6.18.22-rc1 review
Greg Kroah-Hartman
maintainercover 6.18.22-rc1 review
This is the start of the stable review cycle for the 6.18.22 release. There are 277 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 10 Apr 2026 17:58:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.22-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.18.22-rc1
Andrea Righi <[email protected]>
sched_ext: Fix stale direct dispatch state in ddsp_dsq_id
Tejun Heo <[email protected]>
sched_ext: Refactor do_enqueue_task() local and global DSQ paths
David Hildenbrand (Arm) <[email protected]>
mm/memory: fix PMD/PUD checks in follow_pfnmap_start()
Anshuman Khandual <[email protected]>
mm: replace READ_ONCE() with standard page table accessors
Josef Bacik <[email protected]>
scsi: target: tcm_loop: Drain commands in target_reset handler
Thinh Nguyen <[email protected]>
scsi: target: file: Use kzalloc_flex for aio_cmd
Willem de Bruijn <[email protected]>
net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
Guangshuo Li <[email protected]>
net: mana: fix use-after-free in add_adev() error path
Alex Deucher <[email protected]>
drm/amd/display: Fix DCE LVDS handling
Yang Wang <[email protected]>
drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13
Alexander Popov <[email protected]>
wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
Petr Mladek <[email protected]>
kallsyms: prevent module removal when printing module name and buildid
Petr Mladek <[email protected]>
kallsyms: cleanup code for appending the module buildid
Petr Mladek <[email protected]>
kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid()
Petr Mladek <[email protected]>
kallsyms: clean up @namebuf initialization in kallsyms_lookup_buildid()
Taegu Ha <[email protected]>
usb: gadget: f_uac1_legacy: validate control request size
Michael Zimmermann <[email protected]>
usb: gadget: f_hid: move list and spinlock inits from bind to alloc
Kuen-Han Tsai <[email protected]>
usb: gadget: f_rndis: Fix net_device lifecycle with device_move
Kuen-Han Tsai <[email protected]>
usb: gadget: f_subset: Fix net_device lifecycle with device_move
Kuen-Han Tsai <[email protected]>
usb: gadget: f_eem: Fix net_device lifecycle with device_move
Kuen-Han Tsai <[email protected]>
usb: gadget: f_ecm: Fix net_device lifecycle with device_move
Kuen-Han Tsai <[email protected]>
usb: gadget: f_rndis: Protect RNDIS options with mutex
Kuen-Han Tsai <[email protected]>
usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
Jimmy Hu <[email protected]>
usb: gadget: uvc: fix NULL pointer dereference during unbind race
Kuen-Han Tsai <[email protected]>
usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
Kuen-Han Tsai <[email protected]>
usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
Zilin Guan <[email protected]>
ice: Fix memory leak in ice_set_ringparam()
Aditya Garg <[email protected]>
HID: appletb-kbd: add .resume method in PM
Nathan Rebello <[email protected]>
usb: typec: ucsi: validate connector number in ucsi_notify_common()
Sebastian Urban <[email protected]>
usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer
Alan Stern <[email protected]>
USB: dummy-hcd: Fix interrupt synchronization error
Alan Stern <[email protected]>
USB: dummy-hcd: Fix locking/synchronization error
Konrad Dybcio <[email protected]>
thunderbolt: Fix property read in nhi_wake_supported()
Andrei Kuchynski <[email protected]>
usb: typec: thunderbolt: Set enter_vdo during initialization
Xingjing Deng <[email protected]>
misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe
Xingjing Deng <[email protected]>
misc: fastrpc: possible double-free of cctx->remote_heap
Rafael J. Wysocki <[email protected]>
thermal: core: Fix thermal zone device registration error path
Rafael J. Wysocki <[email protected]>
thermal: core: Address thermal zone removal races with resume
Tzung-Bi Shih <[email protected]>
gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()
Shenwei Wang <[email protected]>
gpio: mxc: map Both Edge pad wakeup to Rising Edge
Changwoo Min <[email protected]>
sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU
Guangshuo Li <[email protected]>
cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
