6.6.131-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.6.131-rc1 review
This is the start of the stable review cycle for the 6.6.131 release. There are 175 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 Apr 2026 16:16:56 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.131-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.131-rc1
Kuniyuki Iwashima <[email protected]>
tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-wildcard addresses.
Davidlohr Bueso <[email protected]>
futex: Clear stale exiting pointer in futex_lock_pi() retry path
Vinicius Costa Gomes <[email protected]>
dmaengine: idxd: Fix freeing the allocated ida too late
Christophe JAILLET <[email protected]>
dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API
Filipe Manana <[email protected]>
btrfs: fix lost error when running device stats on multiple devices fs
Shin'ichiro Kawasaki <[email protected]>
btrfs: fix leak of kobject name for sub-group space_info
Mark Harmstone <[email protected]>
btrfs: fix super block offset in error message in btrfs_validate_super()
Tomi Valkeinen <[email protected]>
dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
Marek Vasut <[email protected]>
dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction
Marek Vasut <[email protected]>
dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA
Marek Vasut <[email protected]>
dmaengine: xilinx: xilinx_dma: Fix dma_device directions
Alexander Stein <[email protected]>
dmaengine: xilinx: xdma: Fix regmap init error handling
LUO Haowen <[email protected]>
dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA.
Felix Gu <[email protected]>
phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types()
Vinicius Costa Gomes <[email protected]>
dmaengine: idxd: Fix memory leak when a wq is reset
Vinicius Costa Gomes <[email protected]>
dmaengine: idxd: Fix not releasing workqueue on .release()
Gao Xiang <[email protected]>
erofs: fix "BUG: Bad page state in z_erofs_do_read_page"
Yuto Ohnuki <[email protected]>
xfs: save ailp before dropping the AIL lock in push callbacks
Yuto Ohnuki <[email protected]>
xfs: avoid dereferencing log items after push callbacks
Josh Law <[email protected]>
mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
Ming Lei <[email protected]>
nvme: fix admin queue leak on controller reset
Al Viro <[email protected]>
xattr: switch to CLASS(fd)
Mikhail Gavrilov <[email protected]>
libbpf: Fix -Wdiscarded-qualifiers under C23
Andreas Gruenbacher <[email protected]>
gfs2: Fix unlikely race in gdlm_put_lock
Pratyush Yadav <[email protected]>
mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode
Pratyush Yadav <[email protected]>
mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode
Benno Lossin <[email protected]>
rust: pin-init: internal: init: document load-bearing fact of field accessors
Benno Lossin <[email protected]>
rust: pin-init: add references to previously initialized fields
Luo Haiyang <[email protected]>
tracing: Fix potential deadlock in cpu hotplug with osnoise
Steven Rostedt <[email protected]>
tracing: Switch trace_osnoise.c code over to use guard() and __free()
Werner Kasselman <[email protected]>
ksmbd: fix memory leaks and NULL deref in smb2_lock()
Werner Kasselman <[email protected]>
ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
Hari Bathini <[email protected]>
powerpc64/bpf: do not increment tailcall count when prog is NULL
Markus Niebel <[email protected]>
arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off
Theodore Ts'o <[email protected]>
ext4: always drain queued discard work in ext4_mb_release()
Baokun Li <[email protected]>
ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
Zqiang <[email protected]>
ext4: fix the might_sleep() warnings in kvfree()
Jiayuan Chen <[email protected]>
ext4: fix use-after-free in update_super_work when racing with umount
Helen Koike <[email protected]>
ext4: reject mount if bigalloc with s_first_data_block != 0
Ye Bin <[email protected]>
ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
Edward Adam Davis <[email protected]>
ext4: avoid infinite loops caused by residual data
Yuto Ohnuki <[email protected]>
ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
Jan Kara <[email protected]>
ext4: make recently_deleted() properly work with lazy itable initialization
Jan Kara <[email protected]>
ext4: fix fsync(2) for nojournal mode
Jan Kara <[email protected]>
ext4: fix stale xarray tags after writeback
Deepanshu Kartikey <[email protected]>
ext4: convert inline data to extents when truncate exceeds inline size
Simon Weber <[email protected]>
ext4: fix journal credit check when setting fscrypt context
Long Li <[email protected]>
xfs: fix ri_total validation in xlog_recover_attri_commit_pass2
Yuto Ohnuki <[email protected]>
xfs: stop reclaim before pushing AIL during unmount
Huacai Chen <[email protected]>
LoongArch: Workaround LS2K/LS7A GPU DMA hang bug
Claudiu Beznea <[email protected]>
dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
Claudiu Beznea <[email protected]>
dmaengine: sh: rz-dmac: Protect the driver specific lists
Jassi Brar <[email protected]>
irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment
Milos Nikic <[email protected]>
jbd2: gracefully abort on checkpointing state corruptions
Sean Christopherson <[email protected]>
KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
Kevin Hao <[email protected]>
net: macb: Use dev_consume_skb_any() to free TX SKBs
Greg Kroah-Hartman <[email protected]>
scsi: ses: Handle positive SCSI error from ses_recv_diag()
Tyllis Xu <[email protected]>
scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
Zhan Xusheng <[email protected]>
alarmtimer: Fix argument order in alarm_timer_forward()
Jiucheng Xu <[email protected]>
erofs: add GFP_NOIO in the bio completion if needed
Vasily Gorbik <[email protected]>
s390/entry: Scrub r12 register on kernel entry
xietangxin <[email protected]>
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
Yuchan Nam <[email protected]>
media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
Sanman Pradhan <[email protected]>
hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()
Sanman Pradhan <[email protected]>
hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature
Sanman Pradhan <[email protected]>
hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes
Marc Zyngier <[email protected]>
KVM: arm64: Discard PC update state on vcpu reset
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Correct locked bit width
Viresh Kumar <[email protected]>
cpufreq: conservative: Reset requested_freq on limits change
Oliver Hartkopp <[email protected]>
can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
Ali Norouzi <[email protected]>
can: gw: fix OOB heap access in cgw_csum_crc8_rel()
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload
Alexey Nepomnyashih <[email protected]>
ALSA: firewire-lib: fix uninitialized local variable
Hyunwoo Kim <[email protected]>
ksmbd: do not expire session on binding failure
Namjae Jeon <[email protected]>
ksmbd: fix potencial OOB in get_file_all_info() for compound requests
Namjae Jeon <[email protected]>
ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
Vasily Gorbik <[email protected]>
s390/barrier: Make array_index_mask_nospec() __always_inline
Greg Kroah-Hartman <[email protected]>
s390/syscalls: Add spectre boundary for syscall dispatch table
Marc Kleine-Budde <[email protected]>
spi: spi-fsl-lpspi: fix teardown order issue (UAF)
Jihed Chaibi <[email protected]>
ASoC: adau1372: Fix clock leak on PLL lock failure
Jihed Chaibi <[email protected]>
ASoC: adau1372: Fix unchecked clk_prepare_enable() return value
Marc Buerg <[email protected]>
sysctl: fix uninitialized variable in proc_do_large_bitmap
Sanman Pradhan <[email protected]>
hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
Weiming Shi <[email protected]>
ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
Cezary Rojewski <[email protected]>
ASoC: Intel: catpt: Fix the device initialization
Felix Gu <[email protected]>
spi: sn-f-ospi: Fix resource leak in f_ospi_probe()
Alberto Garcia <[email protected]>
PM: hibernate: Drain trailing zero pages on userspace restore
Christophe Leroy <[email protected]>
PM: hibernate: Don't ignore return from set_memory_ro()
Samasth Norway Ananda <[email protected]>
drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
Mike Rapoport (Microsoft) <[email protected]>
x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size
Yihang Li <[email protected]>
scsi: scsi_transport_sas: Fix the maximum channel scanning issue
Tatyana Nikolova <[email protected]>
RDMA/irdma: Return EINVAL for invalid arp index error
Anil Samal <[email protected]>
RDMA/irdma: Fix deadlock during netdev reset with active connections
Tatyana Nikolova <[email protected]>
RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
Ivan Barrera <[email protected]>
RDMA/irdma: Clean up unnecessary dereference of event->cm_node
Tatyana Nikolova <[email protected]>
RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
Tatyana Nikolova <[email protected]>
RDMA/irdma: Update ibqp state to error if QP is already in error state
Jacob Moroni <[email protected]>
RDMA/irdma: Initialize free_qp completion before using it
Chuck Lever <[email protected]>
RDMA/rw: Fall back to direct SGE on MR pool exhaustion
Andy Shevchenko <[email protected]>
regmap: Synchronize cache for the page selector
Paolo Valerio <[email protected]>
net: macb: use the current queue number for stats
David Carlier <[email protected]>
netfilter: ctnetlink: use netlink policy range checks
Weiming Shi <[email protected]>
netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: skip expectations in other netns via proc
Ren Wei <[email protected]>
netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
Weiming Shi <[email protected]>
netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
Chuck Lever <[email protected]>
tls: Purge async_hold in tls_decrypt_async_wait()
Pengpeng Hou <[email protected]>
Bluetooth: btusb: clamp SCO altsetting table indices
Hyunwoo Kim <[email protected]>
Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
Cen Zhang <[email protected]>
Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Remove remaining dependencies of hci_request
Zijun Hu <[email protected]>
Bluetooth: Remove 3 repeated macro definitions
Zhang Chen <[email protected]>
Bluetooth: L2CAP: Fix send LE flow credits in ACL link
Miguel Ojeda <[email protected]>
dma-mapping: add missing inline for dma_free_attrs
Wei Fang <[email protected]>
net: enetc: fix the output issue of 'ethtool --show-ring'
Martin KaFai Lau <[email protected]>
udp: Fix wildcard bind conflict check when using hash2
Eric Dumazet <[email protected]>
tcp: optimize inet_use_bhash2_on_bind()
Kuniyuki Iwashima <[email protected]>
tcp: Rearrange tests in inet_csk_bind_conflict().
Kuniyuki Iwashima <[email protected]>
tcp: Use bhash2 for v4-mapped-v6 non-wildcard address.
Yochai Eisenrich <[email protected]>
net: fix fanout UAF in packet_release() via NETDEV_UP race
Kuniyuki Iwashima <[email protected]>
ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist.
Kuniyuki Iwashima <[email protected]>
ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire.
Petr Oros <[email protected]>
ice: use ice_update_eth_stats() for representor stats
Alok Tiwari <[email protected]>
platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen
Sabrina Dubroca <[email protected]>
rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
Qi Tang <[email protected]>
net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
Yang Yang <[email protected]>
openvswitch: validate MPLS set/set_masked payload length
Yang Yang <[email protected]>
openvswitch: defer tunnel netdev_put to RCU release
Toke Høiland-Jørgensen <[email protected]>
net: openvswitch: Avoid releasing netdev before teardown completes
Jakub Kicinski <[email protected]>
nfc: nci: fix circular locking dependency in nci_close_device
Mohammad Heib <[email protected]>
ionic: fix persistent MAC address override on PF
Luca Leonardo Scorcia <[email protected]>
pinctrl: mediatek: common: Fix probe failure for devices without EINT
Helen Koike <[email protected]>
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
Anas Iqbal <[email protected]>
Bluetooth: hci_ll: Fix firmware leak on error path
Hyunwoo Kim <[email protected]>
Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
Hyunwoo Kim <[email protected]>
Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
Oliver Hartkopp <[email protected]>
can: statistics: add missing atomic access in hot path
Shigeru Yoshida <[email protected]>
dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
Eric Dumazet <[email protected]>
af_key: validate families in pfkey_send_migrate()
Sabrina Dubroca <[email protected]>
esp: fix skb leak with espintcp and async crypto
Steffen Klassert <[email protected]>
xfrm: Fix the usage of skb->sk
Sabrina Dubroca <[email protected]>
xfrm: call xdo_dev_state_delete during state update
Alan Borzeszkowski <[email protected]>
spi: intel-pci: Add support for Nova Lake mobile SPI flash
Jie Deng <[email protected]>
usb: core: new quirk to handle devices with zero configurations
Josh Poimboeuf <[email protected]>
objtool: Handle Clang RSP musical chairs
Uzair Mughal <[email protected]>
ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
Liucheng Lu <[email protected]>
ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
Boris Burkov <[email protected]>
btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
Günther Noack <[email protected]>
HID: apple: avoid memory leak in apple_report_fixup()
Isaac J. Manjarres <[email protected]>
dma-buf: Include ioctl.h in UAPI header
Mark Brown <[email protected]>
ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits()
Mark Brown <[email protected]>
ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg()
Ihor Solodrai <[email protected]>
module: Fix kernel panic when a symbol st_shndx is out of bounds
Denis Benato <[email protected]>
HID: asus: add xg mobile 2023 external hardware support
Romain Sioen <[email protected]>
HID: mcp2221: cancel last I2C command on read error
Valentin Spreckels <[email protected]>
net: usb: r8152: add TRENDnet TUC-ET2G
Günther Noack <[email protected]>
HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
Julius Lehmann <[email protected]>
HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
Keith Busch <[email protected]>
nvme-pci: ensure we're polling a polled queue
Hans de Goede <[email protected]>
platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10
Leif Skunberg <[email protected]>
platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1
Daniel Hodges <[email protected]>
nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
Keith Busch <[email protected]>
nvme-pci: cap queue creation to used queues
Peter Metz <[email protected]>
platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list
Günther Noack <[email protected]>
HID: asus: avoid memory leak in asus_report_fixup()
Jenny Guanni Qu <[email protected]>
bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
Kumar Kartikeya Dwivedi <[email protected]>
bpf: Release module BTF IDR before module unload
Danilo Krummrich <[email protected]>
sh: platform_early: remove pdev->driver_override check
Danilo Krummrich <[email protected]>
hwmon: axi-fan: don't use driver_override as IRQ name
Nuno Sa <[email protected]>
hwmon: (axi-fan-control) Make use of dev_err_probe()
Nuno Sa <[email protected]>
hwmon: (axi-fan-control) Use device firmware agnostic API
Smita Koralahalli <[email protected]>
cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled
Peter Zijlstra <[email protected]>
perf: Make sure to use pmu_ctx->pmu for groups
Peter Zijlstra <[email protected]>
perf: Extract a few helpers
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 3 + Documentation/hwmon/adm1177.rst | 8 +- Documentation/hwmon/peci-cputemp.rst | 10 +- Makefile | 4 +- .../boot/dts/freescale/imx8mn-tqma8mqnl-mba8mx.dts | 13 +- .../arm64/boot/dts/freescale/imx8mn-tqma8mqnl.dtsi | 22 +++ arch/arm64/kvm/reset.c | 14 ++ arch/loongarch/pci/pci.c | 80 +++++++++++ arch/powerpc/net/bpf_jit_comp64.c | 23 +-- arch/s390/include/asm/barrier.h | 4 +- arch/s390/kernel/entry.S | 4 + arch/s390/kernel/syscall.c | 2 + arch/sh/drivers/platform_early.c | 4 - arch/x86/kvm/mmu/mmu.c | 14 +- arch/x86/platform/efi/quirks.c | 2 +- drivers/acpi/ec.c | 2 + drivers/base/regmap/regmap.c | 30 +++- drivers/bluetooth/btintel.c | 11 +- drivers/bluetooth/btusb.c | 5 +- drivers/bluetooth/hci_ll.c | 2 + drivers/cpufreq/cpufreq_conservative.c | 12 ++ drivers/cpufreq/cpufreq_governor.c | 3 + drivers/cpufreq/cpufreq_governor.h | 1 + drivers/cxl/core/hdm.c | 25 ++-- drivers/dma/dw-edma/dw-hdma-v0-core.c | 6 +- drivers/dma/idxd/cdev.c | 10 +- drivers/dma/idxd/device.c | 3 +- drivers/dma/idxd/sysfs.c | 1 + drivers/dma/sh/rz-dmac.c | 68 +++++---- drivers/dma/xilinx/xdma.c | 4 +- drivers/dma/xilinx/xilinx_dma.c | 46 +++--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 4 +- drivers/gpu/drm/i915/display/intel_gmbus.c | 4 +- drivers/hid/hid-apple.c | 4 +- drivers/hid/hid-asus.c | 18 ++- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-magicmouse.c | 6 +- drivers/hid/hid-mcp2221.c | 2 + drivers/hwmon/adm1177.c | 54 ++++--- drivers/hwmon/axi-fan-control.c | 73 +++++----- drivers/hwmon/peci/cputemp.c | 4 +- drivers/hwmon/pmbus/isl68137.c | 21 ++- drivers/infiniband/core/rw.c | 27 +++- drivers/infiniband/hw/irdma/cm.c | 29 ++-- drivers/infiniband/hw/irdma/utils.c | 2 - drivers/infiniband/hw/irdma/verbs.c | 9 +- drivers/irqchip/irq-qcom-mpm.c | 3 + drivers/media/mc/mc-request.c | 5 + drivers/media/v4l2-core/v4l2-ioctl.c | 5 +- drivers/mtd/spi-nor/core.c | 145 ++++++++++++++++++- drivers/net/ethernet/cadence/macb_main.c | 4 +- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 2 + drivers/net/ethernet/intel/ice/ice_ethtool.c | 14 +- drivers/net/ethernet/intel/ice/ice_repr.c | 3 +- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 ++- drivers/net/usb/r8152.c | 1 + drivers/net/virtio_net.c | 1 + drivers/nvme/host/core.c | 7 + drivers/nvme/host/fabrics.c | 4 +- drivers/nvme/host/pci.c | 11 +- drivers/phy/ti/phy-j721e-wiz.c | 2 + drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 9 +- drivers/platform/olpc/olpc-xo175-ec.c | 2 +- drivers/platform/x86/intel/hid.c | 13 ++ .../x86/intel/speed_select_if/isst_tpmi_core.c | 2 +- drivers/platform/x86/touchscreen_dmi.c | 18 +++ drivers/scsi/ibmvscsi/ibmvfc.c | 3 +- drivers/scsi/scsi_transport_sas.c | 2 +- drivers/scsi/ses.c | 2 +- drivers/spi/spi-fsl-lpspi.c | 3 +- drivers/spi/spi-intel-pci.c | 1 + drivers/spi/spi-sn-f-ospi.c | 17 +-- drivers/usb/core/config.c | 6 +- drivers/usb/core/quirks.c | 5 + fs/btrfs/block-group.c | 2 +- fs/btrfs/disk-io.c | 4 +- fs/btrfs/ioctl.c | 7 + fs/btrfs/volumes.c | 5 +- fs/erofs/zdata.c | 4 + fs/ext4/crypto.c | 9 +- fs/ext4/ext4.h | 1 + fs/ext4/extents.c | 8 +- fs/ext4/fast_commit.c | 13 +- fs/ext4/fsync.c | 16 ++- fs/ext4/ialloc.c | 6 + fs/ext4/inline.c | 10 +- fs/ext4/inode.c | 12 ++ fs/ext4/mballoc.c | 28 ++-- fs/ext4/page-io.c | 10 +- fs/ext4/super.c | 16 ++- fs/ext4/sysfs.c | 10 +- fs/gfs2/lock_dlm.c | 10 +- fs/jbd2/checkpoint.c | 15 +- fs/smb/server/oplock.c | 72 ++++++---- fs/smb/server/smb2pdu.c | 73 +++++++--- fs/xattr.c | 27 +--- fs/xfs/xfs_attr_item.c | 4 +- fs/xfs/xfs_dquot_item.c | 9 +- fs/xfs/xfs_inode_item.c | 9 +- fs/xfs/xfs_mount.c | 7 +- fs/xfs/xfs_trace.c | 1 + fs/xfs/xfs_trace.h | 36 ++++- fs/xfs/xfs_trans_ail.c | 26 +++- include/linux/dma-mapping.h | 4 +- include/linux/usb/quirks.h | 3 + include/linux/usb/r8152.h | 1 + include/net/bluetooth/hci_sync.h | 17 +++ include/net/inet_hashtables.h | 14 ++ include/net/ip6_fib.h | 21 ++- include/uapi/linux/dma-buf.h | 1 + include/uapi/linux/netfilter/nf_conntrack_common.h | 4 + kernel/bpf/btf.c | 24 +++- kernel/bpf/core.c | 22 +-- kernel/dma/swiotlb.c | 21 ++- kernel/events/core.c | 58 ++++---- kernel/futex/pi.c | 3 +- kernel/module/main.c | 7 + kernel/power/power.h | 2 +- kernel/power/snapshot.c | 36 +++-- kernel/power/swap.c | 8 +- kernel/power/user.c | 4 +- kernel/sysctl.c | 2 +- kernel/time/alarmtimer.c | 2 +- kernel/trace/trace_osnoise.c | 48 +++---- mm/damon/sysfs.c | 3 + net/bluetooth/hci_request.h | 21 --- net/bluetooth/hci_sync.c | 14 +- net/bluetooth/l2cap_core.c | 28 +++- net/bluetooth/l2cap_sock.c | 3 + net/bluetooth/sco.c | 10 +- net/can/af_can.c | 4 +- net/can/af_can.h | 2 +- net/can/gw.c | 6 +- net/can/isotp.c | 24 +++- net/can/proc.c | 3 +- net/core/rtnetlink.c | 9 +- net/ipv4/esp4.c | 11 +- net/ipv4/inet_connection_sock.c | 72 +++++----- net/ipv4/inet_hashtables.c | 3 +- net/ipv4/udp.c | 2 +- net/ipv6/addrconf.c | 4 +- net/ipv6/esp6.c | 11 +- net/ipv6/ip6_fib.c | 15 +- net/ipv6/netfilter/ip6t_rt.c | 4 + net/ipv6/route.c | 2 +- net/ipv6/xfrm6_output.c | 4 +- net/key/af_key.c | 19 ++- net/netfilter/nf_conntrack_expect.c | 4 + net/netfilter/nf_conntrack_netlink.c | 16 +-- net/netfilter/nf_conntrack_proto_tcp.c | 10 +- net/netfilter/nf_conntrack_sip.c | 14 +- net/netfilter/nfnetlink_log.c | 8 +- net/nfc/nci/core.c | 10 +- net/openvswitch/flow_netlink.c | 2 + net/openvswitch/vport-netdev.c | 11 +- net/packet/af_packet.c | 1 + net/smc/smc_rx.c | 9 +- net/tls/tls_sw.c | 2 +- net/xfrm/xfrm_interface_core.c | 2 +- net/xfrm/xfrm_output.c | 7 +- net/xfrm/xfrm_policy.c | 2 +- net/xfrm/xfrm_state.c | 1 + rust/kernel/init/macros.rs | 160 +++++++++++++++++---- sound/firewire/amdtp-stream.c | 2 +- sound/pci/hda/patch_realtek.c | 2 + sound/soc/codecs/adau1372.c | 34 +++-- sound/soc/fsl/fsl_easrc.c | 14 +- sound/soc/intel/catpt/device.c | 10 +- sound/soc/intel/catpt/dsp.c | 3 - sound/soc/sof/ipc4-topology.c | 2 +- tools/lib/bpf/libbpf.c | 2 +- tools/objtool/arch/x86/decode.c | 68 ++++----- tools/objtool/check.c | 14 ++ 173 files changed, 1689 insertions(+), 748 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/175 perf: Extract a few helpers
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 9a32bd9901fe5b1dcf544389dbf04f3b0a2fbab4 ]
The context time update code is repeated verbatim a few times.
Stable-dep-of: 4b9ce6719606 ("perf: Make sure to use pmu_ctx->pmu for groups")
--- kernel/events/core.c | 39 ++++++++++++++++++++++----------------- 1 file changed, 22 insertions(+), 17 deletions(-)
kernel/events/core.c +22 -17
@@ -2349,6 +2349,24 @@ group_sched_out(struct perf_event *group_event, struct perf_event_context *ctx)event_sched_out (event, ctx); } +static inline void +ctx_time_update (struct perf_cpu_context *cpuctx,struct perf_event_context *ctx) +{ +if (ctx->is_active &EVENT_TIME ) { +update_context_time (ctx); +update_cgrp_time_from_cpuctx (cpuctx, false); + } +} + +static inline void +ctx_time_update_event (struct perf_event_context *ctx,struct perf_event *event) +{ +if (ctx->is_active &EVENT_TIME ) { +update_context_time (ctx); +update_cgrp_time_from_event (event); + } +} +#define DETACH_GROUP 0x01UL#define DETACH_CHILD 0x02UL#define DETACH_DEAD 0x04UL
@@ -2370,10 +2388,7 @@ __perf_remove_from_context(struct perf_event *event,enum perf_event_state state =PERF_EVENT_STATE_OFF ;unsigned long flags = (unsigned long )info; -if (ctx->is_active &EVENT_TIME ) { -update_context_time (ctx); -update_cgrp_time_from_cpuctx (cpuctx, false); - } +ctx_time_update (cpuctx, ctx);/* * Ensure event_sched_out() switches to OFF, at the very least
@@ -2470,12 +2485,8 @@ static void __perf_event_disable(struct perf_event *event,if (event->state <PERF_EVENT_STATE_INACTIVE )return ; -if (ctx->is_active &EVENT_TIME ) { -update_context_time (ctx); -update_cgrp_time_from_event (event); - } -perf_pmu_disable (event->pmu_ctx->pmu); +ctx_time_update_event (ctx, event);/* * When disabling a group leader, the whole group becomes ineligible
@@ -4534,10 +4545,7 @@ static void __perf_event_read(void *info)return ;raw_spin_lock (&ctx->lock); -if (ctx->is_active &EVENT_TIME ) { -update_context_time (ctx); -update_cgrp_time_from_event (event); - } +ctx_time_update_event (ctx, event);perf_event_update_time (event);if (data->group)
@@ -4718,10 +4726,7 @@ static int perf_event_read(struct perf_event *event, bool group)* May read while context is not active (e.g., thread is * blocked), in that case we cannot update context time */ -if (ctx->is_active &EVENT_TIME ) { -update_context_time (ctx); -update_cgrp_time_from_event (event); - } +ctx_time_update_event (ctx, event);perf_event_update_time (event);if (group)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 2/175 perf: Make sure to use pmu_ctx->pmu for groups
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 4b9ce671960627b2505b3f64742544ae9801df97 ]
Oliver reported that x86_pmu_del() ended up doing an out-of-bound memory access when group_sched_in() fails and needs to roll back.
This *should* be handled by the transaction callbacks, but he found that when the group leader is a software event, the transaction handlers of the wrong PMU are used. Despite the move_group case in perf_event_open() and group_sched_in() using pmu_ctx->pmu.
Turns out, inherit uses event->pmu to clone the events, effectively undoing the move_group case for all inherited contexts. Fix this by also making inherit use pmu_ctx->pmu, ensuring all inherited counters end up in the same pmu context.
Similarly, __perf_event_read() should use equally use pmu_ctx->pmu for the group case.
--- kernel/events/core.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-)
kernel/events/core.c +8 -11
@@ -4532,7 +4532,7 @@ static void __perf_event_read(void *info)struct perf_event *sub, *event = data->event;struct perf_event_context *ctx = event->ctx;struct perf_cpu_context *cpuctx =this_cpu_ptr (&perf_cpu_context); -struct pmu *pmu = event->pmu; +struct pmu *pmu;/* * If this is a task context, we need to check whether it is
@@ -4544,7 +4544,7 @@ static void __perf_event_read(void *info)if (ctx->task && cpuctx->task_ctx != ctx)return ; -raw_spin_lock (&ctx->lock); +guard (raw_spinlock)(&ctx->lock);ctx_time_update_event (ctx, event);perf_event_update_time (event);
@@ -4552,25 +4552,22 @@ static void __perf_event_read(void *info)perf_event_update_sibling_time (event);if (event->state !=PERF_EVENT_STATE_ACTIVE ) - goto unlock; +return ;if (!data->group) { - pmu->read (event); +perf_pmu_read (event); data->ret =0 ; - goto unlock; +return ; } + pmu = event->pmu_ctx->pmu; pmu->start_txn (pmu,PERF_PMU_TXN_READ ); - pmu->read (event); - +perf_pmu_read (event);for_each_sibling_event (sub, event)perf_pmu_read (sub); data->ret = pmu->commit_txn (pmu); - -unlock: -raw_spin_unlock (&ctx->lock); }static inline u64 perf_event_count (struct perf_event *event)
@@ -13541,7 +13538,7 @@ inherit_event(struct perf_event *parent_event,get_ctx (child_ctx); child_event->ctx = child_ctx; - pmu_ctx =find_get_pmu_context (child_event->pmu, child_ctx, child_event); + pmu_ctx =find_get_pmu_context (parent_event->pmu_ctx->pmu, child_ctx, child_event);if (IS_ERR (pmu_ctx)) {free_event (child_event);return ERR_CAST (pmu_ctx);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/175 cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Smita Koralahalli <[email protected]>
[ Upstream commit 75cea0776de502f2a1be5ca02d37c586dc81887e ]
Check the global CXL_HDM_DECODER_ENABLE bit instead of looping over per-decoder COMMITTED bits to determine whether to fall back to DVSEC range emulation. When the HDM decoder capability is globally enabled, ignore DVSEC range registers regardless of individual decoder commit state.
should_emulate_decoders() currently loops over per-decoder COMMITTED bits, which leads to an incorrect DVSEC fallback when those bits are zero. One way to trigger this is to destroy a region and bounce the memdev:
cxl disable-region region0
cxl destroy-region region0
cxl disable-memdev mem0
cxl enable-memdev mem0
Region teardown zeroes the HDM decoder registers including the committed bits. The subsequent memdev re-probe finds uncommitted decoders and falls back to DVSEC emulation, even though HDM remains globally enabled.
Observed failures:
should_emulate_decoders: cxl_port endpoint6: decoder6.0: committed: 0 base: 0x0_00000000 size: 0x0_00000000
devm_cxl_setup_hdm: cxl_port endpoint6: Fallback map 1 range register
..
devm_cxl_add_region: cxl_acpi ACPI0017:00: decoder0.0: created region0 __construct_region: cxl_pci 0000:e1:00.0: mem1:decoder6.0:
__construct_region region0 res: [mem 0x850000000-0x284fffffff flags 0x200] iw: 1 ig: 4096 cxl region0: pci0000:e0:port1 cxl_port_setup_targets expected iw: 1 ig: 4096 ..
cxl region0: pci0000:e0:port1 cxl_port_setup_targets got iw: 1 ig: 256 state: disabled .. cxl_port endpoint6: failed to attach decoder6.0 to region0: -6
..
devm_cxl_add_region: cxl_acpi ACPI0017:00: decoder0.0: created region4
alloc_hpa: cxl region4: HPA allocation error (-34) ..
--- drivers/cxl/core/hdm.c | 25 +++++++++---------------- 1 file changed, 9 insertions(+), 16 deletions(-)
drivers/cxl/core/hdm.c +9 -16
@@ -119,7 +119,6 @@ static bool should_emulate_decoders(struct cxl_endpoint_dvsec_info *info)struct cxl_hdm *cxlhdm;void __iomem *hdm;u32 ctrl; -int i;if (!info)return false;
@@ -138,22 +137,16 @@ static bool should_emulate_decoders(struct cxl_endpoint_dvsec_info *info)return false;/* -* If any decoders are committed already, there should not be any -* emulated DVSEC decoders. +* If HDM decoders are globally enabled, do not fall back to DVSEC +* range emulation. Zeroed decoder registers after region teardown +* do not imply absence of HDM capability. +* +* Falling back to DVSEC here would treat the decoder as AUTO and +* may incorrectly latch default interleave settings. */ -for (i =0 ; i < cxlhdm->decoder_count; i++) { - ctrl =readl (hdm +CXL_HDM_DECODER0_CTRL_OFFSET (i)); -dev_dbg (&info->port->dev, -"decoder%d.%d: committed: %ld base: %#x_%.8x size: %#x_%.8x\n" , - info->port->id, i, -FIELD_GET (CXL_HDM_DECODER0_CTRL_COMMITTED , ctrl), -readl (hdm +CXL_HDM_DECODER0_BASE_HIGH_OFFSET (i)), -readl (hdm +CXL_HDM_DECODER0_BASE_LOW_OFFSET (i)), -readl (hdm +CXL_HDM_DECODER0_SIZE_HIGH_OFFSET (i)), -readl (hdm +CXL_HDM_DECODER0_SIZE_LOW_OFFSET (i))); -if (FIELD_GET (CXL_HDM_DECODER0_CTRL_COMMITTED , ctrl)) -return false; - } + ctrl =readl (hdm +CXL_HDM_DECODER_CTRL_OFFSET ); +if (ctrl &CXL_HDM_DECODER_ENABLE ) +return false;return true; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/175 hwmon: (axi-fan-control) Use device firmware agnostic API
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sa <[email protected]>
[ Upstream commit 1b5239f70fcd2d7fe86f0f5473006c2896db07a8 ]
Don't directly use OF and use device property APIs. In addition, this makes the probe() code neater and also allow us to move the of_device_id table to it's natural place.
While at it, make sure to explicitly include mod_devicetable.h for the of_device_id table.
Stable-dep-of: 813bbc4d33d2 ("hwmon: axi-fan: don't use driver_override as IRQ name")
--- drivers/hwmon/axi-fan-control.c | 39 +++++++++++++++++---------------- 1 file changed, 20 insertions(+), 19 deletions(-)
drivers/hwmon/axi-fan-control.c +20 -19
@@ -13,8 +13,9 @@#include <linux/io.h> #include <linux/kernel.h> #include <linux/module.h> -#include <linux/of.h> +#include <linux/mod_devicetable.h> #include <linux/platform_device.h> +#include <linux/property.h> /* register map */ #define ADI_REG_RSTN 0x0080
@@ -368,12 +369,12 @@ static irqreturn_t axi_fan_control_irq_handler(int irq, void *data) }static int axi_fan_control_init (struct axi_fan_control_data *ctl, -const struct device_node *np) +const struct device *dev) {int ret;/* get fan pulses per revolution */ - ret =of_property_read_u32 (np,"pulses-per-revolution" , &ctl->ppr); + ret =device_property_read_u32 (dev,"pulses-per-revolution" , &ctl->ppr);if (ret)return ret;
@@ -443,25 +444,16 @@ static struct attribute *axi_fan_control_attrs[] = { };ATTRIBUTE_GROUPS (axi_fan_control); -static const u32 version_1_0_0 =ADI_AXI_PCORE_VER (1 ,0 ,'a' ); - -static const struct of_device_id axi_fan_control_of_match[] = { - { .compatible ="adi,axi-fan-control-1.00.a" , - .data = (void *)&version_1_0_0}, - {}, -}; -MODULE_DEVICE_TABLE (of, axi_fan_control_of_match); -static int axi_fan_control_probe (struct platform_device *pdev) {struct axi_fan_control_data *ctl;struct clk *clk; -const struct of_device_id *id; +const unsigned int *id;const char *name ="axi_fan_control" ;u32 version;int ret; - id =of_match_node (axi_fan_control_of_match, pdev->dev.of_node); + id =device_get_match_data (&pdev->dev);if (!id)return -EINVAL ;
@@ -485,18 +477,18 @@ static int axi_fan_control_probe(struct platform_device *pdev) version =axi_ioread (ADI_AXI_REG_VERSION , ctl);if (ADI_AXI_PCORE_VER_MAJOR (version) != -ADI_AXI_PCORE_VER_MAJOR ((*(u32 *)id->data))) { +ADI_AXI_PCORE_VER_MAJOR ((*id))) {dev_err (&pdev->dev,"Major version mismatch. Expected %d.%.2d.%c, Reported %d.%.2d.%c\n" , -ADI_AXI_PCORE_VER_MAJOR ((*(u32 *)id->data)), -ADI_AXI_PCORE_VER_MINOR ((*(u32 *)id->data)), -ADI_AXI_PCORE_VER_PATCH ((*(u32 *)id->data)), +ADI_AXI_PCORE_VER_MAJOR (*id), +ADI_AXI_PCORE_VER_MINOR (*id), +ADI_AXI_PCORE_VER_PATCH (*id),ADI_AXI_PCORE_VER_MAJOR (version),ADI_AXI_PCORE_VER_MINOR (version),ADI_AXI_PCORE_VER_PATCH (version));return -ENODEV ; } - ret =axi_fan_control_init (ctl, pdev->dev.of_node); + ret =axi_fan_control_init (ctl, &pdev->dev);if (ret) {dev_err (&pdev->dev,"Failed to initialize device\n" );return ret;
@@ -527,6 +519,15 @@ static int axi_fan_control_probe(struct platform_device *pdev)return 0 ; } +static const u32 version_1_0_0 =ADI_AXI_PCORE_VER (1 ,0 ,'a' ); + +static const struct of_device_id axi_fan_control_of_match[] = { + { .compatible ="adi,axi-fan-control-1.00.a" , + .data = (void *)&version_1_0_0}, + {}, +}; +MODULE_DEVICE_TABLE (of, axi_fan_control_of_match); +static struct platform_driver axi_fan_control_driver = { .driver = { .name ="axi_fan_control_driver" ,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/175 hwmon: (axi-fan-control) Make use of dev_err_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sa <[email protected]>
[ Upstream commit ec823656c1e0e5f49e92ed86cee9fb26585da18e ]
Use dev_err_probe() to slightly simplify printing errors during probe. No functional changes intended.
Stable-dep-of: 813bbc4d33d2 ("hwmon: axi-fan: don't use driver_override as IRQ name")
--- drivers/hwmon/axi-fan-control.c | 40 +++++++++++++++------------------ 1 file changed, 18 insertions(+), 22 deletions(-)
drivers/hwmon/axi-fan-control.c +18 -22
@@ -466,10 +466,9 @@ static int axi_fan_control_probe(struct platform_device *pdev)return PTR_ERR (ctl->base); clk =devm_clk_get_enabled (&pdev->dev,NULL ); -if (IS_ERR (clk)) { -dev_err (&pdev->dev,"clk_get failed with %ld\n" ,PTR_ERR (clk)); -return PTR_ERR (clk); - } +if (IS_ERR (clk)) +return dev_err_probe (&pdev->dev,PTR_ERR (clk), +"clk_get failed\n" ); ctl->clk_rate =clk_get_rate (clk);if (!ctl->clk_rate)
@@ -477,22 +476,20 @@ static int axi_fan_control_probe(struct platform_device *pdev) version =axi_ioread (ADI_AXI_REG_VERSION , ctl);if (ADI_AXI_PCORE_VER_MAJOR (version) != -ADI_AXI_PCORE_VER_MAJOR ((*id))) { -dev_err (&pdev->dev,"Major version mismatch. Expected %d.%.2d.%c, Reported %d.%.2d.%c\n" , -ADI_AXI_PCORE_VER_MAJOR (*id), -ADI_AXI_PCORE_VER_MINOR (*id), -ADI_AXI_PCORE_VER_PATCH (*id), -ADI_AXI_PCORE_VER_MAJOR (version), -ADI_AXI_PCORE_VER_MINOR (version), -ADI_AXI_PCORE_VER_PATCH (version)); -return -ENODEV ; - } +ADI_AXI_PCORE_VER_MAJOR ((*id))) +return dev_err_probe (&pdev->dev, -ENODEV , +"Major version mismatch. Expected %d.%.2d.%c, Reported %d.%.2d.%c\n" , +ADI_AXI_PCORE_VER_MAJOR (*id), +ADI_AXI_PCORE_VER_MINOR (*id), +ADI_AXI_PCORE_VER_PATCH (*id), +ADI_AXI_PCORE_VER_MAJOR (version), +ADI_AXI_PCORE_VER_MINOR (version), +ADI_AXI_PCORE_VER_PATCH (version)); ret =axi_fan_control_init (ctl, &pdev->dev); -if (ret) { -dev_err (&pdev->dev,"Failed to initialize device\n" ); -return ret; - } +if (ret) +return dev_err_probe (&pdev->dev, ret, +"Failed to initialize device\n" ); ctl->hdev = devm_hwmon_device_register_with_info(&pdev->dev, name,
@@ -511,10 +508,9 @@ static int axi_fan_control_probe(struct platform_device *pdev) axi_fan_control_irq_handler,IRQF_ONESHOT |IRQF_TRIGGER_HIGH , pdev->driver_override, ctl); -if (ret) { -dev_err (&pdev->dev,"failed to request an irq, %d" , ret); -return ret; - } +if (ret) +return dev_err_probe (&pdev->dev, ret, +"failed to request an irq\n" );return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/175 hwmon: axi-fan: dont use driver_override as IRQ name
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <[email protected]>
[ Upstream commit 813bbc4d33d2ca5b0da63e70ae13b60874f20d37 ]
Do not use driver_override as IRQ name, as it is not guaranteed to point to a valid string; use NULL instead (which makes the devm IRQ helpers use dev_name()).
--- drivers/hwmon/axi-fan-control.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/axi-fan-control.c +1 -1
@@ -507,7 +507,7 @@ static int axi_fan_control_probe(struct platform_device *pdev) ret =devm_request_threaded_irq (&pdev->dev, ctl->irq,NULL , axi_fan_control_irq_handler,IRQF_ONESHOT |IRQF_TRIGGER_HIGH , - pdev->driver_override, ctl); +NULL , ctl);if (ret)return dev_err_probe (&pdev->dev, ret,"failed to request an irq\n" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/175 sh: platform_early: remove pdev->driver_override check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <[email protected]>
[ Upstream commit c5f60e3f07b6609562d21efda878e83ce8860728 ]
In commit 507fd01d5333 ("drivers: move the early platform device support to arch/sh") platform_match() was copied over to the sh platform_early code, accidentally including the driver_override check.
This check does not make sense for platform_early, as sysfs is not even available in first place at this point in the boot process, hence remove the check.
--- arch/sh/drivers/platform_early.c | 4 ---- 1 file changed, 4 deletions(-)
arch/sh/drivers/platform_early.c +0 -4
@@ -26,10 +26,6 @@ static int platform_match(struct device *dev, struct device_driver *drv)struct platform_device *pdev =to_platform_device (dev);struct platform_driver *pdrv =to_platform_driver (drv); -/* When driver_override is set, only bind to the matching driver */ -if (pdev->driver_override) -return !strcmp (pdev->driver_override, drv->name); -/* Then try to match against the id table */ if (pdrv->id_table)return platform_match_id (pdrv->id_table, pdev) !=NULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/175 bpf: Release module BTF IDR before module unload
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <[email protected]>
[ Upstream commit 146bd2a87a65aa407bb17fac70d8d583d19aba06 ]
Gregory reported in [0] that the global_map_resize test when run in repeatedly ends up failing during program load. This stems from the fact that BTF reference has not dropped to zero after the previous run's module is unloaded, and the older module's BTF is still discoverable and visible. Later, in libbpf, load_module_btfs() will find the ID for this stale BTF, open its fd, and then it will be used during program load where later steps taking module reference using btf_try_get_module() fail since the underlying module for the BTF is gone.
Logically, once a module is unloaded, it's associated BTF artifacts should become hidden. The BTF object inside the kernel may still remain alive as long its reference counts are alive, but it should no longer be discoverable.
To fix this, let us call btf_free_id() from the MODULE_STATE_GOING case for the module unload to free the BTF associated IDR entry, and disable its discovery once module unload returns to user space. If a race happens during unload, the outcome is non-deterministic anyway. However, user space should be able to rely on the guarantee that once it has synchronously established a successful module unload, no more stale artifacts associated with this module can be obtained subsequently.
Note that we must be careful to not invoke btf_free_id() in btf_put() when btf_is_module() is true now. There could be a window where the module unload drops a non-terminal reference, frees the IDR, but the same ID gets reused and the second unconditional btf_free_id() ends up releasing an unrelated entry.
