse - s->object_size, ret)) ret =0 ;if (slub_debug_orig_size (s) && val ==SLUB_RED_ACTIVE ) {
@@ -1341,7 +1342,7 @@ static int check_object(struct kmem_cachif (s->object_size > orig_size && !check_bytes_and_report (s, slab, object,"kmalloc Redzone" , p + orig_size, - val, s->object_size - orig_size)) { + val, s->object_size - orig_size, ret)) { ret =0 ; } }
@@ -1349,7 +1350,7 @@ static int check_object(struct kmem_cachif ((s->flags &SLAB_POISON ) && s->object_size < s->inuse) {if (!check_bytes_and_report (s, slab, p,"Alignment padding" , endobject,POISON_INUSE , - s->inuse - s->object_size)) + s->inuse - s->object_size, ret)) ret =0 ; } }
@@ -1365,11 +1366,11 @@ static int check_object(struct kmem_cachif (kasan_meta_size < s->object_size -1 && !check_bytes_and_report (s, slab, p,"Poison" , p + kasan_meta_size,POISON_FREE , - s->object_size - kasan_meta_size -1 )) + s->object_size - kasan_meta_size -1 , ret)) ret =0 ;if (kasan_meta_size < s->object_size && !check_bytes_and_report (s, slab, p,"End Poison" , - p + s->object_size -1 ,POISON_END ,1 )) + p + s->object_size -1 ,POISON_END ,1 , ret)) ret =0 ; }/*
@@ -1395,11 +1396,6 @@ static int check_object(struct kmem_cach ret =0 ; } -if (!ret && !slab_in_kunit_test ()) { -print_trailer (s, slab, object); -add_taint (TAINT_BAD_PAGE ,LOCKDEP_NOW_UNRELIABLE ); - } -return ret; }