Srujana Challa <[email protected]>
virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN
Sven Eckelmann (Plasma Cloud) <[email protected]>
net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled
Yufan Chen <[email protected]>
net: ftgmac100: fix ring allocation unwind on open failure
Yang Yang <[email protected]>
vxlan: validate ND option lengths in vxlan_na_create
Eric Biggers <[email protected]>
crypto: tegra - Add missing CRYPTO_ALG_ASYNC
Cosmin Tanislav <[email protected]>
counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member
Cosmin Tanislav <[email protected]>
counter: rz-mtu3-cnt: prevent counter from being toggled multiple times
Nicolas Pitre <[email protected]>
vt: resize saved unicode buffer on alt screen exit after resize
Liav Mordouch <[email protected]>
vt: discard stale unicode buffer on alt screen exit after resize
Dave Penkler <[email protected]>
gpib: Fix fluke driver s390 compile issue
Yifan Wu <[email protected]>
netfilter: ipset: drop logically empty buckets in mtype_del
Ivan Vera <[email protected]>
nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy
Christian Eggers <[email protected]>
nvmem: imx: assign nvmem_cell_info::raw_len
Thomas Richter <[email protected]>
s390/cpum_sf: Cap sampling rate to prevent lsctl exception
Harald Freudenberger <[email protected]>
s390/zcrypt: Fix memory leak with CCA cards used as accelerator
Emanuele Ghidoli <[email protected]>
spi: cadence-qspi: Fix exec_mem_op error handling
Xu Yang <[email protected]>
dt-bindings: connector: add pd-disable dependency
Conor Dooley <[email protected]>
firmware: microchip: fail auto-update probe if no flash found
Ian Abbott <[email protected]>
comedi: me4000: Fix potential overrun of firmware buffer
Ian Abbott <[email protected]>
comedi: me_daq: Fix potential overrun of firmware buffer
Ian Abbott <[email protected]>
comedi: ni_atmio16d: Fix invalid clean-up after failed attach
Ian Abbott <[email protected]>
comedi: Reinit dev->spinlock between attachments to low-level drivers
Deepanshu Kartikey <[email protected]>
comedi: dt2815: add hardware detection to prevent crash
Oliver Neukum <[email protected]>
cdc-acm: new quirk for EPSON HMD
Yang Yang <[email protected]>
bridge: br_nd_send: validate ND option lengths
Srinivas Kandagatla <[email protected]>
ASoC: qcom: sc7280: make use of common helpers
Jens Axboe <[email protected]>
io_uring: protect remaining lockless ctx->rings accesses with RCU
Dmitry Torokhov <[email protected]>
x86/platform/geode: Fix on-stack property data use-after-return bug
Guan-Yu Lin <[email protected]>
usb: core: use dedicated spinlock for offload state
Yongchao Wu <[email protected]>
usb: cdns3: gadget: fix state inconsistency on gadget init failure
Yongchao Wu <[email protected]>
usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
Gabor Juhos <[email protected]>
usb: core: phy: avoid double use of 'usb3-phy'
Juno Choi <[email protected]>
usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
Justin Chen <[email protected]>
usb: ehci-brcm: fix sleep during atomic
Guan-Yu Lin <[email protected]>
usb: host: xhci-sideband: delegate offload_usage tracking to class drivers
Felix Gu <[email protected]>
usb: misc: usbio: Fix URB memory leak on submit failure
Heitor Alves de Siqueira <[email protected]>
usb: usbtmc: Flush anchored URBs in usbtmc_release
Guangshuo Li <[email protected]>
usb: ulpi: fix double free in ulpi_register_interface() error path
Miao Li <[email protected]>
usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
Johan Hovold <[email protected]>
gpib: lpvo_usb: fix memory leak on disconnect
Alexander Usyskin <[email protected]>
mei: me: reduce the scope on unexpected reset
Ethan Tidmore <[email protected]>
iio: gyro: mpu3050: Fix out-of-sequence free_irq()
Ethan Tidmore <[email protected]>
iio: gyro: mpu3050: Move iio_device_register() to correct location
Ethan Tidmore <[email protected]>
iio: gyro: mpu3050: Fix irq resource leak
Ethan Tidmore <[email protected]>
iio: gyro: mpu3050: Fix incorrect free_irq() variable
Francesco Lavra <[email protected]>
iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
Josh Poimboeuf <[email protected]>
iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin()