To avoid a special case for btf_is_module() case, set btf->id to zero to make btf_free_id() idempotent, such that we can unconditionally invoke it from btf_put(), and also from the MODULE_STATE_GOING case. Since zero is an invalid IDR, the idr_remove() should be a noop.
Note that we can be sure that by the time we reach final btf_put() for btf_is_module() case, the btf_free_id() is already done, since the module itself holds the BTF reference, and it will call this function for the BTF before dropping its own reference.
[0]: https://lore.kernel.org/bpf/[email protected]
--- kernel/bpf/btf.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-)
kernel/bpf/btf.c +20 -4
@@ -1636,7 +1636,16 @@ static void btf_free_id(struct btf *btf)* of the _bh() version. */ spin_lock_irqsave (&btf_idr_lock, flags); -idr_remove (&btf_idr, btf->id); +if (btf->id) { +idr_remove (&btf_idr, btf->id); +/* +* Clear the id here to make this function idempotent, since it will get +* called a couple of times for module BTFs: on module unload, and then +* the final btf_put(). btf_alloc_id() starts IDs with 1, so we can use +* 0 as sentinel value. +*/ +WRITE_ONCE (btf->id,0 ); + }spin_unlock_irqrestore (&btf_idr_lock, flags); }
@@ -7158,7 +7167,7 @@ static void bpf_btf_show_fdinfo(struct seq_file *m, struct file *filp) {const struct btf *btf = filp->private_data; -seq_printf (m,"btf_id:\t%u\n" , btf->id); +seq_printf (m,"btf_id:\t%u\n" ,READ_ONCE (btf->id)); }#endif
@@ -7250,7 +7259,7 @@ int btf_get_info_by_fd(const struct btf *btf,if (copy_from_user (&info, uinfo, info_copy))return -EFAULT ; - info.id = btf->id; + info.id =READ_ONCE (btf->id); ubtf =u64_to_user_ptr (info.btf); btf_copy =min_t (u32, btf->data_size, info.btf_size);if (copy_to_user (ubtf, btf->data, btf_copy))
@@ -7313,7 +7322,7 @@ int btf_get_fd_by_id(u32 id)u32 btf_obj_id (const struct btf *btf) { -return btf->id; +return READ_ONCE (btf->id); }bool btf_is_kernel (const struct btf *btf)
@@ -7445,6 +7454,13 @@ static int btf_module_notify(struct notifier_block *nb, unsigned long op,if (btf_mod->module != module)continue ; +/* +* For modules, we do the freeing of BTF IDR as soon as +* module goes away to disable BTF discovery, since the +* btf_try_get_module() on such BTFs will fail. This may +* be called again on btf_put(), but it's ok to do so. +*/ +btf_free_id (btf_mod->btf);list_del (&btf_mod->list);if (btf_mod->sysfs_attr)sysfs_remove_bin_file (btf_kobj, btf_mod->sysfs_attr);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/175 bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jenny Guanni Qu <[email protected]>
[ Upstream commit c77b30bd1dcb61f66c640ff7d2757816210c7cb0 ]
The BPF interpreter's signed 32-bit division and modulo handlers use the kernel abs() macro on s32 operands. The abs() macro documentation (include/linux/math.h) explicitly states the result is undefined when the input is the type minimum. When DST contains S32_MIN (0x80000000), abs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged on arm64/x86. This value is then sign-extended to u64 as 0xFFFFFFFF80000000, causing do_div() to compute the wrong result.
The verifier's abstract interpretation (scalar32_min_max_sdiv) computes the mathematically correct result for range tracking, creating a verifier/interpreter mismatch that can be exploited for out-of-bounds map value access.
Introduce abs_s32() which handles S32_MIN correctly by casting to u32 before negating, avoiding signed overflow entirely. Replace all 8 abs((s32)...) call sites in the interpreter's sdiv32/smod32 handlers.
s32 is the only affected case -- the s64 division/modulo handlers do not use abs().
--- kernel/bpf/core.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-)
kernel/bpf/core.c +14 -8
@@ -1667,6 +1667,12 @@ bool bpf_opcode_in_insntable(u8 code) }#ifndef CONFIG_BPF_JIT_ALWAYS_ON +/* Absolute value of s32 without undefined behavior for S32_MIN */ +static u32 abs_s32 (s32 x) +{ +return x >=0 ? (u32 )x : -(u32 )x; +} +/** * ___bpf_prog_run - run eBPF program on a given context * @regs: is the array of MAX_BPF_EXT_REG eBPF pseudo-registers
@@ -1831,8 +1837,8 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn)DST =do_div (AX , (u32 )SRC );break ;case 1 : -AX =abs ((s32 )DST ); -AX =do_div (AX ,abs ((s32 )SRC )); +AX =abs_s32 ((s32 )DST ); +AX =do_div (AX ,abs_s32 ((s32 )SRC ));if ((s32 )DST <0 )DST = (u32)-AX ;else
@@ -1859,8 +1865,8 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn)DST =do_div (AX , (u32 )IMM );break ;case 1 : -AX =abs ((s32 )DST ); -AX =do_div (AX ,abs ((s32 )IMM )); +AX =abs_s32 ((s32 )DST ); +AX =do_div (AX ,abs_s32 ((s32 )IMM ));if ((s32 )DST <0 )DST = (u32)-AX ;else
@@ -1886,8 +1892,8 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn)DST = (u32 )AX ;break ;case 1 : -AX =abs ((s32 )DST ); -do_div (AX ,abs ((s32 )SRC )); +AX =abs_s32 ((s32 )DST ); +do_div (AX ,abs_s32 ((s32 )SRC ));if (((s32 )DST <0 ) == ((s32 )SRC <0 ))DST = (u32 )AX ;else
@@ -1913,8 +1919,8 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn)DST = (u32 )AX ;break ;case 1 : -AX =abs ((s32 )DST ); -do_div (AX ,abs ((s32 )IMM )); +AX =abs_s32 ((s32 )DST ); +do_div (AX ,abs_s32 ((s32 )IMM ));if (((s32 )DST <0 ) == ((s32 )IMM <0 ))DST = (u32 )AX ;else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/175 HID: asus: avoid memory leak in asus_report_fixup()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Günther Noack <[email protected]>
[ Upstream commit 2bad24c17742fc88973d6aea526ce1353f5334a3 ]
The asus_report_fixup() function was returning a newly allocated kmemdup()-allocated buffer, but never freeing it. Switch to devm_kzalloc() to ensure the memory is managed and freed automatically when the device is removed.
The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a pointer whose lifetime is at least that of the input buffer.
Also fix a harmless out-of-bounds read by copying only the original descriptor size.
--- drivers/hid/hid-asus.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/hid/hid-asus.c +11 -4
@@ -1200,14 +1200,21 @@ static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc,*/ if (*rsize == rsize_orig && rdesc[offs] ==0x09 && rdesc[offs +1 ] ==0x76 ) { - *rsize = rsize_orig +1 ; - rdesc =kmemdup (rdesc, *rsize,GFP_KERNEL ); -if (!rdesc) -return NULL ; +__u8 *new_rdesc; + + new_rdesc =devm_kzalloc (&hdev->dev, rsize_orig +1 , +GFP_KERNEL ); +if (!new_rdesc) +return rdesc;hid_info (hdev,"Fixing up %s keyb report descriptor\n" , drvdata->quirks &QUIRK_T100CHI ?"T100CHI" :"T90CHI" ); + +memcpy (new_rdesc, rdesc, rsize_orig); + *rsize = rsize_orig +1 ; + rdesc = new_rdesc; +memmove (rdesc + offs +4 , rdesc + offs +2 ,12 ); rdesc[offs] =0x19 ; rdesc[offs +1 ] =0x00 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/175 platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Metz <[email protected]>
[ Upstream commit 6b3fa0615cd8432148581de62a52f83847af3d70 ]
The Dell 14 Plus 2-in-1 (model DB04250) requires the VGBS allow list entry to correctly enable the tablet mode switch. Without this, the chassis state is not reported, and the hinge rotation only emits unknown scancodes.
Verified on Dell 14 Plus 2-in-1 DB04250.
--- drivers/platform/x86/intel/hid.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/platform/x86/intel/hid.c +6 -0
@@ -175,6 +175,12 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = { DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 12 Tablet RA02260"), }, }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "Dell 14 Plus 2-in-1 DB04250"), + }, + }, { } };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/175 nvme-pci: cap queue creation to used queues
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit 4735b510a00fb2d4ac9e8d21a8c9552cb281f585 ]
If the user reduces the special queue count at runtime and resets the controller, we need to reduce the number of queues and interrupts requested accordingly rather than start with the pre-allocated queue count.
--- drivers/nvme/host/pci.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/nvme/host/pci.c +7 -1
@@ -2355,7 +2355,13 @@ static int nvme_setup_io_queues(struct nvme_dev *dev) dev->nr_write_queues = write_queues; dev->nr_poll_queues = poll_queues; - nr_io_queues = dev->nr_allocated_queues -1 ; +/* +* The initial number of allocated queue slots may be too large if the +* user reduced the special queue parameters. Cap the value to the +* number we need for this round. +*/ + nr_io_queues =min (nvme_max_io_queues (dev), + dev->nr_allocated_queues -1 ); result =nvme_set_queue_count (&dev->ctrl, &nr_io_queues);if (result <0 )return result;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/175 nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Hodges <[email protected]>
[ Upstream commit 0a1fc2f301529ac75aec0ce80d5ab9d9e4dc4b16 ]
The DHCHAP secrets (dhchap_secret and dhchap_ctrl_secret) contain authentication key material for NVMe-oF. Use kfree_sensitive() instead of kfree() in nvmf_free_options() to ensure secrets are zeroed before the memory is freed, preventing recovery from freed pages.
--- drivers/nvme/host/fabrics.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/nvme/host/fabrics.c +2 -2
@@ -1179,8 +1179,8 @@ void nvmf_free_options(struct nvmf_ctrl_options *opts)kfree (opts->subsysnqn);kfree (opts->host_traddr);kfree (opts->host_iface); -kfree (opts->dhchap_secret); -kfree (opts->dhchap_ctrl_secret); +kfree_sensitive (opts->dhchap_secret); +kfree_sensitive (opts->dhchap_ctrl_secret);kfree (opts); }EXPORT_SYMBOL_GPL (nvmf_free_options);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/175 platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leif Skunberg <[email protected]>
[ Upstream commit b38d478dad79e61e8a65931021bdfd7a71741212 ]
The Lenovo ThinkPad X1 Fold 16 Gen 1 has physical volume up/down buttons that are handled through the intel-hid 5-button array interface. The firmware does not advertise 5-button array support via HEBC, so the driver relies on a DMI allowlist to enable it.
Add the ThinkPad X1 Fold 16 Gen 1 to the button_array_table so the volume buttons work out of the box.
--- drivers/platform/x86/intel/hid.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/platform/x86/intel/hid.c +7 -0
@@ -121,6 +121,13 @@ static const struct dmi_system_id button_array_table[] = { DMI_MATCH(DMI_PRODUCT_FAMILY, "ThinkPad X1 Tablet Gen 2"), }, }, + { + .ident = "Lenovo ThinkPad X1 Fold 16 Gen 1", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_FAMILY, "ThinkPad X1 Fold 16 Gen 1"), + }, + }, { .ident ="Microsoft Surface Go 3" , .matches = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/175 platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 7d87ed70fc95482c12edf9493c249b6413be485e ]
The touchscreen on the SUPI S10 tablet reports inverted Y coordinates, causing touch input to be mirrored vertically relative to the display.
Add a quirk to set the "touchscreen-inverted-y" boolean device-property on the touchscreen device, so that the goodix_ts driver will fixup the coordinates.
--- drivers/platform/x86/touchscreen_dmi.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/platform/x86/touchscreen_dmi.c +18 -0
@@ -430,6 +430,16 @@ static const struct ts_dmi_data gdix1002_00_upside_down_data = { .properties = gdix1001_upside_down_props, }; +static const struct property_entry gdix1001_y_inverted_props[] = { +PROPERTY_ENTRY_BOOL ("touchscreen-inverted-y" ), + { } +}; + +static const struct ts_dmi_data gdix1001_y_inverted_data = { + .acpi_name ="GDIX1001" , + .properties = gdix1001_y_inverted_props, +}; +static const struct property_entry gp_electronic_t701_props[] = {PROPERTY_ENTRY_U32 ("touchscreen-size-x" ,960 ),PROPERTY_ENTRY_U32 ("touchscreen-size-y" ,640 ),
@@ -1691,6 +1701,14 @@ const struct dmi_system_id touchscreen_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_SKU, "PN20170413488"), }, }, + { +/* SUPI S10 */ + .driver_data = (void *)&gdix1001_y_inverted_data, + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"SUPI" ), + DMI_MATCH(DMI_PRODUCT_NAME, "S10"), + }, + }, {/* Techbite Arc 11.6 */ .driver_data = (void *)&techbite_arc_11_6_data,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/175 nvme-pci: ensure were polling a polled queue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit 166e31d7dbf6aa44829b98aa446bda5c9580f12a ]
A user can change the polled queue count at run time. There's a brief window during a reset where a hipri task may try to poll that queue before the block layer has updated the queue maps, which would race with the now interrupt driven queue and may cause double completions.
--- drivers/nvme/host/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/host/pci.c +2 -1
@@ -1120,7 +1120,8 @@ static int nvme_poll(struct blk_mq_hw_ctx *hctx, struct io_comp_batch *iob)struct nvme_queue *nvmeq = hctx->driver_data;bool found; -if (!nvme_cqe_pending (nvmeq)) +if (!test_bit (NVMEQ_POLLED , &nvmeq->flags) || + !nvme_cqe_pending (nvmeq))return 0 ;spin_lock (&nvmeq->cq_poll_lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/175 HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julius Lehmann <[email protected]>
[ Upstream commit 5f3518d77419255f8b12bb23c8ec22acbeb6bc5b ]
Battery reporting does not work for the Apple Magic Trackpad 2 if it is connected via USB. The current hid descriptor fixup code checks for a hid descriptor length of exactly 83 bytes. If the hid descriptor is larger, which is the case for newer apple mice, the fixup is not applied.
This fix checks for hid descriptor sizes greater/equal 83 bytes which applies the fixup for newer devices as well.
--- drivers/hid/hid-magicmouse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/hid-magicmouse.c +1 -1
@@ -963,7 +963,7 @@ static __u8 *magicmouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,*/ if ((is_usb_magicmouse2 (hdev->vendor, hdev->product) ||is_usb_magictrackpad2 (hdev->vendor, hdev->product)) && - *rsize ==83 && rdesc[46 ] ==0x84 && rdesc[58 ] ==0x85 ) { + *rsize >=83 && rdesc[46 ] ==0x84 && rdesc[58 ] ==0x85 ) {hid_info (hdev,"fixing up magicmouse battery report descriptor\n" ); *rsize = *rsize -1 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/175 HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Günther Noack <[email protected]>
[ Upstream commit 91e8c6e601bdc1ccdf886479b6513c01c7e51c2c ]
The magicmouse_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it.
The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.
--- drivers/hid/hid-magicmouse.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/hid/hid-magicmouse.c +1 -3
@@ -967,9 +967,7 @@ static __u8 *magicmouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,hid_info (hdev,"fixing up magicmouse battery report descriptor\n" ); *rsize = *rsize -1 ; - rdesc =kmemdup (rdesc +1 , *rsize,GFP_KERNEL ); -if (!rdesc) -return NULL ; + rdesc = rdesc +1 ; rdesc[0 ] =0x05 ; rdesc[1 ] =0x01 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/175 net: usb: r8152: add TRENDnet TUC-ET2G
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valentin Spreckels <[email protected]>
[ Upstream commit 15fba71533bcdfaa8eeba69a5a5a2927afdf664a ]
The TRENDnet TUC-ET2G is a RTL8156 based usb ethernet adapter. Add its vendor and product IDs.
--- drivers/net/usb/r8152.c | 1 + include/linux/usb/r8152.h | 1 + 2 files changed, 2 insertions(+)
drivers/net/usb/r8152.c +1 -0
@@ -10036,6 +10036,7 @@ static const struct usb_device_id rtl8152_table[] = { { USB_DEVICE(VENDOR_ID_DLINK, 0xb301) }, { USB_DEVICE(VENDOR_ID_DELL, 0xb097) }, { USB_DEVICE(VENDOR_ID_ASUS, 0x1976) }, + { USB_DEVICE(VENDOR_ID_TRENDNET, 0xe02b) }, {} };
include/linux/usb/r8152.h +1 -0
@@ -32,6 +32,7 @@#define VENDOR_ID_DLINK 0x2001#define VENDOR_ID_DELL 0x413c#define VENDOR_ID_ASUS 0x0b05 +#define VENDOR_ID_TRENDNET 0x20f4#if IS_REACHABLE (CONFIG_USB_RTL8152 )extern u8 rtl8152_get_version (struct usb_interface *intf);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/175 HID: mcp2221: cancel last I2C command on read error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Romain Sioen <[email protected]>
[ Upstream commit e31b556c0ba21f20c298aa61181b96541140b7b9 ]
When an I2C SMBus read operation fails, the MCP2221 internal state machine may not reset correctly, causing subsequent transactions to fail.
By adding a short delay and explicitly cancelling the last command, we ensure the device is ready for the next operation.
Fix an issue where i2cdetect was not able to detect all devices correctly on the bus.
--- drivers/hid/hid-mcp2221.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hid/hid-mcp2221.c +2 -0
@@ -337,6 +337,8 @@ static int mcp_i2c_smbus_read(struct mcp2221 *mcp,usleep_range (90 ,100 ); retries++; }else { +usleep_range (980 ,1000 ); +mcp_cancel_last_cmd (mcp);return ret; } }else {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/175 HID: asus: add xg mobile 2023 external hardware support
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Benato <[email protected]>
[ Upstream commit 377f8e788945d45b012ed9cfc35ca56c02e86cd8 ]
XG mobile stations have the 0x5a endpoint and has to be initialized:
add them to hid-asus.
--- drivers/hid/hid-asus.c | 3 +++ drivers/hid/hid-ids.h | 1 + 2 files changed, 4 insertions(+)
drivers/hid/hid-asus.c +3 -0
@@ -1298,6 +1298,9 @@ static const struct hid_device_id asus_devices[] = { {HID_USB_DEVICE (USB_VENDOR_ID_ASUSTEK ,USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X ), QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD }, + { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, +USB_DEVICE_ID_ASUSTEK_XGM_2023 ), + }, { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD ), QUIRK_ROG_CLAYMORE_II_KEYBOARD },
drivers/hid/hid-ids.h +1 -0
@@ -219,6 +219,7 @@#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X 0x1b4c#define USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD 0x196b#define USB_DEVICE_ID_ASUSTEK_FX503VD_KEYBOARD 0x1869 +#define USB_DEVICE_ID_ASUSTEK_XGM_2023 0x1a9a#define USB_VENDOR_ID_ATEN 0x0557#define USB_DEVICE_ID_ATEN_UC100KM 0x2004
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/175 module: Fix kernel panic when a symbol st_shndx is out of bounds
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ihor Solodrai <[email protected]>
[ Upstream commit f9d69d5e7bde2295eb7488a56f094ac8f5383b92 ]
The module loader doesn't check for bounds of the ELF section index in simplify_symbols():
for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
const char *name = info->strtab + sym[i].st_name;
switch (sym[i].st_shndx) {
case SHN_COMMON:
[...]
default:
/* Divert to percpu allocation if a percpu var. */
if (sym[i].st_shndx == info->index.pcpu)
secbase = (unsigned long)mod_percpu(mod);
else
/** HERE --> **/ secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
sym[i].st_value += secbase;
break;
}
}A symbol with an out-of-bounds st_shndx value, for example 0xffff (known as SHN_XINDEX or SHN_HIRESERVE), may cause a kernel panic:
BUG: unable to handle page fault for address: ... RIP: 0010:simplify_symbols+0x2b2/0x480 ... Kernel panic - not syncing: Fatal exception
This can happen when module ELF is legitimately using SHN_XINDEX or when it is corrupted.
Add a bounds check in simplify_symbols() to validate that st_shndx is within the valid range before using it.
This issue was discovered due to a bug in llvm-objcopy, see relevant discussion for details [1].
[1] https://lore.kernel.org/linux-modules/[email protected]/
--- kernel/module/main.c | 7 +++++++ 1 file changed, 7 insertions(+)
kernel/module/main.c +7 -0
@@ -1424,6 +1424,13 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)break ;default : +if (sym[i].st_shndx >= info->hdr->e_shnum) { +pr_err ("%s: Symbol %s has an invalid section index %u (max %u)\n" , + mod->name, name, sym[i].st_shndx, info->hdr->e_shnum -1 ); + ret = -ENOEXEC ; +break ; + } +/* Divert to percpu allocation if a percpu var. */ if (sym[i].st_shndx == info->index.pcpu) secbase = (unsigned long )mod_percpu (mod);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/175 ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit 31ddc62c1cd92e51b9db61d7954b85ae2ec224da ]
ALSA controls should return 1 if the value in the control changed but the control put operation fsl_easrc_set_reg() only returns 0 or a negative error code, causing ALSA to not generate any change events. Add a suitable check by using regmap_update_bits_check() with the underlying regmap, this is more clearly and simply correct than trying to verify that one of the generic ops is exactly equivalent to this one.
--- sound/soc/fsl/fsl_easrc.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
sound/soc/fsl/fsl_easrc.c +6 -3
@@ -93,14 +93,17 @@ static int fsl_easrc_set_reg(struct snd_kcontrol *kcontrol,struct snd_soc_component *component =snd_kcontrol_chip (kcontrol);struct soc_mreg_control *mc = (struct soc_mreg_control *)kcontrol->private_value; +struct fsl_asrc *easrc =snd_soc_component_get_drvdata (component);unsigned int regval = ucontrol->value.integer.value[0 ]; +bool changed;int ret; - ret =snd_soc_component_write (component, mc->regbase, regval); -if (ret <0 ) + ret =regmap_update_bits_check (easrc->regmap, mc->regbase, +GENMASK (31 ,0 ), regval, &changed); +if (ret !=0 )return ret; -return 0 ; +return changed; }#define SOC_SINGLE_REG_RW (xname, xreg) \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/175 ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit 54a86cf48eaa6d1ab5130d756b718775e81e1748 ]
ALSA controls should return 1 if the value in the control changed but the control put operation fsl_easrc_iec958_put_bits() unconditionally returns 0, causing ALSA to not generate any change events. This is detected by mixer-test with large numbers of messages in the form:
No event generated for Context 3 IEC958 CS5 Context 3 IEC958 CS5.0 orig 5224 read 5225, is_volatile 0
Add a suitable check.
--- sound/soc/fsl/fsl_easrc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
sound/soc/fsl/fsl_easrc.c +4 -1
@@ -52,10 +52,13 @@ static int fsl_easrc_iec958_put_bits(struct snd_kcontrol *kcontrol,struct soc_mreg_control *mc = (struct soc_mreg_control *)kcontrol->private_value;unsigned int regval = ucontrol->value.integer.value[0 ]; +int ret; + + ret = (easrc_priv->bps_iec958[mc->regbase] != regval); easrc_priv->bps_iec958[mc->regbase] = regval; -return 0 ; +return ret; } static int fsl_easrc_iec958_get_bits(struct snd_kcontrol *kcontrol,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/175 dma-buf: Include ioctl.h in UAPI header
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Isaac J. Manjarres <[email protected]>
[ Upstream commit a116bac87118903925108e57781bbfc7a7eea27b ]
include/uapi/linux/dma-buf.h uses several macros from ioctl.h to define its ioctl commands. However, it does not include ioctl.h itself. So, if userspace source code tries to include the dma-buf.h file without including ioctl.h, it can result in build failures.
Therefore, include ioctl.h in the dma-buf UAPI header.
--- include/uapi/linux/dma-buf.h | 1 + 1 file changed, 1 insertion(+)
include/uapi/linux/dma-buf.h +1 -0
@@ -20,6 +20,7 @@#ifndef _DMA_BUF_UAPI_H_#define _DMA_BUF_UAPI_H_ +#include <linux/ioctl.h> #include <linux/types.h> /**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/175 HID: apple: avoid memory leak in apple_report_fixup()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Günther Noack <[email protected]>
[ Upstream commit 239c15116d80f67d32f00acc34575f1a6b699613 ]
The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it.
The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.
--- drivers/hid/hid-apple.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/hid/hid-apple.c +1 -3
@@ -645,9 +645,7 @@ static __u8 *apple_report_fixup(struct hid_device *hdev, __u8 *rdesc,hid_info (hdev,"fixing up Magic Keyboard battery report descriptor\n" ); *rsize = *rsize -1 ; - rdesc =kmemdup (rdesc +1 , *rsize,GFP_KERNEL ); -if (!rdesc) -return NULL ; + rdesc = rdesc +1 ; rdesc[0 ] =0x05 ; rdesc[1 ] =0x01 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/175 btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
[ Upstream commit 5131fa077f9bb386a1b901bf5b247041f0ec8f80 ]
We have recently observed a number of subvolumes with broken dentries. ls-ing the parent dir looks like:
drwxrwxrwt 1 root root 16 Jan 23 16:49 .
drwxr-xr-x 1 root root 24 Jan 23 16:48 ..
d????????? ? ? ? ? ? broken_subvol
and similarly stat-ing the file fails.
In this state, deleting the subvol fails with ENOENT, but attempting to create a new file or subvol over it errors out with EEXIST and even aborts the fs. Which leaves us a bit stuck.
dmesg contains a single notable error message reading:
"could not do orphan cleanup -2"
2 is ENOENT and the error comes from the failure handling path of btrfs_orphan_cleanup(), with the stack leading back up to btrfs_lookup().
btrfs_lookupbtrfs_lookup_dentrybtrfs_orphan_cleanup // prints that message and returns -ENOENT
After some detailed inspection of the internal state, it became clear that:
- there are no orphan items for the subvol
- the subvol is otherwise healthy looking, it is not half-deleted or anything, there is no drop progress, etc.
- the subvol was created a while ago and does the meaningful first btrfs_orphan_cleanup() call that sets BTRFS_ROOT_ORPHAN_CLEANUP much later.
- after btrfs_orphan_cleanup() fails, btrfs_lookup_dentry() returns -ENOENT, which results in a negative dentry for the subvolume via d_splice_alias(NULL, dentry), leading to the observed behavior. The bug can be mitigated by dropping the dentry cache, at which point we can successfully delete the subvolume if we want.
i.e.,btrfs_lookup()
btrfs_lookup_dentry()
if (!sb_rdonly(inode->vfs_inode)->vfs_inode) btrfs_orphan_cleanup(sub_root)
test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP) btrfs_search_slot() // finds orphan item for inode N
...
prints "could not do orphan cleanup -2"
if (inode == ERR_PTR(-ENOENT))
inode = NULL;
return d_splice_alias(NULL, dentry) // NEGATIVE DENTRY for valid subvolume
btrfs_orphan_cleanup() does test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP) on the root when it runs, so it cannot run more than once on a given root, so something else must run concurrently. However, the obvious routes to deleting an orphan when nlinks goes to 0 should not be able to run without first doing a lookup into the subvolume, which should run btrfs_orphan_cleanup() and set the bit.
The final important observation is that create_subvol() calls d_instantiate_new() but does not set BTRFS_ROOT_ORPHAN_CLEANUP, so if the dentry cache gets dropped, the next lookup into the subvolume will make a real call into btrfs_orphan_cleanup() for the first time. This opens up the possibility of concurrently deleting the inode/orphan items but most typical evict() paths will be holding a reference on the parent dentry (child dentry holds parent->d_lockref.count via dget in d_alloc(), released in __dentry_kill()) and prevent the parent from being removed from the dentry cache.
The one exception is delayed iputs. Ordered extent creation calls igrab() on the inode. If the file is unlinked and closed while those refs are held, iput() in __dentry_kill() decrements i_count but does not trigger eviction (i_count > 0). The child dentry is freed and the subvol dentry's d_lockref.count drops to 0, making it evictable while the inode is still alive.
Since there are two races (the race between writeback and unlink and the race between lookup and delayed iputs), and there are too many moving parts, the following three diagrams show the complete picture. (Only the second and third are races)
Phase 1:
Create Subvol in dentry cache without BTRFS_ROOT_ORPHAN_CLEANUP set
btrfs_mksubvol()
lookup_one_len()
__lookup_slow()
d_alloc_parallel()
__d_alloc() // d_lockref.count = 1
create_subvol(dentry)
// doesn't touch the bit..
d_instantiate_new(dentry, inode) // dentry in cache with d_lockref.count == 1Phase 2:
Create a delayed iput for a file in the subvol but leave the subvol in state where its dentry can be evicted (d_lockref.count == 0)
T1 (task) T2 (writeback) T3 (OE workqueue)
write() // dirty pages
btrfs_writepages()
btrfs_run_delalloc_range()
cow_file_range()
btrfs_alloc_ordered_extent()
igrab() // i_count: 1 -> 2btrfs_unlink_inode()
btrfs_orphan_add()close()
__fput()
dput()
finish_dput()
__dentry_kill()
dentry_unlink_inode()
iput() // 2 -> 1
--parent->d_lockref.count // 1 -> 0; evictable
finish_ordered_fn()
btrfs_finish_ordered_io()
btrfs_put_ordered_extent()
btrfs_add_delayed_iput()Phase 3:
Once the delayed iput is pending and the subvol dentry is evictable, the shrinker can free it, causing the next lookup to go through btrfs_lookup() and call btrfs_orphan_cleanup() for the first time. If the cleaner kthread processes the delayed iput concurrently, the two race:
T1 (shrinker) T2 (cleaner kthread) T3 (lookup)
super_cache_scan()
prune_dcache_sb()
__dentry_kill()
// subvol dentry freed
btrfs_run_delayed_iputs()
iput() // i_count -> 0
evict() // sets I_FREEING
btrfs_evict_inode()
// truncation loop
btrfs_lookup()
btrfs_lookup_dentry()
btrfs_orphan_cleanup()
// first call (bit never set)
btrfs_iget()
// blocks on I_FREEING
btrfs_orphan_del()
// inode freed
// returns -ENOENT
btrfs_del_orphan_item()
// -ENOENT
// "could not do orphan cleanup -2"
d_splice_alias(NULL, dentry)
// negative dentry for valid subvolThe most straightforward fix is to ensure the invariant that a dentry for a subvolume can exist if and only if that subvolume has BTRFS_ROOT_ORPHAN_CLEANUP set on its root (and is known to have no orphans or ran btrfs_orphan_cleanup()).
--- fs/btrfs/ioctl.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/btrfs/ioctl.c +7 -0
@@ -759,6 +759,13 @@ static noinline int create_subvol(struct mnt_idmap *idmap, goto out; } +/* +* Subvolumes have orphans cleaned on first dentry lookup. A new +* subvolume cannot have any orphans, so we should set the bit before we +* add the subvolume dentry to the dentry cache, so that it is in the +* same state as a subvolume after first lookup. +*/ +set_bit (BTRFS_ROOT_ORPHAN_CLEANUP , &new_root->state);d_instantiate_new (dentry, new_inode_args.inode); new_inode_args.inode =NULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/175 ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liucheng Lu <[email protected]>
[ Upstream commit 178dd118c0f07fd63a9ed74cfbd8c31ae50e33af ]
HP Laptop 14s-dr5xxx with ALC236 codec does not handle the toggling of the mute LED.
This patch adds a quirk entry for subsystem ID 0x8a1f using ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 fixup, enabling correct mute LED behavior.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10175,6 +10175,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x89ca ,"HP" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ),SND_PCI_QUIRK (0x103c ,0x89d3 ,"HP EliteBook 645 G9 (MB 89D2)" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ),SND_PCI_QUIRK (0x103c ,0x8a0f ,"HP Pavilion 14-ec1xxx" ,ALC287_FIXUP_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x8a1f ,"HP Laptop 14s-dr5xxx" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x8a20 ,"HP Laptop 15s-fq5xxx" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x8a25 ,"HP Victus 16-d1xxx (MB 8A25)" ,ALC245_FIXUP_HP_MUTE_LED_COEFBIT ), SND_PCI_QUIRK(0x103c, 0x8a78, "HP Dev One", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/175 ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uzair Mughal <[email protected]>
[ Upstream commit 542127f6528ca7cc3cf61e1651d6ccb58495f953 ]
The Lenovo ThinkPad X390 (ALC257 codec, subsystem ID 0x17aa2288) does not report headset button press events. Headphone insertion is detected (SW_HEADPHONE_INSERT), but pressing the inline microphone button on a headset produces no input events.
Add a SND_PCI_QUIRK entry that maps this subsystem ID to ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK, which enables headset jack button detection through alc_fixup_headset_jack() and ThinkPad ACPI integration. This is the same fixup used by similar ThinkPad models (P1 Gen 3, X1 Extreme Gen 3).
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10520,6 +10520,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x224c ,"Thinkpad" ,ALC298_FIXUP_TPT470_DOCK ),SND_PCI_QUIRK (0x17aa ,0x224d ,"Thinkpad" ,ALC298_FIXUP_TPT470_DOCK ),SND_PCI_QUIRK (0x17aa ,0x225d ,"Thinkpad T480" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ), +SND_PCI_QUIRK (0x17aa ,0x2288 ,"Thinkpad X390" ,ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK ),SND_PCI_QUIRK (0x17aa ,0x2292 ,"Thinkpad X1 Carbon 7th" ,ALC285_FIXUP_THINKPAD_HEADSET_JACK ),SND_PCI_QUIRK (0x17aa ,0x22be ,"Thinkpad X1 Carbon 8th" ,ALC285_FIXUP_THINKPAD_HEADSET_JACK ), SND_PCI_QUIRK(0x17aa, 0x22c1, "Thinkpad P1 Gen 3", ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/175 objtool: Handle Clang RSP musical chairs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 7fdaa640c810cb42090a182c33f905bcc47a616a ]
For no apparent reason (possibly related to CONFIG_KMSAN), Clang can randomly pass the value of RSP to other registers and then back again to RSP. Handle that accordingly.
Fixes the following warnings:
drivers/input/misc/uinput.o: warning: objtool: uinput_str_to_user+0x165: undefined stack state drivers/input/misc/uinput.o: warning: objtool: uinput_str_to_user+0x165: unknown CFA base reg -1
--- tools/objtool/arch/x86/decode.c | 62 ++++++++++++--------------------- tools/objtool/check.c | 14 ++++++++ 2 files changed, 37 insertions(+), 39 deletions(-)
tools/objtool/arch/x86/decode.c +23 -39
@@ -325,52 +325,36 @@ int arch_decode_instruction(struct objtool_file *file, const struct section *secif (!rex_w)break ; -if (modrm_reg ==CFI_SP ) { - -if (mod_is_reg ()) { -/* mov %rsp, reg */ -ADD_OP (op) { - op->src.type =OP_SRC_REG ; - op->src.reg =CFI_SP ; - op->dest.type =OP_DEST_REG ; - op->dest.reg = modrm_rm; - } -break ; - - }else { -/* skip RIP relative displacement */ -if (is_RIP ()) -break ; - -/* skip nontrivial SIB */ -if (have_SIB ()) { - modrm_rm = sib_base; -if (sib_index !=CFI_SP ) -break ; - } - -/* mov %rsp, disp(%reg) */ -ADD_OP (op) { - op->src.type =OP_SRC_REG ; - op->src.reg =CFI_SP ; - op->dest.type =OP_DEST_REG_INDIRECT ; - op->dest.reg = modrm_rm; - op->dest.offset = ins.displacement.value; - } -break ; +if (mod_is_reg ()) { +/* mov reg, reg */ +ADD_OP (op) { + op->src.type =OP_SRC_REG ; + op->src.reg = modrm_reg; + op->dest.type =OP_DEST_REG ; + op->dest.reg = modrm_rm; } -break ; } -if (rm_is_reg (CFI_SP )) { +/* skip RIP relative displacement */ +if (is_RIP ()) +break ; -/* mov reg, %rsp */ +/* skip nontrivial SIB */ +if (have_SIB ()) { + modrm_rm = sib_base; +if (sib_index !=CFI_SP ) +break ; + } + +/* mov %rsp, disp(%reg) */ +if (modrm_reg ==CFI_SP ) {ADD_OP (op) { op->src.type =OP_SRC_REG ; - op->src.reg = modrm_reg; - op->dest.type =OP_DEST_REG ; - op->dest.reg =CFI_SP ; + op->src.reg =CFI_SP ; + op->dest.type =OP_DEST_REG_INDIRECT ; + op->dest.reg = modrm_rm; + op->dest.offset = ins.displacement.value; }break ; }
tools/objtool/check.c +14 -0
@@ -2969,6 +2969,20 @@ static int update_cfi_state(struct instruction *insn, cfi->stack_size +=8 ; } +else if (cfi->vals[op->src.reg].base ==CFI_CFA ) { +/* +* Clang RSP musical chairs: +* +* mov %rsp, %rdx [handled above] +* ... +* mov %rdx, %rbx [handled here] +* ... +* mov %rbx, %rsp [handled above] +*/ + cfi->vals[op->dest.reg].base =CFI_CFA ; + cfi->vals[op->dest.reg].offset = cfi->vals[op->src.reg].offset; + } +break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/175 usb: core: new quirk to handle devices with zero configurations
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Deng <[email protected]>
[ Upstream commit 9f6a983cfa22ac662c86e60816d3a357d4b551e9 ]
Some USB devices incorrectly report bNumConfigurations as 0 in their device descriptor, which causes the USB core to reject them during enumeration.
logs:
usb 1-2: device descriptor read/64, error -71
usb 1-2: no configurations
usb 1-2: can't read configurations, error -22
However, these devices actually work correctly when treated as having a single configuration.
Add a new quirk USB_QUIRK_FORCE_ONE_CONFIG to handle such devices. When this quirk is set, assume the device has 1 configuration instead of failing with -EINVAL.
This quirk is applied to the device with VID:PID 5131:2007 which exhibits this behavior.
--- Documentation/admin-guide/kernel-parameters.txt | 3 +++ drivers/usb/core/config.c | 6 +++++- drivers/usb/core/quirks.c | 5 +++++ include/linux/usb/quirks.h | 3 +++ 4 files changed, 16 insertions(+), 1 deletion(-)
Documentation/admin-guide/kernel-parameters.txt +3 -0
@@ -6901,6 +6901,9 @@ p = USB_QUIRK_SHORT_SET_ADDRESS_REQ_TIMEOUT (Reduce timeout of the SET_ADDRESS request from 5000 ms to 500 ms); + q = USB_QUIRK_FORCE_ONE_CONFIG (Device + claims zero configurations, + forcing to 1); Example: quirks=0781:5580:bk,0a5c:5834:gij usbhid.mousepoll=
drivers/usb/core/config.c +5 -1
@@ -891,7 +891,11 @@ int usb_get_configuration(struct usb_device *dev) dev->descriptor.bNumConfigurations = ncfg =USB_MAXCONFIG ; } -if (ncfg <1 ) { +if (ncfg <1 && dev->quirks &USB_QUIRK_FORCE_ONE_CONFIG ) { +dev_info (ddev,"Device claims zero configurations, forcing to 1\n" ); + dev->descriptor.bNumConfigurations =1 ; + ncfg =1 ; + }else if (ncfg <1 ) {dev_err (ddev,"no configurations\n" );return -EINVAL ; }
drivers/usb/core/quirks.c +5 -0
@@ -141,6 +141,8 @@ static int quirks_param_set(const char *value, const struct kernel_param *kp)case 'p' : flags |=USB_QUIRK_SHORT_SET_ADDRESS_REQ_TIMEOUT ;break ; +case 'q' : + flags |=USB_QUIRK_FORCE_ONE_CONFIG ;/* Ignore unrecognized flag characters */ } }
@@ -594,6 +596,9 @@ static const struct usb_device_id usb_quirk_list[] = {/* VCOM device */ { USB_DEVICE(0x4296, 0x7570), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS }, + /* Noji-MCS SmartCard Reader */ + { USB_DEVICE(0x5131, 0x2007), .driver_info = USB_QUIRK_FORCE_ONE_CONFIG }, + /* INTEL VALUE SSD */ { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
include/linux/usb/quirks.h +3 -0
@@ -78,4 +78,7 @@/* skip BOS descriptor request */ #define USB_QUIRK_NO_BOS BIT(17) +/* Device claims zero configurations, forcing to 1 */ +#define USB_QUIRK_FORCE_ONE_CONFIG BIT(18) +#endif /* __LINUX_USB_QUIRKS_H */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/175 spi: intel-pci: Add support for Nova Lake mobile SPI flash
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Borzeszkowski <[email protected]>
[ Upstream commit 85b731ad4bbf6eb3fedf267ab00be3596f148432 ]
Add Intel Nova Lake PCD-H SPI serial flash PCI ID to the list of supported devices.
--- drivers/spi/spi-intel-pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-intel-pci.c +1 -0
@@ -86,6 +86,7 @@ static const struct pci_device_id intel_spi_pci_ids[] = { { PCI_VDEVICE(INTEL, 0xa324), (unsigned long)&cnl_info }, { PCI_VDEVICE(INTEL, 0xa3a4), (unsigned long)&cnl_info }, { PCI_VDEVICE(INTEL, 0xa823), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0xd323), (unsigned long)&cnl_info }, { PCI_VDEVICE(INTEL, 0xe323), (unsigned long)&cnl_info }, { PCI_VDEVICE(INTEL, 0xe423), (unsigned long)&cnl_info }, { },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/175 xfrm: call xdo_dev_state_delete during state update
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 7d2fc41f91bc69acb6e01b0fa23cd7d0109a6a23 ]
When we update an SA, we construct a new state and call xdo_dev_state_add, but never insert it. The existing state is updated, then we immediately destroy the new state. Since we haven't added it, we don't go through the standard state delete code, and we're skipping removing it from the device (but xdo_dev_state_free will get called when we destroy the temporary state).
This is similar to commit c5d4d7d83165 ("xfrm: Fix deletion of offloaded SAs on failure.").
--- net/xfrm/xfrm_state.c | 1 + 1 file changed, 1 insertion(+)
net/xfrm/xfrm_state.c +1 -0
@@ -2033,6 +2033,7 @@ int xfrm_state_update(struct xfrm_state *x) err =0 ; x->km.state =XFRM_STATE_DEAD ; +xfrm_dev_state_delete (x);__xfrm_state_put (x); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/175 xfrm: Fix the usage of skb->sk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Klassert <[email protected]>
[ Upstream commit 1620c88887b16940e00dbe57dd38c74eda9bad9e ]
xfrm assumed to always have a full socket at skb->sk. This is not always true, so fix it by converting to a full socket before it is used.