Aldo Conte <[email protected]>
iio: light: veml6070: fix veml6070_read() return value
David Lechner <[email protected]>
iio: light: vcnl4035: fix scan buffer on big-endian
Antoniu Miclaus <[email protected]>
iio: imu: adis16550: fix swapped gyro/accel filter functions
Antoniu Miclaus <[email protected]>
iio: dac: ad5770r: fix error return in ad5770r_read_raw()
Antoniu Miclaus <[email protected]>
iio: accel: adxl313: add missing error check in predisable
Antoniu Miclaus <[email protected]>
iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0
Valek Andrej <[email protected]>
iio: accel: fix ADXL355 temperature signature value
Billy Tsai <[email protected]>
iio: adc: aspeed: clear reference voltage bits before configuring vref
Antoniu Miclaus <[email protected]>
iio: adc: ade9000: move mutex init before IRQ registration
Giorgi Tchankvetadze <[email protected]>
iio: adc: ade9000: fix wrong register in CALIBBIAS case for active power
Giorgi Tchankvetadze <[email protected]>
iio: adc: ade9000: fix wrong return type in streaming push
Dmitry Torokhov <[email protected]>
iio: adc: ti-ads7950: do not clobber gpio state in ti_ads7950_get()
Dmitry Torokhov <[email protected]>
iio: adc: ti-ads7950: normalize return value of gpio_get
Zoltan Illes <[email protected]>
Input: xpad - add support for Razer Wolverine V3 Pro
Shengyu Qu <[email protected]>
Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode
Liam Mitchell <[email protected]>
Input: bcm5974 - recover from failed mode switch
Christoffer Sandberg <[email protected]>
Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table
Bart Van Assche <[email protected]>
Input: synaptics-rmi4 - fix a locking bug in an error path
JP Hein <[email protected]>
USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
Wanquan Zhong <[email protected]>
USB: serial: option: add support for Rolling Wireless RW135R-GL
Frej Drejhammar <[email protected]>
USB: serial: io_edgeport: add support for Blackbox IC135A
Alex Deucher <[email protected]>
drm/amdgpu/pm: drop SMU driver if version not matched messages
Donet Tom <[email protected]>
drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB
Junrui Luo <[email protected]>
drm/amdgpu: validate doorbell_offset in user queue creation
Lijo Lazar <[email protected]>
drm/amdgpu: Fix wait after reset sequence in S4
Ville Syrjälä <[email protected]>
drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP
Ville Syrjälä <[email protected]>
drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode
Thomas Zimmermann <[email protected]>
drm/ast: dp501: Fix initialization of SCU2C
Felix Gu <[email protected]>
iio: adc: ti-ads1119: Replace IRQF_ONESHOT with IRQF_NO_THREAD
Felix Gu <[email protected]>
iio: adc: ti-ads1119: Reinit completion before wait_for_completion_timeout()
Felix Gu <[email protected]>
iio: adc: ti-ads1119: Fix unbalanced pm reference count in ds1119_single_conversion()
David Lechner <[email protected]>
iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
David Lechner <[email protected]>
iio: adc: ti-adc161s626: fix buffer read on big-endian
David Lechner <[email protected]>
iio: orientation: hid-sensor-rotation: add timestamp hack to not break userspace
David Lechner <[email protected]>
iio: orientation: hid-sensor-rotation: fix quaternion alignment
David Lechner <[email protected]>
iio: add IIO_DECLARE_QUATERNION() macro
Adam Crosser <[email protected]>
gpib: fix use-after-free in IO ioctl handlers
Prike Liang <[email protected]>
drm/amdgpu: fix the idr allocation flags
Aleksandr Nogikh <[email protected]>
x86/kexec: Disable KCOV instrumentation after load_segments()
Stefan Wiehler <[email protected]>
mips: mm: Allocate tlb_vpn array atomically
Sanman Pradhan <[email protected]>
hwmon: (occ) Fix division by zero in occ_show_power_1()
Maciej W. Rozycki <[email protected]>
MIPS: Fix the GCC version check for `__multi3' workaround
Maciej W. Rozycki <[email protected]>
MIPS: SiByte: Bring back cache initialisation
Asim Viladi Oglu Manizada <[email protected]>
ksmbd: fix OOB write in QUERY_INFO for compound requests
hkbinbin <[email protected]>
Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
Oleh Konko <[email protected]>
Bluetooth: SMP: force responder MITM requirements before building the pairing response
Oleh Konko <[email protected]>
Bluetooth: SMP: derive legacy responder STK authentication from MITM state
Junxi Qian <[email protected]>
io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()
Sourav Nayak <[email protected]>
ALSA: hda/realtek: add quirk for HP Victus 15-fb0xxx
Zhang Heng <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS ROG Strix SCAR 15
Takashi Iwai <[email protected]>
ALSA: ctxfi: Fix missing SPDIFI1 index handling
Berk Cem Goksel <[email protected]>
ALSA: caiaq: fix stack out-of-bounds read in init_card
Eric Biggers <[email protected]>
lib/crypto: chacha: Zeroize permuted_state before it leaves scope
Cheng-Yang Chou <[email protected]>
sched_ext: Fix inconsistent NUMA node lookup in scx_select_cpu_dfl()
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()
Ernestas Kulik <[email protected]>
USB: serial: option: add MeiG Smart SRM825WN
Alexey Velichayshiy <[email protected]>
wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()
Yasuaki Torimaru <[email protected]>
wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
Alice Ryhl <[email protected]>
rust_binder: use AssertSync for BINDER_VM_OPS
Greg Kroah-Hartman <[email protected]>
drm/ioc32: stop speculation on the drm_compat_ioctl path
Sunil V L <[email protected]>
ACPI: RIMT: Add dependency between iommu and devices
Zishun Yi <[email protected]>
riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set
Paul Walmsley <[email protected]>
riscv: kgdb: fix several debug register assignment bugs
Ian Rogers <[email protected]>
perf/x86: Fix potential bad container_of in intel_pmu_hw_config
Peter Zijlstra <[email protected]>
sched/fair: Fix zero_vruntime tracking fix
Shiji Yang <[email protected]>
mips: ralink: update CPU clock index
Corey Hickey <[email protected]>
hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI
Chen Ni <[email protected]>
drm/sysfb: Fix efidrm error handling and memory type mismatch
Sanman Pradhan <[email protected]>
hwmon: (occ) Fix missing newline in occ_show_extended()
Felix Gu <[email protected]>
spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback
Sanman Pradhan <[email protected]>
hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify()
Daniele Ceraolo Spurio <[email protected]>
drm/xe/pxp: Clear restart flag in pxp_start after jumping back
Daniele Ceraolo Spurio <[email protected]>
drm/xe/pxp: Remove incorrect handling of impossible state during suspend
Daniele Ceraolo Spurio <[email protected]>
drm/xe/pxp: Clean up termination status on failure
Felix Gu <[email protected]>
spi: stm32-ospi: Fix reset control leak on probe error
Felix Gu <[email protected]>
spi: stm32-ospi: Fix resource leak in remove() callback
Jamie Gibbons <[email protected]>
dt-bindings: gpio: fix microchip #interrupt-cells
Sanman Pradhan <[email protected]>
hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
Sanman Pradhan <[email protected]>
hwmon: (pxe1610) Check return value of page-select write in probe
Sanman Pradhan <[email protected]>
hwmon: (tps53679) Fix array access with zero-length block read
Qi Tang <[email protected]>
io_uring/rsrc: reject zero-length fixed buffer import
Youssef Samir <[email protected]>
accel/qaic: Handle DBC deactivation if the owner went away
Barnabás Pőcze <[email protected]>
gpiolib: clear requested flag if line is invalid
Bartosz Golaszewski <[email protected]>
gpio: rename gpio_chip_hwgpio() to gpiod_hwgpio()
David Lechner <[email protected]>
iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
Maarten Lankhorst <[email protected]>
Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug"
Varun R Mallya <[email protected]>
bpf: Reject sleepable kprobe_multi programs at attach time
Qi Tang <[email protected]>
bpf: reject direct access to nullable PTR_TO_BUF pointers
Dimitri Daskalakis <[email protected]>
eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64
Eric Dumazet <[email protected]>
ipv6: avoid overflows in ip6_datagram_send_ctl()
Luka Gejak <[email protected]>
net: hsr: fix VLAN add unwind on slave errors
Xiang Mei <[email protected]>
net/sched: cls_flow: fix NULL pointer dereference on shared blocks