Stable-dep-of: 0c0eef8ccd24 ("esp: fix skb leak with espintcp and async crypto")
--- net/ipv4/esp4.c | 2 +- net/ipv6/esp6.c | 2 +- net/ipv6/xfrm6_output.c | 4 ++-- net/xfrm/xfrm_interface_core.c | 2 +- net/xfrm/xfrm_output.c | 7 ++++--- net/xfrm/xfrm_policy.c | 2 +- 6 files changed, 10 insertions(+), 9 deletions(-)
net/ipv4/esp4.c +1 -1
@@ -236,7 +236,7 @@ static void esp_output_done(void *data, int err) x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)esp_output_tail_tcp (x, skb); else - xfrm_output_resume(skb->sk, skb, err); +xfrm_output_resume (skb_to_full_sk (skb ),skb ,err ); } }
net/ipv6/esp6.c +1 -1
@@ -272,7 +272,7 @@ static void esp_output_done(void *data, int err) x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)esp_output_tail_tcp (x, skb); else - xfrm_output_resume(skb->sk, skb, err); +xfrm_output_resume (skb_to_full_sk (skb ),skb ,err ); } }
net/ipv6/xfrm6_output.c +2 -2
@@ -82,14 +82,14 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb) toobig = skb->len > mtu && !skb_is_gso (skb); -if (toobig &&xfrm6_local_dontfrag (skb->sk)) { +if (toobig &&xfrm6_local_dontfrag (sk)) {xfrm6_local_rxpmtu (skb, mtu);kfree_skb (skb);return -EMSGSIZE ; }else if (toobig &&xfrm6_noneed_fragment (skb)) { skb->ignore_df =1 ; goto skip_frag; - }else if (!skb->ignore_df && toobig && skb->sk) { + }else if (!skb->ignore_df && toobig && sk) {xfrm_local_error (skb, mtu);kfree_skb (skb);return -EMSGSIZE ;
net/xfrm/xfrm_interface_core.c +1 -1
@@ -507,7 +507,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)skb_dst_set (skb, dst); skb->dev = tdev; - err =dst_output (xi->net, skb->sk, skb); + err =dst_output (xi->net,skb_to_full_sk (skb), skb);if (net_xmit_eval (err) ==0 ) {dev_sw_netstats_tx_add (dev,1 , length); }else {
net/xfrm/xfrm_output.c +4 -3
@@ -841,7 +841,7 @@ static int xfrm4_tunnel_check_size(struct sk_buff *skb) !skb_gso_validate_network_len(skb, ip_skb_dst_mtu(skb->sk, skb)))) { skb->protocol =htons (ETH_P_IP ); -if (skb->sk) +if (skb->sk &&sk_fullsock (skb->sk))xfrm_local_error (skb, mtu);else icmp_send(skb, ICMP_DEST_UNREACH,
@@ -877,6 +877,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb) {int mtu, ret =0 ;struct dst_entry *dst =skb_dst (skb); +struct sock *sk =skb_to_full_sk (skb);if (skb->ignore_df) goto out;
@@ -891,9 +892,9 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb) skb->dev = dst->dev; skb->protocol =htons (ETH_P_IPV6 ); -if (xfrm6_local_dontfrag (skb->sk)) +if (xfrm6_local_dontfrag (sk)) ipv6_stub->xfrm6_local_rxpmtu (skb, mtu); -else if (skb->sk) +else if (sk)xfrm_local_error (skb, mtu);else icmpv6_send (skb,ICMPV6_PKT_TOOBIG ,0 , mtu);
net/xfrm/xfrm_policy.c +1 -1
@@ -2937,7 +2937,7 @@ static void xfrm_policy_queue_process(struct timer_list *t)skb_dst_drop (skb);skb_dst_set (skb, dst); -dst_output (net, skb->sk, skb); +dst_output (net,skb_to_full_sk (skb), skb); } out:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/175 esp: fix skb leak with espintcp and async crypto
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 0c0eef8ccd2413b0a10eb6bbd3442333b1e64dd2 ]
When the TX queue for espintcp is full, esp_output_tail_tcp will return an error and not free the skb, because with synchronous crypto, the common xfrm output code will drop the packet for us.
With async crypto (esp_output_done), we need to drop the skb when esp_output_tail_tcp returns an error.
--- net/ipv4/esp4.c | 9 ++++++--- net/ipv6/esp6.c | 9 ++++++--- 2 files changed, 12 insertions(+), 6 deletions(-)
net/ipv4/esp4.c +6 -3
@@ -233,10 +233,13 @@ static void esp_output_done(void *data, int err)xfrm_dev_resume (skb); }else {if (!err && - x->encap && x->encap->encap_type ==TCP_ENCAP_ESPINTCP ) -esp_output_tail_tcp (x, skb); -else + x->encap && x->encap->encap_type ==TCP_ENCAP_ESPINTCP ) { + err =esp_output_tail_tcp (x, skb); +if (err != -EINPROGRESS ) +kfree_skb (skb); + }else {xfrm_output_resume (skb_to_full_sk (skb), skb, err); + } } }
net/ipv6/esp6.c +6 -3
@@ -269,10 +269,13 @@ static void esp_output_done(void *data, int err)xfrm_dev_resume (skb); }else {if (!err && - x->encap && x->encap->encap_type ==TCP_ENCAP_ESPINTCP ) -esp_output_tail_tcp (x, skb); -else + x->encap && x->encap->encap_type ==TCP_ENCAP_ESPINTCP ) { + err =esp_output_tail_tcp (x, skb); +if (err != -EINPROGRESS ) +kfree_skb (skb); + }else {xfrm_output_resume (skb_to_full_sk (skb), skb, err); + } } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/175 af_key: validate families in pfkey_send_migrate()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit eb2d16a7d599dc9d4df391b5e660df9949963786 ]
syzbot was able to trigger a crash in skb_put() [1]
Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overfilling the skb.
Validate families early, do not wait set_ipsecrequest().
[1]
skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL>
kernel BUG at net/core/skbuff.c:214 !
Call Trace: <TASK> skb_over_panic net/core/skbuff.c:219 [inline] skb_put+0x159/0x210 net/core/skbuff.c:2655 skb_put_zero include/linux/skbuff.h:2788 [inline] set_ipsecrequest net/key/af_key.c:3532 [inline] pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636 km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848 xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705 xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150
--- net/key/af_key.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
net/key/af_key.c +12 -7
@@ -3517,7 +3517,7 @@ static int set_sadb_kmaddress(struct sk_buff *skb, const struct xfrm_kmaddress *static int set_ipsecrequest (struct sk_buff *skb,uint8_t proto,uint8_t mode,int level, -uint32_t reqid,uint8_t family, +uint32_t reqid,sa_family_t family,const xfrm_address_t *src,const xfrm_address_t *dst) {struct sadb_x_ipsecrequest *rq;
@@ -3582,12 +3582,17 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,/* ipsecrequests */ for (i =0 , mp = m; i < num_bundles; i++, mp++) { -/* old locator pair */ - size_pol +=sizeof (struct sadb_x_ipsecrequest ) + -pfkey_sockaddr_pair_size (mp->old_family); -/* new locator pair */ - size_pol +=sizeof (struct sadb_x_ipsecrequest ) + -pfkey_sockaddr_pair_size (mp->new_family); +int pair_size; + + pair_size =pfkey_sockaddr_pair_size (mp->old_family); +if (!pair_size) +return -EINVAL ; + size_pol +=sizeof (struct sadb_x_ipsecrequest ) + pair_size; + + pair_size =pfkey_sockaddr_pair_size (mp->new_family); +if (!pair_size) +return -EINVAL ; + size_pol +=sizeof (struct sadb_x_ipsecrequest ) + pair_size; } size +=sizeof (struct sadb_msg ) + size_pol;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/175 dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <[email protected]>
[ Upstream commit 6f770b73d0311a5b099277653199bb6421c4fed2 ]
When a device performs DMA to a bounce buffer, KMSAN is unaware of the write and does not mark the data as initialized. When swiotlb_bounce() later copies the bounce buffer back to the original buffer, memcpy propagates the uninitialized shadow to the original buffer, causing false positive uninit-value reports.
Fix this by calling kmsan_unpoison_memory() on the bounce buffer before copying it back in the DMA_FROM_DEVICE path, so that memcpy naturally propagates initialized shadow to the destination.
--- kernel/dma/swiotlb.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-)
kernel/dma/swiotlb.c +19 -2
@@ -30,6 +30,7 @@#include <linux/gfp.h> #include <linux/highmem.h> #include <linux/io.h> +#include <linux/kmsan-checks.h> #include <linux/iommu-helper.h> #include <linux/init.h> #include <linux/memblock.h>
@@ -906,10 +907,19 @@ static void swiotlb_bounce(struct device *dev, phys_addr_t tlb_addr, size_t sizelocal_irq_save (flags); page =pfn_to_page (pfn); -if (dir ==DMA_TO_DEVICE ) +if (dir ==DMA_TO_DEVICE ) { +/* +* Ideally, kmsan_check_highmem_page() +* could be used here to detect infoleaks, +* but callers may map uninitialized buffers +* that will be written by the device, +* causing false positives. +*/ memcpy_from_page (vaddr, page, offset, sz); -else + }else { +kmsan_unpoison_memory (vaddr, sz);memcpy_to_page (page, offset, vaddr, sz); + }local_irq_restore (flags); size -= sz;
@@ -918,8 +928,15 @@ static void swiotlb_bounce(struct device *dev, phys_addr_t tlb_addr, size_t size offset =0 ; } }else if (dir ==DMA_TO_DEVICE ) { +/* +* Ideally, kmsan_check_memory() could be used here to detect +* infoleaks (uninitialized data being sent to device), but +* callers may map uninitialized buffers that will be written +* by the device, causing false positives. +*/ memcpy (vaddr,phys_to_virt (orig_addr), size); }else { +kmsan_unpoison_memory (vaddr, size);memcpy (phys_to_virt (orig_addr), vaddr, size); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/175 can: statistics: add missing atomic access in hot path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
[ Upstream commit 46eee1661aa9b49966e6c43d07126fe408edda57 ]
Commit 80b5f90158d1 ("can: statistics: use atomic access in hot path") fixed a KCSAN issue in can_receive() but missed to convert the 'matches' variable used in can_rcv_filter().
--- net/can/af_can.c | 4 ++-- net/can/af_can.h | 2 +- net/can/proc.c | 3 ++- 3 files changed, 5 insertions(+), 4 deletions(-)
net/can/af_can.c +2 -2
@@ -467,7 +467,7 @@ int can_rx_register(struct net *net, struct net_device *dev, canid_t can_id, rcv->can_id = can_id; rcv->mask = mask; - rcv->matches =0 ; +atomic_long_set (&rcv->matches,0 ); rcv->func = func; rcv->data = data; rcv->ident = ident;
@@ -571,7 +571,7 @@ EXPORT_SYMBOL(can_rx_unregister);static inline void deliver (struct sk_buff *skb,struct receiver *rcv) { rcv->func (skb, rcv->data); - rcv->matches++; +atomic_long_inc (&rcv->matches); }static int can_rcv_filter (struct can_dev_rcv_lists *dev_rcv_lists,struct sk_buff *skb)
net/can/af_can.h +1 -1
@@ -52,7 +52,7 @@ struct receiver {struct hlist_node list;canid_t can_id;canid_t mask; -unsigned long matches; +atomic_long_t matches;void (*func)(struct sk_buff *skb,void *data);void *data;char *ident;
net/can/proc.c +2 -1
@@ -196,7 +196,8 @@ static void can_print_rcvlist(struct seq_file *m, struct hlist_head *rx_list," %-5s %03x %08x %pK %pK %8ld %s\n" ;seq_printf (m, fmt,DNAME (dev), r->can_id, r->mask, - r->func, r->data, r->matches, r->ident); + r->func, r->data,atomic_long_read (&r->matches), + r->ident); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/175 Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit c65bd945d1c08c3db756821b6bf9f1c4a77b29c6 ]
l2cap_ecred_data_rcv() reads the SDU length field from skb->data using get_unaligned_le16() without first verifying that skb contains at least L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads past the valid data in the skb.
The ERTM reassembly path correctly calls pskb_may_pull() before reading the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the same validation to the Enhanced Credit Based Flow Control data path.
--- net/bluetooth/l2cap_core.c | 5 +++++ 1 file changed, 5 insertions(+)
net/bluetooth/l2cap_core.c +5 -0
@@ -6636,6 +6636,11 @@ static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)if (!chan->sdu) {u16 sdu_len; +if (!pskb_may_pull (skb,L2CAP_SDULEN_SIZE )) { + err = -EINVAL ; + goto failed; + } + sdu_len =get_unaligned_le16 (skb->data);skb_pull (skb,L2CAP_SDULEN_SIZE );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/175 Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit 598dbba9919c5e36c54fe1709b557d64120cb94b ]
sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk->sk_state access, resulting in a use-after-free.
Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock.
Fix by using sco_sock_hold() to take a reference before releasing the lock, and adding sock_put() on all exit paths.
--- net/bluetooth/sco.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/bluetooth/sco.c +7 -3
@@ -338,7 +338,7 @@ static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)struct sock *sk;sco_conn_lock (conn); - sk = conn->sk; + sk =sco_sock_hold (conn);sco_conn_unlock (conn);if (!sk)
@@ -347,11 +347,15 @@ static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)BT_DBG ("sk %p len %u" , sk, skb->len);if (sk->sk_state !=BT_CONNECTED ) - goto drop; + goto drop_put; -if (!sock_queue_rcv_skb (sk, skb)) +if (!sock_queue_rcv_skb (sk, skb)) { +sock_put (sk);return ; + } +drop_put: +sock_put (sk); drop:kfree_skb (skb); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/175 Bluetooth: hci_ll: Fix firmware leak on error path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anas Iqbal <[email protected]>
[ Upstream commit 31148a7be723aa9f2e8fbd62424825ab8d577973 ]
Smatch reports:
drivers/bluetooth/hci_ll.c:587 download_firmware() warn:
'fw' from request_firmware() not released on lines: 544.
In download_firmware(), if request_firmware() succeeds but the returned firmware content is invalid (no data or zero size), the function returns without releasing the firmware, resulting in a resource leak.
Fix this by calling release_firmware() before returning when request_firmware() succeeded but the firmware content is invalid.
--- drivers/bluetooth/hci_ll.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/hci_ll.c +2 -0
@@ -541,6 +541,8 @@ static int download_firmware(struct ll_device *lldev)if (err || !fw->data || !fw->size) {bt_dev_err (lldev->hu.hdev,"request_firmware failed(errno %d) for %s" , err, bts_scr_name); +if (!err) +release_firmware (fw);return -EINVAL ; } ptr = (void *)fw->data;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/175 Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helen Koike <[email protected]>
[ Upstream commit b6552e0503973daf6f23bd6ed9273ef131ee364f ]
Before using sk pointer, check if it is null.
Fix the following:
KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267] CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025 Workqueue: events l2cap_info_timeout RIP: 0010:kasan_byte_accessible+0x12/0x30 Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce veth0_macvtap: entered promiscuous mode RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001 RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000 R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0 PKRU: 55555554 Call Trace: <TASK> __kasan_check_byte+0x12/0x40 lock_acquire+0x79/0x2e0 lock_sock_nested+0x48/0x100 ? l2cap_sock_ready_cb+0x46/0x160 l2cap_sock_ready_cb+0x46/0x160 l2cap_conn_start+0x779/0xff0 ? __pfx_l2cap_conn_start+0x10/0x10 ? l2cap_info_timeout+0x60/0xa0 ? __pfx___mutex_lock+0x10/0x10 l2cap_info_timeout+0x68/0xa0 ? process_scheduled_works+0xa8d/0x18c0 process_scheduled_works+0xb6e/0x18c0 ? __pfx_process_scheduled_works+0x10/0x10 ? assign_work+0x3d5/0x5e0 worker_thread+0xa53/0xfc0 kthread+0x388/0x470 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x51e/0xb90 ? __pfx_ret_from_fork+0x10/0x10 veth1_macvtap: entered promiscuous mode ? __switch_to+0xc7d/0x1450 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- batman_adv: batadv0: Interface activated: batadv_slave_0 batman_adv: batadv0: Interface activated: batadv_slave_1 netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 RIP: 0010:kasan_byte_accessible+0x12/0x30 Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce ieee80211 phy39: Selected rate control algorithm 'minstrel_ht' RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001 RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000 R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0 PKRU: 55555554 Kernel panic - not syncing: Fatal exception
--- net/bluetooth/l2cap_sock.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/l2cap_sock.c +3 -0
@@ -1665,6 +1665,9 @@ static void l2cap_sock_ready_cb(struct l2cap_chan *chan)struct sock *sk = chan->data;struct sock *parent; +if (!sk) +return ; +lock_sock (sk); parent =bt_sk (sk)->parent;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/175 pinctrl: mediatek: common: Fix probe failure for devices without EINT
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Leonardo Scorcia <[email protected]>
[ Upstream commit 8f9f64c8f90dca07d3b9f1d7ce5d34ccd246c9dd ]
Some pinctrl devices like mt6397 or mt6392 don't support EINT at all, but the mtk_eint_init function is always called and returns -ENODEV, which then bubbles up and causes probe failure.
To address this only call mtk_eint_init if EINT pins are present.
Tested on Xiaomi Mi Smart Clock x04g (mt6392).
--- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/pinctrl/mediatek/pinctrl-mtk-common.c +6 -3
@@ -1133,9 +1133,12 @@ int mtk_pctrl_init(struct platform_device *pdev, goto chip_error; } - ret =mtk_eint_init (pctl, pdev); -if (ret) - goto chip_error; +/* Only initialize EINT if we have EINT pins */ +if (data->eint_hw.ap_num >0 ) { + ret =mtk_eint_init (pctl, pdev); +if (ret) + goto chip_error; + }return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/175 ionic: fix persistent MAC address override on PF
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohammad Heib <[email protected]>
[ Upstream commit cbcb3cfcdc436d6f91a3d95ecfa9c831abe14aed ]
The use of IONIC_CMD_LIF_SETATTR in the MAC address update path causes the ionic firmware to update the LIF's identity in its persistent state. Since the firmware state is maintained across host warm boots and driver reloads, any MAC change on the Physical Function (PF) becomes "sticky.
This is problematic because it causes ethtool -P to report the user-configured MAC as the permanent factory address, which breaks system management tools that rely on a stable hardware identity.
While Virtual Functions (VFs) need this hardware-level programming to properly handle MAC assignments in guest environments, the PF should maintain standard transient behavior. This patch gates the ionic_program_mac call using is_virtfn so that PF MAC changes remain local to the netdev filters and do not overwrite the firmware's permanent identity block.
--- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
drivers/net/ethernet/pensando/ionic/ionic_lif.c +11 -6
@@ -1728,13 +1728,18 @@ static int ionic_set_mac_address(struct net_device *netdev, void *sa)if (ether_addr_equal (netdev->dev_addr, mac))return 0 ; - err =ionic_program_mac (lif, mac); -if (err <0 ) -return err; +/* Only program macs for virtual functions to avoid losing the permanent +* Mac across warm reset/reboot. +*/ +if (lif->ionic->pdev->is_virtfn) { + err =ionic_program_mac (lif, mac); +if (err <0 ) +return err; -if (err >0 ) -netdev_dbg (netdev,"%s: SET and GET ATTR Mac are not equal-due to old FW running\n" , - __func__); +if (err >0 ) +netdev_dbg (netdev,"%s: SET and GET ATTR Mac are not equal-due to old FW running\n" , + __func__); + } err =eth_prepare_mac_addr_change (netdev, addr);if (err)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/175 nfc: nci: fix circular locking dependency in nci_close_device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 4527025d440ce84bf56e75ce1df2e84cb8178616 ]
nci_close_device() flushes rx_wq and tx_wq while holding req_lock. This causes a circular locking dependency because nci_rx_work() running on rx_wq can end up taking req_lock too:
nci_rx_work -> nci_rx_data_packet -> nci_data_exchange_complete
-> __sk_destruct -> rawsock_destruct -> nfc_deactivate_target
-> nci_deactivate_target -> nci_request -> mutex_lock(&ndev->req_lock)Move the flush of rx_wq after req_lock has been released. This should safe (I think) because NCI_UP has already been cleared and the transport is closed, so the work will see it and return -ENETDOWN.
NIPA has been hitting this running the nci selftest with a debug kernel on roughly 4% of the runs.
--- net/nfc/nci/core.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
net/nfc/nci/core.c +6 -4
@@ -575,8 +575,7 @@ static int nci_close_device(struct nci_dev *ndev)skb_queue_purge (&ndev->rx_q);skb_queue_purge (&ndev->tx_q); -/* Flush RX and TX wq */ -flush_workqueue (ndev->rx_wq); +/* Flush TX wq, RX wq flush can't be under the lock */ flush_workqueue (ndev->tx_wq);/* Reset device */
@@ -588,13 +587,13 @@ static int nci_close_device(struct nci_dev *ndev) msecs_to_jiffies(NCI_RESET_TIMEOUT));/* After this point our queues are empty -* and no works are scheduled. +* rx work may be running but will see that NCI_UP was cleared */ ndev->ops->close (ndev);clear_bit (NCI_INIT , &ndev->flags); -/* Flush cmd wq */ +/* Flush cmd and tx wq */ flush_workqueue (ndev->cmd_wq);del_timer_sync (&ndev->cmd_timer);
@@ -604,6 +603,9 @@ static int nci_close_device(struct nci_dev *ndev)mutex_unlock (&ndev->req_lock); +/* rx_work may take req_lock via nci_deactivate_target */ +flush_workqueue (ndev->rx_wq); +return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/175 net: openvswitch: Avoid releasing netdev before teardown completes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 7c770dadfda5cbbde6aa3c4363ed513f1d212bf8 ]
The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. After this change, the netdev_destroy() callback can proceed immediately to the call_rcu() invocation if the IFF_OVS_DATAPATH flag is already cleared on the netdev.
The ovs_netdev_detach_dev() function clears the flag before completing the unregistration, and if it gets preempted after clearing the flag (as can happen on an -rt kernel), netdev_destroy() can complete and the device can be freed before the unregistration completes. This leads to a splat like:
[ 998.393867] Oops: general protection fault, probably for non-canonical address 0xff00000001000239: 0000 [#1] SMP PTI [ 998.393877] CPU: 42 UID: 0 PID: 55177 Comm: ip Kdump: loaded Not tainted 6.12.0-211.1.1.el10_2.x86_64+rt #1 PREEMPT_RT [ 998.393886] Hardware name: Dell Inc. PowerEdge R740/0JMK61, BIOS 2.24.0 03/27/2025 [ 998.393889] RIP: 0010:dev_set_promiscuity+0x8d/0xa0 [ 998.393901] Code: 00 00 75 d8 48 8b 53 08 48 83 ba b0 02 00 00 00 75 ca 48 83 c4 08 5b c3 cc cc cc cc 48 83 bf 48 09 00 00 00 75 91 48 8b 47 08 <48> 83 b8 b0 02 00 00 00 74 97 eb 81 0f 1f 80 00 00 00 00 90 90 90 [ 998.393906] RSP: 0018:ffffce5864a5f6a0 EFLAGS: 00010246 [ 998.393912] RAX: ff00000000ffff89 RBX: ffff894d0adf5a05 RCX: 0000000000000000 [ 998.393917] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffff894d0adf5a05 [ 998.393921] RBP: ffff894d19252000 R08: ffff894d19252000 R09: 0000000000000000 [ 998.393924] R10: ffff894d19252000 R11: ffff894d192521b8 R12: 0000000000000006 [ 998.393927] R13: ffffce5864a5f738 R14: 00000000ffffffe2 R15: 0000000000000000 [ 998.393931] FS: 00007fad61971800(0000) GS:ffff894cc0140000(0000) knlGS:0000000000000000 [ 998.393936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 998.393940] CR2: 000055df0a2a6e40 CR3: 000000011c7fe003 CR4: 00000000007726f0 [ 998.393944] PKRU: 55555554 [ 998.393946] Call Trace: [ 998.393949] <TASK> [ 998.393952] ? show_trace_log_lvl+0x1b0/0x2f0 [ 998.393961] ? show_trace_log_lvl+0x1b0/0x2f0 [ 998.393975] ? dp_device_event+0x41/0x80 [openvswitch] [ 998.394009] ? __die_body.cold+0x8/0x12 [ 998.394016] ? die_addr+0x3c/0x60 [ 998.394027] ? exc_general_protection+0x16d/0x390 [ 998.394042] ? asm_exc_general_protection+0x26/0x30 [ 998.394058] ? dev_set_promiscuity+0x8d/0xa0 [ 998.394066] ? ovs_netdev_detach_dev+0x3a/0x80 [openvswitch] [ 998.394092] dp_device_event+0x41/0x80 [openvswitch] [ 998.394102] notifier_call_chain+0x5a/0xd0 [ 998.394106] unregister_netdevice_many_notify+0x51b/0xa60 [ 998.394110] rtnl_dellink+0x169/0x3e0 [ 998.394121] ? rt_mutex_slowlock.constprop.0+0x95/0xd0 [ 998.394125] rtnetlink_rcv_msg+0x142/0x3f0 [ 998.394128] ? avc_has_perm_noaudit+0x69/0xf0 [ 998.394130] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 998.394132] netlink_rcv_skb+0x50/0x100 [ 998.394138] netlink_unicast+0x292/0x3f0 [ 998.394141] netlink_sendmsg+0x21b/0x470 [ 998.394145] ____sys_sendmsg+0x39d/0x3d0 [ 998.394149] ___sys_sendmsg+0x9a/0xe0 [ 998.394156] __sys_sendmsg+0x7a/0xd0 [ 998.394160] do_syscall_64+0x7f/0x170 [ 998.394162] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 998.394165] RIP: 0033:0x7fad61bf4724 [ 998.394188] Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d c5 e9 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 [ 998.394189] RSP: 002b:00007ffd7e2f7cb8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 998.394191] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fad61bf4724 [ 998.394193] RDX: 0000000000000000 RSI: 00007ffd7e2f7d20 RDI: 0000000000000003 [ 998.394194] RBP: 00007ffd7e2f7d90 R08: 0000000000000010 R09: 000000000000003f [ 998.394195] R10: 000055df11558010 R11: 0000000000000202 R12: 00007ffd7e2f8380 [ 998.394196] R13: 0000000069b233d7 R14: 000055df0a256040 R15: 0000000000000000 [ 998.394200] </TASK>
To fix this, reorder the operations in ovs_netdev_detach_dev() to only clear the flag after completing the other operations, and introduce an smp_wmb() to make the ordering requirement explicit. The smp_wmb() is paired with a full smp_mb() in netdev_destroy() to make sure the call_rcu() invocation does not happen before the unregister operations are visible.
--- net/openvswitch/vport-netdev.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
net/openvswitch/vport-netdev.c +8 -1
@@ -144,11 +144,15 @@ static void vport_netdev_free(struct rcu_head *rcu)void ovs_netdev_detach_dev (struct vport *vport) {ASSERT_RTNL (); - vport->dev->priv_flags &= ~IFF_OVS_DATAPATH ;netdev_rx_handler_unregister (vport->dev);netdev_upper_dev_unlink (vport->dev,netdev_master_upper_dev_get (vport->dev));dev_set_promiscuity (vport->dev,-1 ); + +/* paired with smp_mb() in netdev_destroy() */ +smp_wmb (); + + vport->dev->priv_flags &= ~IFF_OVS_DATAPATH ; }static void netdev_destroy (struct vport *vport)
@@ -167,6 +171,9 @@ static void netdev_destroy(struct vport *vport)rtnl_unlock (); } +/* paired with smp_wmb() in ovs_netdev_detach_dev() */ +smp_mb (); +call_rcu (&vport->rcu, vport_netdev_free); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/175 openvswitch: defer tunnel netdev_put to RCU release
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yang <[email protected]>
[ Upstream commit 6931d21f87bc6d657f145798fad0bf077b82486c ]
ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already detached the device. Dropping the netdev reference in destroy can race with concurrent readers that still observe vport->dev.
Do not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let vport_netdev_free() drop the reference from the RCU callback, matching the non-tunnel destroy path and avoiding additional synchronization under RTNL.
--- net/openvswitch/vport-netdev.c | 2 -- 1 file changed, 2 deletions(-)
net/openvswitch/vport-netdev.c +0 -2
@@ -189,8 +189,6 @@ void ovs_netdev_tunnel_destroy(struct vport *vport)*/ if (vport->dev->reg_state ==NETREG_REGISTERED )rtnl_delete_link (vport->dev,0 ,NULL ); -netdev_put (vport->dev, &vport->dev_tracker); - vport->dev =NULL ;rtnl_unlock ();call_rcu (&vport->rcu, vport_netdev_free);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/175 openvswitch: validate MPLS set/set_masked payload length
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yang <[email protected]>
[ Upstream commit 546b68ac893595877ffbd7751e5c55fd1c43ede6 ]
validate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for SET/SET_MASKED actions. In action handling, OVS expects fixed-size MPLS key data (struct ovs_key_mpls).
Use the already normalized key_len (masked case included) and reject non-matching MPLS action key sizes.
Reject invalid MPLS action payload lengths early.
--- net/openvswitch/flow_netlink.c | 2 ++ 1 file changed, 2 insertions(+)
net/openvswitch/flow_netlink.c +2 -0
@@ -2939,6 +2939,8 @@ static int validate_set(const struct nlattr *a,case OVS_KEY_ATTR_MPLS :if (!eth_p_mpls (eth_type))return -EINVAL ; +if (key_len !=sizeof (struct ovs_key_mpls )) +return -EINVAL ;break ;case OVS_KEY_ATTR_SCTP :
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/175 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Tang <[email protected]>
[ Upstream commit 24dd586bb4cbba1889a50abe74143817a095c1c9 ]
smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores the pointer in pipe_buffer.private. The pipe_buf_operations for these buffers used .get = generic_pipe_buf_get, which only increments the page reference count when tee(2) duplicates a pipe buffer. The smc_spd_priv pointer itself was not handled, so after tee() both the original and the cloned pipe_buffer share the same smc_spd_priv *.
When both pipes are subsequently released, smc_rx_pipe_buf_release() is called twice against the same object:
1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct] 2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF]
KASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which then escalates to a NULL-pointer dereference and kernel panic via smc_rx_update_consumer() when it chases the freed priv->smc pointer:
BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0 Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xce/0x650 kasan_report+0xc6/0x100 smc_rx_pipe_buf_release+0x78/0x2a0 free_pipe_info+0xd4/0x130 pipe_release+0x142/0x160 __fput+0x1c6/0x490 __x64_sys_close+0x4f/0x90 do_syscall_64+0xa6/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> BUG: kernel NULL pointer dereference, address: 0000000000000020 RIP: 0010:smc_rx_update_consumer+0x8d/0x350 Call Trace: <TASK> smc_rx_pipe_buf_release+0x121/0x2a0 free_pipe_info+0xd4/0x130 pipe_release+0x142/0x160 __fput+0x1c6/0x490 __x64_sys_close+0x4f/0x90 do_syscall_64+0xa6/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Kernel panic - not syncing: Fatal exception
Beyond the memory-safety problem, duplicating an SMC splice buffer is semantically questionable: smc_rx_update_cons() would advance the consumer cursor twice for the same data, corrupting receive-window accounting. A refcount on smc_spd_priv could fix the double-free, but the cursor-accounting issue would still need to be addressed separately.
The .get callback is invoked by both tee(2) and splice_pipe_to_pipe() for partial transfers; both will now return -EFAULT. Users who need to duplicate SMC socket data must use a copy-based read path.
--- net/smc/smc_rx.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
net/smc/smc_rx.c +8 -1
@@ -135,9 +135,16 @@ static void smc_rx_pipe_buf_release(struct pipe_inode_info *pipe,sock_put (sk); } +static bool smc_rx_pipe_buf_get (struct pipe_inode_info *pipe, +struct pipe_buffer *buf) +{ +/* smc_spd_priv in buf->private is not shareable; disallow cloning. */ +return false; +} +static const struct pipe_buf_operations smc_pipe_ops = { .release = smc_rx_pipe_buf_release, - .get = generic_pipe_buf_get + .get = smc_rx_pipe_buf_get, }; static void smc_rx_spd_release(struct splice_pipe_desc *spd,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/175 rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit ee00a12593ffb69db4dd1a1c00ecb0253376874a ]
rtnl_link_get_slave_info_data_size counts IFLA_INFO_SLAVE_DATA, but rtnl_link_slave_info_fill adds both IFLA_INFO_SLAVE_DATA and IFLA_INFO_SLAVE_KIND.
--- net/core/rtnetlink.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
net/core/rtnetlink.c +6 -3
@@ -571,11 +571,14 @@ static size_t rtnl_link_get_slave_info_data_size(const struct net_device *dev) goto out; ops = master_dev->rtnl_link_ops; -if (!ops || !ops->get_slave_size) +if (!ops) + goto out; + size +=nla_total_size (strlen (ops->kind) +1 );/* IFLA_INFO_SLAVE_KIND */ +if (!ops->get_slave_size) goto out;/* IFLA_INFO_SLAVE_DATA + nested data */ - size =nla_total_size (sizeof (struct nlattr )) + - ops->get_slave_size (master_dev, dev); + size +=nla_total_size (sizeof (struct nlattr )) + + ops->get_slave_size (master_dev, dev); out:rcu_read_unlock ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/175 platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 2061f7b042f88d372cca79615f8425f3564c0b40 ]
The command length check validates inlen (> 5), but the error message incorrectly printed resp_len. Print inlen so the log reflects the actual command length.
--- drivers/platform/olpc/olpc-xo175-ec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/olpc/olpc-xo175-ec.c +1 -1
@@ -482,7 +482,7 @@ static int olpc_xo175_ec_cmd(u8 cmd, u8 *inbuf, size_t inlen, u8 *resp,dev_dbg (dev,"CMD %x, %zd bytes expected\n" , cmd, resp_len);if (inlen >5 ) { -dev_err (dev,"command len %zd too big!\n" , resp_len); +dev_err (dev,"command len %zd too big!\n" , inlen);return -EOVERFLOW ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/175 ice: use ice_update_eth_stats() for representor stats
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Oros <[email protected]>
[ Upstream commit 2526e440df2725e7328d59b835a164826f179b93 ]
ice_repr_get_stats64() and __ice_get_ethtool_stats() call ice_update_vsi_stats() on the VF's src_vsi. This always returns early because ICE_VSI_DOWN is permanently set for VF VSIs - ice_up() is never called on them since queues are managed by iavf through virtchnl.
In __ice_get_ethtool_stats() the original code called ice_update_vsi_stats() for all VSIs including representors, iterated over ice_gstrings_vsi_stats[] to populate the data, and then bailed out with an early return before the per-queue ring stats section. That early return was necessary because representor VSIs have no rings on the PF side - the rings belong to the VF driver (iavf), so accessing per-queue stats would be invalid.
Move the representor handling to the top of __ice_get_ethtool_stats() and call ice_update_eth_stats() directly to read the hardware GLV_* counters. This matches ice_get_vf_stats() which already uses ice_update_eth_stats() for the same VF VSI in legacy mode. Apply the same fix to ice_repr_get_stats64().
Note that ice_gstrings_vsi_stats[] contains five software ring counters (rx_buf_failed, rx_page_failed, tx_linearize, tx_busy, tx_restart) that are always zero for representors since the PF never processes packets on VF rings. This is pre-existing behavior unchanged by this patch.
--- drivers/net/ethernet/intel/ice/ice_ethtool.c | 14 +++++++++++--- drivers/net/ethernet/intel/ice/ice_repr.c | 3 ++- 2 files changed, 13 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/ice/ice_ethtool.c +11 -3
@@ -1528,6 +1528,17 @@ __ice_get_ethtool_stats(struct net_device *netdev,int i =0 ;char *p; +if (ice_is_port_repr_netdev (netdev)) { +ice_update_eth_stats (vsi); + +for (j =0 ; j <ICE_VSI_STATS_LEN ; j++) { + p = (char *)vsi + ice_gstrings_vsi_stats[j].stat_offset; + data[i++] = (ice_gstrings_vsi_stats[j].sizeof_stat == +sizeof (u64)) ? *(u64 *)p : *(u32 *)p; + } +return ; + } +ice_update_pf_stats (pf);ice_update_vsi_stats (vsi);
@@ -1537,9 +1548,6 @@ __ice_get_ethtool_stats(struct net_device *netdev, sizeof(u64)) ? *(u64 *)p : *(u32 *)p; } -if (ice_is_port_repr_netdev (netdev)) -return ; -/* populate per queue stats */ rcu_read_lock ();
drivers/net/ethernet/intel/ice/ice_repr.c +2 -1
@@ -2,6 +2,7 @@/* Copyright (C) 2019-2021, Intel Corporation. */ #include "ice.h" +#include "ice_lib.h" #include "ice_eswitch.h" #include "ice_devlink.h" #include "ice_sriov.h"
@@ -57,7 +58,7 @@ ice_repr_get_stats64(struct net_device *netdev, struct rtnl_link_stats64 *stats)return ; vsi = np->repr->src_vsi; -ice_update_vsi_stats (vsi); +ice_update_eth_stats (vsi); eth_stats = &vsi->eth_stats; stats->tx_packets = eth_stats->tx_unicast + eth_stats->tx_broadcast +
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/175 ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 6af51e9f31336632263c4680b2a3712295103e1f ]
Commit 5eb902b8e719 ("net/ipv6: Remove expired routes with a separated list of routes.") introduced a per-table GC list and changed GC to iterate over that list instead of traversing the entire route table.
However, it forgot to add permanent routes to tb6_gc_hlist when exception routes are added.
Commit cfe82469a00f ("ipv6: add exception routes to GC list in rt6_insert_exception") fixed that issue but introduced another one.
Even after all exception routes expire, the permanent routes remain in tb6_gc_hlist, potentially negating the performance benefits intended by the initial change.
Let's count gc_args->more before and after rt6_age_exceptions() and remove the permanent route when the delta is 0.
Note that the next patch will reuse fib6_age_exceptions().
--- net/ipv6/ip6_fib.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
net/ipv6/ip6_fib.c +12 -1
@@ -2311,6 +2311,17 @@ static void fib6_flush_trees(struct net *net)/* * Garbage collection */ +static void fib6_age_exceptions (struct fib6_info *rt,struct fib6_gc_args *gc_args, +unsigned long now) +{ +bool may_expire = rt->fib6_flags &RTF_EXPIRES && rt->expires; +int old_more = gc_args->more; + +rt6_age_exceptions (rt, gc_args, now); + +if (!may_expire && old_more == gc_args->more) +fib6_remove_gc_list (rt); +}static int fib6_age (struct fib6_info *rt,struct fib6_gc_args *gc_args) {
@@ -2333,7 +2344,7 @@ static int fib6_age(struct fib6_info *rt, struct fib6_gc_args *gc_args)* Note, that clones are aged out * only if they are not in use now. */ -rt6_age_exceptions (rt, gc_args, now); +fib6_age_exceptions (rt, gc_args, now);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/175 ipv6: Dont remove permanent routes with exceptions from tb6_gc_hlist.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 4be7b99c253f0c85a255cc1db7127ba3232dfa30 ]
The cited commit mechanically put fib6_remove_gc_list() just after every fib6_clean_expires() call.
When a temporary route is promoted to a permanent route, there may already be exception routes tied to it.
If fib6_remove_gc_list() removes the route from tb6_gc_hlist, such exception routes will no longer be aged.
Let's replace fib6_remove_gc_list() with a new helper fib6_may_remove_gc_list() and use fib6_age_exceptions() there.
Note that net->ipv6 is only compiled when CONFIG_IPV6 is enabled, so fib6_{add,remove,may_remove}_gc_list() are guarded.
--- include/net/ip6_fib.h | 21 ++++++++++++++++++++- net/ipv6/addrconf.c | 4 ++-- net/ipv6/ip6_fib.c | 6 +++--- net/ipv6/route.c | 2 +- 4 files changed, 26 insertions(+), 7 deletions(-)
include/net/ip6_fib.h +20 -1
@@ -512,12 +512,14 @@ void fib6_rt_update(struct net *net, struct fib6_info *rt,void inet6_rt_notify (int event,struct fib6_info *rt,struct nl_info *info,unsigned int flags); +void fib6_age_exceptions (struct fib6_info *rt,struct fib6_gc_args *gc_args, +unsigned long now);void fib6_run_gc (unsigned long expires,struct net *net,bool force); -void fib6_gc_cleanup (void );int fib6_init (void ); +#if IS_ENABLED (CONFIG_IPV6 )/* Add the route to the gc list if it is not already there * * The callers should hold f6i->fib6_table->tb6_lock.
@@ -550,6 +552,23 @@ static inline void fib6_remove_gc_list(struct fib6_info *f6i)hlist_del_init (&f6i->gc_link); } +static inline void fib6_may_remove_gc_list (struct net *net, +struct fib6_info *f6i) +{ +struct fib6_gc_args gc_args; + +if (hlist_unhashed (&f6i->gc_link)) +return ; + + gc_args.timeout =READ_ONCE (net->ipv6.sysctl.ip6_rt_gc_interval); + gc_args.more =0 ; + +rcu_read_lock (); +fib6_age_exceptions (f6i, &gc_args, jiffies); +rcu_read_unlock (); +} +#endif +struct ipv6_route_iter {struct seq_net_private p;struct fib6_walker w;
net/ipv6/addrconf.c +2 -2
@@ -2831,7 +2831,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)fib6_add_gc_list (rt); }else {fib6_clean_expires (rt); -fib6_remove_gc_list (rt); +fib6_may_remove_gc_list (net, rt); }spin_unlock_bh (&table->tb6_lock);
@@ -4816,7 +4816,7 @@ static int modify_prefix_route(struct net *net, struct inet6_ifaddr *ifp,if (!expires) {fib6_clean_expires (f6i); -fib6_remove_gc_list (f6i); +fib6_may_remove_gc_list (net, f6i); }else {fib6_set_expires (f6i, expires);fib6_add_gc_list (f6i);
net/ipv6/ip6_fib.c +3 -3
@@ -1131,7 +1131,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,return -EEXIST ;if (!(rt->fib6_flags &RTF_EXPIRES )) {fib6_clean_expires (iter); -fib6_remove_gc_list (iter); +fib6_may_remove_gc_list (info->nl_net, iter); }else {fib6_set_expires (iter, rt->expires);fib6_add_gc_list (iter);
@@ -2311,8 +2311,8 @@ static void fib6_flush_trees(struct net *net)/* * Garbage collection */ -static void fib6_age_exceptions (struct fib6_info *rt,struct fib6_gc_args *gc_args, -unsigned long now) +void fib6_age_exceptions (struct fib6_info *rt,struct fib6_gc_args *gc_args, +unsigned long now) {bool may_expire = rt->fib6_flags &RTF_EXPIRES && rt->expires;int old_more = gc_args->more;
net/ipv6/route.c +1 -1
@@ -1035,7 +1035,7 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,if (!addrconf_finite_timeout (lifetime)) {fib6_clean_expires (rt); -fib6_remove_gc_list (rt); +fib6_may_remove_gc_list (net, rt); }else {fib6_set_expires (rt, jiffies +HZ * lifetime);fib6_add_gc_list (rt);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/175 net: fix fanout UAF in packet_release() via NETDEV_UP race
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yochai Eisenrich <[email protected]>
[ Upstream commit 42156f93d123436f2a27c468f18c966b7e5db796 ]
packet_release() has a race window where NETDEV_UP can re-register a socket into a fanout group's arr[] array. The re-registration is not cleaned up by fanout_release(), leaving a dangling pointer in the fanout array.packet_release() does NOT zero po->num in its bind_lock section. After releasing bind_lock, po->num is still non-zero and po->ifindex still matches the bound device. A concurrent packet_notifier(NETDEV_UP) that already found the socket in sklist can re-register the hook. For fanout sockets, this re-registration calls __fanout_link(sk, po) which adds the socket back into f->arr[] and increments f->num_members, but does NOT increment f->sk_ref.
The fix sets po->num to zero in packet_release while bind_lock is held to prevent NETDEV_UP from linking, preventing the race window.
This bug was found following an additional audit with Claude Code based on CVE-2025-38617.
--- net/packet/af_packet.c | 1 + 1 file changed, 1 insertion(+)
net/packet/af_packet.c +1 -0
@@ -3196,6 +3196,7 @@ static int packet_release(struct socket *sock)spin_lock (&po->bind_lock);unregister_prot_hook (sk, false); +WRITE_ONCE (po->num,0 );packet_cached_dev_reset (po);if (po->prot_hook.dev) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/175 tcp: Use bhash2 for v4-mapped-v6 non-wildcard address.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 5e07e672412bed473122813ab35d4f7d42fd9635 ]
While checking port availability in bind() or listen(), we used only bhash for all v4-mapped-v6 addresses. But there is no good reason not to use bhash2 for v4-mapped-v6 non-wildcard addresses.
Let's do it by returning true in inet_use_bhash2_on_bind(). Then, we also need to add a test in inet_bind2_bucket_match_addr_any() so that ::ffff:X.X.X.X will match with 0.0.0.0.
Note that sk->sk_rcv_saddr is initialised for v4-mapped-v6 sk in __inet6_bind().
Stable-dep-of: e537dd15d0d4 ("udp: Fix wildcard bind conflict check when using hash2")
--- net/ipv4/inet_connection_sock.c | 7 +++++-- net/ipv4/inet_hashtables.c | 3 ++- 2 files changed, 7 insertions(+), 3 deletions(-)
net/ipv4/inet_connection_sock.c +5 -2
@@ -157,8 +157,11 @@ static bool inet_use_bhash2_on_bind(const struct sock *sk)if (sk->sk_family ==AF_INET6 ) {int addr_type =ipv6_addr_type (&sk->sk_v6_rcv_saddr); -return addr_type !=IPV6_ADDR_ANY && - addr_type !=IPV6_ADDR_MAPPED ; +if (addr_type ==IPV6_ADDR_ANY ) +return false; + +if (addr_type !=IPV6_ADDR_MAPPED ) +return true; }#endif return sk->sk_rcv_saddr !=htonl (INADDR_ANY );
net/ipv4/inet_hashtables.c +2 -1
@@ -845,7 +845,8 @@ bool inet_bind2_bucket_match_addr_any(const struct inet_bind2_bucket *tb, constreturn ipv6_addr_any (&tb->v6_rcv_saddr) ||ipv6_addr_v4mapped_any (&tb->v6_rcv_saddr); -return false; +return ipv6_addr_v4mapped (&sk->sk_v6_rcv_saddr) && + tb->rcv_saddr ==0 ; }if (sk->sk_family ==AF_INET6 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/175 tcp: Rearrange tests in inet_csk_bind_conflict().
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 58655bc0ad7ccdd5b53319bcc091cb81b6aee7c3 ]
The following patch adds code in the !inet_use_bhash2_on_bind(sk) case in inet_csk_bind_conflict().
To avoid adding nest and make the change cleaner, this patch rearranges tests in inet_csk_bind_conflict().
Stable-dep-of: e537dd15d0d4 ("udp: Fix wildcard bind conflict check when using hash2")
--- net/ipv4/inet_connection_sock.c | 40 ++++++++++++++++----------------- 1 file changed, 19 insertions(+), 21 deletions(-)
net/ipv4/inet_connection_sock.c +19 -21
@@ -240,9 +240,10 @@ static int inet_csk_bind_conflict(const struct sock *sk,const struct inet_bind2_bucket *tb2,/* may be null */ bool relax, bool reuseport_ok) { - bool reuseport_cb_ok; -struct sock_reuseport *reuseport_cb; kuid_t uid = sock_i_uid((struct sock *)sk); +struct sock_reuseport *reuseport_cb; +bool reuseport_cb_ok; +struct sock *sk2;rcu_read_lock (); reuseport_cb =rcu_dereference (sk->sk_reuseport_cb);
@@ -250,32 +251,29 @@ static int inet_csk_bind_conflict(const struct sock *sk, reuseport_cb_ok = !reuseport_cb ||READ_ONCE (reuseport_cb->num_closed_socks);rcu_read_unlock (); -/* -* Unlike other sk lookup places we do not check +/* Conflicts with an existing IPV6_ADDR_ANY (if ipv6) or INADDR_ANY (if +* ipv4) should have been checked already. We need to do these two +* checks separately because their spinlocks have to be acquired/released +* independently of each other, to prevent possible deadlocks +*/ +if (inet_use_bhash2_on_bind (sk)) +return tb2 &&inet_bhash2_conflict (sk, tb2, uid, relax, + reuseport_cb_ok, reuseport_ok); + +/* Unlike other sk lookup places we do not check * for sk_net here, since _all_ the socks listed * in tb->owners and tb2->owners list belong * to the same net - the one this bucket belongs to. */ +sk_for_each_bound (sk2, &tb->owners) { +if (!inet_bind_conflict (sk, sk2, uid, relax, reuseport_cb_ok, reuseport_ok)) +continue ; -if (!inet_use_bhash2_on_bind (sk)) { -struct sock *sk2; - -sk_for_each_bound (sk2, &tb->owners) -if (inet_bind_conflict (sk, sk2, uid, relax, - reuseport_cb_ok, reuseport_ok) && -inet_rcv_saddr_equal (sk, sk2, true)) -return true; - -return false; +if (inet_rcv_saddr_equal (sk, sk2, true)) +return true; } -/* Conflicts with an existing IPV6_ADDR_ANY (if ipv6) or INADDR_ANY (if -* ipv4) should have been checked already. We need to do these two -* checks separately because their spinlocks have to be acquired/released -* independently of each other, to prevent possible deadlocks -*/ -return tb2 &&inet_bhash2_conflict (sk, tb2, uid, relax, reuseport_cb_ok, - reuseport_ok); +return false; }/* Determine if there is a bind conflict with an existing IPV6_ADDR_ANY (if ipv6) or
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/175 tcp: optimize inet_use_bhash2_on_bind()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit ca79d80b0b9f42362a893f06413a9fe91811158a ]
There is no reason to call ipv6_addr_type().
Instead, use highly optimized ipv6_addr_any() and ipv6_addr_v4mapped().
Stable-dep-of: e537dd15d0d4 ("udp: Fix wildcard bind conflict check when using hash2")
--- net/ipv4/inet_connection_sock.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
net/ipv4/inet_connection_sock.c +2 -4
@@ -155,12 +155,10 @@ static bool inet_use_bhash2_on_bind(const struct sock *sk) {#if IS_ENABLED (CONFIG_IPV6 )if (sk->sk_family ==AF_INET6 ) { -int addr_type =ipv6_addr_type (&sk->sk_v6_rcv_saddr); - -if (addr_type ==IPV6_ADDR_ANY ) +if (ipv6_addr_any (&sk->sk_v6_rcv_saddr))return false; -if (addr_type !=IPV6_ADDR_MAPPED ) +if (!ipv6_addr_v4mapped (&sk->sk_v6_rcv_saddr))return true; }#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/175 udp: Fix wildcard bind conflict check when using hash2
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin KaFai Lau <[email protected]>
[ Upstream commit e537dd15d0d4ad989d56a1021290f0c674dd8b28 ]
When binding a udp_sock to a local address and port, UDP uses two hashes (udptable->hash and udptable->hash2) for collision detection. The current code switches to "hash2" when hslot->count > 10.
"hash2" is keyed by local address and local port. "hash" is keyed by local port only.
The issue can be shown in the following bind sequence (pseudo code):
bind(fd1, "[fd00::1]:8888") bind(fd2, "[fd00::2]:8888") bind(fd3, "[fd00::3]:8888") bind(fd4, "[fd00::4]:8888") bind(fd5, "[fd00::5]:8888") bind(fd6, "[fd00::6]:8888") bind(fd7, "[fd00::7]:8888") bind(fd8, "[fd00::8]:8888") bind(fd9, "[fd00::9]:8888")
bind(fd10, "[fd00::10]:8888")
/* Correctly return -EADDRINUSE because "hash" is used
* instead of "hash2". udp_lib_lport_inuse() detects the
* conflict.
*/bind(fail_fd, "[::]:8888")
/* After one more socket is bound to "[fd00::11]:8888",
* hslot->count exceeds 10 and "hash2" is used instead. */bind(fd11, "[fd00::11]:8888")bind(fail_fd, "[::]:8888") /* succeeds unexpectedly */
The same issue applies to the IPv4 wildcard address "0.0.0.0" and the IPv4-mapped wildcard address "::ffff:0.0.0.0". For example, if there are existing sockets bound to "192.168.1.[1-11]:8888", then binding "0.0.0.0:8888" or "[::ffff:0.0.0.0]:8888" can also miss the conflict when hslot->count > 10.
TCP inet_csk_get_port() already has the correct check in inet_use_bhash2_on_bind(). Rename it to inet_use_hash2_on_bind() and move it to inet_hashtables.h so udp.c can reuse it in this fix.
--- include/net/inet_hashtables.h | 14 ++++++++++++++ net/ipv4/inet_connection_sock.c | 20 +++----------------- net/ipv4/udp.c | 2 +- 3 files changed, 18 insertions(+), 18 deletions(-)
include/net/inet_hashtables.h +14 -0
@@ -278,6 +278,20 @@ inet_bhashfn_portaddr(const struct inet_hashinfo *hinfo, const struct sock *sk,return &hinfo->bhash2[hash & (hinfo->bhash_size -1 )]; } +static inline bool inet_use_hash2_on_bind (const struct sock *sk) +{ +#if IS_ENABLED (CONFIG_IPV6 ) +if (sk->sk_family ==AF_INET6 ) { +if (ipv6_addr_any (&sk->sk_v6_rcv_saddr)) +return false; + +if (!ipv6_addr_v4mapped (&sk->sk_v6_rcv_saddr)) +return true; + } +#endif +return sk->sk_rcv_saddr !=htonl (INADDR_ANY ); +} +struct inet_bind_hashbucket *inet_bhash2_addr_any_hashbucket (const struct sock *sk,const struct net *net,int port);
net/ipv4/inet_connection_sock.c +3 -17
@@ -151,20 +151,6 @@ void inet_sk_get_local_port_range(const struct sock *sk, int *low, int *high) }EXPORT_SYMBOL (inet_sk_get_local_port_range); -static bool inet_use_bhash2_on_bind (const struct sock *sk) -{ -#if IS_ENABLED (CONFIG_IPV6 ) -if (sk->sk_family ==AF_INET6 ) { -if (ipv6_addr_any (&sk->sk_v6_rcv_saddr)) -return false; - -if (!ipv6_addr_v4mapped (&sk->sk_v6_rcv_saddr)) -return true; - } -#endif -return sk->sk_rcv_saddr !=htonl (INADDR_ANY ); -} -static bool inet_bind_conflict (const struct sock *sk,struct sock *sk2,kuid_t sk_uid,bool relax,bool reuseport_cb_ok,bool reuseport_ok)
@@ -254,7 +240,7 @@ static int inet_csk_bind_conflict(const struct sock *sk,* checks separately because their spinlocks have to be acquired/released * independently of each other, to prevent possible deadlocks */ -if (inet_use_bhash2_on_bind (sk)) +if (inet_use_hash2_on_bind (sk))return tb2 &&inet_bhash2_conflict (sk, tb2, uid, relax, reuseport_cb_ok, reuseport_ok);
@@ -371,7 +357,7 @@ inet_csk_find_open_port(const struct sock *sk, struct inet_bind_bucket **tb_ret, head = &hinfo->bhash[inet_bhashfn (net, port, hinfo->bhash_size)];spin_lock_bh (&head->lock); -if (inet_use_bhash2_on_bind (sk)) { +if (inet_use_hash2_on_bind (sk)) {if (inet_bhash2_addr_any_conflict (sk, port, l3mdev, relax, false)) goto next_port; }
@@ -556,7 +542,7 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum) check_bind_conflict = false; } -if (check_bind_conflict &&inet_use_bhash2_on_bind (sk)) { +if (check_bind_conflict &&inet_use_hash2_on_bind (sk)) {if (inet_bhash2_addr_any_conflict (sk, port, l3mdev, true, true)) goto fail_unlock; }
net/ipv4/udp.c +1 -1
@@ -287,7 +287,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum, }else { hslot =udp_hashslot (udptable, net, snum);spin_lock_bh (&hslot->lock); -if (hslot->count >10 ) { +if (inet_use_hash2_on_bind (sk) && hslot->count >10 ) {int exist;unsigned int slot2 =udp_sk (sk)->udp_portaddr_hash ^ snum;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/175 net: enetc: fix the output issue of ethtool --show-ring
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit 70b439bf06f6a12e491f827fa81a9887a11501f9 ]
Currently, enetc_get_ringparam() only provides rx_pending and tx_pending, but 'ethtool --show-ring' no longer displays these fields. Because the ringparam retrieval path has moved to the new netlink interface, where rings_fill_reply() emits the *x_pending only if the *x_max_pending values are non-zero. So rx_max_pending and tx_max_pending to are added to enetc_get_ringparam() to fix the issue.
Note that the maximum tx/rx ring size of hardware is 64K, but we haven't added set_ringparam() to make the ring size configurable. To avoid users mistakenly believing that the ring size can be increased, so set the *x_max_pending to priv->*x_bd_count.
--- drivers/net/ethernet/freescale/enetc/enetc_ethtool.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/freescale/enetc/enetc_ethtool.c +2 -0
@@ -747,6 +747,8 @@ static void enetc_get_ringparam(struct net_device *ndev, {struct enetc_ndev_priv *priv =netdev_priv (ndev); + ring->rx_max_pending = priv->rx_bd_count; + ring->tx_max_pending = priv->tx_bd_count; ring->rx_pending = priv->rx_bd_count; ring->tx_pending = priv->tx_bd_count;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/175 dma-mapping: add missing `inline` for `dma_free_attrs`
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
[ Upstream commit 2cdaff22ed26f1e619aa2b43f27bb84f2c6ef8f8 ]
Under an UML build for an upcoming series [1], I got -Wstatic-in-inline for dma_free_attrs:
BINDGEN rust/bindings/bindings_generated.rs - due to target missing
In file included from rust/helpers/helpers.c:59:
rust/helpers/dma.c:17:2: warning: static function 'dma_free_attrs' is used in an inline function with external linkage [-Wstatic-in-inline]
17 | dma_free_attrs(dev, size, cpu_addr, dma_handle, attrs);
| ^
rust/helpers/dma.c:12:1: note: use 'static' to give inline function 'rust_helper_dma_free_attrs' internal linkage
12 | __rust_helper void rust_helper_dma_free_attrs(struct device *dev, size_t size,
| ^
| static
The issue is that dma_free_attrs was not marked inline when it was introduced alongside the rest of the stubs.
Thus mark it.
--- include/linux/dma-mapping.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/dma-mapping.h +2 -2
@@ -219,8 +219,8 @@ static inline void *dma_alloc_attrs(struct device *dev, size_t size, {return NULL ; } -static void dma_free_attrs (struct device *dev,size_t size,void *cpu_addr, -dma_addr_t dma_handle,unsigned long attrs) +static inline void dma_free_attrs (struct device *dev,size_t size, +void *cpu_addr,dma_addr_t dma_handle,unsigned long attrs) { } static inline void *dmam_alloc_attrs(struct device *dev, size_t size,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/175 Bluetooth: L2CAP: Fix send LE flow credits in ACL link
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Chen <[email protected]>
[ Upstream commit f39f905e55f529b036321220af1ba4f4085564a5 ]
When the L2CAP channel mode is L2CAP_MODE_ERTM/L2CAP_MODE_STREAMING, l2cap_publish_rx_avail will be called and le flow credits will be sent in l2cap_chan_rx_avail, even though the link type is ACL.
The logs in question as follows:
Quoted 1 line
ACL Data RX: Handle 129 flags
0x02dlen 12
L2CAP: Unknown (0x16) ident 4 len 4
40 00 ed 05
< ACL Data TX: Handle 129 flags 0x00 dlen 10
L2CAP: Command Reject (0x01) ident 4 len 2
Reason: Command not understood (0x0000)Bluetooth: Unknown BR/EDR signaling command 0x16
Bluetooth: Wrong link type (-22)
--- net/bluetooth/l2cap_core.c | 4 ++++ 1 file changed, 4 insertions(+)
net/bluetooth/l2cap_core.c +4 -0
@@ -6553,6 +6553,10 @@ static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)struct l2cap_le_credits pkt;u16 return_credits =l2cap_le_rx_credits (chan); +if (chan->mode !=L2CAP_MODE_LE_FLOWCTL && + chan->mode !=L2CAP_MODE_EXT_FLOWCTL ) +return ; +if (chan->rx_credits >= return_credits)return ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/175 Bluetooth: Remove 3 repeated macro definitions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit 94c603c28e59091f698efc5caaddc93c365455ab ]
Macros HCI_REQ_DONE, HCI_REQ_PEND and HCI_REQ_CANCELED are repeatedly defined twice with hci_request.h, so remove a copy of definition.
Stable-dep-of: 94d8e6fe5d08 ("Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock")
--- net/bluetooth/hci_request.h | 4 ---- 1 file changed, 4 deletions(-)
net/bluetooth/hci_request.h +0 -4
@@ -29,10 +29,6 @@#define hci_req_sync_lock (hdev) mutex_lock(&hdev->req_lock)#define hci_req_sync_unlock (hdev) mutex_unlock(&hdev->req_lock) -#define HCI_REQ_DONE 0 -#define HCI_REQ_PEND 1 -#define HCI_REQ_CANCELED 2 -struct hci_request {struct hci_dev *hdev;struct sk_buff_head cmd_q;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/175 Bluetooth: hci_sync: Remove remaining dependencies of hci_request
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit f2d89775358606c7ab6b6b6c4a02fe1e8cd270b1 ]
This removes the dependencies of hci_req_init and hci_request_cancel_all from hci_sync.c.
Stable-dep-of: 94d8e6fe5d08 ("Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock")
--- include/net/bluetooth/hci_sync.h | 17 +++++++++++++++++ net/bluetooth/hci_request.h | 17 ----------------- net/bluetooth/hci_sync.c | 14 +++++++++++--- 3 files changed, 28 insertions(+), 20 deletions(-)
include/net/bluetooth/hci_sync.h +17 -0
@@ -8,6 +8,23 @@#define UINT_PTR (_handle) ((void *)((uintptr_t)_handle))#define PTR_UINT (_ptr) ((uintptr_t)((void *)_ptr)) +#define HCI_REQ_DONE 0 +#define HCI_REQ_PEND 1 +#define HCI_REQ_CANCELED 2 + +#define hci_req_sync_lock (hdev) mutex_lock(&hdev->req_lock) +#define hci_req_sync_unlock (hdev) mutex_unlock(&hdev->req_lock) + +struct hci_request { +struct hci_dev *hdev; +struct sk_buff_head cmd_q; + +/* If something goes wrong when building the HCI request, the error +* value is stored in this field. +*/ +int err; +}; +typedef int (*hci_cmd_sync_work_func_t )(struct hci_dev *hdev,void *data);typedef void (*hci_cmd_sync_work_destroy_t )(struct hci_dev *hdev,void *data,int err);
net/bluetooth/hci_request.h +0 -17
@@ -22,23 +22,6 @@#include <asm/unaligned.h> -#define HCI_REQ_DONE 0 -#define HCI_REQ_PEND 1 -#define HCI_REQ_CANCELED 2 - -#define hci_req_sync_lock (hdev) mutex_lock(&hdev->req_lock) -#define hci_req_sync_unlock (hdev) mutex_unlock(&hdev->req_lock) - -struct hci_request { -struct hci_dev *hdev; -struct sk_buff_head cmd_q; - -/* If something goes wrong when building the HCI request, the error -* value is stored in this field. -*/ -int err; -}; -void hci_req_init (struct hci_request *req,struct hci_dev *hdev);void hci_req_purge (struct hci_request *req);bool hci_req_status_pend (struct hci_dev *hdev);
net/bluetooth/hci_sync.c +11 -3
@@ -12,7 +12,6 @@#include <net/bluetooth/hci_core.h> #include <net/bluetooth/mgmt.h> -#include "hci_request.h" #include "hci_codec.h" #include "hci_debugfs.h" #include "smp.h"
@@ -147,6 +146,13 @@ static int hci_req_sync_run(struct hci_request *req)return 0 ; } +static void hci_request_init (struct hci_request *req,struct hci_dev *hdev) +{ +skb_queue_head_init (&req->cmd_q); + req->hdev = hdev; + req->err =0 ; +} +/* This function requires the caller holds hdev->req_lock. */ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, const void *param, u8 event, u32 timeout,
@@ -158,7 +164,7 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen,bt_dev_dbg (hdev,"Opcode 0x%4.4x" , opcode); -hci_req_init (&req, hdev); +hci_request_init (&req, hdev);hci_cmd_sync_add (&req, opcode, plen, param, event, sk);
@@ -5227,7 +5233,9 @@ int hci_dev_close_sync(struct hci_dev *hdev)cancel_delayed_work (&hdev->le_scan_disable);cancel_delayed_work (&hdev->le_scan_restart); -hci_request_cancel_all (hdev); +hci_cmd_sync_cancel_sync (hdev,ENODEV ); + +cancel_interleave_scan (hdev);if (hdev->adv_instance_timeout) {cancel_delayed_work_sync (&hdev->adv_instance_expire);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/175 Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <[email protected]>
[ Upstream commit 94d8e6fe5d0818e9300e514e095a200bd5ff93ae ]
btintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET and Intel exception-info retrieval) without holding hci_req_sync_lock(). This lets it race against hci_dev_do_close() -> btintel_shutdown_combined(), which also runs __hci_cmd_sync() under the same lock. When both paths manipulate hdev->req_status/req_rsp concurrently, the close path may free the response skb first, and the still-running hw_error path hits a slab-use-after-free in kfree_skb().
Wrap the whole recovery sequence in hci_req_sync_lock/unlock so it is serialized with every other synchronous HCI command issuer.
Below is the data race report and the kasan report:
BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined
read of hdev->req_rsp at net/bluetooth/hci_sync.c:199 by task kworker/u17:1/83:
__hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200 __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223 btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254 hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030
write/free by task ioctl/22580:
btintel_shutdown_combined+0xd0/0x360
drivers/bluetooth/btintel.c:3648
hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246
hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526
BUG: KASAN: slab-use-after-free in
sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202
Read of size 4 at addr ffff888144a738dc
by task kworker/u17:1/83:
__hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200
__hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223
btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260--- drivers/bluetooth/btintel.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/bluetooth/btintel.c +8 -3
@@ -242,11 +242,13 @@ static void btintel_hw_error(struct hci_dev *hdev, u8 code)bt_dev_err (hdev,"Hardware error 0x%2.2x" , code); +hci_req_sync_lock (hdev); + skb =__hci_cmd_sync (hdev,HCI_OP_RESET ,0 ,NULL ,HCI_INIT_TIMEOUT );if (IS_ERR (skb)) {bt_dev_err (hdev,"Reset after hardware error failed (%ld)" ,PTR_ERR (skb)); -return ; + goto unlock; }kfree_skb (skb);
@@ -254,18 +256,21 @@ static void btintel_hw_error(struct hci_dev *hdev, u8 code)if (IS_ERR (skb)) {bt_dev_err (hdev,"Retrieving Intel exception info failed (%ld)" ,PTR_ERR (skb)); -return ; + goto unlock; }if (skb->len !=13 ) {bt_dev_err (hdev,"Exception info size mismatch" );kfree_skb (skb); -return ; + goto unlock; }bt_dev_err (hdev,"Exception info %s" , (char *)(skb->data +1 ));kfree_skb (skb); + +unlock: +hci_req_sync_unlock (hdev); }int btintel_version_info (struct hci_dev *hdev,struct intel_version *ver)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/175 Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit 25f420a0d4cfd61d3d23ec4b9c56d9f443d91377 ]
l2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED state to support L2CAP reconfiguration (e.g. MTU changes). However, since both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from the initial configuration, the reconfiguration path falls through to l2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and retrans_list without freeing the previous allocations and sets chan->sdu to NULL without freeing the existing skb. This leaks all previously allocated ERTM resources.
Additionally, l2cap_parse_conf_req() does not validate the minimum value of remote_mps derived from the RFC max_pdu_size option. A zero value propagates to l2cap_segment_sdu() where pdu_len becomes zero, causing the while loop to never terminate since len is never decremented, exhausting all available memory.
Fix the double-init by skipping l2cap_ertm_init() and l2cap_chan_ready() when the channel is already in BT_CONNECTED state, while still allowing the reconfiguration parameters to be updated through l2cap_parse_conf_req(). Also add a pdu_len zero check in l2cap_segment_sdu() as a safeguard.
--- net/bluetooth/l2cap_core.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
net/bluetooth/l2cap_core.c +12 -7
@@ -2383,6 +2383,9 @@ static int l2cap_segment_sdu(struct l2cap_chan *chan,/* Remote device may have requested smaller PDUs */ pdu_len =min_t (size_t, pdu_len, chan->remote_mps); +if (!pdu_len) +return -EINVAL ; +if (len <= pdu_len) { sar =L2CAP_SAR_UNSEGMENTED ; sdu_len =0 ;
@@ -4281,14 +4284,16 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,if (test_bit (CONF_INPUT_DONE , &chan->conf_state)) {set_default_fcs (chan); -if (chan->mode ==L2CAP_MODE_ERTM || - chan->mode ==L2CAP_MODE_STREAMING ) - err =l2cap_ertm_init (chan); +if (chan->state !=BT_CONNECTED ) { +if (chan->mode ==L2CAP_MODE_ERTM || + chan->mode ==L2CAP_MODE_STREAMING ) + err =l2cap_ertm_init (chan); -if (err <0 ) -l2cap_send_disconn_req (chan, -err); -else -l2cap_chan_ready (chan); +if (err <0 ) +l2cap_send_disconn_req (chan, -err); +else +l2cap_chan_ready (chan); + } goto unlock; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/175 Bluetooth: btusb: clamp SCO altsetting table indices
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 129fa608b6ad08b8ab7178eeb2ec272c993aaccc ]
btusb_work() maps the number of active SCO links to USB alternate settings through a three-entry lookup table when CVSD traffic uses transparent voice settings. The lookup currently indexes alts[] with data->sco_num - 1 without first constraining sco_num to the number of available table entries.
While the table only defines alternate settings for up to three SCO links, data->sco_num comes from hci_conn_num() and is used directly. Cap the lookup to the last table entry before indexing it so the driver keeps selecting the highest supported alternate setting without reading past alts[].
--- drivers/bluetooth/btusb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/bluetooth/btusb.c +4 -1
@@ -2314,8 +2314,11 @@ static void btusb_work(struct work_struct *work)if (data->air_mode ==HCI_NOTIFY_ENABLE_SCO_CVSD ) {if (hdev->voice_setting &0x0020 ) {static const int alts[3 ] = {2 ,4 ,5 }; +unsigned int sco_idx; - new_alts = alts[data->sco_num -1 ]; + sco_idx = min_t(unsigned int, data->sco_num - 1, +ARRAY_SIZE (alts) -1 ); + new_alts = alts[sco_idx]; }else { new_alts = data->sco_num; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/175 tls: Purge async_hold in tls_decrypt_async_wait()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 84a8335d8300576f1b377ae24abca1d9f197807f ]
The async_hold queue pins encrypted input skbs while the AEAD engine references their scatterlist data. Once tls_decrypt_async_wait() returns, every AEAD operation has completed and the engine no longer references those skbs, so they can be freed unconditionally.
A subsequent patch adds batch async decryption to tls_sw_read_sock(), introducing a new call site that must drain pending AEAD operations and release held skbs. Move __skb_queue_purge(&ctx->async_hold) into tls_decrypt_async_wait() so the purge is centralized and every caller -- recvmsg's drain path, the -EBUSY fallback in tls_do_decryption(), and the new read_sock batch path -- releases held skbs on synchronization without each site managing the purge independently.
This fixes a leak when tls_strp_msg_hold() fails part-way through, after having added some cloned skbs to the async_hold queue. tls_decrypt_sg() will then call tls_decrypt_async_wait() to process all pending decrypts, and drop back to synchronous mode, but tls_sw_recvmsg() only flushes the async_hold queue when one record has been processed in "fully-async" mode, which may not be the case here.
--- net/tls/tls_sw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tls/tls_sw.c +1 -1
@@ -246,6 +246,7 @@ static int tls_decrypt_async_wait(struct tls_sw_context_rx *ctx)crypto_wait_req (-EINPROGRESS , &ctx->async_wait);atomic_inc (&ctx->decrypt_pending); +__skb_queue_purge (&ctx->async_hold);return ctx->async_wait.err; }
@@ -2191,7 +2192,6 @@ int tls_sw_recvmsg(struct sock *sk,/* Wait for all previously submitted records to be decrypted */ ret =tls_decrypt_async_wait (ctx); -__skb_queue_purge (&ctx->async_hold);if (ret) {if (err >=0 || err == -EINPROGRESS )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/175 netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit 52025ebaa29f4eb4ed8bf92ce83a68f24ab7fdf7 ]
__build_packet_message() manually constructs the NFULA_PAYLOAD netlink attribute using skb_put() and skb_copy_bits(), bypassing the standard nla_reserve()/nla_put() helpers. While nla_total_size(data_len) bytes are allocated (including NLA alignment padding), only data_len bytes of actual packet data are copied. The trailing nla_padlen(data_len) bytes (1-3 when data_len is not 4-byte aligned) are never initialized, leaking stale heap contents to userspace via the NFLOG netlink socket.
Replace the manual attribute construction with nla_reserve(), which handles the tailroom check, header setup, and padding zeroing via __nla_reserve(). The subsequent skb_copy_bits() fills in the payload data on top of the properly initialized attribute.
--- net/netfilter/nfnetlink_log.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
net/netfilter/nfnetlink_log.c +2 -6
@@ -647,15 +647,11 @@ __build_packet_message(struct nfnl_log_net *log,if (data_len) {struct nlattr *nla; -int size =nla_attr_size (data_len); -if (skb_tailroom (inst->skb) <nla_total_size (data_len)) + nla =nla_reserve (inst->skb,NFULA_PAYLOAD , data_len); +if (!nla) goto nla_put_failure; - nla =skb_put (inst->skb,nla_total_size (data_len)); - nla->nla_type =NFULA_PAYLOAD ; - nla->nla_len = size; -if (skb_copy_bits (skb,0 ,nla_data (nla), data_len))BUG (); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/175 netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ren Wei <[email protected]>
[ Upstream commit 9d3f027327c2fa265f7f85ead41294792c3296ed ]
Reject rt match rules whose addrnr exceeds IP6T_RT_HOPS.
rt_mt6() expects addrnr to stay within the bounds of rtinfo->addrs[]. Validate addrnr during rule installation so malformed rules are rejected before the match logic can use an out-of-range value.
--- net/ipv6/netfilter/ip6t_rt.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ipv6/netfilter/ip6t_rt.c +4 -0
@@ -157,6 +157,10 @@ static int rt_mt6_check(const struct xt_mtchk_param *par)pr_debug ("unknown flags %X\n" , rtinfo->invflags);return -EINVAL ; } +if (rtinfo->addrnr >IP6T_RT_HOPS ) { +pr_debug ("too many addresses specified\n" ); +return -EINVAL ; + } if ((rtinfo->flags & (IP6T_RT_RES | IP6T_RT_FST_MASK)) && (!(rtinfo->flags & IP6T_RT_TYP) || (rtinfo->rt_type != 0) ||
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/175 netfilter: nf_conntrack_expect: skip expectations in other netns via proc
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 3db5647984de03d9cae0dcddb509b058351f0ee4 ]
Skip expectations that do not reside in this netns.
Similar to e77e6ff502ea ("netfilter: conntrack: do not dump other netns's conntrack entries via proc").
--- net/netfilter/nf_conntrack_expect.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/nf_conntrack_expect.c +4 -0
@@ -627,11 +627,15 @@ static int exp_seq_show(struct seq_file *s, void *v) {struct nf_conntrack_expect *expect;struct nf_conntrack_helper *helper; +struct net *net =seq_file_net (s);struct hlist_node *n = v;char *delim ="" ; expect = hlist_entry(n, struct nf_conntrack_expect, hnode); +if (!net_eq (nf_ct_exp_net (expect), net)) +return 0 ; +if (expect->timeout.function)seq_printf (s,"%ld " ,timer_pending (&expect->timeout) ? (long )(expect->timeout.expires - jiffies)/HZ :0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/175 netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit 6a2b724460cb67caed500c508c2ae5cf012e4db4 ]
process_sdp() declares union nf_inet_addr rtp_addr on the stack and passes it to the nf_nat_sip sdp_session hook after walking the SDP media descriptions. However rtp_addr is only initialized inside the media loop when a recognized media type with a non-zero port is found.
If the SDP body contains no m= lines, only inactive media sections (m=audio 0 ...) or only unrecognized media types, rtp_addr is never assigned. Despite that, the function still calls hooks->sdp_session() with &rtp_addr, causing nf_nat_sdp_session() to format the stale stack value as an IP address and rewrite the SDP session owner and connection lines with it.
With CONFIG_INIT_STACK_ALL_ZERO (default on most distributions) this results in the session-level o= and c= addresses being rewritten to 0.0.0.0 for inactive SDP sessions. Without stack auto-init the rewritten address is whatever happened to be on the stack.
Fix this by pre-initializing rtp_addr from the session-level connection address (caddr) when available, and tracking via a have_rtp_addr flag whether any valid address was established. Skip the sdp_session hook entirely when no valid address exists.
--- net/netfilter/nf_conntrack_sip.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
net/netfilter/nf_conntrack_sip.c +10 -4
@@ -1040,6 +1040,7 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff,unsigned int port;const struct sdp_media_type *t;int ret =NF_ACCEPT ; +bool have_rtp_addr = false; hooks =rcu_dereference (nf_nat_sip_hooks);
@@ -1056,8 +1057,11 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff, caddr_len =0 ;if (ct_sip_parse_sdp_addr (ct, *dptr, sdpoff, *datalen,SDP_HDR_CONNECTION ,SDP_HDR_MEDIA , - &matchoff, &matchlen, &caddr) >0 ) + &matchoff, &matchlen, &caddr) >0 ) { caddr_len = matchlen; +memcpy (&rtp_addr, &caddr,sizeof (rtp_addr)); + have_rtp_addr = true; + } mediaoff = sdpoff;for (i =0 ; i <ARRAY_SIZE (sdp_media_types); ) {
@@ -1091,9 +1095,11 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff, &matchoff, &matchlen, &maddr) > 0) { maddr_len = matchlen;memcpy (&rtp_addr, &maddr,sizeof (rtp_addr)); - } else if (caddr_len) + have_rtp_addr = true; + } else if (caddr_len) {memcpy (&rtp_addr, &caddr,sizeof (rtp_addr)); - else { + have_rtp_addr = true; + } else {nf_ct_helper_log (skb, ct,"cannot parse SDP message" );return NF_DROP ; }
@@ -1125,7 +1131,7 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff,/* Update session connection and owner addresses */ hooks =rcu_dereference (nf_nat_sip_hooks); -if (hooks && ct->status &IPS_NAT_MASK ) +if (hooks && ct->status &IPS_NAT_MASK && have_rtp_addr) ret = hooks->sdp_session (skb, protoff, dataoff, dptr, datalen, sdpoff, &rtp_addr);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/175 netfilter: ctnetlink: use netlink policy range checks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <[email protected]>
[ Upstream commit 8f15b5071b4548b0aafc03b366eb45c9c6566704 ]
Replace manual range and mask validations with netlink policy annotations in ctnetlink code paths, so that the netlink core rejects invalid values early and can generate extack errors.
- CTA_PROTOINFO_TCP_STATE: reject values > TCP_CONNTRACK_SYN_SENT2 at policy level, removing the manual >= TCP_CONNTRACK_MAX check.
- CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values > TCP_MAX_WSCALE (14). The normal TCP option parsing path already clamps to this value, but the ctnetlink path accepted 0-255, causing undefined behavior when used as a u32 shift count.
- CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with CTA_FILTER_F_ALL, removing the manual mask checks.
- CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding a new mask define grouping all valid expect flags.
Extracted from a broader nf-next patch by Florian Westphal, scoped to ctnetlink for the fixes tree.
--- .../uapi/linux/netfilter/nf_conntrack_common.h | 4 ++++ net/netfilter/nf_conntrack_netlink.c | 16 +++++----------- net/netfilter/nf_conntrack_proto_tcp.c | 10 +++------- 3 files changed, 12 insertions(+), 18 deletions(-)
include/uapi/linux/netfilter/nf_conntrack_common.h +4 -0
@@ -159,5 +159,9 @@ enum ip_conntrack_expect_events {#define NF_CT_EXPECT_INACTIVE 0x2#define NF_CT_EXPECT_USERSPACE 0x4 +#ifdef __KERNEL__ +#define NF_CT_EXPECT_MASK (NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE | \ + NF_CT_EXPECT_USERSPACE) +#endif #endif /* _UAPI_NF_CONNTRACK_COMMON_H */
net/netfilter/nf_conntrack_netlink.c +5 -11
@@ -883,8 +883,8 @@ struct ctnetlink_filter { };static const struct nla_policy cta_filter_nla_policy[CTA_FILTER_MAX +1 ] = { - [CTA_FILTER_ORIG_FLAGS ] = { .type =NLA_U32 }, - [CTA_FILTER_REPLY_FLAGS ] = { .type =NLA_U32 }, + [CTA_FILTER_ORIG_FLAGS ] =NLA_POLICY_MASK (NLA_U32 ,CTA_FILTER_F_ALL ), + [CTA_FILTER_REPLY_FLAGS ] =NLA_POLICY_MASK (NLA_U32 ,CTA_FILTER_F_ALL ), }; static int ctnetlink_parse_filter(const struct nlattr *attr,
@@ -898,17 +898,11 @@ static int ctnetlink_parse_filter(const struct nlattr *attr,if (ret)return ret; -if (tb[CTA_FILTER_ORIG_FLAGS ]) { +if (tb[CTA_FILTER_ORIG_FLAGS ]) filter->orig_flags =nla_get_u32 (tb[CTA_FILTER_ORIG_FLAGS ]); -if (filter->orig_flags & ~CTA_FILTER_F_ALL ) -return -EOPNOTSUPP ; - } -if (tb[CTA_FILTER_REPLY_FLAGS ]) { +if (tb[CTA_FILTER_REPLY_FLAGS ]) filter->reply_flags =nla_get_u32 (tb[CTA_FILTER_REPLY_FLAGS ]); -if (filter->reply_flags & ~CTA_FILTER_F_ALL ) -return -EOPNOTSUPP ; - }return 0 ; }
@@ -2622,7 +2616,7 @@ static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = { [CTA_EXPECT_HELP_NAME] = { .type = NLA_NUL_STRING, .len = NF_CT_HELPER_NAME_LEN - 1 }, [CTA_EXPECT_ZONE] = { .type = NLA_U16 }, - [CTA_EXPECT_FLAGS] = { .type = NLA_U32 }, + [CTA_EXPECT_FLAGS] = NLA_POLICY_MASK(NLA_BE32, NF_CT_EXPECT_MASK), [CTA_EXPECT_CLASS] = { .type = NLA_U32 }, [CTA_EXPECT_NAT] = { .type = NLA_NESTED }, [CTA_EXPECT_FN] = { .type = NLA_NUL_STRING },
net/netfilter/nf_conntrack_proto_tcp.c +3 -7
@@ -1384,9 +1384,9 @@ static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla, }static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX +1 ] = { - [CTA_PROTOINFO_TCP_STATE ] = { .type =NLA_U8 }, - [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL ] = { .type =NLA_U8 }, - [CTA_PROTOINFO_TCP_WSCALE_REPLY ] = { .type =NLA_U8 }, + [CTA_PROTOINFO_TCP_STATE ] =NLA_POLICY_MAX (NLA_U8 ,TCP_CONNTRACK_SYN_SENT2 ), + [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL ] =NLA_POLICY_MAX (NLA_U8 ,TCP_MAX_WSCALE ), + [CTA_PROTOINFO_TCP_WSCALE_REPLY ] =NLA_POLICY_MAX (NLA_U8 ,TCP_MAX_WSCALE ), [CTA_PROTOINFO_TCP_FLAGS_ORIGINAL ] = { .len =sizeof (struct nf_ct_tcp_flags ) }, [CTA_PROTOINFO_TCP_FLAGS_REPLY ] = { .len =sizeof (struct nf_ct_tcp_flags ) }, };
@@ -1413,10 +1413,6 @@ static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)if (err <0 )return err; -if (tb[CTA_PROTOINFO_TCP_STATE ] && -nla_get_u8 (tb[CTA_PROTOINFO_TCP_STATE ]) >=TCP_CONNTRACK_MAX ) -return -EINVAL ; -spin_lock_bh (&ct->lock);if (tb[CTA_PROTOINFO_TCP_STATE ]) ct->proto.tcp.state =nla_get_u8 (tb[CTA_PROTOINFO_TCP_STATE ]);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/175 net: macb: use the current queue number for stats
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Valerio <[email protected]>
[ Upstream commit 72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5 ]
There's a potential mismatch between the memory reserved for statistics and the amount of memory written.
gem_get_sset_count() correctly computes the number of stats based on the active queues, whereas gem_get_ethtool_stats() indiscriminately copies data using the maximum number of queues, and in the case the number of active queues is less than MACB_MAX_QUEUES, this results in a OOB write as observed in the KASAN splat.
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78 [macb] Write of size 760 at addr ffff80008080b000 by task ethtool/1027
CPU: [...]
Tainted: [E]=UNSIGNED_MODULE
Hardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025
Call trace:
show_stack+0x20/0x38 (C)
dump_stack_lvl+0x80/0xf8
print_report+0x384/0x5e0
kasan_report+0xa0/0xf0
kasan_check_range+0xe8/0x190
__asan_memcpy+0x54/0x98
gem_get_ethtool_stats+0x54/0x78 [macb
926c13f3af83b0c6fe64badb21ec87d5e93fcf65]
dev_ethtool+0x1220/0x38c0
dev_ioctl+0x4ac/0xca8
sock_do_ioctl+0x170/0x1d8
sock_ioctl+0x484/0x5d8
__arm64_sys_ioctl+0x12c/0x1b8
invoke_syscall+0xd4/0x258
el0_svc_common.constprop.0+0xb4/0x240
do_el0_svc+0x48/0x68
el0_svc+0x40/0xf8
el0t_64_sync_handler+0xa0/0xe8
el0t_64_sync+0x1b0/0x1b8
The buggy address belongs to a 1-page vmalloc region starting at
0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000
index:0xffff00000a333000 pfn:0xa333
flags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff)
raw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff80008080b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff80008080b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff80008080b180: 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
^
ffff80008080b200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
ffff80008080b280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================Fix it by making sure the copied size only considers the active number of queues.
--- drivers/net/ethernet/cadence/macb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cadence/macb_main.c +1 -1
@@ -3255,7 +3255,7 @@ static void gem_get_ethtool_stats(struct net_device *dev,spin_lock_irq (&bp->stats_lock);gem_update_stats (bp);memcpy (data, &bp->ethtool_stats,sizeof (u64) - * (GEM_STATS_LEN +QUEUE_STATS_LEN *MACB_MAX_QUEUES )); + * (GEM_STATS_LEN +QUEUE_STATS_LEN * bp->num_queues));spin_unlock_irq (&bp->stats_lock); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/175 regmap: Synchronize cache for the page selector
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 09e70e4f119ff650d24c96161fd2f62ac7e424b0 ]
If the selector register is represented in each page, its value according to the debugfs is stale because it gets synchronized only after the real page switch happens. Hence the regmap cache initialisation from the HW inherits outdated data in the selector register.