Xiang Mei <[email protected]>
net/sched: cls_fw: fix NULL pointer dereference on shared blocks
Martin Schiller <[email protected]>
net/x25: Fix overflow when accumulating packets
Martin Schiller <[email protected]>
net/x25: Fix potential double free of skb
Pavan Chebbi <[email protected]>
bnxt_en: Restore default stat ctxs for ULP when resource is available
Saeed Mahameed <[email protected]>
net/mlx5: Fix switchdev mode rollback in case of failure
Saeed Mahameed <[email protected]>
net/mlx5: Avoid "No data available" when FW version queries fail
Shay Drory <[email protected]>
net/mlx5: lag: Check for LAG device before creating debugfs
Fedor Pchelkin <[email protected]>
net: macb: properly unregister fixed rate clocks
Fedor Pchelkin <[email protected]>
net: macb: fix clk handling on PCI glue driver removal
Yucheng Lu <[email protected]>
net/sched: sch_netem: fix out-of-bounds access in packet corruption
Kuniyuki Iwashima <[email protected]>
bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready().
Weiming Shi <[email protected]>
rds: ib: reject FRMR registration before IB connection is established
Keenan Dong <[email protected]>
Bluetooth: MGMT: validate mesh send advertising payload length
Pauli Virtanen <[email protected]>
Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
Pauli Virtanen <[email protected]>
Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
Keenan Dong <[email protected]>
Bluetooth: MGMT: validate LTK enc_size on load
Jonathan Rissanen <[email protected]>
Bluetooth: hci_h4: Fix race during initialization
Cen Zhang <[email protected]>
Bluetooth: SCO: fix race conditions in sco_sock_connect()
Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject immediate NF_QUEUE verdict
Pablo Neira Ayuso <[email protected]>
netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
Pablo Neira Ayuso <[email protected]>
netfilter: ctnetlink: ignore explicit helper on new expectations
Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: store netns and zone in expectation
Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: use expect->helper
Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: honor expectation helper field
Qi Tang <[email protected]>
netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
Qi Tang <[email protected]>
netfilter: nf_conntrack_helper: pass helper to expect cleanup
Florian Westphal <[email protected]>
netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
Florian Westphal <[email protected]>
netfilter: x_tables: ensure names are nul-terminated
Florian Westphal <[email protected]>
netfilter: nfnetlink_log: account for netlink header size
Pablo Neira Ayuso <[email protected]>
netfilter: flowtable: strictly check for maximum number of actions
Geoffrey D. Bennett <[email protected]>
ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen (8016) from SKIP_IFACE_SETUP
Michal Piekos <[email protected]>
net: stmmac: skip VLAN restore when VLAN hash ops are missing
Li Xiasong <[email protected]>
mptcp: fix soft lockup in mptcp_recvmsg()
Geliang Tang <[email protected]>
mptcp: add eat_recv_skb helper
Zhengchuan Liang <[email protected]>
net: ipv6: flowlabel: defer exclusive option free until RCU teardown
Alexei Starovoitov <[email protected]>
bpf: Fix regsafe() for pointers to packet
Julian Braha <[email protected]>
ASoC: Intel: boards: fix unmet dependency on PINCTRL
Suraj Gupta <[email protected]>
net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets
Suraj Gupta <[email protected]>
net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
Pengpeng Hou <[email protected]>
NFC: pn533: bound the UART receive buffer
Xiang Mei <[email protected]>
net: bonding: fix use-after-free in bond_xmit_broadcast()
Herbert Xu <[email protected]>
crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
Herbert Xu <[email protected]>
crypto: algif_aead - Revert to operating out-of-place
Pengpeng Hou <[email protected]>
bnxt_en: set backing store type from query type
Yochai Eisenrich <[email protected]>
net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak
Guoyu Su <[email protected]>
net: use skb_header_pointer() for TCPv4 GSO frag_off check
Paolo Abeni <[email protected]>
net: introduce mangleid_features