Synchronize cache for the page selector just in time.
Before (offset followed by hexdump, the first byte is selector):
// Real registers
18: 05 ff 00 00 ff 0f 00 00 f0 00 00 00
...
// Virtual (per port)
40: 05 ff 00 00 e0 e0 00 00 00 00 00 1f
50: 00 ff 00 00 e0 e0 00 00 00 00 00 1f
60: 01 ff 00 00 ff ff 00 00 00 00 00 00
70: 02 ff 00 00 cf f3 00 00 00 00 00 0c
80: 03 ff 00 00 00 00 00 00 00 00 00 ff
90: 04 ff 00 00 ff 0f 00 00 f0 00 00 00After:
// Real registers
18: 05 ff 00 00 ff 0f 00 00 f0 00 00 00
...
// Virtual (per port)
40: 00 ff 00 00 e0 e0 00 00 00 00 00 1f
50: 01 ff 00 00 e0 e0 00 00 00 00 00 1f
60: 02 ff 00 00 ff ff 00 00 00 00 00 00
70: 03 ff 00 00 cf f3 00 00 00 00 00 0c
80: 04 ff 00 00 00 00 00 00 00 00 00 ff
90: 05 ff 00 00 ff 0f 00 00 f0 00 00 00--- drivers/base/regmap/regmap.c | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-)
drivers/base/regmap/regmap.c +26 -4
@@ -1541,6 +1541,7 @@ static int _regmap_select_page(struct regmap *map, unsigned int *reg, unsigned int val_num) {void *orig_work_buf; +unsigned int selector_reg;unsigned int win_offset;unsigned int win_page;bool page_chg;
@@ -1559,10 +1560,31 @@ static int _regmap_select_page(struct regmap *map, unsigned int *reg,return -EINVAL ; } -/* It is possible to have selector register inside data window. -In that case, selector register is located on every page and -it needs no page switching, when accessed alone. */ +/* +* Calculate the address of the selector register in the corresponding +* data window if it is located on every page. +*/ + page_chg =in_range (range->selector_reg, range->window_start, range->window_len); +if (page_chg) + selector_reg = range->range_min + win_page * range->window_len + + range->selector_reg - range->window_start; + +/* +* It is possible to have selector register inside data window. +* In that case, selector register is located on every page and it +* needs no page switching, when accessed alone. +* +* Nevertheless we should synchronize the cache values for it. +* This can't be properly achieved if the selector register is +* the first and the only one to be read inside the data window. +* That's why we update it in that case as well. +* +* However, we specifically avoid updating it for the default page, +* when it's overlapped with the real data window, to prevent from +* infinite looping. +*/ if (val_num >1 || + (page_chg && selector_reg != range->selector_reg) || range->window_start + win_offset != range->selector_reg) {/* Use separate work_buf during page switching */ orig_work_buf = map->work_buf;
@@ -1571,7 +1593,7 @@ static int _regmap_select_page(struct regmap *map, unsigned int *reg, ret =_regmap_update_bits (map, range->selector_reg, range->selector_mask, win_page << range->selector_shift, - &page_chg, false); +NULL , false); map->work_buf = orig_work_buf;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 76/175 RDMA/rw: Fall back to direct SGE on MR pool exhaustion
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 00da250c21b074ea9494c375d0117b69e5b1d0a4 ]
When IOMMU passthrough mode is active, ib_dma_map_sgtable_attrs() produces no coalescing: each scatterlist page maps 1:1 to a DMA entry, so sgt.nents equals the raw page count. A 1 MB transfer yields 256 DMA entries. If that count exceeds the device's max_sgl_rd threshold (an optimization hint from mlx5 firmware), rdma_rw_io_needs_mr() steers the operation into the MR registration path. Each such operation consumes one or more MRs from a pool sized at max_rdma_ctxs -- roughly one MR per concurrent context. Under write-intensive workloads that issue many concurrent RDMA READs, the pool is rapidly exhausted, ib_mr_pool_get() returns NULL, and rdma_rw_init_one_mr() returns -EAGAIN. Upper layer protocols treat this as a fatal DMA mapping failure and tear down the connection.
The max_sgl_rd check is a performance optimization, not a correctness requirement: the device can handle large SGE counts via direct posting, just less efficiently than with MR registration. When the MR pool cannot satisfy a request, falling back to the direct SGE (map_wrs) path avoids the connection reset while preserving the MR optimization for the common case where pool resources are available.
Add a fallback in rdma_rw_ctx_init() so that -EAGAIN from rdma_rw_init_mr_wrs() triggers direct SGE posting instead of propagating the error. iWARP devices, which mandate MR registration for RDMA READs, and force_mr debug mode continue to treat -EAGAIN as terminal.
--- drivers/infiniband/core/rw.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
drivers/infiniband/core/rw.c +18 -3
@@ -326,14 +326,29 @@ int rdma_rw_ctx_init(struct rdma_rw_ctx *ctx, struct ib_qp *qp, u32 port_num,if (rdma_rw_io_needs_mr (qp->device, port_num, dir, sg_cnt)) { ret =rdma_rw_init_mr_wrs (ctx, qp, port_num, sg, sg_cnt, sg_offset, remote_addr, rkey, dir); - }else if (sg_cnt >1 ) { +/* +* If MR init succeeded or failed for a reason other +* than pool exhaustion, that result is final. +* +* Pool exhaustion (-EAGAIN) from the max_sgl_rd +* optimization is recoverable: fall back to +* direct SGE posting. iWARP and force_mr require +* MRs unconditionally, so -EAGAIN is terminal. +*/ +if (ret != -EAGAIN || +rdma_protocol_iwarp (qp->device, port_num) || +unlikely (rdma_rw_force_mr)) + goto out; + } + +if (sg_cnt >1 ) ret =rdma_rw_init_map_wrs (ctx, qp, sg, sg_cnt, sg_offset, remote_addr, rkey, dir); - }else { +else ret =rdma_rw_init_single_wr (ctx, qp, sg, sg_offset, remote_addr, rkey, dir); - } +out:if (ret <0 ) goto out_unmap_sg;return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 77/175 RDMA/irdma: Initialize free_qp completion before using it
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <[email protected]>
[ Upstream commit 11a95521fb93c91e2d4ef9d53dc80ef0a755549b ]
In irdma_create_qp, if ib_copy_to_udata fails, it will call irdma_destroy_qp to clean up which will attempt to wait on the free_qp completion, which is not initialized yet. Fix this by initializing the completion before the ib_copy_to_udata call.
--- drivers/infiniband/hw/irdma/verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/irdma/verbs.c +1 -1
@@ -1008,6 +1008,7 @@ static int irdma_create_qp(struct ib_qp *ibqp,spin_lock_init (&iwqp->sc_qp.pfpdu.lock); iwqp->sig_all = init_attr->sq_sig_type ==IB_SIGNAL_ALL_WR ; rf->qp_table[qp_num] = iwqp; +init_completion (&iwqp->free_qp);if (rdma_protocol_roce (&iwdev->ibdev,1 )) {if (dev->ws_add (&iwdev->vsi,0 )) {
@@ -1042,7 +1043,6 @@ static int irdma_create_qp(struct ib_qp *ibqp, } } -init_completion (&iwqp->free_qp);return 0 ; error:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 78/175 RDMA/irdma: Update ibqp state to error if QP is already in error state
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tatyana Nikolova <[email protected]>
[ Upstream commit 8c1f19a2225cf37b3f8ab0b5a8a5322291cda620 ]
In irdma_modify_qp() update ibqp state to error if the irdma QP is already in error state, otherwise the ibqp state which is visible to the consumer app remains stale.
--- drivers/infiniband/hw/irdma/verbs.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/infiniband/hw/irdma/verbs.c +2 -0
@@ -1442,6 +1442,7 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr,case IB_QPS_ERR :case IB_QPS_RESET :if (iwqp->iwarp_state ==IRDMA_QP_STATE_ERROR ) { + iwqp->ibqp_state = attr->qp_state;spin_unlock_irqrestore (&iwqp->lock, flags);if (udata && udata->inlen) { if (ib_copy_from_udata(&ureq, udata,
@@ -1647,6 +1648,7 @@ int irdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,case IB_QPS_ERR :case IB_QPS_RESET :if (iwqp->iwarp_state ==IRDMA_QP_STATE_ERROR ) { + iwqp->ibqp_state = attr->qp_state;spin_unlock_irqrestore (&iwqp->lock, flags);if (udata && udata->inlen) { if (ib_copy_from_udata(&ureq, udata,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 79/175 RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tatyana Nikolova <[email protected]>
[ Upstream commit 5e8f0239731a83753473b7aa91bda67bbdff5053 ]
Remove a NOP wait_event() in irdma_modify_qp_roce() which is relevant for iWARP and likely a copy and paste artifact for RoCEv2. The wait event is for sending a reset on a TCP connection, after the reset has been requested in irdma_modify_qp(), which occurs only in iWarp mode.
--- drivers/infiniband/hw/irdma/verbs.c | 2 -- 1 file changed, 2 deletions(-)
drivers/infiniband/hw/irdma/verbs.c +0 -2
@@ -1364,8 +1364,6 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, roce_info->rd_en = true; } -wait_event (iwqp->mod_qp_waitq, !atomic_read (&iwqp->hw_mod_qp_pend)); - ibdev_dbg(&iwdev->ibdev, "VERBS: caller: %pS qp_id=%d to_ibqpstate=%d ibqpstate=%d irdma_qpstate=%d attr_mask=0x%x\n", __builtin_return_address(0), ibqp->qp_num, attr->qp_state,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 80/175 RDMA/irdma: Clean up unnecessary dereference of event->cm_node
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Barrera <[email protected]>
[ Upstream commit b415399c9a024d574b65479636f0d4eb625b9abd ]
The cm_node is available and the usage of cm_node and event->cm_node seems arbitrary. Clean up unnecessary dereference of event->cm_node.
--- drivers/infiniband/hw/irdma/cm.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/infiniband/hw/irdma/cm.c +6 -6
@@ -4237,21 +4237,21 @@ static void irdma_cm_event_handler(struct work_struct *work)irdma_cm_event_reset (event);break ;case IRDMA_CM_EVENT_CONNECTED : -if (!event->cm_node->cm_id || - event->cm_node->state !=IRDMA_CM_STATE_OFFLOADED ) +if (!cm_node->cm_id || + cm_node->state !=IRDMA_CM_STATE_OFFLOADED )break ;irdma_cm_event_connected (event);break ;case IRDMA_CM_EVENT_MPA_REJECT : -if (!event->cm_node->cm_id || +if (!cm_node->cm_id || cm_node->state ==IRDMA_CM_STATE_OFFLOADED )break ;irdma_send_cm_event (cm_node, cm_node->cm_id,IW_CM_EVENT_CONNECT_REPLY , -ECONNREFUSED );break ;case IRDMA_CM_EVENT_ABORTED : -if (!event->cm_node->cm_id || - event->cm_node->state ==IRDMA_CM_STATE_OFFLOADED ) +if (!cm_node->cm_id || + cm_node->state ==IRDMA_CM_STATE_OFFLOADED )break ;irdma_event_connect_error (event);break ;
@@ -4261,7 +4261,7 @@ static void irdma_cm_event_handler(struct work_struct *work)break ; } -irdma_rem_ref_cm_node (event->cm_node); +irdma_rem_ref_cm_node (cm_node);kfree (event); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 81/175 RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tatyana Nikolova <[email protected]>
[ Upstream commit c45c6ebd693b944f1ffe429fdfb6cc1674c237be ]
During reset, irdma_modify_qp() to error should be called to disconnect the QP. Without this fix, if not preceded by irdma_modify_qp() to error, the API call irdma_destroy_qp() gets stuck waiting for the QP refcount to go to zero, because the cm_node associated with this QP isn't disconnected.
--- drivers/infiniband/hw/irdma/utils.c | 2 -- 1 file changed, 2 deletions(-)
drivers/infiniband/hw/irdma/utils.c +0 -2
@@ -2345,8 +2345,6 @@ void irdma_modify_qp_to_err(struct irdma_sc_qp *sc_qp)struct irdma_qp *qp = sc_qp->qp_uk.back_qp;struct ib_qp_attr attr; -if (qp->iwdev->rf->reset) -return ; attr.qp_state =IB_QPS_ERR ;if (rdma_protocol_roce (qp->ibqp.device,1 ))
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 82/175 RDMA/irdma: Fix deadlock during netdev reset with active connections
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anil Samal <[email protected]>
[ Upstream commit 6f52370970ac07d352a7af4089e55e0e6425f827 ]
Resolve deadlock that occurs when user executes netdev reset while RDMA applications (e.g., rping) are active. The netdev reset causes ice driver to remove irdma auxiliary driver, triggering device_delete and subsequent client removal. During client removal, uverbs_client waits for QP reference count to reach zero while cma_client holds the final reference, creating circular dependency and indefinite wait in iWARP mode. Skip QP reference count wait during device reset to prevent deadlock.
--- drivers/infiniband/hw/irdma/verbs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/hw/irdma/verbs.c +2 -1
@@ -536,7 +536,8 @@ static int irdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata) }irdma_qp_rem_ref (&iwqp->ibqp); -wait_for_completion (&iwqp->free_qp); +if (!iwdev->rf->reset) +wait_for_completion (&iwqp->free_qp);irdma_free_lsmm_rsrc (iwqp);irdma_cqp_qp_destroy_cmd (&iwdev->rf->sc_dev, &iwqp->sc_qp);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 83/175 RDMA/irdma: Return EINVAL for invalid arp index error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tatyana Nikolova <[email protected]>
[ Upstream commit 7221f581eefa79ead06e171044f393fb7ee22f87 ]
When rdma_connect() fails due to an invalid arp index, user space rdma core reports ENOMEM which is confusing. Modify irdma_make_cm_node() to return the correct error code.
--- drivers/infiniband/hw/irdma/cm.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
drivers/infiniband/hw/irdma/cm.c +10 -7
@@ -2239,11 +2239,12 @@ irdma_make_cm_node(struct irdma_cm_core *cm_core, struct irdma_device *iwdev,int oldarpindex;int arpindex;struct net_device *netdev = iwdev->netdev; +int ret;/* create an hte and cm_node for this instance */ cm_node =kzalloc (sizeof (*cm_node),GFP_ATOMIC );if (!cm_node) -return NULL ; +return ERR_PTR (-ENOMEM );/* set our node specific transport info */ cm_node->ipv4 = cm_info->ipv4;
@@ -2346,8 +2347,10 @@ irdma_make_cm_node(struct irdma_cm_core *cm_core, struct irdma_device *iwdev, arpindex = -EINVAL ; } -if (arpindex <0 ) +if (arpindex <0 ) { + ret = -EINVAL ; goto err; + }ether_addr_copy (cm_node->rem_mac, iwdev->rf->arp_table[arpindex].mac_addr);
@@ -2358,7 +2361,7 @@ irdma_make_cm_node(struct irdma_cm_core *cm_core, struct irdma_device *iwdev, err:kfree (cm_node); -return NULL ; +return ERR_PTR (ret); }static void irdma_destroy_connection (struct irdma_cm_node *cm_node)
@@ -3019,8 +3022,8 @@ static int irdma_create_cm_node(struct irdma_cm_core *cm_core,/* create a CM connection node */ cm_node =irdma_make_cm_node (cm_core, iwdev, cm_info,NULL ); -if (!cm_node) -return -ENOMEM ; +if (IS_ERR (cm_node)) +return PTR_ERR (cm_node);/* set our node side to client (active) side */ cm_node->tcp_cntxt.client =1 ;
@@ -3217,9 +3220,9 @@ void irdma_receive_ilq(struct irdma_sc_vsi *vsi, struct irdma_puda_buf *rbuf) cm_info.cm_id = listener->cm_id; cm_node =irdma_make_cm_node (cm_core, iwdev, &cm_info, listener); -if (!cm_node) { +if (IS_ERR (cm_node)) {ibdev_dbg (&cm_core->iwdev->ibdev, -"CM: allocate node failed\n" ); +"CM: allocate node failed ret=%ld\n" ,PTR_ERR (cm_node));refcount_dec (&listener->refcnt);return ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 84/175 scsi: scsi_transport_sas: Fix the maximum channel scanning issue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <[email protected]>
[ Upstream commit d71afa9deb4d413232ba16d693f7d43b321931b4 ]
After commit 37c4e72b0651 ("scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"), if the device supports multiple channels (0 to shost->max_channel), user_scan() invokes updated sas_user_scan() to perform the scan behavior for a specific transfer. However, when the user specifies shost->max_channel, it will return -EINVAL, which is not expected.
Fix and support specifying the scan shost->max_channel for scanning.
--- drivers/scsi/scsi_transport_sas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/scsi_transport_sas.c +1 -1
@@ -1732,7 +1732,7 @@ static int sas_user_scan(struct Scsi_Host *shost, uint channel,break ;default : -if (channel < shost->max_channel) { +if (channel <= shost->max_channel) { res =scsi_scan_host_selected (shost, channel, id, lun,SCSI_SCAN_MANUAL ); }else {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 85/175 x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (Microsoft) <[email protected]>
[ Upstream commit 217c0a5c177a3d4f7c8497950cbf5c36756e8bbb ]
ranges_to_free array should have enough room to store the entire EFI memmap plus an extra element for NULL entry.
The calculation of this array size wrongly adds 1 to the overall size instead of adding 1 to the number of elements.
Add parentheses to properly size the array.
--- arch/x86/platform/efi/quirks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/platform/efi/quirks.c +1 -1
@@ -424,7 +424,7 @@ void __init efi_unmap_boot_services(void)if (efi_enabled (EFI_DBG ))return ; - sz =sizeof (*ranges_to_free) * efi.memmap.nr_map +1 ; + sz =sizeof (*ranges_to_free) * (efi.memmap.nr_map +1 ); ranges_to_free =kzalloc (sz,GFP_KERNEL );if (!ranges_to_free) {pr_err ("Failed to allocate storage for freeable EFI regions\n" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 86/175 drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samasth Norway Ananda <[email protected]>
[ Upstream commit 08441f10f4dc09fdeb64529953ac308abc79dd38 ]
When reading exactly 512 bytes with burst read enabled, the extra_byte_added path breaks out of the inner do-while without decrementing len. The outer while(len) then re-enters and gmbus_wait() times out since all data has been delivered. Decrement len before the break so the outer loop terminates correctly.
--- drivers/gpu/drm/i915/display/intel_gmbus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/display/intel_gmbus.c +3 -1
@@ -460,8 +460,10 @@ gmbus_xfer_read_chunk(struct drm_i915_private *i915, val =intel_de_read_fw (i915,GMBUS3 (i915)); do { - if (extra_byte_added && len == 1) + if (extra_byte_added && len == 1) { + len--; break; + } *buf++ = val & 0xff; val >>= 8;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 87/175 PM: hibernate: Dont ignore return from set_memory_ro()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit f4311756a83fb01c28a9bf841cbb7eb2b318eebf ]
set_memory_ro() and set_memory_rw() can fail, leaving memory unprotected.
Take the returned value into account and abort in case of failure.
Stable-dep-of: 734eba62cd32 ("PM: hibernate: Drain trailing zero pages on userspace restore")
--- kernel/power/power.h | 2 +- kernel/power/snapshot.c | 25 ++++++++++++++++--------- kernel/power/swap.c | 8 ++++---- kernel/power/user.c | 4 +++- 4 files changed, 24 insertions(+), 15 deletions(-)
kernel/power/power.h +1 -1
@@ -152,7 +152,7 @@ extern unsigned int snapshot_additional_pages(struct zone *zone);extern unsigned long snapshot_get_image_size (void );extern int snapshot_read_next (struct snapshot_handle *handle);extern int snapshot_write_next (struct snapshot_handle *handle); -extern void snapshot_write_finalize (struct snapshot_handle *handle); +int snapshot_write_finalize (struct snapshot_handle *handle);extern int snapshot_image_loaded (struct snapshot_handle *handle);extern bool hibernate_acquire (void );
kernel/power/snapshot.c +16 -9
@@ -58,22 +58,24 @@ static inline void hibernate_restore_protection_end(void) hibernate_restore_protection_active = false; } -static inline void hibernate_restore_protect_page (void *page_address) +static inline int __must_check hibernate_restore_protect_page (void *page_address) {if (hibernate_restore_protection_active) -set_memory_ro ((unsigned long )page_address,1 ); +return set_memory_ro ((unsigned long )page_address,1 ); +return 0 ; } -static inline void hibernate_restore_unprotect_page (void *page_address) +static inline int hibernate_restore_unprotect_page (void *page_address) {if (hibernate_restore_protection_active) -set_memory_rw ((unsigned long )page_address,1 ); +return set_memory_rw ((unsigned long )page_address,1 ); +return 0 ; }#else static inline void hibernate_restore_protection_begin (void ) {}static inline void hibernate_restore_protection_end (void ) {} -static inline void hibernate_restore_protect_page (void *page_address) {} -static inline void hibernate_restore_unprotect_page (void *page_address) {} +static inline int __must_check hibernate_restore_protect_page (void *page_address) {return 0 ; } +static inline int hibernate_restore_unprotect_page (void *page_address) {return 0 ; }#endif /* CONFIG_STRICT_KERNEL_RWX && CONFIG_ARCH_HAS_SET_MEMORY */
@@ -2832,7 +2834,9 @@ int snapshot_write_next(struct snapshot_handle *handle) } }else {copy_last_highmem_page (); -hibernate_restore_protect_page (handle->buffer); + error =hibernate_restore_protect_page (handle->buffer); +if (error) +return error; handle->buffer =get_buffer (&orig_bm, &ca);if (IS_ERR (handle->buffer))return PTR_ERR (handle->buffer);
@@ -2858,15 +2862,18 @@ int snapshot_write_next(struct snapshot_handle *handle)* stored in highmem. Additionally, it recycles bitmap memory that's not * necessary any more. */ -void snapshot_write_finalize (struct snapshot_handle *handle) +int snapshot_write_finalize (struct snapshot_handle *handle) { +int error; +copy_last_highmem_page (); -hibernate_restore_protect_page (handle->buffer); + error =hibernate_restore_protect_page (handle->buffer);/* Do that only if we have loaded the image entirely */ if (handle->cur >1 && handle->cur > nr_meta_pages + nr_copy_pages + nr_zero_pages) {memory_bm_recycle (&orig_bm);free_highmem_data (); } +return error; }int snapshot_image_loaded (struct snapshot_handle *handle)
kernel/power/swap.c +4 -4
@@ -1099,8 +1099,8 @@ static int load_image(struct swap_map_handle *handle, ret = err2;if (!ret) {pr_info ("Image loading done\n" ); -snapshot_write_finalize (snapshot); -if (!snapshot_image_loaded (snapshot)) + ret =snapshot_write_finalize (snapshot); +if (!ret && !snapshot_image_loaded (snapshot)) ret = -ENODATA ; }swsusp_show_speed (start, stop, nr_to_read,"Read" );
@@ -1440,8 +1440,8 @@ static int load_image_lzo(struct swap_map_handle *handle, stop =ktime_get ();if (!ret) {pr_info ("Image loading done\n" ); -snapshot_write_finalize (snapshot); -if (!snapshot_image_loaded (snapshot)) + ret =snapshot_write_finalize (snapshot); +if (!ret && !snapshot_image_loaded (snapshot)) ret = -ENODATA ;if (!ret) {if (swsusp_header->flags &SF_CRC32_MODE ) {
kernel/power/user.c +3 -1
@@ -317,7 +317,9 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,break ;case SNAPSHOT_ATOMIC_RESTORE : -snapshot_write_finalize (&data->handle); + error =snapshot_write_finalize (&data->handle); +if (error) +break ;if (data->mode !=O_WRONLY || !data->frozen || !snapshot_image_loaded (&data->handle)) { error = -EPERM ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 88/175 PM: hibernate: Drain trailing zero pages on userspace restore
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alberto Garcia <[email protected]>
[ Upstream commit 734eba62cd32cb9ceffa09e57cdc03d761528525 ]
Commit 005e8dddd497 ("PM: hibernate: don't store zero pages in the image file") added an optimization to skip zero-filled pages in the hibernation image. On restore, zero pages are handled internally by snapshot_write_next() in a loop that processes them without returning to the caller.
With the userspace restore interface, writing the last non-zero page to /dev/snapshot is followed by the SNAPSHOT_ATOMIC_RESTORE ioctl. At this point there are no more calls to snapshot_write_next() so any trailing zero pages are not processed, snapshot_image_loaded() fails because handle->cur is smaller than expected, the ioctl returns -EPERM and the image is not restored.
The in-kernel restore path is not affected by this because the loop in load_image() in swap.c calls snapshot_write_next() until it returns 0. It is this final call that drains any trailing zero pages.
Fixed by calling snapshot_write_next() in snapshot_write_finalize(), giving the kernel the chance to drain any trailing zero pages.
--- kernel/power/snapshot.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
kernel/power/snapshot.c +11 -0
@@ -2866,6 +2866,17 @@ int snapshot_write_finalize(struct snapshot_handle *handle) {int error; +/* +* Call snapshot_write_next() to drain any trailing zero pages, +* but make sure we're in the data page region first. +* This function can return PAGE_SIZE if the kernel was expecting +* another copy page. Return -ENODATA in that situation. +*/ +if (handle->cur > nr_meta_pages +1 ) { + error =snapshot_write_next (handle); +if (error) +return error >0 ? -ENODATA : error; + }copy_last_highmem_page (); error =hibernate_restore_protect_page (handle->buffer);/* Do that only if we have loaded the image entirely */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 89/175 spi: sn-f-ospi: Fix resource leak in f_ospi_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
[ Upstream commit ef3d549e1deb3466c61f3b01d22fc3fe3e5efb08 ]
In f_ospi_probe(), when num_cs validation fails, it returns without calling spi_controller_put() on the SPI controller, which causes a resource leak.
Use devm_spi_alloc_host() instead of spi_alloc_host() to ensure the SPI controller is properly freed when probe fails.
--- drivers/spi/spi-sn-f-ospi.c | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-)
drivers/spi/spi-sn-f-ospi.c +5 -12
@@ -609,7 +609,7 @@ static int f_ospi_probe(struct platform_device *pdev)u32 num_cs =OSPI_NUM_CS ;int ret; - ctlr =spi_alloc_host (dev,sizeof (*ospi)); + ctlr =devm_spi_alloc_host (dev,sizeof (*ospi));if (!ctlr)return -ENOMEM ;
@@ -632,16 +632,12 @@ static int f_ospi_probe(struct platform_device *pdev)platform_set_drvdata (pdev, ospi); ospi->base =devm_platform_ioremap_resource (pdev,0 ); -if (IS_ERR (ospi->base)) { - ret =PTR_ERR (ospi->base); - goto err_put_ctlr; - } +if (IS_ERR (ospi->base)) +return PTR_ERR (ospi->base); ospi->clk =devm_clk_get_enabled (dev,NULL ); -if (IS_ERR (ospi->clk)) { - ret =PTR_ERR (ospi->clk); - goto err_put_ctlr; - } +if (IS_ERR (ospi->clk)) +return PTR_ERR (ospi->clk);mutex_init (&ospi->mlock);
@@ -658,9 +654,6 @@ static int f_ospi_probe(struct platform_device *pdev) err_destroy_mutex:mutex_destroy (&ospi->mlock); -err_put_ctlr: -spi_controller_put (ctlr); -return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 90/175 ASoC: Intel: catpt: Fix the device initialization
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <[email protected]>
[ Upstream commit 5a184f1cb43a8e035251c635f5c47da5dc3e3049 ]
The DMA mask shall be coerced before any buffer allocations for the device are done. At the same time explain why DMA mask of 31 bits is used in the first place.
--- sound/soc/intel/catpt/device.c | 10 +++++++++- sound/soc/intel/catpt/dsp.c | 3 --- 2 files changed, 9 insertions(+), 4 deletions(-)
sound/soc/intel/catpt/device.c +9 -1
@@ -271,7 +271,15 @@ static int catpt_acpi_probe(struct platform_device *pdev)if (IS_ERR (cdev->pci_ba))return PTR_ERR (cdev->pci_ba); -/* alloc buffer for storing DRAM context during dx transitions */ +/* +* As per design HOST is responsible for preserving firmware's runtime +* context during D0 -> D3 -> D0 transitions. Addresses used for DMA +* to/from HOST memory shall be outside the reserved range of 0xFFFxxxxx. +*/ + ret =dma_coerce_mask_and_coherent (cdev->dev,DMA_BIT_MASK (31 )); +if (ret) +return ret; + cdev->dxbuf_vaddr =dmam_alloc_coherent (dev,catpt_dram_size (cdev), &cdev->dxbuf_paddr,GFP_KERNEL );if (!cdev->dxbuf_vaddr)
sound/soc/intel/catpt/dsp.c +0 -3
@@ -125,9 +125,6 @@ int catpt_dmac_probe(struct catpt_dev *cdev) dmac->dev = cdev->dev; dmac->irq = cdev->irq; - ret =dma_coerce_mask_and_coherent (cdev->dev,DMA_BIT_MASK (31 )); -if (ret) -return ret;/* * Caller is responsible for putting device in D0 to allow * for I/O and memory access before probing DW.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 91/175 ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit f6484cadbcaf26b5844b51bd7307a663dda48ef6 ]
When ec_install_handlers() returns -EPROBE_DEFER on reduced-hardware platforms, it has already started the EC and installed the address space handler with the struct acpi_ec pointer as handler context. However, acpi_ec_setup() propagates the error without any cleanup.
The caller acpi_ec_add() then frees the struct acpi_ec for non-boot instances, leaving a dangling handler context in ACPICA.
Any subsequent AML evaluation that accesses an EC OpRegion field dispatches into acpi_ec_space_handler() with the freed pointer, causing a use-after-free:
BUG: KASAN: slab-use-after-free in mutex_lock (kernel/locking/mutex.c:289) Write of size 8 at addr ffff88800721de38 by task init/1 Call Trace: <TASK> mutex_lock (kernel/locking/mutex.c:289) acpi_ec_space_handler (drivers/acpi/ec.c:1362) acpi_ev_address_space_dispatch (drivers/acpi/acpica/evregion.c:293) acpi_ex_access_region (drivers/acpi/acpica/exfldio.c:246) acpi_ex_field_datum_io (drivers/acpi/acpica/exfldio.c:509) acpi_ex_extract_from_field (drivers/acpi/acpica/exfldio.c:700) acpi_ex_read_data_from_field (drivers/acpi/acpica/exfield.c:327) acpi_ex_resolve_node_to_value (drivers/acpi/acpica/exresolv.c:392) </TASK> Allocated by task 1: acpi_ec_alloc (drivers/acpi/ec.c:1424) acpi_ec_add (drivers/acpi/ec.c:1692) Freed by task 1: kfree (mm/slub.c:6876) acpi_ec_add (drivers/acpi/ec.c:1751)
The bug triggers on reduced-hardware EC platforms (ec->gpe < 0) when the GPIO IRQ provider defers probing. Once the stale handler exists, any unprivileged sysfs read that causes AML to touch an EC OpRegion (battery, thermal, backlight) exercises the dangling pointer.
Fix this by calling ec_remove_handlers() in the error path of acpi_ec_setup() before clearing first_ec. ec_remove_handlers() checks each EC_FLAGS_* bit before acting, so it is safe to call regardless of how far ec_install_handlers() progressed:
-ENODEV (handler not installed): only calls acpi_ec_stop() -EPROBE_DEFER (handler installed): removes handler, stops EC
--- drivers/acpi/ec.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/acpi/ec.c +2 -0
@@ -1653,6 +1653,8 @@ static int acpi_ec_setup(struct acpi_ec *ec, struct acpi_device *device, bool ca ret =ec_install_handlers (ec, device, call_reg);if (ret) { +ec_remove_handlers (ec); +if (ec == first_ec) first_ec =NULL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 92/175 drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 7150850146ebfa4ca998f653f264b8df6f7f85be ]
amdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence from amdgpu_ib_schedule(). This fence is used to wait for job completion.
Currently, the code drops the fence reference using dma_fence_put() before calling dma_fence_wait().
If dma_fence_put() releases the last reference, the fence may be freed before dma_fence_wait() is called. This can lead to a use-after-free.
Fix this by waiting on the fence first and releasing the reference only after dma_fence_wait() completes.
Fixes the below:drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory 'f' (line 696)
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c +2 -2
@@ -670,9 +670,9 @@ int amdgpu_amdkfd_submit_ib(struct amdgpu_device *adev, goto err_ib_sched; } -/* Drop the initial kref_init count (see drm_sched_main as example) */ -dma_fence_put (f); ret =dma_fence_wait (f, false); +/* Drop the returned fence reference after the wait completes */ +dma_fence_put (f); err_ib_sched:amdgpu_job_free (job);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 93/175 hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
[ Upstream commit bf08749a6abb6d1959bfdc0edc32c640df407558 ]
The adm1177 driver exposes the current alert threshold through hwmon_curr_max_alarm. This violates the hwmon sysfs ABI, where *_alarm attributes are read-only status flags and writable thresholds must use currN_max.
The driver also stores the threshold internally in microamps, while currN_max is defined in milliamps. Convert the threshold accordingly on both the read and write paths.
Widen the cached threshold and related calculations to 64 bits so that small shunt resistor values do not cause truncation or overflow. Also use 64-bit arithmetic for the mA/uA conversions, clamp writes to the range the hardware can represent, and propagate failures from adm1177_write_alert_thr() instead of silently ignoring them.
Update the hwmon documentation to reflect the attribute rename and the correct units returned by the driver.
--- Documentation/hwmon/adm1177.rst | 8 ++--- drivers/hwmon/adm1177.c | 54 +++++++++++++++++++-------------- 2 files changed, 35 insertions(+), 27 deletions(-)
Documentation/hwmon/adm1177.rst +4 -4
@@ -27,10 +27,10 @@ for details. Sysfs entries ------------- -The following attributes are supported. Current maxim attribute +The following attributes are supported. Current maximum attribute is read-write, all other attributes are read-only. -in0_input Measured voltage in microvolts. +in0_input Measured voltage in millivolts. -curr1_input Measured current in microamperes. -curr1_max_alarm Overcurrent alarm in microamperes. +curr1_input Measured current in milliamperes. +curr1_max Overcurrent shutdown threshold in milliamperes.
drivers/hwmon/adm1177.c +31 -23
111 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 94/175 sysctl: fix uninitialized variable in proc_do_large_bitmap
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Buerg <[email protected]>
[ Upstream commit f63a9df7e3f9f842945d292a19d9938924f066f9 ]
proc_do_large_bitmap() does not initialize variable c, which is expected to be set to a trailing character by proc_get_long().
However, proc_get_long() only sets c when the input buffer contains a trailing character after the parsed value.
If c is not initialized it may happen to contain a '-'. If this is the case proc_do_large_bitmap() expects to be able to parse a second part of the input buffer. If there is no second part an unjustified -EINVAL will be returned.
Initialize c to 0 to prevent returning -EINVAL on valid input.
--- kernel/sysctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sysctl.c +1 -1
@@ -1374,7 +1374,7 @@ int proc_do_large_bitmap(struct ctl_table *table, int write,unsigned long bitmap_len = table->maxlen;unsigned long *bitmap = *(unsigned long **) table->data;unsigned long *tmp_bitmap =NULL ; -char tr_a[] = {'-' ,',' ,'\n' }, tr_b[] = {',' ,'\n' ,0 }, c; +char tr_a[] = {'-' ,',' ,'\n' }, tr_b[] = {',' ,'\n' ,0 }, c =0 ;if (!bitmap || !bitmap_len || !left || (*ppos && !write)) { *lenp =0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 95/175 ASoC: adau1372: Fix unchecked clk_prepare_enable() return value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jihed Chaibi <[email protected]>
[ Upstream commit 326fe8104a4020d30080d37ac8b6b43893cdebca ]
adau1372_set_power() calls clk_prepare_enable() but discards the return value. If the clock enable fails, the driver proceeds to access registers on unpowered hardware, potentially causing silent corruption.
Make adau1372_set_power() return int and propagate the error from clk_prepare_enable(). Update adau1372_set_bias_level() to return the error directly for the STANDBY and OFF cases.
--- sound/soc/codecs/adau1372.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
sound/soc/codecs/adau1372.c +10 -7
@@ -781,15 +781,18 @@ static void adau1372_enable_pll(struct adau1372 *adau1372)dev_err (adau1372->dev,"Failed to lock PLL\n" ); } -static void adau1372_set_power (struct adau1372 *adau1372,bool enable) +static int adau1372_set_power (struct adau1372 *adau1372,bool enable) {if (adau1372->enabled == enable) -return ; +return 0 ;if (enable) {unsigned int clk_ctrl =ADAU1372_CLK_CTRL_MCLK_EN ; +int ret; -clk_prepare_enable (adau1372->mclk); + ret =clk_prepare_enable (adau1372->mclk); +if (ret) +return ret;if (adau1372->pd_gpio)gpiod_set_value (adau1372->pd_gpio,0 );
@@ -828,6 +831,8 @@ static void adau1372_set_power(struct adau1372 *adau1372, bool enable) } adau1372->enabled = enable; + +return 0 ; } static int adau1372_set_bias_level(struct snd_soc_component *component,
@@ -841,11 +846,9 @@ static int adau1372_set_bias_level(struct snd_soc_component *component,case SND_SOC_BIAS_PREPARE :break ;case SND_SOC_BIAS_STANDBY : -adau1372_set_power (adau1372, true); -break ; +return adau1372_set_power (adau1372, true);case SND_SOC_BIAS_OFF : -adau1372_set_power (adau1372, false); -break ; +return adau1372_set_power (adau1372, false); }return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 96/175 ASoC: adau1372: Fix clock leak on PLL lock failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jihed Chaibi <[email protected]>
[ Upstream commit bfe6a264effcb6fe99ad7ceaf9e8c7439fc9555b ]
adau1372_enable_pll() was a void function that logged a dev_err() on PLL lock timeout but did not propagate the error. As a result, adau1372_set_power() would continue with adau1372->enabled set to true despite the PLL being unlocked, and the mclk left enabled with no corresponding disable on the error path.
Convert adau1372_enable_pll() to return int, using -ETIMEDOUT on lock timeout and propagating regmap errors directly. In adau1372_set_power(), check the return value and unwind in reverse order: restore regcache to cache-only mode, reassert GPIO power-down, and disable the clock before returning the error.
--- sound/soc/codecs/adau1372.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)
sound/soc/codecs/adau1372.c +14 -3
@@ -761,7 +761,7 @@ static int adau1372_startup(struct snd_pcm_substream *substream, struct snd_soc_return 0 ; } -static void adau1372_enable_pll (struct adau1372 *adau1372) +static int adau1372_enable_pll (struct adau1372 *adau1372) {unsigned int val, timeout =0 ;int ret;
@@ -777,8 +777,12 @@ static void adau1372_enable_pll(struct adau1372 *adau1372) timeout++; }while (!(val &1 ) && timeout <3 ); -if (ret <0 || !(val &1 )) +if (ret <0 || !(val &1 )) {dev_err (adau1372->dev,"Failed to lock PLL\n" ); +return ret <0 ? ret : -ETIMEDOUT ; + } + +return 0 ; }static int adau1372_set_power (struct adau1372 *adau1372,bool enable)
@@ -806,7 +810,14 @@ static int adau1372_set_power(struct adau1372 *adau1372, bool enable)* accessed. */ if (adau1372->use_pll) { -adau1372_enable_pll (adau1372); + ret =adau1372_enable_pll (adau1372); +if (ret) { +regcache_cache_only (adau1372->regmap, true); +if (adau1372->pd_gpio) +gpiod_set_value (adau1372->pd_gpio,1 ); +clk_disable_unprepare (adau1372->mclk); +return ret; + } clk_ctrl |=ADAU1372_CLK_CTRL_CLKSRC ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 97/175 spi: spi-fsl-lpspi: fix teardown order issue (UAF)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit b341c1176f2e001b3adf0b47154fc31589f7410e ]
There is a teardown order issue in the driver. The SPI controller is registered using devm_spi_register_controller(), which delays unregistration of the SPI controller until after the fsl_lpspi_remove() function returns.
As the fsl_lpspi_remove() function synchronously tears down the DMA channels, a running SPI transfer triggers the following NULL pointer dereference due to use after free:
| fsl_lpspi 42550000.spi: I/O Error in DMA RX
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...]
| Call trace: | fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi] | fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi] | spi_transfer_one_message+0x49c/0x7c8 | __spi_pump_transfer_message+0x120/0x420 | __spi_sync+0x2c4/0x520 | spi_sync+0x34/0x60 | spidev_message+0x20c/0x378 [spidev] | spidev_ioctl+0x398/0x750 [spidev]
[...]
Switch from devm_spi_register_controller() to spi_register_controller() in fsl_lpspi_probe() and add the corresponding spi_unregister_controller() in fsl_lpspi_remove().
--- drivers/spi/spi-fsl-lpspi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/spi/spi-fsl-lpspi.c +2 -1
@@ -954,7 +954,7 @@ static int fsl_lpspi_probe(struct platform_device *pdev)enable_irq (irq); } - ret =devm_spi_register_controller (&pdev->dev, controller); + ret =spi_register_controller (controller);if (ret <0 ) {dev_err_probe (&pdev->dev, ret,"spi_register_controller error\n" ); goto free_dma;
@@ -981,6 +981,7 @@ static void fsl_lpspi_remove(struct platform_device *pdev)struct fsl_lpspi_data *fsl_lpspi =spi_controller_get_devdata (controller); +spi_unregister_controller (controller);fsl_lpspi_dma_exit (controller);pm_runtime_dont_use_autosuspend (fsl_lpspi->dev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 98/175 s390/syscalls: Add spectre boundary for syscall dispatch table
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 48b8814e25d073dd84daf990a879a820bad2bcbd upstream.
The s390 syscall number is directly controlled by userspace, but does not have an array_index_nospec() boundary to prevent access past the syscall function pointer tables.
--- arch/s390/kernel/syscall.c | 2 ++ 1 file changed, 2 insertions(+)
arch/s390/kernel/syscall.c +2 -0
@@ -13,6 +13,7 @@*/ #include <linux/errno.h> +#include <linux/nospec.h> #include <linux/sched.h> #include <linux/mm.h> #include <linux/fs.h>
@@ -141,6 +142,7 @@ static void do_syscall(struct pt_regs *rif (likely (nr >= NR_syscalls)) goto out;do { + nr =array_index_nospec (nr, NR_syscalls); regs->gprs[2 ] = current->thread.sys_call_table[nr](regs); }while (test_and_clear_pt_regs_flag (regs,PIF_EXECVE_PGSTE_RESTART )); out:
Greg Kroah-Hartman
maintainerPATCH 99/175 s390/barrier: Make array_index_mask_nospec() __always_inline
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Gorbik <[email protected]>
commit c5c0a268b38adffbb2e70e6957017537ff54c157 upstream.
Mark array_index_mask_nospec() as __always_inline to guarantee the mitigation is emitted inline regardless of compiler inlining decisions.
--- arch/s390/include/asm/barrier.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/s390/include/asm/barrier.h +2 -2
@@ -60,8 +60,8 @@ do { \* @size: number of elements in array */ #define array_index_mask_nospec array_index_mask_nospec -static inline unsigned long array_index_mask_nospec (unsigned long index, -unsigned long size) +static __always_inline unsigned long array_index_mask_nospec (unsigned long index, +unsigned long size) {unsigned long mask;
Greg Kroah-Hartman
maintainerPATCH 100/175 ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit 0e55f63dd08f09651d39e1b709a91705a8a0ddcb upstream.
After this commit (e2b76ab8b5c9 "ksmbd: add support for read compound"), response buffer management was changed to use dynamic iov array. In the new design, smb2_calc_max_out_buf_len() expects the second argument (hdr2_len) to be the offset of ->Buffer field in the response structure, not a hardcoded magic number.
Fix the remaining call sites to use the correct offsetof() value.
--- fs/smb/server/smb2pdu.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
fs/smb/server/smb2pdu.c +12 -8
@@ -4436,8 +4436,9 @@ int smb2_query_dir(struct ksmbd_work *wo d_info.wptr = (char *)rsp->Buffer; d_info.rptr = (char *)rsp->Buffer; d_info.out_buf_len = -smb2_calc_max_out_buf_len (work,8 , -le32_to_cpu (req->OutputBufferLength)); +smb2_calc_max_out_buf_len (work, + offsetof(struct smb2_query_directory_rsp , Buffer), +le32_to_cpu (req->OutputBufferLength));if (d_info.out_buf_len <0 ) { rc = -EINVAL ; goto err_out;
@@ -4704,8 +4705,9 @@ static int smb2_get_ea(struct ksmbd_work } buf_free_len = -smb2_calc_max_out_buf_len (work,8 , -le32_to_cpu (req->OutputBufferLength)); +smb2_calc_max_out_buf_len (work, + offsetof(struct smb2_query_info_rsp , Buffer), +le32_to_cpu (req->OutputBufferLength));if (buf_free_len <0 )return -EINVAL ;
@@ -5018,8 +5020,9 @@ static int get_file_stream_info(struct k file_info = (struct smb2_file_stream_info *)rsp->Buffer; buf_free_len = -smb2_calc_max_out_buf_len (work,8 , -le32_to_cpu (req->OutputBufferLength)); +smb2_calc_max_out_buf_len (work, + offsetof(struct smb2_query_info_rsp , Buffer), +le32_to_cpu (req->OutputBufferLength));if (buf_free_len <0 ) goto out;
@@ -8119,8 +8122,9 @@ int smb2_ioctl(struct ksmbd_work *work) buffer = (char *)req +le32_to_cpu (req->InputOffset); cnt_code =le32_to_cpu (req->CtlCode); - ret =smb2_calc_max_out_buf_len (work,48 , -le32_to_cpu (req->MaxOutputResponse)); + ret =smb2_calc_max_out_buf_len (work, + offsetof(struct smb2_ioctl_rsp , Buffer), +le32_to_cpu (req->MaxOutputResponse));if (ret <0 ) { rsp->hdr.Status =STATUS_INVALID_PARAMETER ; goto out;
Greg Kroah-Hartman
maintainerPATCH 101/175 ksmbd: fix potencial OOB in get_file_all_info() for compound requests
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit beef2634f81f1c086208191f7228bce1d366493d upstream.
When a compound request consists of QUERY_DIRECTORY + QUERY_INFO (FILE_ALL_INFORMATION) and the first command consumes nearly the entire max_trans_size, get_file_all_info() would blindly call smbConvertToUTF16() with PATH_MAX, causing out-of-bounds write beyond the response buffer. In get_file_all_info(), there was a missing validation check for the client-provided OutputBufferLength before copying the filename into FileName field of the smb2_file_all_info structure.
If the filename length exceeds the available buffer space, it could lead to potential buffer overflows or memory corruption during smbConvertToUTF16 conversion. This calculating the actual free buffer size using smb2_calc_max_out_buf_len() and returning -EINVAL if the buffer is insufficient and updating smbConvertToUTF16 to use the actual filename length (clamped by PATH_MAX) to ensure a safe copy operation.
--- fs/smb/server/smb2pdu.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
fs/smb/server/smb2pdu.c +14 -2
@@ -4919,7 +4919,8 @@ static int get_file_all_info(struct ksmbint conv_len;char *filename;u64 time; -int ret; +int ret, buf_free_len, filename_len; +struct smb2_query_info_req *req =ksmbd_req_buf_next (work);if (!(fp->daccess &FILE_READ_ATTRIBUTES_LE )) { ksmbd_debug(SMB, "no right to read the attributes : 0x%x\n",
@@ -4931,6 +4932,16 @@ static int get_file_all_info(struct ksmbif (IS_ERR (filename))return PTR_ERR (filename); + filename_len =strlen (filename); + buf_free_len =smb2_calc_max_out_buf_len (work, + offsetof(struct smb2_query_info_rsp , Buffer) + + offsetof(struct smb2_file_all_info , FileName), +le32_to_cpu (req->OutputBufferLength)); +if (buf_free_len < (filename_len +1 ) *2 ) { +kfree (filename); +return -EINVAL ; + } + ret =vfs_getattr (&fp->filp->f_path, &stat,STATX_BASIC_STATS ,AT_STATX_SYNC_AS_STAT );if (ret) {
@@ -4966,7 +4977,8 @@ static int get_file_all_info(struct ksmb file_info->Mode = fp->coption; file_info->AlignmentRequirement =0 ; conv_len =smbConvertToUTF16 ((__le16 *)file_info->FileName, filename, -PATH_MAX , conn->local_nls,0 ); +min (filename_len,PATH_MAX ), + conn->local_nls,0 ); conv_len *=2 ; file_info->FileNameLength =cpu_to_le32 (conv_len); rsp->OutputBufferLength =
Greg Kroah-Hartman
maintainerPATCH 102/175 ksmbd: do not expire session on binding failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
commit 9bbb19d21ded7d78645506f20d8c44895e3d0fb9 upstream.
When a multichannel session binding request fails (e.g. wrong password), the error path unconditionally sets sess->state = SMB2_SESSION_EXPIRED. However, during binding, sess points to the target session looked up via ksmbd_session_lookup_slowpath() -- which belongs to another connection's user. This allows a remote attacker to invalidate any active session by simply sending a binding request with a wrong password (DoS).
Fix this by skipping session expiration when the failed request was a binding attempt, since the session does not belong to the current connection. The reference taken by ksmbd_session_lookup_slowpath() is still correctly released via ksmbd_user_session_put().
--- fs/smb/server/smb2pdu.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/smb/server/smb2pdu.c +8 -2
@@ -1925,8 +1925,14 @@ out_err:if (sess->user && sess->user->flags &KSMBD_USER_FLAG_DELAY_SESSION ) try_delay = true; - sess->last_active = jiffies; - sess->state =SMB2_SESSION_EXPIRED ; +/* +* For binding requests, session belongs to another +* connection. Do not expire it. +*/ +if (!(req->Flags &SMB2_SESSION_REQ_FLAG_BINDING )) { + sess->last_active = jiffies; + sess->state =SMB2_SESSION_EXPIRED ; + }ksmbd_user_session_put (sess); work->sess =NULL ;if (try_delay) {
Greg Kroah-Hartman
maintainerPATCH 103/175 ALSA: firewire-lib: fix uninitialized local variable
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Nepomnyashih <[email protected]>
commit bb120ad57def62e3f23e3d999c5fbed11f610993 upstream.
Similar to commit d8dc8720468a ("ALSA: firewire-lib: fix uninitialized local variable"), the local variable curr_cycle_time in process_rx_packets() is declared without initialization.
When the tracepoint event is not probed, the variable may appear to be used without being initialized. In practice the value is only relevant when the tracepoint is enabled, however initializing it avoids potential use of an uninitialized value and improves code safety.
Initialize curr_cycle_time to zero.
--- sound/firewire/amdtp-stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/firewire/amdtp-stream.c +1 -1
@@ -1156,7 +1156,7 @@ static void process_rx_packets(struct fwstruct pkt_desc *desc = s->packet_descs_cursor;unsigned int pkt_header_length;unsigned int packets; -u32 curr_cycle_time; +u32 curr_cycle_time =0 ;bool need_hw_irq;int i;
Greg Kroah-Hartman
maintainerPATCH 104/175 ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
commit d40a198e2b7821197c5c77b89d0130cc90f400f5 upstream.
It is unexpected, but allowed to have no initial payload for a bytes control and the code is prepared to handle this case, but the size check missed this corner case.
Update the check for minimal size to allow the initial size to be 0.
--- sound/soc/sof/ipc4-topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/sof/ipc4-topology.c +1 -1
@@ -2203,7 +2203,7 @@ static int sof_ipc4_control_load_bytes(sreturn -EINVAL ; } -if (scontrol->priv_size <sizeof (struct sof_abi_hdr )) { +if (scontrol->priv_size && scontrol->priv_size <sizeof (struct sof_abi_hdr )) {dev_err (sdev->dev,"bytes control %s initial data size %zu is insufficient.\n" , scontrol->name, scontrol->priv_size);
Greg Kroah-Hartman
maintainerPATCH 105/175 can: gw: fix OOB heap access in cgw_csum_crc8_rel()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ali Norouzi <[email protected]>
commit b9c310d72783cc2f30d103eed83920a5a29c671a upstream.
cgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx():
int from = calc_idx(crc8->from_idx, cf->len);
int to = calc_idx(crc8->to_idx, cf->len);
int res = calc_idx(crc8->result_idx, cf->len);
if (from < 0 || to < 0 || res < 0)
return;However, the loop and the result write then use the raw s8 fields directly instead of the computed variables:
for (i = crc8->from_idx; ...) /* BUG: raw negative index */
cf->data[crc8->result_idx] = ...; /* BUG: raw negative index */With from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame, calc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with i = -64, reading cf->data[-64], and the write goes to cf->data[-64]. This write might end up to 56 (7.0-rc) or 40 (<= 6.19) bytes before the start of the canfd_frame on the heap.
The companion function cgw_csum_xor_rel() uses from/to/res correctly throughout; fix cgw_csum_crc8_rel() to match.
Confirmed with KASAN on linux-7.0-rc2:
BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0 Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62
To configure the can-gw crc8 checksums CAP_NET_ADMIN is needed.
--- net/can/gw.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/can/gw.c +3 -3
@@ -374,10 +374,10 @@ static void cgw_csum_crc8_rel(struct canreturn ;if (from <= to) { -for (i = crc8->from_idx; i <= crc8->to_idx; i++) +for (i = from; i <= to; i++) crc = crc8->crctab[crc ^ cf->data[i]]; }else { -for (i = crc8->from_idx; i >= crc8->to_idx; i--) +for (i = from; i >= to; i--) crc = crc8->crctab[crc ^ cf->data[i]]; }
@@ -396,7 +396,7 @@ static void cgw_csum_crc8_rel(struct canbreak ; } - cf->data[crc8->result_idx] = crc ^ crc8->final_xor_val; + cf->data[res] = crc ^ crc8->final_xor_val; } static void cgw_csum_crc8_pos(struct canfd_frame *cf,
Greg Kroah-Hartman
maintainerPATCH 106/175 can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit 424e95d62110cdbc8fd12b40918f37e408e35a92 upstream.
isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access to so->tx.buf. isotp_release() waits for ISOTP_IDLE via wait_event_interruptible() and then calls kfree(so->tx.buf).
If a signal interrupts the wait_event_interruptible() inside close() while tx.state is ISOTP_SENDING, the loop exits early and release proceeds to force ISOTP_SHUTDOWN and continues to kfree(so->tx.buf) while sendmsg may still be reading so->tx.buf for the final CAN frame in isotp_fill_dataframe().
The so->tx.buf can be allocated once when the standard tx.buf length needs to be extended. Move the kfree() of this potentially extended tx.buf to sk_destruct time when either isotp_sendmsg() and isotp_release() are done.
--- net/can/isotp.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-)
net/can/isotp.c +18 -6
@@ -1227,12 +1227,6 @@ static int isotp_release(struct socket * so->ifindex =0 ; so->bound =0 ; -if (so->rx.buf != so->rx.sbuf) -kfree (so->rx.buf); - -if (so->tx.buf != so->tx.sbuf) -kfree (so->tx.buf); -sock_orphan (sk); sock->sk =NULL ;
@@ -1600,6 +1594,21 @@ static int isotp_notifier(struct notifiereturn NOTIFY_DONE ; } +static void isotp_sock_destruct (struct sock *sk) +{ +struct isotp_sock *so =isotp_sk (sk); + +/* do the standard CAN sock destruct work */ +can_sock_destruct (sk); + +/* free potential extended PDU buffers */ +if (so->rx.buf != so->rx.sbuf) +kfree (so->rx.buf); + +if (so->tx.buf != so->tx.sbuf) +kfree (so->tx.buf); +} +static int isotp_init (struct sock *sk) {struct isotp_sock *so =isotp_sk (sk);
@@ -1646,6 +1655,9 @@ static int isotp_init(struct sock *sk)list_add_tail (&so->notifier, &isotp_notifier_list);spin_unlock (&isotp_notifier_lock); +/* re-assign default can_sock_destruct() reference */ + sk->sk_destruct = isotp_sock_destruct; +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 107/175 cpufreq: conservative: Reset requested_freq on limits change
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <[email protected]>
commit 6a28fb8cb28b9eb39a392e531d938a889eacafc5 upstream.
A recently reported issue highlighted that the cached requested_freq is not guaranteed to stay in sync with policy->cur. If the platform changes the actual CPU frequency after the governor sets one (e.g. due to platform-specific frequency scaling) and a re-sync occurs later, policy->cur may diverge from requested_freq.
This can lead to incorrect behavior in the conservative governor. For example, the governor may assume the CPU is already running at the maximum frequency and skip further increases even though there is still headroom.
Avoid this by resetting the cached requested_freq to policy->cur on detecting a change in policy limits.
--- drivers/cpufreq/cpufreq_conservative.c | 12 ++++++++++++ drivers/cpufreq/cpufreq_governor.c | 3 +++ drivers/cpufreq/cpufreq_governor.h | 1 + 3 files changed, 16 insertions(+)
drivers/cpufreq/cpufreq_conservative.c +12 -0
@@ -314,6 +314,17 @@ static void cs_start(struct cpufreq_poli dbs_info->requested_freq = policy->cur; } +static void cs_limits (struct cpufreq_policy *policy) +{ +struct cs_policy_dbs_info *dbs_info =to_dbs_info (policy->governor_data); + +/* +* The limits have changed, so may have the current frequency. Reset +* requested_freq to avoid any unintended outcomes due to the mismatch. +*/ + dbs_info->requested_freq = policy->cur; +} +static struct dbs_governor cs_governor = { .gov =CPUFREQ_DBS_GOVERNOR_INITIALIZER ("conservative" ), .kobj_type = { .default_groups = cs_groups },
@@ -323,6 +334,7 @@ static struct dbs_governor cs_governor = .init = cs_init, .exit = cs_exit, .start = cs_start, + .limits = cs_limits, };#define CPU_FREQ_GOV_CONSERVATIVE (cs_governor.gov)
drivers/cpufreq/cpufreq_governor.c +3 -0
@@ -563,6 +563,7 @@ EXPORT_SYMBOL_GPL(cpufreq_dbs_governor_svoid cpufreq_dbs_governor_limits (struct cpufreq_policy *policy) { +struct dbs_governor *gov =dbs_governor_of (policy);struct policy_dbs_info *policy_dbs;/* Protect gov->gdbs_data against cpufreq_dbs_governor_exit() */
@@ -574,6 +575,8 @@ void cpufreq_dbs_governor_limits(structmutex_lock (&policy_dbs->update_mutex);cpufreq_policy_apply_limits (policy);gov_update_sample_delay (policy_dbs,0 ); +if (gov->limits) + gov->limits (policy);mutex_unlock (&policy_dbs->update_mutex); out:
drivers/cpufreq/cpufreq_governor.h +1 -0
@@ -138,6 +138,7 @@ struct dbs_governor {int (*init)(struct dbs_data *dbs_data);void (*exit)(struct dbs_data *dbs_data);void (*start)(struct cpufreq_policy *policy); +void (*limits)(struct cpufreq_policy *policy); };static inline struct dbs_governor *dbs_governor_of (struct cpufreq_policy *policy)
Greg Kroah-Hartman
maintainerPATCH 108/175 platform/x86: ISST: Correct locked bit width
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit fbddf68d7b4e1e6da7a78dd7fbd8ec376536584a upstream.
SST-PP locked bit width is set to three bits. It should be only one bit. Use SST_PP_LOCK_WIDTH define instead of SST_PP_LEVEL_WIDTH.
--- drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c +1 -1
@@ -709,7 +709,7 @@ static int isst_if_get_perf_level(void __read_pp_info ("current_level" , perf_level.current_level,SST_PP_STATUS_OFFSET , SST_PP_LEVEL_START, SST_PP_LEVEL_WIDTH, SST_MUL_FACTOR_NONE)_read_pp_info ("locked" , perf_level.locked,SST_PP_STATUS_OFFSET , - SST_PP_LOCK_START, SST_PP_LEVEL_WIDTH, SST_MUL_FACTOR_NONE) + SST_PP_LOCK_START, SST_PP_LOCK_WIDTH, SST_MUL_FACTOR_NONE)_read_pp_info ("feature_state" , perf_level.feature_state,SST_PP_STATUS_OFFSET ,SST_PP_FEATURE_STATE_START ,SST_PP_FEATURE_STATE_WIDTH ,SST_MUL_FACTOR_NONE ) perf_level.enabled = !!(power_domain_info->sst_header.cap_mask & BIT(1));
Greg Kroah-Hartman
maintainerPATCH 109/175 KVM: arm64: Discard PC update state on vcpu reset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 1744a6ef48b9a48f017e3e1a0d05de0a6978396e upstream.
Our vcpu reset suffers from a particularly interesting flaw, as it does not correctly deal with state that will have an effect on the execution flow out of reset.
Take the following completely random example, never seen in the wild and that never resulted in a couple of sleepless nights: /s
- vcpu-A issues a PSCI_CPU_OFF using the SMC conduit
- SMC being a trapped instruction (as opposed to HVC which is always normally executed), we annotate the vcpu as needing to skip the next instruction, which is the SMC itself
- vcpu-A is now safely off
- vcpu-B issues a PSCI_CPU_ON for vcpu-A, providing a starting PC
- vcpu-A gets reset, get the new PC, and is sent on its merry way
- right at the point of entering the guest, we notice that a PC increment is pending (remember the earlier SMC?)
- vcpu-A skips its first instruction...
What could possibly go wrong?
Well, I'm glad you asked. For pKVM as a NV guest, that first instruction is extremely significant, as it indicates whether the CPU is booting or resuming. Having skipped that instruction, nothing makes any sense anymore, and CPU hotplugging fails.
This is all caused by the decoupling of PC update from the handling of an exception that triggers such update, making it non-obvious what affects what when.
Fix this train wreck by discarding all the PC-affecting state on vcpu reset.
--- arch/arm64/kvm/reset.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
arch/arm64/kvm/reset.c +14 -0
@@ -293,6 +293,20 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpukvm_vcpu_set_be (vcpu); *vcpu_pc (vcpu) = target_pc; + +/* +* We may come from a state where either a PC update was +* pending (SMC call resulting in PC being increpented to +* skip the SMC) or a pending exception. Make sure we get +* rid of all that, as this cannot be valid out of reset. +* +* Note that clearing the exception mask also clears PC +* updates, but that's an implementation detail, and we +* really want to make it explicit. +*/ +vcpu_clear_flag (vcpu,PENDING_EXCEPTION ); +vcpu_clear_flag (vcpu,EXCEPT_MASK ); +vcpu_clear_flag (vcpu,INCREMENT_PC );vcpu_set_reg (vcpu,0 , reset_state.r0); }
Greg Kroah-Hartman
maintainerPATCH 110/175 hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
commit 3075a3951f7708da5a8ab47b0b7d068a32f69e58 upstream.
The custom avs0_enable and avs1_enable sysfs attributes access PMBus registers through the exported API helpers (pmbus_read_byte_data, pmbus_read_word_data, pmbus_write_word_data, pmbus_update_byte_data) without holding the PMBus update_lock mutex. These exported helpers do not acquire the mutex internally, unlike the core's internal callers which hold the lock before invoking them.
The store callback is especially vulnerable: it performs a multi-step read-modify-write sequence (read VOUT_COMMAND, write VOUT_COMMAND, then update OPERATION) where concurrent access from another thread could interleave and corrupt the register state.
Add pmbus_lock_interruptible()/pmbus_unlock() around both the show and store callbacks to serialize PMBus register access with the rest of the driver.
--- drivers/hwmon/pmbus/isl68137.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
drivers/hwmon/pmbus/isl68137.c +18 -3
@@ -78,7 +78,15 @@ static ssize_t isl68137_avs_enable_show_int page, char *buf) { - int val = pmbus_read_byte_data(client, page, PMBUS_OPERATION); + int val; + + val =pmbus_lock_interruptible (client); +if (val) +return val; + + val =pmbus_read_byte_data (client, page,PMBUS_OPERATION ); + +pmbus_unlock (client);if (val <0 )return val;
@@ -100,6 +108,10 @@ static ssize_t isl68137_avs_enable_store op_val = result ?ISL68137_VOUT_AVS :0 ; + rc =pmbus_lock_interruptible (client); +if (rc) +return rc; +/* * Writes to VOUT setpoint over AVSBus will persist after the VRM is * switched to PMBus control. Switching back to AVSBus control
@@ -111,17 +123,20 @@ static ssize_t isl68137_avs_enable_store rc =pmbus_read_word_data (client, page,0xff ,PMBUS_VOUT_COMMAND );if (rc <0 ) -return rc; + goto unlock; rc =pmbus_write_word_data (client, page,PMBUS_VOUT_COMMAND , rc);if (rc <0 ) -return rc; + goto unlock; } rc =pmbus_update_byte_data (client, page,PMBUS_OPERATION ,ISL68137_VOUT_AVS , op_val); +unlock: +pmbus_unlock (client); +return (rc <0 ) ? rc : count; }
Greg Kroah-Hartman
maintainerPATCH 111/175 hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
commit 0adc752b4f7d82af7bd14f7cad3091b3b5d702ba upstream.
The hwmon sysfs ABI expects tempN_crit_hyst to report the temperature at which the critical condition clears, not the hysteresis delta from the critical limit.
The peci cputemp driver currently returns tjmax - tcontrol for crit_hyst_type, which is the hysteresis margin rather than the corresponding absolute temperature.
Return tcontrol directly, and update the documentation accordingly.
--- Documentation/hwmon/peci-cputemp.rst | 10 ++++++---- drivers/hwmon/peci/cputemp.c | 2 +- 2 files changed, 7 insertions(+), 5 deletions(-)
Documentation/hwmon/peci-cputemp.rst +6 -4
@@ -51,8 +51,9 @@ temp1_max Provides thermal control temp temp1_crit Provides shutdown temperature of the CPU package which is also known as the maximum processor junction temperature, Tjmax or Tprochot. -temp1_crit_hyst Provides the hysteresis value from Tcontrol to Tjmax of - the CPU package. +temp1_crit_hyst Provides the hysteresis temperature of the CPU + package. Returns Tcontrol, the temperature at which + the critical condition clears. temp2_label "DTS" temp2_input Provides current temperature of the CPU package scaled
@@ -62,8 +63,9 @@ temp2_max Provides thermal control temp temp2_crit Provides shutdown temperature of the CPU package which is also known as the maximum processor junction temperature, Tjmax or Tprochot. -temp2_crit_hyst Provides the hysteresis value from Tcontrol to Tjmax of - the CPU package. +temp2_crit_hyst Provides the hysteresis temperature of the CPU + package. Returns Tcontrol, the temperature at which + the critical condition clears. temp3_label "Tcontrol" temp3_input Provides current Tcontrol temperature of the CPU
drivers/hwmon/peci/cputemp.c +1 -1
@@ -133,7 +133,7 @@ static int get_temp_target(struct peci_c *val = priv->temp.target.tjmax;break ;case crit_hyst_type: - *val = priv->temp.target.tjmax - priv->temp.target.tcontrol; + *val = priv->temp.target.tcontrol;break ;default : ret = -EOPNOTSUPP ;
Greg Kroah-Hartman
maintainerPATCH 112/175 hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
commit b0c9d8ae71509f25690d57f2efddebf7f4b12194 upstream.
cputemp_is_visible() validates the channel index against CPUTEMP_CHANNEL_NUMS, but currently uses '>' instead of '>='. As a result, channel == CPUTEMP_CHANNEL_NUMS is not rejected even though valid indices are 0 .. CPUTEMP_CHANNEL_NUMS - 1.
Fix the bounds check by using '>=' so invalid channel indices are rejected before indexing the core bitmap.
--- drivers/hwmon/peci/cputemp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/peci/cputemp.c +1 -1
@@ -339,7 +339,7 @@ static umode_t cputemp_is_visible(const {const struct peci_cputemp *priv = data; -if (channel >CPUTEMP_CHANNEL_NUMS ) +if (channel >=CPUTEMP_CHANNEL_NUMS )return 0 ;if (channel < channel_core)
Greg Kroah-Hartman
maintainerPATCH 113/175 media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuchan Nam <[email protected]>
commit bef4f4a88b73e4cc550d25f665b8a9952af22773 upstream.
MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0) queue teardown paths. This can race request object cleanup against vb2 queue cancellation and lead to use-after-free reports.
We already serialize request queueing against STREAMON/OFF with req_queue_mutex. Extend that serialization to REQBUFS, and also take the same mutex in media_request_ioctl_reinit() so REINIT is in the same exclusion domain.
This keeps request cleanup and queue cancellation from running in parallel for request-capable devices.
--- drivers/media/mc/mc-request.c | 5 +++++ drivers/media/v4l2-core/v4l2-ioctl.c | 5 +++-- 2 files changed, 8 insertions(+), 2 deletions(-)
drivers/media/mc/mc-request.c +5 -0
@@ -190,6 +190,8 @@ static long media_request_ioctl_reinit(sstruct media_device *mdev = req->mdev;unsigned long flags; +mutex_lock (&mdev->req_queue_mutex); +spin_lock_irqsave (&req->lock, flags);if (req->state !=MEDIA_REQUEST_STATE_IDLE && req->state !=MEDIA_REQUEST_STATE_COMPLETE ) {
@@ -197,6 +199,7 @@ static long media_request_ioctl_reinit(s"request: %s not in idle or complete state, cannot reinit\n" , req->debug_str);spin_unlock_irqrestore (&req->lock, flags); +mutex_unlock (&mdev->req_queue_mutex);return -EBUSY ; }if (req->access_count) {
@@ -204,6 +207,7 @@ static long media_request_ioctl_reinit(s"request: %s is being accessed, cannot reinit\n" , req->debug_str);spin_unlock_irqrestore (&req->lock, flags); +mutex_unlock (&mdev->req_queue_mutex);return -EBUSY ; } req->state =MEDIA_REQUEST_STATE_CLEANING ;
@@ -214,6 +218,7 @@ static long media_request_ioctl_reinit(sspin_lock_irqsave (&req->lock, flags); req->state =MEDIA_REQUEST_STATE_IDLE ;spin_unlock_irqrestore (&req->lock, flags); +mutex_unlock (&mdev->req_queue_mutex);return 0 ; }
drivers/media/v4l2-core/v4l2-ioctl.c +3 -2
@@ -2998,13 +2998,14 @@ static long __video_do_ioctl(struct file vfh = file->private_data;/* -* We need to serialize streamon/off with queueing new requests. +* We need to serialize streamon/off/reqbufs with queueing new requests. * These ioctls may trigger the cancellation of a streaming * operation, and that should not be mixed with queueing a new * request at the same time. */ if (v4l2_device_supports_requests (vfd->v4l2_dev) && - (cmd ==VIDIOC_STREAMON || cmd ==VIDIOC_STREAMOFF )) { + (cmd ==VIDIOC_STREAMON || cmd ==VIDIOC_STREAMOFF || + cmd ==VIDIOC_REQBUFS )) { req_queue_lock = &vfd->v4l2_dev->mdev->req_queue_mutex;if (mutex_lock_interruptible (req_queue_lock))
Greg Kroah-Hartman
maintainerPATCH 114/175 virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: xietangxin <[email protected]>
commit ba8bda9a0896746053aa97ac6c3e08168729172c upstream.
A UAF issue occurs when the virtio_net driver is configured with napi_tx=N and the device's IFF_XMIT_DST_RELEASE flag is cleared
(e.g., during the configuration of tc route filter rules).
When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack expects the driver to hold the reference to skb->dst until the packet is fully transmitted and freed. In virtio_net with napi_tx=N, skbs may remain in the virtio transmit ring for an extended period.
If the network namespace is destroyed while these skbs are still pending, the corresponding dst_ops structure has freed. When a subsequent packet is transmitted, free_old_xmit() is triggered to clean up old skbs. It then calls dst_release() on the skb associated with the stale dst_entry. Since the dst_ops (referenced by the dst_entry) has already been freed, a UAF kernel paging request occurs.
fix it by adds skb_dst_drop(skb) in start_xmit to explicitly release the dst reference before the skb is queued in virtio_net.
Call Trace: Unable to handle kernel paging request at virtual address ffff80007e150000 CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT ... percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P) dst_release+0xe0/0x110 net/core/dst.c:177 skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177 sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255 dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469 napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527 __free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net] free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net] start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net] ...
Reproduction Steps:
NETDEV="enp3s0"
config_qdisc_route_filter() {
tc qdisc del dev $NETDEV root
tc qdisc add dev $NETDEV root handle 1: prio tc filter add dev $NETDEV parent 1:0 \
protocol ip prio 100 route to 100 flowid 1:1
ip route add 192.168.1.100/32 dev $NETDEV realm 100
}
test_ns() {
ip netns add testns
ip link set $NETDEV netns testns
ip netns exec testns ifconfig $NETDEV 10.0.32.46/24 ip netns exec testns ping -c 1 10.0.32.1
ip netns del testns
}
config_qdisc_route_filter
test_ns
sleep 2test_ns
--- drivers/net/virtio_net.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/virtio_net.c +1 -0
@@ -2443,6 +2443,7 @@ static netdev_tx_t start_xmit(struct sk_/* Don't wait up for transmitted skbs to be freed. */ if (!use_napi) {skb_orphan (skb); +skb_dst_drop (skb);nf_reset_ct (skb); }
Greg Kroah-Hartman
maintainerPATCH 115/175 s390/entry: Scrub r12 register on kernel entry
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Gorbik <[email protected]>
commit 0738d395aab8fae3b5a3ad3fc640630c91693c27 upstream.
Before commit f33f2d4c7c80 ("s390/bp: remove TIF_ISOLATE_BP"), all entry handlers loaded r12 with the current task pointer (lg %r12,__LC_CURRENT) for use by the BPENTER/BPEXIT macros. That commit removed TIF_ISOLATE_BP, dropping both the branch prediction macros and the r12 load, but did not add r12 to the register clearing sequence.
Add the missing xgr %r12,%r12 to make the register scrub consistent across all entry points.
--- arch/s390/kernel/entry.S | 4 ++++ 1 file changed, 4 insertions(+)
arch/s390/kernel/entry.S +4 -0
@@ -300,6 +300,7 @@ SYM_CODE_START(system_call) xgr %r9,%r9 xgr %r10,%r10 xgr %r11,%r11 + xgr %r12,%r12 la %r2,STACK_FRAME_OVERHEAD(%r15) # pointer to pt_regs mvc __PT_R8(64,%r2),__LC_SAVE_AREA_SYNC MBEAR %r2
@@ -378,6 +379,7 @@ SYM_CODE_START(pgm_check_handler) xgr %r5,%r5 xgr %r6,%r6 xgr %r7,%r7 + xgr %r12,%r12 lgr %r2,%r11 brasl %r14,__do_pgm_check tmhh %r8,0x0001 # returning to user space?
@@ -439,6 +441,7 @@ SYM_CODE_START(\name) xgr %r6,%r6 xgr %r7,%r7 xgr %r10,%r10 + xgr %r12,%r12 xc __PT_FLAGS(8,%r11),__PT_FLAGS(%r11) mvc __PT_R8(64,%r11),__LC_SAVE_AREA_ASYNC MBEAR %r11
@@ -547,6 +550,7 @@ SYM_CODE_START(mcck_int_handler) xgr %r6,%r6 xgr %r7,%r7 xgr %r10,%r10 + xgr %r12,%r12 mvc __PT_R8(64,%r11),0(%r14) stmg %r8,%r9,__PT_PSW(%r11) xc __PT_FLAGS(8,%r11),__PT_FLAGS(%r11)
Greg Kroah-Hartman
maintainerPATCH 116/175 erofs: add GFP_NOIO in the bio completion if needed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiucheng Xu <[email protected]>
commit c23df30915f83e7257c8625b690a1cece94142a0 upstream.
The bio completion path in the process context (e.g. dm-verity) will directly call into decompression rather than trigger another workqueue context for minimal scheduling latencies, which can then call vm_map_ram() with GFP_KERNEL.
Due to insufficient memory, vm_map_ram() may generate memory swapping I/O, which can cause submit_bio_wait to deadlock in some scenarios.
Trimmed down the call stack, as follows:
f2fs_submit_read_io
submit_bio //bio_list is initialized.
mmc_blk_mq_recovery
z_erofs_endio
vm_map_ram
__pte_alloc_kernel
__alloc_pages_direct_reclaim
shrink_folio_list
__swap_writepage
submit_bio_wait //bio_list is non-NULL, hang!!!
Use memalloc_noio_{save,restore}() to wrap up this path.
--- fs/erofs/zdata.c | 3 +++ 1 file changed, 3 insertions(+)
fs/erofs/zdata.c +3 -0
@@ -1415,6 +1415,7 @@ static void z_erofs_decompress_kickoff(s int bios) {struct erofs_sb_info *const sbi =EROFS_SB (io->sb); +int gfp_flag;/* wake up the caller thread for sync decompression */ if (io->sync) {
@@ -1447,7 +1448,9 @@ static void z_erofs_decompress_kickoff(s sbi->opt.sync_decompress =EROFS_SYNC_DECOMPRESS_FORCE_ON ;return ; } + gfp_flag =memalloc_noio_save ();z_erofs_decompressqueue_work (&io->u.work); +memalloc_noio_restore (gfp_flag); } static struct page *pickup_page_for_submission(struct z_erofs_pcluster *pcl,
Greg Kroah-Hartman
maintainerPATCH 117/175 alarmtimer: Fix argument order in alarm_timer_forward()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhan Xusheng <[email protected]>
commit 5d16467ae56343b9205caedf85e3a131e0914ad8 upstream.
alarm_timer_forward() passes arguments to alarm_forward() in the wrong order:
alarm_forward(alarm, timr->it_interval, now);
However, alarm_forward() is defined as:
u64 alarm_forward(struct alarm *alarm, ktime_t now, ktime_t interval);
and uses the second argument as the current time:
delta = ktime_sub(now, alarm->node.expires);
Passing the interval as "now" results in incorrect delta computation, which can lead to missed expirations or incorrect overrun accounting.
This issue has been present since the introduction of alarm_timer_forward().
Fix this by swapping the arguments.
--- kernel/time/alarmtimer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/time/alarmtimer.c +1 -1
@@ -608,7 +608,7 @@ static s64 alarm_timer_forward(struct k_ {struct alarm *alarm = &timr->it.alarm.alarmtimer; -return alarm_forward (alarm, timr->it_interval, now); +return alarm_forward (alarm, now, timr->it_interval); }/**
Greg Kroah-Hartman
maintainerPATCH 118/175 scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyllis Xu <[email protected]>
commit 61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f upstream.
A malicious or compromised VIO server can return a num_written value in the discover targets MAD response that exceeds max_targets. This value is stored directly in vhost->num_targets without validation, and is then used as the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which is only allocated for max_targets entries. Indices at or beyond max_targets access kernel memory outside the DMA-coherent allocation. The out-of-bounds data is subsequently embedded in Implicit Logout and PLOGI MADs that are sent back to the VIO server, leaking kernel memory.
Fix by clamping num_written to max_targets before storing it.
--- drivers/scsi/ibmvscsi/ibmvfc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/ibmvscsi/ibmvfc.c +2 -1
@@ -4928,7 +4928,8 @@ static void ibmvfc_discover_targets_doneswitch (mad_status) {case IBMVFC_MAD_SUCCESS :ibmvfc_dbg (vhost,"Discover Targets succeeded\n" ); - vhost->num_targets =be32_to_cpu (rsp->num_written); + vhost->num_targets =min_t (u32,be32_to_cpu (rsp->num_written), + max_targets);ibmvfc_set_host_action (vhost,IBMVFC_HOST_ACTION_ALLOC_TGTS );break ;case IBMVFC_MAD_FAILED :
Greg Kroah-Hartman
maintainerPATCH 119/175 scsi: ses: Handle positive SCSI error from ses_recv_diag()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 7a9f448d44127217fabc4065c5ba070d4e0b5d37 upstream.
ses_recv_diag() can return a positive value, which also means that an error happened, so do not only test for negative values.
--- drivers/scsi/ses.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/ses.c +1 -1
@@ -190,7 +190,7 @@ static unsigned char *ses_get_page2_descunsigned char *type_ptr = ses_dev->page1_types;unsigned char *desc_ptr = ses_dev->page2 +8 ; -if (ses_recv_diag (sdev,2 , ses_dev->page2, ses_dev->page2_len) <0 ) +if (ses_recv_diag (sdev,2 , ses_dev->page2, ses_dev->page2_len))return NULL ;for (i =0 ; i < ses_dev->page1_num_types; i++, type_ptr +=4 ) {
Greg Kroah-Hartman
maintainerPATCH 120/175 net: macb: Use dev_consume_skb_any() to free TX SKBs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Hao <[email protected]>
commit 647b8a2fe474474704110db6bd07f7a139e621eb upstream.
The napi_consume_skb() function is not intended to be called in an IRQ disabled context. However, after commit 6bc8a5098bf4 ("net: macb: Fix tx_ptr_lock locking"), the freeing of TX SKBs is performed with IRQs disabled. To resolve the following call trace, use dev_consume_skb_any() for freeing TX SKBs:
WARNING: kernel/softirq.c:430 at __local_bh_enable_ip+0x174/0x188, CPU#0: ksoftirqd/0/15
Modules linked in:
CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 7.0.0-rc4-next-20260319-yocto-standard-dirty #37 PREEMPT
Hardware name: ZynqMP ZCU102 Rev1.1 (DT)
pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __local_bh_enable_ip+0x174/0x188
lr : local_bh_enable+0x24/0x38
sp : ffff800082b3bb10
x29: ffff800082b3bb10 x28: ffff0008031f3c00 x27: 000000000011ede0
x26: ffff000800a7ff00 x25: ffff800083937ce8 x24: 0000000000017a80
x23: ffff000803243a78 x22: 0000000000000040 x21: 0000000000000000
x20: ffff000800394c80 x19: 0000000000000200 x18: 0000000000000001
x17: 0000000000000001 x16: ffff000803240000 x15: 0000000000000000
x14: ffffffffffffffff x13: 0000000000000028 x12: ffff000800395650
x11: ffff8000821d1528 x10: ffff800081c2bc08 x9 : ffff800081c1e258
x8 : 0000000100000301 x7 : ffff8000810426ec x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000008 x1 : 0000000000000200 x0 : ffff8000810428dc
Call trace:
__local_bh_enable_ip+0x174/0x188 (P)
local_bh_enable+0x24/0x38
skb_attempt_defer_free+0x190/0x1d8
napi_consume_skb+0x58/0x108
macb_tx_poll+0x1a4/0x558
__napi_poll+0x50/0x198
net_rx_action+0x1f4/0x3d8
handle_softirqs+0x16c/0x560
run_ksoftirqd+0x44/0x80
smpboot_thread_fn+0x1d8/0x338
kthread+0x120/0x150
ret_from_fork+0x10/0x20
irq event stamp: 29751
hardirqs last enabled at (29750): [<ffff8000813be184>] _raw_spin_unlock_irqrestore+0x44/0x88
hardirqs last disabled at (29751): [<ffff8000813bdf60>] _raw_spin_lock_irqsave+0x38/0x98
softirqs last enabled at (29150): [<ffff8000800f1aec>] handle_softirqs+0x504/0x560
softirqs last disabled at (29153): [<ffff8000800f2fec>] run_ksoftirqd+0x44/0x80--- drivers/net/ethernet/cadence/macb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cadence/macb_main.c +1 -1
@@ -1129,7 +1129,7 @@ static void macb_tx_unmap(struct macb *b }if (tx_skb->skb) { -napi_consume_skb (tx_skb->skb, budget); +dev_consume_skb_any (tx_skb->skb); tx_skb->skb =NULL ; } }
Greg Kroah-Hartman
maintainerPATCH 121/175 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit aad885e774966e97b675dfe928da164214a71605 upstream.
When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM.
E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE.
------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]---
--- arch/x86/kvm/mmu/mmu.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
arch/x86/kvm/mmu/mmu.c +8 -6
@@ -2914,12 +2914,6 @@ static int mmu_set_spte(struct kvm_vcpubool prefetch = !fault || fault->prefetch;bool write_fault = fault && fault->write; -if (unlikely (is_noslot_pfn (pfn))) { - vcpu->stat.pf_mmio_spte_created++; -mark_mmio_spte (vcpu, sptep, gfn, pte_access); -return RET_PF_EMULATE ; - } -if (is_shadow_present_pte (*sptep)) {/* * If we overwrite a PTE page pointer with a 2MB PMD, unlink
@@ -2939,6 +2933,14 @@ static int mmu_set_spte(struct kvm_vcpu was_rmapped =1 ; } +if (unlikely (is_noslot_pfn (pfn))) { + vcpu->stat.pf_mmio_spte_created++; +mark_mmio_spte (vcpu, sptep, gfn, pte_access); +if (flush) +kvm_flush_remote_tlbs_gfn (vcpu->kvm, gfn, level); +return RET_PF_EMULATE ; + } + wrprot =make_spte (vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch, true, host_writable, &spte);
Greg Kroah-Hartman
maintainerPATCH 122/175 jbd2: gracefully abort on checkpointing state corruptions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Milos Nikic <[email protected]>
commit bac3190a8e79beff6ed221975e0c9b1b5f2a21da upstream.
This patch targets two internal state machine invariants in checkpoint.c residing inside functions that natively return integer error codes.
- In jbd2_cleanup_journal_tail(): A blocknr of 0 indicates a severely corrupted journal superblock. Replaced the J_ASSERT with a WARN_ON_ONCE and a graceful journal abort, returning -EFSCORRUPTED.
- In jbd2_log_do_checkpoint(): Replaced the J_ASSERT_BH checking for an unexpected buffer_jwrite state. If the warning triggers, we explicitly drop the just-taken get_bh() reference and call __flush_batch() to safely clean up any previously queued buffers in the j_chkpt_bhs array, preventing a memory leak before returning -EFSCORRUPTED.
--- fs/jbd2/checkpoint.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
fs/jbd2/checkpoint.c +13 -2
@@ -267,7 +267,15 @@ restart:*/ BUFFER_TRACE (bh,"queue" );get_bh (bh); -J_ASSERT_BH (bh, !buffer_jwrite (bh)); +if (WARN_ON_ONCE (buffer_jwrite (bh))) { +put_bh (bh);/* drop the ref we just took */ +spin_unlock (&journal->j_list_lock); +/* Clean up any previously batched buffers */ +if (batch_count) +__flush_batch (journal, &batch_count); +jbd2_journal_abort (journal, -EFSCORRUPTED ); +return -EFSCORRUPTED ; + } journal->j_chkpt_bhs[batch_count++] = bh; transaction->t_chp_stats.cs_written++; transaction->t_checkpoint_list = jh->b_cpnext;
@@ -325,7 +333,10 @@ int jbd2_cleanup_journal_tail(journal_tif (!jbd2_journal_get_log_tail (journal, &first_tid, &blocknr))return 1 ; -J_ASSERT (blocknr !=0 ); +if (WARN_ON_ONCE (blocknr ==0 )) { +jbd2_journal_abort (journal, -EFSCORRUPTED ); +return -EFSCORRUPTED ; + }/* * We need to make sure that any blocks that were recently written out
Greg Kroah-Hartman
maintainerPATCH 123/175 irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jassi Brar <[email protected]>
commit cfe02147e86307a17057ee4e3604f5f5919571d2 upstream.
The mbox_client for qcom-mpm sends NULL doorbell messages via mbox_send_message() but never signals TX completion.
Set knows_txdone=true and call mbox_client_txdone() after a successful send, matching the pattern used by other Qualcomm mailbox clients (smp2p, smsm, qcom_aoss etc).
--- drivers/irqchip/irq-qcom-mpm.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/irqchip/irq-qcom-mpm.c +3 -0
@@ -305,6 +305,8 @@ static int mpm_pd_power_off(struct generif (ret <0 )return ret; +mbox_client_txdone (priv->mbox_chan,0 ); +return 0 ; }
@@ -414,6 +416,7 @@ static int qcom_mpm_init(struct device_n } priv->mbox_client.dev = dev; + priv->mbox_client.knows_txdone = true; priv->mbox_chan =mbox_request_channel (&priv->mbox_client,0 );if (IS_ERR (priv->mbox_chan)) { ret =PTR_ERR (priv->mbox_chan);
Greg Kroah-Hartman
maintainerPATCH 124/175 dmaengine: sh: rz-dmac: Protect the driver specific lists
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit abb863e6213dc41a58ef8bb3289b7e77460dabf3 upstream.
The driver lists (ld_free, ld_queue) are used in rz_dmac_free_chan_resources(), rz_dmac_terminate_all(), rz_dmac_issue_pending(), and rz_dmac_irq_handler_thread(), all under the virtual channel lock. Take the same lock in rz_dmac_prep_slave_sg() and rz_dmac_prep_dma_memcpy() as well to avoid concurrency issues, since these functions also check whether the lists are empty and update or remove list entries.
--- drivers/dma/sh/rz-dmac.c | 63 ++++++++++++++++++++++++++--------------------- 1 file changed, 35 insertions(+), 28 deletions(-)
drivers/dma/sh/rz-dmac.c +35 -28
@@ -10,6 +10,7 @@*/ #include <linux/bitfield.h> +#include <linux/cleanup.h> #include <linux/dma-mapping.h> #include <linux/dmaengine.h> #include <linux/interrupt.h>
@@ -424,6 +425,7 @@ static int rz_dmac_alloc_chan_resources(if (!desc)break ; +/* No need to lock. This is called only for the 1st client. */ list_add_tail (&desc->node, &channel->ld_free); channel->descs_allocated++; }
@@ -479,18 +481,21 @@ rz_dmac_prep_dma_memcpy(struct dma_chandev_dbg (dmac->dev,"%s channel: %d src=0x%pad dst=0x%pad len=%zu\n" , __func__, channel->index, &src, &dest, len); -if (list_empty (&channel->ld_free)) -return NULL ; + scoped_guard(spinlock_irqsave, &channel->vc.lock) { +if (list_empty (&channel->ld_free)) +return NULL ; + + desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node); + + desc->type =RZ_DMAC_DESC_MEMCPY ; + desc->src = src; + desc->dest = dest; + desc->len = len; + desc->direction =DMA_MEM_TO_MEM ; - desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node); - - desc->type =RZ_DMAC_DESC_MEMCPY ; - desc->src = src; - desc->dest = dest; - desc->len = len; - desc->direction =DMA_MEM_TO_MEM ; +list_move_tail (channel->ld_free.next, &channel->ld_queue); + } -list_move_tail (channel->ld_free.next, &channel->ld_queue);return vchan_tx_prep (&channel->vc, &desc->vd, flags); }
@@ -506,27 +511,29 @@ rz_dmac_prep_slave_sg(struct dma_chan *cint dma_length =0 ;int i =0 ; -if (list_empty (&channel->ld_free)) -return NULL ; - - desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node); + scoped_guard(spinlock_irqsave, &channel->vc.lock) { +if (list_empty (&channel->ld_free)) +return NULL ; + + desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node); + +for_each_sg (sgl, sg, sg_len, i) + dma_length +=sg_dma_len (sg); + + desc->type =RZ_DMAC_DESC_SLAVE_SG ; + desc->sg = sgl; + desc->sgcount = sg_len; + desc->len = dma_length; + desc->direction = direction; + +if (direction ==DMA_DEV_TO_MEM ) + desc->src = channel->src_per_address; +else + desc->dest = channel->dst_per_address; -for_each_sg (sgl, sg, sg_len, i) { - dma_length +=sg_dma_len (sg); +list_move_tail (channel->ld_free.next, &channel->ld_queue); } - desc->type =RZ_DMAC_DESC_SLAVE_SG ; - desc->sg = sgl; - desc->sgcount = sg_len; - desc->len = dma_length; - desc->direction = direction; - -if (direction ==DMA_DEV_TO_MEM ) - desc->src = channel->src_per_address; -else - desc->dest = channel->dst_per_address; - -list_move_tail (channel->ld_free.next, &channel->ld_queue);return vchan_tx_prep (&channel->vc, &desc->vd, flags); }
Greg Kroah-Hartman
maintainerPATCH 125/175 dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit 89a8567d84bde88cb7cdbbac2ab2299c4f991490 upstream.
Both rz_dmac_disable_hw() and rz_dmac_irq_handle_channel() update the CHCTRL register. To avoid concurrency issues when configuring functionalities exposed by this registers, take the virtual channel lock. All other CHCTRL updates were already protected by the same lock.
Previously, rz_dmac_disable_hw() disabled and re-enabled local IRQs, before accessing CHCTRL registers but this does not ensure race-free access. Remove the local IRQ disable/enable code as well.
--- drivers/dma/sh/rz-dmac.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/dma/sh/rz-dmac.c +4 -5
@@ -286,13 +286,10 @@ static void rz_dmac_disable_hw(struct rz {struct dma_chan *chan = &channel->vc.chan;struct rz_dmac *dmac =to_rz_dmac (chan->device); -unsigned long flags;dev_dbg (dmac->dev,"%s channel %d\n" , __func__, channel->index); -local_irq_save (flags);rz_dmac_ch_writel (channel,CHCTRL_DEFAULT ,CHCTRL ,1 ); -local_irq_restore (flags); }static void rz_dmac_set_dmars_register (struct rz_dmac *dmac,int nr,u32 dmars)
@@ -545,8 +542,8 @@ static int rz_dmac_terminate_all(structunsigned int i;LIST_HEAD (head); -rz_dmac_disable_hw (channel);spin_lock_irqsave (&channel->vc.lock, flags); +rz_dmac_disable_hw (channel);for (i =0 ; i <DMAC_NR_LMDESC ; i++) lmdesc[i].header =0 ;
@@ -674,7 +671,9 @@ static void rz_dmac_irq_handle_channel(sif (chstat &CHSTAT_ER ) {dev_err (dmac->dev,"DMAC err CHSTAT_%d = %08X\n" , channel->index, chstat); -rz_dmac_ch_writel (channel,CHCTRL_DEFAULT ,CHCTRL ,1 ); + + scoped_guard(spinlock_irqsave, &channel->vc.lock) +rz_dmac_ch_writel (channel,CHCTRL_DEFAULT ,CHCTRL ,1 ); goto done; }
Greg Kroah-Hartman
maintainerPATCH 126/175 LoongArch: Workaround LS2K/LS7A GPU DMA hang bug
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 95db0c9f526d583634cddb2e5914718570fbac87 upstream.
1. Hardware limitation: GPU, DC and VPU are typically PCI device 06.0, 06.1 and 06.2. They share some hardware resources, so when configure the PCI 06.0 device BAR1, DMA memory access cannot be performed through this BAR, otherwise it will cause hardware abnormalities.
2. In typical scenarios of reboot or S3/S4, DC access to memory through BAR is not prohibited, resulting in GPU DMA hangs.
3. Workaround method: When configuring the 06.0 device BAR1, turn off the memory access of DC, GPU and VPU (via DC's CRTC registers).
--- arch/loongarch/pci/pci.c | 80 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+)
arch/loongarch/pci/pci.c +80 -0
@@ -6,9 +6,11 @@#include <linux/export.h> #include <linux/init.h> #include <linux/acpi.h> +#include <linux/delay.h> #include <linux/types.h> #include <linux/pci.h> #include <linux/vgaarb.h> +#include <linux/io-64-nonatomic-lo-hi.h> #include <asm/cacheflush.h> #include <asm/loongson.h>
@@ -16,6 +18,9 @@#define PCI_DEVICE_ID_LOONGSON_DC1 0x7a06#define PCI_DEVICE_ID_LOONGSON_DC2 0x7a36#define PCI_DEVICE_ID_LOONGSON_DC3 0x7a46 +#define PCI_DEVICE_ID_LOONGSON_GPU1 0x7a15 +#define PCI_DEVICE_ID_LOONGSON_GPU2 0x7a25 +#define PCI_DEVICE_ID_LOONGSON_GPU3 0x7a35int raw_pci_read (unsigned int domain,unsigned int bus,unsigned int devfn,int reg,int len,u32 *val)
@@ -100,3 +105,78 @@ static void pci_fixup_vgadev(struct pci_DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_LOONGSON ,PCI_DEVICE_ID_LOONGSON_DC1 , pci_fixup_vgadev);DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_LOONGSON ,PCI_DEVICE_ID_LOONGSON_DC2 , pci_fixup_vgadev);DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_LOONGSON ,PCI_DEVICE_ID_LOONGSON_DC3 , pci_fixup_vgadev); + +#define CRTC_NUM_MAX 2 +#define CRTC_OUTPUT_ENABLE 0x100 + +static void loongson_gpu_fixup_dma_hang (struct pci_dev *pdev,bool on) +{ +u32 i, val, count, crtc_offset, device; +void __iomem *crtc_reg, *base, *regbase; +static u32 crtc_status[CRTC_NUM_MAX ] = {0 }; + + base = pdev->bus->ops->map_bus (pdev->bus, pdev->devfn +1 ,0 ); + device =readw (base +PCI_DEVICE_ID ); + + regbase =ioremap (readq (base +PCI_BASE_ADDRESS_0 ) & ~0xffull ,SZ_64K ); +if (!regbase) { +pci_err (pdev,"Failed to ioremap()\n" ); +return ; + } + +switch (device) { +case PCI_DEVICE_ID_LOONGSON_DC2 : + crtc_reg = regbase +0x1240 ; + crtc_offset =0x10 ; +break ; +case PCI_DEVICE_ID_LOONGSON_DC3 : + crtc_reg = regbase; + crtc_offset =0x400 ; +break ; + } + +for (i =0 ; i <CRTC_NUM_MAX ; i++, crtc_reg += crtc_offset) { + val =readl (crtc_reg); + +if (!on) + crtc_status[i] = val; + +/* No need to fixup if the status is off at startup. */ +if (!(crtc_status[i] &CRTC_OUTPUT_ENABLE )) +continue ; + +if (on) + val |=CRTC_OUTPUT_ENABLE ; +else + val &= ~CRTC_OUTPUT_ENABLE ; + +mb (); +writel (val, crtc_reg); + +for (count =0 ; count <40 ; count++) { + val =readl (crtc_reg) &CRTC_OUTPUT_ENABLE ; +if ((on && val) || (!on && !val)) +break ; +udelay (1000 ); + } + +pci_info (pdev,"DMA hang fixup at reg[0x%lx]: 0x%x\n" , + (unsigned long )crtc_reg &0xffff ,readl (crtc_reg)); + } + +iounmap (regbase); +} + +static void pci_fixup_dma_hang_early (struct pci_dev *pdev) +{ +loongson_gpu_fixup_dma_hang (pdev, false); +} +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_LOONGSON ,PCI_DEVICE_ID_LOONGSON_GPU2 , pci_fixup_dma_hang_early); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_LOONGSON ,PCI_DEVICE_ID_LOONGSON_GPU3 , pci_fixup_dma_hang_early); + +static void pci_fixup_dma_hang_final (struct pci_dev *pdev) +{ +loongson_gpu_fixup_dma_hang (pdev, true); +} +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_LOONGSON ,PCI_DEVICE_ID_LOONGSON_GPU2 , pci_fixup_dma_hang_final); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_LOONGSON ,PCI_DEVICE_ID_LOONGSON_GPU3 , pci_fixup_dma_hang_final);
Greg Kroah-Hartman
maintainerPATCH 127/175 xfs: stop reclaim before pushing AIL during unmount
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuto Ohnuki <[email protected]>
commit 4f24a767e3d64a5f58c595b5c29b6063a201f1e3 upstream.
The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while background reclaim and inodegc are still running. This is broken independently of any use-after-free issues - background reclaim and inodegc should not be running while the AIL is being pushed during unmount, as inodegc can dirty and insert inodes into the AIL during the flush, and background reclaim can race to abort and free dirty inodes.
Reorder xfs_unmount_flush_inodes() to stop inodegc and cancel background reclaim before pushing the AIL. Stop inodegc before cancelling m_reclaim_work because the inodegc worker can re-queue m_reclaim_work via xfs_inodegc_set_reclaimable.
--- fs/xfs/xfs_mount.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/xfs/xfs_mount.c +4 -3
@@ -576,8 +576,9 @@ xfs_unmount_check(* have been retrying in the background. This will prevent never-ending * retries in AIL pushing from hanging the unmount. * -* Finally, we can push the AIL to clean all the remaining dirty objects, then -* reclaim the remaining inodes that are still in memory at this point in time. +* Stop inodegc and background reclaim before pushing the AIL so that they +* are not running while the AIL is being flushed. Then push the AIL to +* clean all the remaining dirty objects and reclaim the remaining inodes. */ static void xfs_unmount_flush_inodes(
@@ -589,9 +590,9 @@ xfs_unmount_flush_inodes(set_bit (XFS_OPSTATE_UNMOUNTING , &mp->m_opstate); -xfs_ail_push_all_sync (mp->m_ail);xfs_inodegc_stop (mp);cancel_delayed_work_sync (&mp->m_reclaim_work); +xfs_ail_push_all_sync (mp->m_ail);xfs_reclaim_inodes (mp);xfs_health_unmount (mp); }
Greg Kroah-Hartman
maintainerPATCH 128/175 xfs: fix ri_total validation in xlog_recover_attri_commit_pass2
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
commit d72f2084e30966097c8eae762e31986a33c3c0ae upstream.
The ri_total checks for SET/REPLACE operations are hardcoded to 3, but xfs_attri_item_size() only emits a value iovec when value_len > 0, so ri_total is 2 when value_len == 0.
For PPTR_SET/PPTR_REMOVE/PPTR_REPLACE, value_len is validated by xfs_attri_validate() to be exactly sizeof(struct xfs_parent_rec) and is never zero, so their hardcoded checks remain correct.
This problem may cause log recovery failures. The following script can be used to reproduce the problem:
#!/bin/bash
mkfs.xfs -f /dev/sda
mount /dev/sda /mnt/test/
touch /mnt/test/file
for i in {1..200}; do
attr -s "user.attr_$i" -V "value_$i" /mnt/test/file > /dev/null
done
echo 1 > /sys/fs/xfs/debug/larp
echo 1 > /sys/fs/xfs/sda/errortag/larp
attr -s "user.zero" -V "" /mnt/test/file
echo 0 > /sys/fs/xfs/sda/errortag/larp
umount /mnt/test
mount /dev/sda /mnt/test/ # mount failed
Fix this by deriving the expected count dynamically as "2 + !!value_len" for SET/REPLACE operations.
--- fs/xfs/xfs_attr_item.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/xfs/xfs_attr_item.c +2 -2
@@ -746,8 +746,8 @@ xlog_recover_attri_commit_pass2(switch (op) {case XFS_ATTRI_OP_FLAGS_SET :case XFS_ATTRI_OP_FLAGS_REPLACE : -/* Log item, attr name, attr value */ -if (item->ri_total !=3 ) { +/* Log item, attr name, optional attr value */ +if (item->ri_total !=2 + !!attri_formatp->alfi_value_len) {XFS_CORRUPTION_ERROR (__func__,XFS_ERRLEVEL_LOW , mp, attri_formatp, len);return -EFSCORRUPTED ;
Greg Kroah-Hartman
maintainerPATCH 129/175 ext4: fix journal credit check when setting fscrypt context
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Weber <[email protected]>
commit b1d682f1990c19fb1d5b97d13266210457092bcd upstream.
Fix an issue arising when ext4 features has_journal, ea_inode, and encrypt are activated simultaneously, leading to ENOSPC when creating an encrypted file.
Fix by passing XATTR_CREATE flag to xattr_set_handle function if a handle is specified, i.e., when the function is called in the control flow of creating a new inode. This aligns the number of jbd2 credits set_handle checks for with the number allocated for creating a new inode.
ext4_set_context must not be called with a non-null handle (fs_data) if fscrypt context xattr is not guaranteed to not exist yet. The only other usage of this function currently is when handling the ioctl FS_IOC_SET_ENCRYPTION_POLICY, which calls it with fs_data=NULL.
--- fs/ext4/crypto.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/ext4/crypto.c +8 -1
@@ -169,10 +169,17 @@ static int ext4_set_context(struct inode*/ if (handle) { +/* +* Since the inode is new it is ok to pass the +* XATTR_CREATE flag. This is necessary to match the +* remaining journal credits check in the set_handle +* function with the credits allocated for the new +* inode. +*/ res =ext4_xattr_set_handle (handle, inode,EXT4_XATTR_INDEX_ENCRYPTION ,EXT4_XATTR_NAME_ENCRYPTION_CONTEXT , - ctx, len,0 ); + ctx, len,XATTR_CREATE );if (!res) {ext4_set_inode_flag (inode,EXT4_INODE_ENCRYPT ); ext4_clear_inode_state(inode,
Greg Kroah-Hartman
maintainerPATCH 130/175 ext4: convert inline data to extents when truncate exceeds inline size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
commit ed9356a30e59c7cc3198e7fc46cfedf3767b9b17 upstream.
Add a check in ext4_setattr() to convert files from inline data storage to extent-based storage when truncate() grows the file size beyond the inline capacity. This prevents the filesystem from entering an inconsistent state where the inline data flag is set but the file size exceeds what can be stored inline.
Without this fix, the following sequence causes a kernel BUG_ON():
1. Mount filesystem with inode that has inline flag set and small size
2. truncate(file, 50MB) - grows size but inline flag remains set
3. sendfile() attempts to write data
4. ext4_write_inline_data() hits BUG_ON(write_size > inline_capacity)
The crash occurs because ext4_write_inline_data() expects inline storage to accommodate the write, but the actual inline capacity (~60 bytes for i_block + ~96 bytes for xattrs) is far smaller than the file size and write request.
The fix checks if the new size from setattr exceeds the inode's actual inline capacity (EXT4_I(inode)->i_inline_size) and converts the file to extent-based storage before proceeding with the size change.
This addresses the root cause by ensuring the inline data flag and file size remain consistent during truncate operations.
--- fs/ext4/inode.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
fs/ext4/inode.c +12 -0
@@ -5530,6 +5530,18 @@ int ext4_setattr(struct mnt_idmap *idmapif (attr->ia_size == inode->i_size) inc_ivers = false; +/* +* If file has inline data but new size exceeds inline capacity, +* convert to extent-based storage first to prevent inconsistent +* state (inline flag set but size exceeds inline capacity). +*/ +if (ext4_has_inline_data (inode) && + attr->ia_size >EXT4_I (inode)->i_inline_size) { + error =ext4_convert_inline_data (inode); +if (error) + goto err_out; + } +if (shrink) {if (ext4_should_order_data (inode)) { error = ext4_begin_ordered_truncate(inode,
Greg Kroah-Hartman
maintainerPATCH 131/175 ext4: fix stale xarray tags after writeback
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit f4a2b42e78914ff15630e71289adc589c3a8eb45 upstream.
There are cases where ext4_bio_write_page() gets called for a page which has no buffers to submit. This happens e.g. when the part of the file is actually a hole, when we cannot allocate blocks due to being called from jbd2, or in data=journal mode when checkpointing writes the buffers earlier. In these cases we just return from ext4_bio_write_page() however if the page didn't need redirtying, we will leave stale DIRTY and/or TOWRITE tags in xarray because those get cleared only in __folio_start_writeback(). As a result we can leave these tags set in mappings even after a final sync on filesystem that's getting remounted read-only or that's being frozen. Various assertions can then get upset when writeback is started on such filesystems (Gerald reported assertion in ext4_journal_check_start() firing).
Fix the problem by cycling the page through writeback state even if we decide nothing needs to be written for it so that xarray tags get properly updated. This is slightly silly (we could update the xarray tags directly) but I don't think a special helper messing with xarray tags is really worth it in this relatively rare corner case.
--- fs/ext4/page-io.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/ext4/page-io.c +8 -2
@@ -506,9 +506,15 @@ int ext4_bio_write_folio(struct ext4_io_ nr_to_submit++; }while ((bh = bh->b_this_page) != head); -/* Nothing to submit? Just unlock the folio... */ -if (!nr_to_submit) +if (!nr_to_submit) { +/* +* We have nothing to submit. Just cycle the folio through +* writeback state to properly update xarray tags. +*/ +__folio_start_writeback (folio, keep_towrite); +folio_end_writeback (folio);return 0 ; + } bh = head =folio_buffers (folio);
Greg Kroah-Hartman
maintainerPATCH 132/175 ext4: fix fsync(2) for nojournal mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 1308255bbf8452762f89f44f7447ce137ecdbcff upstream.
When inode metadata is changed, we sometimes just call ext4_mark_inode_dirty() to track modified metadata. This copies inode metadata into block buffer which is enough when we are journalling metadata. However when we are running in nojournal mode we currently fail to write the dirtied inode buffer during fsync(2) because the inode is not marked as dirty. Use explicit ext4_write_inode() call to make sure the inode table buffer is written to the disk. This is a band aid solution but proper solution requires a much larger rewrite including changes in metadata bh tracking infrastructure.
--- fs/ext4/fsync.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
fs/ext4/fsync.c +14 -2
@@ -83,11 +83,23 @@ static int ext4_fsync_nojournal(struct f int datasync, bool *needs_barrier) { struct inode *inode = file->f_inode; +struct writeback_control wbc = { + .sync_mode =WB_SYNC_ALL , + .nr_to_write =0 , + };int ret; ret =generic_buffers_fsync_noflush (file, start, end, datasync); -if (!ret) - ret =ext4_sync_parent (inode); +if (ret) +return ret; + +/* Force writeout of inode table buffer to disk */ + ret =ext4_write_inode (inode, &wbc); +if (ret) +return ret; + + ret =ext4_sync_parent (inode); +if (test_opt (inode->i_sb,BARRIER )) *needs_barrier = true;
Greg Kroah-Hartman
maintainerPATCH 133/175 ext4: make recently_deleted() properly work with lazy itable initialization
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit bd060afa7cc3e0ad30afa9ecc544a78638498555 upstream.
recently_deleted() checks whether inode has been used in the near past. However this can give false positive result when inode table is not initialized yet and we are in fact comparing to random garbage (or stale itable block of a filesystem before mkfs). Ultimately this results in uninitialized inodes being skipped during inode allocation and possibly they are never initialized and thus e2fsck complains. Verify if the inode has been initialized before checking for dtime.
--- fs/ext4/ialloc.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ext4/ialloc.c +6 -0
@@ -688,6 +688,12 @@ static int recently_deleted(struct superif (unlikely (!gdp))return 0 ; +/* Inode was never used in this filesystem? */ +if (ext4_has_group_desc_csum (sb) && + (gdp->bg_flags &cpu_to_le16 (EXT4_BG_INODE_UNINIT ) || + ino >=EXT4_INODES_PER_GROUP (sb) -ext4_itable_unused_count (sb, gdp))) +return 0 ; + bh =sb_find_get_block (sb,ext4_inode_table (sb, gdp) + (ino / inodes_per_block));if (!bh || !buffer_uptodate (bh))
Greg Kroah-Hartman
maintainerPATCH 134/175 ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuto Ohnuki <[email protected]>
commit 356227096eb66e41b23caf7045e6304877322edf upstream.
Replace BUG_ON() with proper error handling when inline data size exceeds PAGE_SIZE. This prevents kernel panic and allows the system to continue running while properly reporting the filesystem corruption.
The error is logged via ext4_error_inode(), the buffer head is released to prevent memory leak, and -EFSCORRUPTED is returned to indicate filesystem corruption.
--- fs/ext4/inline.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/ext4/inline.c +9 -1
@@ -517,7 +517,15 @@ static int ext4_read_inline_folio(struct goto out; len =min_t (size_t,ext4_get_inline_size (inode),i_size_read (inode)); -BUG_ON (len >PAGE_SIZE ); + +if (len >PAGE_SIZE ) { +ext4_error_inode (inode, __func__, __LINE__,0 , +"inline size %zu exceeds PAGE_SIZE" , len); + ret = -EFSCORRUPTED ; +brelse (iloc.bh); + goto out; + } + kaddr =kmap_local_folio (folio,0 ); ret =ext4_read_inline_data (inode, kaddr, len, &iloc);flush_dcache_folio (folio);
Greg Kroah-Hartman
maintainerPATCH 135/175 ext4: avoid infinite loops caused by residual data
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
commit 5422fe71d26d42af6c454ca9527faaad4e677d6c upstream.
On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this example, because the file system disabled the huge file feature when marking the inode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to reclaim the physical block without deleting the corresponding data in the extent tree. This causes subsequent mkdir operations to reference the previously reclaimed physical block number again, even though this physical block is already being used by the xattr block. Therefore, a situation arises where both the directory and xattr are using the same buffer head block in memory simultaneously.
The above causes ext4_xattr_block_set() to enter an infinite loop about "inserted" and cannot release the inode lock, ultimately leading to the 143s blocking problem mentioned in [1].
If the metadata is corrupted, then trying to remove some extent space can do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE was passed, remove space wrongly update quota information. Jan Kara suggests distinguishing between two cases:
1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully consistent and we must maintain its consistency including all the accounting. However these errors can happen only early before we've inserted the extent into the extent tree. So current code works correctly for this case.
2) Some other error - this means metadata is corrupted. We should strive to do as few modifications as possible to limit damage. So I'd just skip freeing of allocated blocks.
[1]
INFO: task syz.0.17:5995 blocked for more than 143 seconds. Call Trace: inode_lock_nested include/linux/fs.h:1073 [inline] __start_dirop fs/namei.c:2923 [inline] start_dirop fs/namei.c:2934 [inline]
--- fs/ext4/extents.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/ext4/extents.c +6 -2
@@ -4421,9 +4421,13 @@ got_allocated_blocks: path =ext4_ext_insert_extent (handle, inode, path, &newex, flags);if (IS_ERR (path)) { err =PTR_ERR (path); -if (allocated_clusters) { +/* +* Gracefully handle out of space conditions. If the filesystem +* is inconsistent, we'll just leak allocated blocks to avoid +* causing even more damage. +*/ +if (allocated_clusters && (err == -EDQUOT || err == -ENOSPC )) {int fb_flags =0 ; -/* * free data blocks we just allocated. * not a good idea to call discard here directly,
Greg Kroah-Hartman
maintainerPATCH 136/175 ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
commit 46066e3a06647c5b186cc6334409722622d05c44 upstream.
There's issue as follows:
...
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2243 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2239 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): error count since last fsck: 1
EXT4-fs (mmcblk0p1): initial error at time 1765597433: ext4_mb_generate_buddy:760 EXT4-fs (mmcblk0p1): last error at time 1765597433: ext4_mb_generate_buddy:760
...
According to the log analysis, blocks are always requested from the corrupted block group. This may happen as follows:ext4_mb_find_by_goal
ext4_mb_load_buddy
ext4_mb_load_buddy_gfp
ext4_mb_init_cache
ext4_read_block_bitmap_nowait
ext4_wait_block_bitmap
ext4_validate_block_bitmap
if (!grp || EXT4_MB_GRP_BBITMAP_CORRUPT(grp))
return -EFSCORRUPTED; // There's no logs.
if (err)
return err; // Will return errorext4_lock_group(ac->ac_sb, group);
if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) // Unreachable
goto out;
After commit 9008a58e5dce ("ext4: make the bitmap read routines return real error codes") merged, Commit 163a203ddb36 ("ext4: mark block group as corrupt on block bitmap error") is no real solution for allocating blocks from corrupted block groups. This is because if 'EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info)' is true, then 'ext4_mb_load_buddy()' may return an error. This means that the block allocation will fail.
Therefore, check block group if corrupted when ext4_mb_load_buddy() returns error.
--- fs/ext4/mballoc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/ext4/mballoc.c +5 -1
@@ -2369,8 +2369,12 @@ int ext4_mb_find_by_goal(struct ext4_allreturn 0 ; err =ext4_mb_load_buddy (ac->ac_sb, group, e4b); -if (err) +if (err) { +if (EXT4_MB_GRP_BBITMAP_CORRUPT (e4b->bd_info) && + !(ac->ac_flags &EXT4_MB_HINT_GOAL_ONLY )) +return 0 ;return err; + }ext4_lock_group (ac->ac_sb, group);if (unlikely (EXT4_MB_GRP_BBITMAP_CORRUPT (e4b->bd_info)))
Greg Kroah-Hartman
maintainerPATCH 137/175 ext4: reject mount if bigalloc with s_first_data_block != 0
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helen Koike <[email protected]>
commit 3822743dc20386d9897e999dbb990befa3a5b3f8 upstream.
bigalloc with s_first_data_block != 0 is not supported, reject mounting it.
--- fs/ext4/super.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/ext4/super.c +7 -0
@@ -3655,6 +3655,13 @@ int ext4_feature_set_ok(struct super_blo "extents feature\n");return 0 ; } +if (ext4_has_feature_bigalloc (sb) && +le32_to_cpu (EXT4_SB (sb)->s_es->s_first_data_block)) { +ext4_msg (sb,KERN_WARNING , +"bad geometry: bigalloc file system with non-zero " +"first_data_block\n" ); +return 0 ; + }#if !IS_ENABLED (CONFIG_QUOTA ) || !IS_ENABLED (CONFIG_QFMT_V2 ) if (!readonly && (ext4_has_feature_quota(sb) ||
Greg Kroah-Hartman
maintainerPATCH 138/175 ext4: fix use-after-free in update_super_work when racing with umount
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
commit d15e4b0a418537aafa56b2cb80d44add83e83697 upstream.
Commit b98535d09179 ("ext4: fix bug_on in start_this_handle during umount filesystem") moved ext4_unregister_sysfs() before flushing s_sb_upd_work to prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups reads during unmount. However, this introduced a use-after-free because update_super_work calls ext4_notify_error_sysfs() -> sysfs_notify() which accesses the kobject's kernfs_node after it has been freed by kobject_del() in ext4_unregister_sysfs():
update_super_work ext4_put_super
----------------- --------------
ext4_unregister_sysfs(sb)
kobject_del(&sbi->s_kobj)
__kobject_del()
sysfs_remove_dir()
kobj->sd = NULL
sysfs_put(sd)
kernfs_put() // RCU free
ext4_notify_error_sysfs(sbi)
sysfs_notify(&sbi->s_kobj)
kn = kobj->sd // stale pointer
kernfs_get(kn) // UAF on freed kernfs_node
ext4_journal_destroy()
flush_work(&sbi->s_sb_upd_work)Instead of reordering the teardown sequence, fix this by making ext4_notify_error_sysfs() detect that sysfs has already been torn down by checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call in that case. A dedicated mutex (s_error_notify_mutex) serializes ext4_notify_error_sysfs() against kobject_del() in ext4_unregister_sysfs() to prevent TOCTOU races where the kobject could be deleted between the state_in_sysfs check and the sysfs_notify() call.
--- fs/ext4/ext4.h | 1 + fs/ext4/super.c | 1 + fs/ext4/sysfs.c | 10 +++++++++- 3 files changed, 11 insertions(+), 1 deletion(-)
fs/ext4/ext4.h +1 -0
@@ -1535,6 +1535,7 @@ struct ext4_sb_info {struct proc_dir_entry *s_proc;struct kobject s_kobj;struct completion s_kobj_unregister; +struct mutex s_error_notify_mutex;/* protects sysfs_notify vs kobject_del */ struct super_block *s_sb;struct buffer_head *s_mmp_bh;
fs/ext4/super.c +1 -0
@@ -5344,6 +5344,7 @@ static int __ext4_fill_super(struct fs_ctimer_setup (&sbi->s_err_report, print_daily_error_info,0 );spin_lock_init (&sbi->s_error_lock); +mutex_init (&sbi->s_error_notify_mutex);INIT_WORK (&sbi->s_sb_upd_work, update_super_work); err =ext4_group_desc_init (sb, es, logical_sb_block, &first_not_zeroed);
fs/ext4/sysfs.c +9 -1
@@ -529,7 +529,10 @@ static const struct kobj_type ext4_feat_void ext4_notify_error_sysfs (struct ext4_sb_info *sbi) { -sysfs_notify (&sbi->s_kobj,NULL ,"errors_count" ); +mutex_lock (&sbi->s_error_notify_mutex); +if (sbi->s_kobj.state_in_sysfs) +sysfs_notify (&sbi->s_kobj,NULL ,"errors_count" ); +mutex_unlock (&sbi->s_error_notify_mutex); }static struct kobject *ext4_root;
@@ -542,8 +545,10 @@ int ext4_register_sysfs(struct super_bloint err;init_completion (&sbi->s_kobj_unregister); +mutex_lock (&sbi->s_error_notify_mutex); err =kobject_init_and_add (&sbi->s_kobj, &ext4_sb_ktype, ext4_root,"%s" , sb->s_id); +mutex_unlock (&sbi->s_error_notify_mutex);if (err) {kobject_put (&sbi->s_kobj);wait_for_completion (&sbi->s_kobj_unregister);
@@ -576,7 +581,10 @@ void ext4_unregister_sysfs(struct super_if (sbi->s_proc)remove_proc_subtree (sb->s_id, ext4_proc_root); + +mutex_lock (&sbi->s_error_notify_mutex);kobject_del (&sbi->s_kobj); +mutex_unlock (&sbi->s_error_notify_mutex); }int __init ext4_init_sysfs (void )
Greg Kroah-Hartman
maintainerPATCH 139/175 ext4: fix the might_sleep() warnings in kvfree()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <[email protected]>
commit 496bb99b7e66f48b178126626f47e9ba79e2d0fa upstream.
Use the kvfree() in the RCU read critical section can trigger the following warnings:
EXT4-fs (vdb): unmounting filesystem cd983e5b-3c83-4f5a-a136-17b00eb9d018.
WARNING: suspicious RCU usage
./include/linux/rcupdate.h:409 Illegal context switch in RCU read-side critical section!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
Call Trace: <TASK> dump_stack_lvl+0xbb/0xd0 dump_stack+0x14/0x20 lockdep_rcu_suspicious+0x15a/0x1b0 __might_resched+0x375/0x4d0 ? put_object.part.0+0x2c/0x50 __might_sleep+0x108/0x160 vfree+0x58/0x910 ? ext4_group_desc_free+0x27/0x270 kvfree+0x23/0x40 ext4_group_desc_free+0x111/0x270 ext4_put_super+0x3c8/0xd40 generic_shutdown_super+0x14c/0x4a0 ? __pfx_shrinker_free+0x10/0x10 kill_block_super+0x40/0x90 ext4_kill_sb+0x6d/0xb0 deactivate_locked_super+0xb4/0x180 deactivate_super+0x7e/0xa0 cleanup_mnt+0x296/0x3e0 __cleanup_mnt+0x16/0x20 task_work_run+0x157/0x250 ? __pfx_task_work_run+0x10/0x10 ? exit_to_user_mode_loop+0x6a/0x550 exit_to_user_mode_loop+0x102/0x550 do_syscall_64+0x44a/0x500 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> BUG: sleeping function called from invalid context at mm/vmalloc.c:3441 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 556, name: umount preempt_count: 1, expected: 0 CPU: 3 UID: 0 PID: 556 Comm: umount Call Trace: <TASK> dump_stack_lvl+0xbb/0xd0 dump_stack+0x14/0x20 __might_resched+0x275/0x4d0 ? put_object.part.0+0x2c/0x50 __might_sleep+0x108/0x160 vfree+0x58/0x910 ? ext4_group_desc_free+0x27/0x270 kvfree+0x23/0x40 ext4_group_desc_free+0x111/0x270 ext4_put_super+0x3c8/0xd40 generic_shutdown_super+0x14c/0x4a0 ? __pfx_shrinker_free+0x10/0x10 kill_block_super+0x40/0x90 ext4_kill_sb+0x6d/0xb0 deactivate_locked_super+0xb4/0x180 deactivate_super+0x7e/0xa0 cleanup_mnt+0x296/0x3e0 __cleanup_mnt+0x16/0x20 task_work_run+0x157/0x250 ? __pfx_task_work_run+0x10/0x10 ? exit_to_user_mode_loop+0x6a/0x550 exit_to_user_mode_loop+0x102/0x550 do_syscall_64+0x44a/0x500 entry_SYSCALL_64_after_hwframe+0x77/0x7f
The above scenarios occur in initialization failures and teardown paths, there are no parallel operations on the resources released by kvfree(), this commit therefore remove rcu_read_lock/unlock() and use rcu_access_pointer() instead of rcu_dereference() operations.
--- fs/ext4/mballoc.c | 10 +++------- fs/ext4/super.c | 8 ++------ 2 files changed, 5 insertions(+), 13 deletions(-)
fs/ext4/mballoc.c +3 -7
@@ -3502,9 +3502,7 @@ err_freebuddy:rcu_read_unlock ();iput (sbi->s_buddy_cache); err_freesgi: -rcu_read_lock (); -kvfree (rcu_dereference (sbi->s_group_info)); -rcu_read_unlock (); +kvfree (rcu_access_pointer (sbi->s_group_info));return -ENOMEM ; }
@@ -3803,7 +3801,8 @@ int ext4_mb_release(struct super_block *WARN_ON_ONCE (!list_empty (&sbi->s_discard_list)); } -if (sbi->s_group_info) { + group_info =rcu_access_pointer (sbi->s_group_info); +if (group_info) {for (i =0 ; i < ngroups; i++) {cond_resched (); grinfo =ext4_get_group_info (sb, i);
@@ -3821,12 +3820,9 @@ int ext4_mb_release(struct super_block * num_meta_group_infos = (ngroups +EXT4_DESC_PER_BLOCK (sb) -1 ) >>EXT4_DESC_PER_BLOCK_BITS (sb); -rcu_read_lock (); - group_info =rcu_dereference (sbi->s_group_info);for (i =0 ; i < num_meta_group_infos; i++)kfree (group_info[i]);kvfree (group_info); -rcu_read_unlock (); }kfree (sbi->s_mb_avg_fragment_size);kfree (sbi->s_mb_avg_fragment_size_locks);
fs/ext4/super.c +2 -6
@@ -1266,12 +1266,10 @@ static void ext4_group_desc_free(structstruct buffer_head **group_desc;int i; -rcu_read_lock (); - group_desc =rcu_dereference (sbi->s_group_desc); + group_desc =rcu_access_pointer (sbi->s_group_desc);for (i =0 ; i < sbi->s_gdb_count; i++)brelse (group_desc[i]);kvfree (group_desc); -rcu_read_unlock (); }static void ext4_flex_groups_free (struct ext4_sb_info *sbi)
@@ -1279,14 +1277,12 @@ static void ext4_flex_groups_free(structstruct flex_groups **flex_groups;int i; -rcu_read_lock (); - flex_groups =rcu_dereference (sbi->s_flex_groups); + flex_groups =rcu_access_pointer (sbi->s_flex_groups);if (flex_groups) {for (i =0 ; i < sbi->s_flex_groups_allocated; i++)kvfree (flex_groups[i]);kvfree (flex_groups); } -rcu_read_unlock (); }static void ext4_put_super (struct super_block *sb)
Greg Kroah-Hartman
maintainerPATCH 140/175 ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit ec0a7500d8eace5b4f305fa0c594dd148f0e8d29 upstream.
During code review, Joseph found that ext4_fc_replay_inode() calls ext4_get_fc_inode_loc() to get the inode location, which holds a reference to iloc.bh that must be released via brelse().
However, several error paths jump to the 'out' label without releasing iloc.bh:
- ext4_handle_dirty_metadata() failure
- sync_dirty_buffer() failure
- ext4_mark_inode_used() failure
- ext4_iget() failure
Fix this by introducing an 'out_brelse' label placed just before the existing 'out' label to ensure iloc.bh is always released.
Additionally, make ext4_fc_replay_inode() propagate errors properly instead of always returning 0.
--- fs/ext4/fast_commit.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
fs/ext4/fast_commit.c +8 -5
@@ -1601,19 +1601,21 @@ static int ext4_fc_replay_inode(struct s/* Immediately update the inode on disk. */ ret =ext4_handle_dirty_metadata (NULL ,NULL , iloc.bh);if (ret) - goto out; + goto out_brelse; ret =sync_dirty_buffer (iloc.bh);if (ret) - goto out; + goto out_brelse; ret =ext4_mark_inode_used (sb, ino);if (ret) - goto out; + goto out_brelse;/* Given that we just wrote the inode on disk, this SHOULD succeed. */ inode =ext4_iget (sb, ino,EXT4_IGET_NORMAL );if (IS_ERR (inode)) {ext4_debug ("Inode not found." ); -return -EFSCORRUPTED ; + inode =NULL ; + ret = -EFSCORRUPTED ; + goto out_brelse; }/*
@@ -1630,13 +1632,14 @@ static int ext4_fc_replay_inode(struct sext4_inode_csum_set (inode,ext4_raw_inode (&iloc),EXT4_I (inode)); ret =ext4_handle_dirty_metadata (NULL ,NULL , iloc.bh);sync_dirty_buffer (iloc.bh); +out_brelse:brelse (iloc.bh); out:iput (inode);if (!ret)blkdev_issue_flush (sb->s_bdev); -return 0 ; +return ret; }/*
Greg Kroah-Hartman
maintainerPATCH 141/175 ext4: always drain queued discard work in ext4_mb_release()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 9ee29d20aab228adfb02ca93f87fb53c56c2f3af upstream.
While reviewing recent ext4 patch[1], Sashiko raised the following concern[2]:
Quoted 5 lines
If the filesystem is initially mounted with the discard option, deleting files will populate
sbi->s_discard_listand queues_discard_work. If it is then remounted with nodiscard, theEXT4_MOUNT_DISCARDflag is cleared, but the pendings_discard_workis neither cancelled nor flushed.
[1] https://lore.kernel.org/r/[email protected]/
[2] https://sashiko.dev/#/patchset/20260319094545.19291-1-qiang.zhang%40linux.dev
The concern was valid, but it had nothing to do with the patch[1]. One of the problems with Sashiko in its current (early) form is that it will detect pre-existing issues and report it as a problem with the patch that it is reviewing.
In practice, it would be hard to hit deliberately (unless you are a malicious syzkaller fuzzer), since it would involve mounting the file system with -o discard, and then deleting a large number of files, remounting the file system with -o nodiscard, and then immediately unmounting the file system before the queued discard work has a change to drain on its own.
Fix it because it's a real bug, and to avoid Sashiko from raising this concern when analyzing future patches to mballoc.c.
--- fs/ext4/mballoc.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
fs/ext4/mballoc.c +5 -7
@@ -3793,13 +3793,11 @@ int ext4_mb_release(struct super_block *struct kmem_cache *cachep =get_groupinfo_cache (sb->s_blocksize_bits);int count; -if (test_opt (sb,DISCARD )) { -/* -* wait the discard work to drain all of ext4_free_data -*/ -flush_work (&sbi->s_discard_work); -WARN_ON_ONCE (!list_empty (&sbi->s_discard_list)); - } +/* +* wait the discard work to drain all of ext4_free_data +*/ +flush_work (&sbi->s_discard_work); +WARN_ON_ONCE (!list_empty (&sbi->s_discard_list)); group_info =rcu_access_pointer (sbi->s_group_info);if (group_info) {
Greg Kroah-Hartman
maintainerPATCH 142/175 arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Niebel <[email protected]>
commit 8adc841d43ebceabec996c9dcff6e82d3e585268 upstream.
Fix SD card removal caused by automatic LDO5 power off after boot
To prevent this, add vqmmc regulator for USDHC, using a GPIO-controlled regulator that is supplied by LDO5. Since this is implemented on SoM but used on baseboards with SD-card interface, implement the functionality on SoM part and optionally enable it on baseboards if needed.
--- arch/arm64/boot/dts/freescale/imx8mn-tqma8mqnl-mba8mx.dts | 13 ++++---- arch/arm64/boot/dts/freescale/imx8mn-tqma8mqnl.dtsi | 22 ++++++++++++++ 2 files changed, 29 insertions(+), 6 deletions(-)
arch/arm64/boot/dts/freescale/imx8mn-tqma8mqnl-mba8mx.dts +7 -6
@@ -63,6 +63,10 @@ }; }; +®_usdhc2_vqmmc { + status = "okay"; +}; + &sai3 { assigned-clocks = <&clk IMX8MN_CLK_SAI3>; assigned-clock-parents = <&clk IMX8MN_AUDIO_PLL1_OUT>;
@@ -207,8 +211,7 @@ <MX8MN_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x1d4>, <MX8MN_IOMUXC_SD2_DATA1_USDHC2_DATA1 0x1d4>, <MX8MN_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d4>, - <MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>, - <MX8MN_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x84>; + <MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>; }; pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
@@ -217,8 +220,7 @@ <MX8MN_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x1d4>, <MX8MN_IOMUXC_SD2_DATA1_USDHC2_DATA1 0x1d4>, <MX8MN_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d4>, - <MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>, - <MX8MN_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x84>; + <MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>; }; pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
@@ -227,8 +229,7 @@ <MX8MN_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x1d4>, <MX8MN_IOMUXC_SD2_DATA1_USDHC2_DATA1 0x1d4>, <MX8MN_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d4>, - <MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>, - <MX8MN_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x84>; + <MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>; }; pinctrl_usdhc2_gpio: usdhc2-gpiogrp {
arch/arm64/boot/dts/freescale/imx8mn-tqma8mqnl.dtsi +22 -0
@@ -30,6 +30,20 @@ regulator-max-microvolt = <3300000>; }; + reg_usdhc2_vqmmc: regulator-usdhc2-vqmmc { + compatible = "regulator-gpio"; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_reg_usdhc2_vqmmc>; + regulator-name = "V_SD2"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; + gpios = <&gpio1 4 GPIO_ACTIVE_HIGH>; + states = <1800000 0x1>, + <3300000 0x0>; + vin-supply = <&ldo5_reg>; + status = "disabled"; + }; + reserved-memory { #address-cells = <2>; #size-cells = <2>;
@@ -219,6 +233,10 @@ }; }; +&usdhc2 { + vqmmc-supply = <®_usdhc2_vqmmc>; +}; + &usdhc3 { pinctrl-names = "default", "state_100mhz", "state_200mhz"; pinctrl-0 = <&pinctrl_usdhc3>;
@@ -273,6 +291,10 @@ fsl,pins = <MX8MN_IOMUXC_SD2_RESET_B_GPIO2_IO19 0x84>; }; + pinctrl_reg_usdhc2_vqmmc: regusdhc2vqmmcgrp { + fsl,pins = <MX8MN_IOMUXC_GPIO1_IO04_GPIO1_IO4 0xc0>; + }; + pinctrl_usdhc3: usdhc3grp { fsl,pins = <MX8MN_IOMUXC_NAND_WE_B_USDHC3_CLK 0x1d4>, <MX8MN_IOMUXC_NAND_WP_B_USDHC3_CMD 0x1d2>,
Greg Kroah-Hartman
maintainerPATCH 143/175 powerpc64/bpf: do not increment tailcall count when prog is NULL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hari Bathini <[email protected]>
commit 521bd39d9d28ce54cbfec7f9b89c94ad4fdb8350 upstream.
Do not increment tailcall count, if tailcall did not succeed due to missing BPF program.
[ Conflict due to missing feature commit 2ed2d8f6fb38 ("powerpc64/bpf:
Support tailcalls with subprogs") resolved accordingly. ]
--- arch/powerpc/net/bpf_jit_comp64.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
arch/powerpc/net/bpf_jit_comp64.c +14 -9
@@ -307,27 +307,32 @@ static int bpf_jit_emit_tail_call(u32 *i/* * tail_call_cnt++; +* Writeback this updated value only if tailcall succeeds. */ EMIT (PPC_RAW_ADDI (bpf_to_ppc (TMP_REG_1 ),bpf_to_ppc (TMP_REG_1 ),1 )); -EMIT (PPC_RAW_STD (bpf_to_ppc (TMP_REG_1 ), _R1,bpf_jit_stack_tailcallcnt (ctx)));/* prog = array->ptrs[index]; */ -EMIT (PPC_RAW_MULI (bpf_to_ppc (TMP_REG_1 ), b2p_index,8 )); -EMIT (PPC_RAW_ADD (bpf_to_ppc (TMP_REG_1 ),bpf_to_ppc (TMP_REG_1 ), b2p_bpf_array)); -EMIT (PPC_RAW_LD (bpf_to_ppc (TMP_REG_1 ),bpf_to_ppc (TMP_REG_1 ), offsetof(struct bpf_array , ptrs))); +EMIT (PPC_RAW_MULI (bpf_to_ppc (TMP_REG_2 ), b2p_index,8 )); +EMIT (PPC_RAW_ADD (bpf_to_ppc (TMP_REG_2 ),bpf_to_ppc (TMP_REG_2 ), b2p_bpf_array)); +EMIT (PPC_RAW_LD (bpf_to_ppc (TMP_REG_2 ),bpf_to_ppc (TMP_REG_2 ), + offsetof(struct bpf_array , ptrs)));/* * if (prog == NULL) * goto out; */ -EMIT (PPC_RAW_CMPLDI (bpf_to_ppc (TMP_REG_1 ),0 )); +EMIT (PPC_RAW_CMPLDI (bpf_to_ppc (TMP_REG_2 ),0 ));PPC_BCC_SHORT (COND_EQ , out);/* goto *(prog->bpf_func + prologue_size); */ -EMIT (PPC_RAW_LD (bpf_to_ppc (TMP_REG_1 ),bpf_to_ppc (TMP_REG_1 ), offsetof(struct bpf_prog , bpf_func))); -EMIT (PPC_RAW_ADDI (bpf_to_ppc (TMP_REG_1 ),bpf_to_ppc (TMP_REG_1 ), -FUNCTION_DESCR_SIZE + bpf_tailcall_prologue_size)); -EMIT (PPC_RAW_MTCTR (bpf_to_ppc (TMP_REG_1 ))); +EMIT (PPC_RAW_LD (bpf_to_ppc (TMP_REG_2 ),bpf_to_ppc (TMP_REG_2 ), + offsetof(struct bpf_prog , bpf_func))); +EMIT (PPC_RAW_ADDI (bpf_to_ppc (TMP_REG_2 ),bpf_to_ppc (TMP_REG_2 ), +FUNCTION_DESCR_SIZE + bpf_tailcall_prologue_size)); +EMIT (PPC_RAW_MTCTR (bpf_to_ppc (TMP_REG_2 ))); + +/* Writeback updated tailcall count */ +EMIT (PPC_RAW_STD (bpf_to_ppc (TMP_REG_1 ), _R1,bpf_jit_stack_tailcallcnt (ctx)));/* tear down stack, restore NVRs, ... */ bpf_jit_emit_common_epilogue (image, ctx);
Greg Kroah-Hartman
maintainerPATCH 144/175 ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Kasselman <[email protected]>
[ Upstream commit 48623ec358c1c600fa1e38368746f933e0f1a617 ]
smb_grant_oplock() has two issues in the oplock publication sequence:
1) opinfo is linked into ci->m_op_list (via opinfo_add) before add_lease_global_list() is called. If add_lease_global_list() fails (kmalloc returns NULL), the error path frees the opinfo via __free_opinfo() while it is still linked in ci->m_op_list. Concurrent m_op_list readers (opinfo_get_list, or direct iteration in smb_break_all_levII_oplock) dereference the freed node.
2) opinfo->o_fp is assigned after add_lease_global_list() publishes the opinfo on the global lease list. A concurrent find_same_lease_key() can walk the lease list and dereference opinfo->o_fp->f_ci while o_fp is still NULL.
Fix by restructuring the publication sequence to eliminate post-publish failure:
- Set opinfo->o_fp before any list publication (fixes NULL deref).
- Preallocate lease_table via alloc_lease_table() before opinfo_add() so add_lease_global_list() becomes infallible after publication.
- Keep the original m_op_list publication order (opinfo_add before lease list) so concurrent opens via same_client_has_lease() and opinfo_get_list() still see the in-flight grant.
- Use opinfo_put() instead of __free_opinfo() on err_out so that the RCU-deferred free path is used.
This also requires splitting add_lease_global_list() to take a preallocated lease_table and changing its return type from int to void, since it can no longer fail.
--- fs/smb/server/oplock.c | 72 ++++++++++++++++++++++++++++++------------------- 1 file changed, 45 insertions(+), 27 deletions(-)
fs/smb/server/oplock.c +45 -27
@@ -82,11 +82,19 @@ static void lease_del_list(struct oplockspin_unlock (&lb->lb_lock); } -static void lb_add (struct lease_table *lb) +static struct lease_table *alloc_lease_table (struct oplock_info *opinfo) { -write_lock (&lease_list_lock); -list_add (&lb->l_entry, &lease_table_list); -write_unlock (&lease_list_lock); +struct lease_table *lb; + + lb =kmalloc (sizeof (struct lease_table ),GFP_KERNEL ); +if (!lb) +return NULL ; + +memcpy (lb->client_guid, opinfo->conn->ClientGUID, +SMB2_CLIENT_GUID_SIZE ); +INIT_LIST_HEAD (&lb->lease_list); +spin_lock_init (&lb->lb_lock); +return lb; }static int alloc_lease (struct oplock_info *opinfo,struct lease_ctx_info *lctx)
@@ -1042,34 +1050,27 @@ static void copy_lease(struct oplock_inf lease2->version = lease1->version; } -static int add_lease_global_list (struct oplock_info *opinfo) +static void add_lease_global_list (struct oplock_info *opinfo, +struct lease_table *new_lb) {struct lease_table *lb; -read_lock (&lease_list_lock); +write_lock (&lease_list_lock);list_for_each_entry (lb, &lease_table_list, l_entry) {if (!memcmp (lb->client_guid, opinfo->conn->ClientGUID,SMB2_CLIENT_GUID_SIZE )) { opinfo->o_lease->l_lb = lb;lease_add_list (opinfo); -read_unlock (&lease_list_lock); -return 0 ; +write_unlock (&lease_list_lock); +kfree (new_lb); +return ; } } -read_unlock (&lease_list_lock); - lb =kmalloc (sizeof (struct lease_table ),GFP_KERNEL ); -if (!lb) -return -ENOMEM ; - -memcpy (lb->client_guid, opinfo->conn->ClientGUID, -SMB2_CLIENT_GUID_SIZE ); -INIT_LIST_HEAD (&lb->lease_list); -spin_lock_init (&lb->lb_lock); - opinfo->o_lease->l_lb = lb; + opinfo->o_lease->l_lb = new_lb;lease_add_list (opinfo); -lb_add (lb); -return 0 ; +list_add (&new_lb->l_entry, &lease_table_list); +write_unlock (&lease_list_lock); } static void set_oplock_level(struct oplock_info *opinfo, int level,
@@ -1189,6 +1190,7 @@ int smb_grant_oplock(struct ksmbd_work *int err =0 ;struct oplock_info *opinfo =NULL , *prev_opinfo =NULL ;struct ksmbd_inode *ci = fp->f_ci; +struct lease_table *new_lb =NULL ;bool prev_op_has_lease;__le32 prev_op_state =0 ;
@@ -1291,21 +1293,37 @@ set_lev:set_oplock_level (opinfo, req_op_level, lctx); out: -opinfo_count_inc (fp); -opinfo_add (opinfo, fp); - +/* +* Set o_fp before any publication so that concurrent readers +* (e.g. find_same_lease_key() on the lease list) that +* dereference opinfo->o_fp don't hit a NULL pointer. +* +* Keep the original publication order so concurrent opens can +* still observe the in-flight grant via ci->m_op_list, but make +* everything after opinfo_add() no-fail by preallocating any new +* lease_table first. +*/ + opinfo->o_fp = fp;if (opinfo->is_lease) { - err =add_lease_global_list (opinfo); -if (err) + new_lb =alloc_lease_table (opinfo); +if (!new_lb) { + err = -ENOMEM ; goto err_out; + } } +opinfo_count_inc (fp); +opinfo_add (opinfo, fp); + +if (opinfo->is_lease) +add_lease_global_list (opinfo, new_lb); +rcu_assign_pointer (fp->f_opinfo, opinfo); - opinfo->o_fp = fp;return 0 ; err_out: -__free_opinfo (opinfo); +kfree (new_lb); +opinfo_put (opinfo);return err; }
Greg Kroah-Hartman
maintainerPATCH 145/175 ksmbd: fix memory leaks and NULL deref in smb2_lock()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Kasselman <[email protected]>
[ Upstream commit 309b44ed684496ed3f9c5715d10b899338623512 ]
smb2_lock() has three error handling issues after list_del() detaches smb_lock from lock_list at no_check_cl:
1) If vfs_lock_file() returns an unexpected error in the non-UNLOCK path, goto out leaks smb_lock and its flock because the out:
handler only iterates lock_list and rollback_list, neither of which contains the detached smb_lock.
2) If vfs_lock_file() returns -ENOENT in the UNLOCK path, goto out leaks smb_lock and flock for the same reason. The error code returned to the dispatcher is also stale.
3) In the rollback path, smb_flock_init() can return NULL on allocation failure. The result is dereferenced unconditionally, causing a kernel NULL pointer dereference. Add a NULL check to prevent the crash and clean up the bookkeeping; the VFS lock itself cannot be rolled back without the allocation and will be released at file or connection teardown.
Fix cases 1 and 2 by hoisting the locks_free_lock()/kfree() to before the if(!rc) check in the UNLOCK branch so all exit paths share one free site, and by freeing smb_lock and flock before goto out in the non-UNLOCK branch. Propagate the correct error code in both cases. Fix case 3 by wrapping the VFS unlock in an if(rlock) guard and adding a NULL check for locks_free_lock(rlock) in the shared cleanup.
Found via call-graph analysis using sqry.
--- fs/smb/server/smb2pdu.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-)
fs/smb/server/smb2pdu.c +19 -10
@@ -7536,14 +7536,15 @@ retry: rc =vfs_lock_file (filp, smb_lock->cmd, flock,NULL ); skip:if (smb_lock->flags &SMB2_LOCKFLAG_UNLOCK ) { +locks_free_lock (flock); +kfree (smb_lock);if (!rc) {ksmbd_debug (SMB ,"File unlocked\n" ); }else if (rc == -ENOENT ) { rsp->hdr.Status =STATUS_NOT_LOCKED ; + err = rc; goto out; } -locks_free_lock (flock); -kfree (smb_lock); }else {if (rc ==FILE_LOCK_DEFERRED ) {void **argv;
@@ -7612,6 +7613,9 @@ skip:spin_unlock (&work->conn->llist_lock);ksmbd_debug (SMB ,"successful in taking lock\n" ); }else { +locks_free_lock (flock); +kfree (smb_lock); + err = rc; goto out; } }
@@ -7642,13 +7646,17 @@ out:struct file_lock *rlock =NULL ; rlock =smb_flock_init (filp); - rlock->fl_type =F_UNLCK ; - rlock->fl_start = smb_lock->start; - rlock->fl_end = smb_lock->end; - - rc =vfs_lock_file (filp,F_SETLK , rlock,NULL ); -if (rc) -pr_err ("rollback unlock fail : %d\n" , rc); +if (rlock) { + rlock->fl_type =F_UNLCK ; + rlock->fl_start = smb_lock->start; + rlock->fl_end = smb_lock->end; + + rc =vfs_lock_file (filp,F_SETLK , rlock,NULL ); +if (rc) +pr_err ("rollback unlock fail : %d\n" , rc); + }else { +pr_err ("rollback unlock alloc failed\n" ); + }list_del (&smb_lock->llist);spin_lock (&work->conn->llist_lock);
@@ -7658,7 +7666,8 @@ out:spin_unlock (&work->conn->llist_lock);locks_free_lock (smb_lock->fl); -locks_free_lock (rlock); +if (rlock) +locks_free_lock (rlock);kfree (smb_lock); } out2:
Greg Kroah-Hartman
maintainerPATCH 146/175 tracing: Switch trace_osnoise.c code over to use guard() and __free()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
[ Upstream commit 930d2b32c0af6895ba4c6ca6404e7f7b6dc214ed ]
The osnoise_hotplug_workfn() grabs two mutexes and cpu_read_lock(). It has various gotos to handle unlocking them. Switch them over to guard() and let the compiler worry about it.
The osnoise_cpus_read() has a temporary mask_str allocated and there's some gotos to make sure it gets freed on error paths. Switch that over to __free() to let the compiler worry about it.
Stable-dep-of: 1f9885732248 ("tracing: Fix potential deadlock in cpu hotplug with osnoise")
--- kernel/trace/trace_osnoise.c | 40 +++++++++++++--------------------------- 1 file changed, 13 insertions(+), 27 deletions(-)
kernel/trace/trace_osnoise.c +13 -27
@@ -2099,26 +2099,21 @@ static void osnoise_hotplug_workfn(struc {unsigned int cpu =smp_processor_id (); -mutex_lock (&trace_types_lock); +guard (mutex)(&trace_types_lock);if (!osnoise_has_registered_instances ()) - goto out_unlock_trace; +return ; -mutex_lock (&interface_lock); -cpus_read_lock (); +guard (mutex)(&interface_lock); +guard (cpus_read_lock)();if (!cpu_online (cpu)) - goto out_unlock; +return ; +if (!cpumask_test_cpu (cpu, &osnoise_cpumask)) - goto out_unlock; +return ;start_kthread (cpu); - -out_unlock: -cpus_read_unlock (); -mutex_unlock (&interface_lock); -out_unlock_trace: -mutex_unlock (&trace_types_lock); } static DECLARE_WORK(osnoise_hotplug_work, osnoise_hotplug_workfn);
@@ -2316,31 +2311,22 @@ static ssize_t osnoise_cpus_read(struct file *filp, char __user *ubuf, size_t count, loff_t *ppos) { - char *mask_str; + char *mask_str __free(kfree) = NULL;int len; -mutex_lock (&interface_lock); +guard (mutex)(&interface_lock); len =snprintf (NULL ,0 ,"%*pbl\n" ,cpumask_pr_args (&osnoise_cpumask)) +1 ; mask_str =kmalloc (len,GFP_KERNEL ); -if (!mask_str) { - count = -ENOMEM ; - goto out_unlock; - } +if (!mask_str) +return -ENOMEM ; len =snprintf (mask_str, len,"%*pbl\n" ,cpumask_pr_args (&osnoise_cpumask)); -if (len >= count) { - count = -EINVAL ; - goto out_free; - } +if (len >= count) +return -EINVAL ; count =simple_read_from_buffer (ubuf, count, ppos, mask_str, len); -out_free: -kfree (mask_str); -out_unlock: -mutex_unlock (&interface_lock); -return count; }
Greg Kroah-Hartman
maintainerPATCH 147/175 tracing: Fix potential deadlock in cpu hotplug with osnoise
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Haiyang <[email protected]>
[ Upstream commit 1f9885732248d22f788e4992c739a98c88ab8a55 ]
The following sequence may leads deadlock in cpu hotplug:
task1 task2 task3
----- ----- ----- mutex_lock(&interface_lock)
[CPU GOING OFFLINE]
cpus_write_lock();
osnoise_cpu_die();
kthread_stop(task3);
wait_for_completion();
osnoise_sleep();
mutex_lock(&interface_lock); cpus_read_lock();
[DEAD LOCK]
Fix by swap the order of cpus_read_lock() and mutex_lock(&interface_lock).
--- kernel/trace/trace_osnoise.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
kernel/trace/trace_osnoise.c +5 -5
@@ -2104,8 +2104,8 @@ static void osnoise_hotplug_workfn(strucif (!osnoise_has_registered_instances ())return ; -guard (mutex)(&interface_lock);guard (cpus_read_lock)(); +guard (mutex)(&interface_lock);if (!cpu_online (cpu))return ;
@@ -2268,11 +2268,11 @@ static ssize_t osnoise_options_write(strif (running)stop_per_cpu_kthreads (); -mutex_lock (&interface_lock);/* * avoid CPU hotplug operations that might read options. */ cpus_read_lock (); +mutex_lock (&interface_lock); retval = cnt;
@@ -2288,8 +2288,8 @@ static ssize_t osnoise_options_write(strclear_bit (option, &osnoise_options); } -cpus_read_unlock ();mutex_unlock (&interface_lock); +cpus_read_unlock ();if (running)start_per_cpu_kthreads ();
@@ -2375,16 +2375,16 @@ osnoise_cpus_write(struct file *filp, coif (running)stop_per_cpu_kthreads (); -mutex_lock (&interface_lock);/* * osnoise_cpumask is read by CPU hotplug operations. */ cpus_read_lock (); +mutex_lock (&interface_lock);cpumask_copy (&osnoise_cpumask, osnoise_cpumask_new); -cpus_read_unlock ();mutex_unlock (&interface_lock); +cpus_read_unlock ();if (running)start_per_cpu_kthreads ();
Greg Kroah-Hartman
maintainerPATCH 148/175 rust: pin-init: add references to previously initialized fields
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benno Lossin <[email protected]>
[ Upstream commit 42415d163e5df6db799c7de6262d707e402c2c7e ]
After initializing a field in an initializer macro, create a variable holding a reference that points at that field. The type is either Pin<&mut T> or &mut T depending on the field's structural pinning kind.
[ Removed the devres changes, because devres is not present in 6.12.y and
earlier. Also adjusted paths in the macro to account for the fact that pin-init is part of the kernel crate in 6.12.y and earlier. - Benno ]
--- rust/kernel/init/macros.rs | 144 +++++++++++++++++++++++++++++++++++---------- 1 file changed, 113 insertions(+), 31 deletions(-)
rust/kernel/init/macros.rs +113 -31
@@ -964,35 +964,54 @@ macro_rules! __pin_data { @pinned($($(#[$($p_attr:tt)*])* $pvis:vis $p_field:ident : $p_type:ty),* $(,)?), @not_pinned($($(#[$($attr:tt)*])* $fvis:vis $field:ident : $type:ty),* $(,)?), ) => { - // For every field, we create a projection function according to its projection type. If a - // field is structurally pinned, then it must be initialized via `PinInit`, if it is not - // structurally pinned, then it can be initialized via `Init`. - // - // The functions are `unsafe` to prevent accidentally calling them. - #[allow(dead_code)] - impl<$($impl_generics)*> $pin_data<$($ty_generics)*> - where $($whr)* - { - $( - $(#[$($p_attr)*])* - $pvis unsafe fn $p_field<E>( - self, - slot: *mut $p_type, - init: impl $crate::init::PinInit<$p_type, E>, - ) -> ::core::result::Result<(), E> { - unsafe { $crate::init::PinInit::__pinned_init(init, slot) } - } - )* - $( - $(#[$($attr)*])* - $fvis unsafe fn $field<E>( - self, - slot: *mut $type, - init: impl $crate::init::Init<$type, E>, - ) -> ::core::result::Result<(), E> { - unsafe { $crate::init::Init::__init(init, slot) } - } - )* + $crate::macros::paste! { +// For every field, we create a projection function according to its projection type. If a +// field is structurally pinned, then it must be initialized via `PinInit`, if it is not +// structurally pinned, then it can be initialized via `Init`. +// +// The functions are `unsafe` to prevent accidentally calling them. +#[allow(dead_code, non_snake_case)] +#[expect(clippy::missing_safety_doc)] +impl <$($impl_generics)*> $pin_data<$($ty_generics)*> +where $($whr)* + { + $( + $(#[$($p_attr)*])* + $pvisunsafe fn $p_field<E >( + self, + slot: *mut $p_type, + init:impl $crate ::init::PinInit <$p_type,E >, + ) -> ::core::result::Result <(),E > { +unsafe { $crate ::init::PinInit ::__pinned_init (init ,slot ) } + } + + $(#[$($p_attr)*])* + $pvisunsafe fn [<__project_ $p_field>]<'__slot>( + self, + slot: &'__slotmut $p_type, + ) -> ::core::pin::Pin <&'__slotmut $p_type> { +unsafe { ::core::pin::Pin ::new_unchecked (slot ) } + } + )* + $( + $(#[$($attr)*])* + $fvisunsafe fn $field<E >( + self, + slot: *mut $type , + init:impl $crate ::init::Init <$type ,E >, + ) -> ::core::result::Result <(),E > { +unsafe { $crate ::init::Init ::__init (init ,slot ) } + } + + $(#[$($attr)*])* + $fvisunsafe fn [<__project_ $field>]<'__slot>( + self, + slot: &'__slotmut $type , + ) -> &'__slotmut $type { +slot + } + )* + } } }; }
@@ -1186,6 +1205,13 @@ macro_rules! __init_internal {// return when an error/panic occurs. // We also use the `data` to require the correct trait (`Init` or `PinInit`) for `$field`. unsafe { $data.$field(::core::ptr::addr_of_mut!((*$slot).$field), init)? }; +// SAFETY: +// - the project function does the correct field projection, +// - the field has been initialized, +// - the reference is only valid until the end of the initializer. +#[allow(unused_variables, unused_assignments)] + let $field = $crate::macros::paste!(unsafe { $data.[< __project_ $field >](&mut (*$slot).$field) }); +// Create the drop guard: // // We rely on macro hygiene to make it impossible for users to access this local variable.
@@ -1217,6 +1243,14 @@ macro_rules! __init_internal {// SAFETY: `slot` is valid, because we are inside of an initializer closure, we // return when an error/panic occurs. unsafe { $crate::init::Init ::__init (init, ::core::ptr::addr_of_mut!((*$slot).$field))? }; + +// SAFETY: +// - the field is not structurally pinned, since the line above must compile, +// - the field has been initialized, +// - the reference is only valid until the end of the initializer. +#[allow(unused_variables, unused_assignments)] + let $field = unsafe { &mut (*$slot).$field }; +// Create the drop guard: // // We rely on macro hygiene to make it impossible for users to access this local variable.
@@ -1235,7 +1269,7 @@ macro_rules! __init_internal { ); } }; - (init_slot($($use_data:ident)?): + (init_slot(): // No `use_data`, so all fields are not structurally pinned @data($data:ident), @slot($slot:ident), @guards($($guards:ident,)*),
@@ -1249,6 +1283,15 @@ macro_rules! __init_internal {// SAFETY: The memory at `slot` is uninitialized. unsafe { ::core::ptr::write (::core::ptr::addr_of_mut!((*$slot).$field), $field) }; } + +#[allow(unused_variables, unused_assignments)] +// SAFETY: +// - the field is not structurally pinned, since no `use_data` was required to create this +// initializer, +// - the field has been initialized, +// - the reference is only valid until the end of the initializer. + let $field = unsafe { &mut (*$slot).$field }; +// Create the drop guard: // // We rely on macro hygiene to make it impossible for users to access this local variable.
@@ -1259,7 +1302,46 @@ macro_rules! __init_internal { $crate::init::__internal::DropGuard ::new (::core::ptr::addr_of_mut!((*$slot).$field)) }; - $crate::__init_internal!(init_slot ($($use_data)?): + $crate::__init_internal!(init_slot (): + @data ($data), + @slot ($slot), + @guards ([< __ $field_guard >], $($guards,)*), + @munch_fields ($($rest)*), + ); + } + }; + (init_slot($use_data:ident): + @data($data:ident), + @slot($slot:ident), + @guards($($guards:ident,)*), +// Init by-value. + @munch_fields($field:ident $(: $val:expr)?, $($rest:tt)*), + ) => { + { + $(let $field = $val;)? +// Initialize the field. +// +// SAFETY: The memory at `slot` is uninitialized. +unsafe { ::core::ptr::write (::core::ptr::addr_of_mut!((*$slot).$field), $field) }; + } +// SAFETY: +// - the project function does the correct field projection, +// - the field has been initialized, +// - the reference is only valid until the end of the initializer. +#[allow(unused_variables, unused_assignments)] + let $field = $crate::macros::paste!(unsafe { $data.[< __project_ $field >](&mut (*$slot).$field) }); + +// Create the drop guard: +// +// We rely on macro hygiene to make it impossible for users to access this local variable. +// We use `paste!` to create new hygiene for `$field`. + $crate::macros::paste! { +// SAFETY: We forget the guard later when initialization has succeeded. +let [< __ $field_guard >] =unsafe { + $crate ::init::__internal::DropGuard ::new (::core::ptr::addr_of_mut!((*$slot).$field)) + }; + + $crate ::__init_internal!(init_slot ($use_data): @data($data), @slot ($slot), @guards ([<$field>], $($guards,)*),
Greg Kroah-Hartman
maintainerPATCH 149/175 rust: pin-init: internal: init: document load-bearing fact of field accessors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benno Lossin <[email protected]>
[ Upstream commit 580cc37b1de4fcd9997c48d7080e744533f09f36 ]
The functions [Pin]Init::__[pinned_]init and ptr::write called from the init! macro require the passed pointer to be aligned. This fact is ensured by the creation of field accessors to previously initialized fields.
Since we missed this very important fact from the beginning [1], document it in the code.
[ Moved changes to the declarative macro, because 6.19.y and earlier do not
have syn. Also duplicated the comment for all field accessor creations.
- Benno ]
--- rust/kernel/init/macros.rs | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
rust/kernel/init/macros.rs +16 -0
@@ -1205,6 +1205,10 @@ macro_rules! __init_internal {// return when an error/panic occurs. // We also use the `data` to require the correct trait (`Init` or `PinInit`) for `$field`. unsafe { $data.$field(::core::ptr::addr_of_mut!((*$slot).$field), init)? }; +// NOTE: the field accessor ensures that the initialized field is properly aligned. +// Unaligned fields will cause the compiler to emit E0793. We do not support +// unaligned fields since `Init::__init` requires an aligned pointer; the call to +// `ptr::write` below has the same requirement. // SAFETY: // - the project function does the correct field projection, // - the field has been initialized,
@@ -1244,6 +1248,10 @@ macro_rules! __init_internal {// return when an error/panic occurs. unsafe { $crate::init::Init ::__init (init, ::core::ptr::addr_of_mut!((*$slot).$field))? }; +// NOTE: the field accessor ensures that the initialized field is properly aligned. +// Unaligned fields will cause the compiler to emit E0793. We do not support +// unaligned fields since `Init::__init` requires an aligned pointer; the call to +// `ptr::write` below has the same requirement. // SAFETY: // - the field is not structurally pinned, since the line above must compile, // - the field has been initialized,
@@ -1284,6 +1292,10 @@ macro_rules! __init_internal {unsafe { ::core::ptr::write (::core::ptr::addr_of_mut!((*$slot).$field), $field) }; } +// NOTE: the field accessor ensures that the initialized field is properly aligned. +// Unaligned fields will cause the compiler to emit E0793. We do not support +// unaligned fields since `Init::__init` requires an aligned pointer; the call to +// `ptr::write` below has the same requirement. #[allow(unused_variables, unused_assignments)] // SAFETY: // - the field is not structurally pinned, since no `use_data` was required to create this
@@ -1324,6 +1336,10 @@ macro_rules! __init_internal {// SAFETY: The memory at `slot` is uninitialized. unsafe { ::core::ptr::write (::core::ptr::addr_of_mut!((*$slot).$field), $field) }; } +// NOTE: the field accessor ensures that the initialized field is properly aligned. +// Unaligned fields will cause the compiler to emit E0793. We do not support +// unaligned fields since `Init::__init` requires an aligned pointer; the call to +// `ptr::write` below has the same requirement. // SAFETY: // - the project function does the correct field projection, // - the field has been initialized,
Greg Kroah-Hartman
maintainerPATCH 150/175 mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pratyush Yadav <[email protected]>
[ Upstream commit f156b23df6a84efb2f6686156be94d4988568954 ]
On Octal DTR capable flashes like Micron Xcella reads cannot start or end at an odd address in Octal DTR mode. Extra bytes need to be read at the start or end to make sure both the start address and length remain even.
To avoid allocating too much extra memory, thereby putting unnecessary memory pressure on the system, the temporary buffer containing the extra padding bytes is capped at PAGE_SIZE bytes. The rest of the 2-byte aligned part should be read directly in the main buffer.
[ Resolve conflict in drivers/mtd/spi-nor/core.c.
In spi_nor_read(), 6.6.y contains a spi_nor_convert_addr() call before spi_nor_read_data(), introduced by 364995962803 ("mtd:
spi-nor: Add a ->convert_addr() method"), which does not exist in mainline. This call is specific to Xilinx S3AN flashes, which use a non-standard address format. In mainline, S3AN flash support was removed entirely, and the corresponding spi_nor_convert_addr() call was dropped by 9539d12d9f52 ("mtd: spi-nor: get rid of non-power-of-2 page size handling"). Keep the existing spi_nor_convert_addr() call and insert the new spi_nor_octal_dtr_read() branch after it. ]
--- drivers/mtd/spi-nor/core.c | 76 ++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 75 insertions(+), 1 deletion(-)
drivers/mtd/spi-nor/core.c +75 -1
@@ -2082,6 +2082,76 @@ static const struct flash_info *spi_nor_return info; } +/* +* On Octal DTR capable flashes, reads cannot start or end at an odd +* address in Octal DTR mode. Extra bytes need to be read at the start +* or end to make sure both the start address and length remain even. +*/ +static int spi_nor_octal_dtr_read (struct spi_nor *nor,loff_t from,size_t len, +u_char *buf) +{ +u_char *tmp_buf; +size_t tmp_len; +loff_t start, end; +int ret, bytes_read; + +if (IS_ALIGNED (from,2 ) &&IS_ALIGNED (len,2 )) +return spi_nor_read_data (nor, from, len, buf); +else if (IS_ALIGNED (from,2 ) && len >PAGE_SIZE ) +return spi_nor_read_data (nor, from,round_down (len,PAGE_SIZE ), + buf); + + tmp_buf =kmalloc (PAGE_SIZE ,GFP_KERNEL ); +if (!tmp_buf) +return -ENOMEM ; + + start =round_down (from,2 ); + end =round_up (from + len,2 ); + +/* +* Avoid allocating too much memory. The requested read length might be +* quite large. Allocating a buffer just as large (slightly bigger, in +* fact) would put unnecessary memory pressure on the system. +* +* For example if the read is from 3 to 1M, then this will read from 2 +* to 4098. The reads from 4098 to 1M will then not need a temporary +* buffer so they can proceed as normal. +*/ + tmp_len =min_t (size_t, end - start,PAGE_SIZE ); + + ret =spi_nor_read_data (nor, start, tmp_len, tmp_buf); +if (ret ==0 ) { + ret = -EIO ; + goto out; + } +if (ret <0 ) + goto out; + +/* +* More bytes are read than actually requested, but that number can't be +* reported to the calling function or it will confuse its calculations. +* Calculate how many of the _requested_ bytes were read. +*/ + bytes_read = ret; + +if (from != start) + ret -= from - start; + +/* +* Only account for extra bytes at the end if they were actually read. +* For example, if the total length was truncated because of temporary +* buffer size limit then the adjustment for the extra bytes at the end +* is not needed. +*/ +if (start + bytes_read == end) + ret -= end - (from + len); + +memcpy (buf, tmp_buf + (from - start), ret); +out: +kfree (tmp_buf); +return ret; +} +static int spi_nor_read (struct mtd_info *mtd,loff_t from,size_t len,size_t *retlen,u_char *buf) {
@@ -2101,7 +2171,11 @@ static int spi_nor_read(struct mtd_info addr =spi_nor_convert_addr (nor, addr); - ret =spi_nor_read_data (nor, addr, len, buf); +if (nor->read_proto ==SNOR_PROTO_8_8_8_DTR ) + ret =spi_nor_octal_dtr_read (nor, addr, len, buf); +else + ret =spi_nor_read_data (nor, addr, len, buf); +if (ret ==0 ) {/* We shouldn't see 0-length reads */ ret = -EIO ;
Greg Kroah-Hartman
maintainerPATCH 151/175 mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pratyush Yadav <[email protected]>
[ Upstream commit 17926cd770ec837ed27d9856cf07f2da8dda4131 ]
On Octal DTR capable flashes like Micron Xcella the writes cannot start or end at an odd address in Octal DTR mode. Extra 0xff bytes need to be appended or prepended to make sure the start address and end address are even. 0xff is used because on NOR flashes a program operation can only flip bits from 1 to 0, not the other way round. 0 to 1 flip needs to happen via erases.
--- drivers/mtd/spi-nor/core.c | 69 ++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 68 insertions(+), 1 deletion(-)
drivers/mtd/spi-nor/core.c +68 -1
@@ -2199,6 +2199,68 @@ read_err: }/* +* On Octal DTR capable flashes, writes cannot start or end at an odd address +* in Octal DTR mode. Extra 0xff bytes need to be appended or prepended to +* make sure the start address and end address are even. 0xff is used because +* on NOR flashes a program operation can only flip bits from 1 to 0, not the +* other way round. 0 to 1 flip needs to happen via erases. +*/ +static int spi_nor_octal_dtr_write (struct spi_nor *nor,loff_t to,size_t len, +const u8 *buf) +{ +u8 *tmp_buf; +size_t bytes_written; +loff_t start, end; +int ret; + +if (IS_ALIGNED (to,2 ) &&IS_ALIGNED (len,2 )) +return spi_nor_write_data (nor, to, len, buf); + + tmp_buf =kmalloc (nor->params->page_size,GFP_KERNEL ); +if (!tmp_buf) +return -ENOMEM ; + +memset (tmp_buf,0xff , nor->params->page_size); + + start =round_down (to,2 ); + end =round_up (to + len,2 ); + +memcpy (tmp_buf + (to - start), buf, len); + + ret =spi_nor_write_data (nor, start, end - start, tmp_buf); +if (ret ==0 ) { + ret = -EIO ; + goto out; + } +if (ret <0 ) + goto out; + +/* +* More bytes are written than actually requested, but that number can't +* be reported to the calling function or it will confuse its +* calculations. Calculate how many of the _requested_ bytes were +* written. +*/ + bytes_written = ret; + +if (to != start) + ret -= to - start; + +/* +* Only account for extra bytes at the end if they were actually +* written. For example, if for some reason the controller could only +* complete a partial write then the adjustment for the extra bytes at +* the end is not needed. +*/ +if (start + bytes_written == end) + ret -= end - (to + len); + +out: +kfree (tmp_buf); +return ret; +} + +/* * Write an address range to the nor chip. Data must be written in * FLASH_PAGESIZE chunks. The address range may be any size provided * it is within the physical boundaries.
@@ -2248,7 +2310,12 @@ static int spi_nor_write(struct mtd_info goto write_err; } - ret =spi_nor_write_data (nor, addr, page_remain, buf + i); +if (nor->write_proto ==SNOR_PROTO_8_8_8_DTR ) + ret =spi_nor_octal_dtr_write (nor, addr, page_remain, + buf + i); +else + ret =spi_nor_write_data (nor, addr, page_remain, + buf + i);spi_nor_unlock_device (nor);if (ret <0 ) goto write_err;
Greg Kroah-Hartman
maintainerPATCH 152/175 gfs2: Fix unlikely race in gdlm_put_lock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit 28c4d9bc0708956c1a736a9e49fee71b65deee81 ]
In gdlm_put_lock(), there is a small window of time in which the DFL_UNMOUNT flag has been set but the lockspace hasn't been released, yet. In that window, dlm may still call gdlm_ast() and gdlm_bast(). To prevent it from dereferencing freed glock objects, only free the glock if the lockspace has actually been released.
--- fs/gfs2/lock_dlm.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
fs/gfs2/lock_dlm.c +5 -5
@@ -311,11 +311,6 @@ static void gdlm_put_lock(struct gfs2_glgfs2_sbstats_inc (gl,GFS2_LKS_DCOUNT );gfs2_update_request_times (gl); -/* don't want to call dlm if we've unmounted the lock protocol */ -if (test_bit (DFL_UNMOUNT , &ls->ls_recover_flags)) { -gfs2_glock_free (gl); -return ; - }/* don't want to skip dlm_unlock writing the lvb when lock has one */ if (test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags) &&
@@ -332,6 +327,11 @@ again: goto again; } +if (error == -ENODEV ) { +gfs2_glock_free (gl); +return ; + } +if (error) { fs_err(sdp, "gdlm_unlock %x,%llx err=%d\n", gl->gl_name.ln_type,
Greg Kroah-Hartman
maintainerPATCH 153/175 libbpf: Fix -Wdiscarded-qualifiers under C23
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Gavrilov <[email protected]>
commit d70f79fef65810faf64dbae1f3a1b5623cdb2345 upstream.
glibc ≥ 2.42 (GCC 15) defaults to -std=gnu23, which promotes -Wdiscarded-qualifiers to an error.
In C23, strstr() and strchr() return "const char *".
Change variable types to const char * where the pointers are never modified (res, sym_sfx, next_path).
[ shung-hsi.yu: needed to fix kernel build failure due to libbpf since glibc
2.43+ (which adds 'const' qualifier to strstr) ]
[ Jonas Rebmann: down to one declaration on 6.6 to resolve build error
with glibc 2.43 ]
--- tools/lib/bpf/libbpf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/libbpf.c +1 -1
@@ -11247,7 +11247,7 @@ static int resolve_full_path(const charif (!search_paths[i])continue ;for (s = search_paths[i]; s !=NULL ; s =strchr (s,':' )) { -char *next_path; +const char *next_path;int seg_len;if (s[0 ] ==':' )