Lorenzo Bianconi <[email protected]>
net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue()
Paolo Abeni <[email protected]>
ipv6: prevent possible UaF in addrconf_permanent_addr()
Jihed Chaibi <[email protected]>
ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure
Dag Smedberg <[email protected]>
ALSA: usb-audio: Exclude Scarlett Solo 1st Gen from SKIP_IFACE_SETUP
Wei Fang <[email protected]>
net: enetc: do not allow VF to configure the RSS key
Wei Fang <[email protected]>
net: enetc: check whether the RSS algorithm is Toeplitz
Marek Behún <[email protected]>
net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta
Xiang Mei <[email protected]>
net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
Yang Yang <[email protected]>
bridge: br_nd_send: linearize skb before parsing ND options
Dimitri Daskalakis <[email protected]>
eth: fbnic: Account for page fragments when updating BDQ tail
Eric Dumazet <[email protected]>
ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
Eric Dumazet <[email protected]>
ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
Thomas Bogendoerfer <[email protected]>
tg3: Fix race for querying speed/duplex
Pengpeng Hou <[email protected]>
net/ipv6: ioam6: prevent schema length wraparound in trace fill
Yochai Eisenrich <[email protected]>
net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
Jiayuan Chen <[email protected]>
net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
Wei Fang <[email protected]>
net: enetc: reset PIR and CIR if they are not equal when initializing TX ring
Buday Csaba <[email protected]>
net: fec: fix the PTP periodic output sysfs interface
Qingfang Deng <[email protected]>
netdevsim: fix build if SKB_EXTENSIONS=n
Dipayaan Roy <[email protected]>
net: mana: Fix RX skb truesize accounting
Norbert Szetei <[email protected]>
crypto: af-alg - fix NULL pointer dereference in scatterwalk
Mikulas Patocka <[email protected]>
crypto: deflate - fix spurious -ENOSPC
Horia Geantă <[email protected]>
crypto: caam - fix overflow on long hmac keys
Horia Geantă <[email protected]>
crypto: caam - fix DMA corruption on long hmac keys
Reshma Immaculate Rajkumar <[email protected]>
wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session
Johannes Berg <[email protected]>
wifi: iwlwifi: mld: correctly set wifi generation data
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: disable EHT if the device doesn't allow it
Johannes Berg <[email protected]>
wifi: iwlwifi: cfg: add new device names
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: don't send a 6E related command when not supported
Pagadala Yesu Anjaneyulu <[email protected]>
wifi: iwlwifi: mld: Fix MLO scan timing
Johannes Berg <[email protected]>
wifi: iwlwifi: fix remaining kernel-doc warnings
Frank Li <[email protected]>
dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning
Praveen Talari <[email protected]>
spi: geni-qcom: Check DMA interrupts early in ISR
Paulo Alcantara <[email protected]>
smb: client: fix generic/694 due to wrong ->i_blocks
ZhengYuan Huang <[email protected]>
btrfs: reject root items with drop_progress and zero drop_level
Mikko Perttunen <[email protected]>
i2c: tegra: Don't mark devices with pins as IRQ safe
Filipe Manana <[email protected]>
btrfs: reserve enough transaction items for qgroup ioctls
Lee Jones <[email protected]>
HID: multitouch: Check to ensure report responses match the request
Lee Jones <[email protected]>
HID: core: Mitigate potential OOB by removing bogus memset()
Lee Jones <[email protected]>
HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
Josh Poimboeuf <[email protected]>
objtool: Fix Clang jump table detection
Paul SAGE <[email protected]>
tg3: replace placeholder MAC address with device property
Johannes Thumshirn <[email protected]>
btrfs: don't take device_list_mutex when querying zone info
Deepanshu Kartikey <[email protected]>
atm: lec: fix use-after-free in sock_def_readable()
Benoît Sevens <[email protected]>
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
Deepanshu Kartikey <[email protected]>
wifi: mac80211: check tdls flag in ieee80211_tdls_oper
Adrian Freund <[email protected]>
HID: logitech-hidpp: Enable MX Master 4 over bluetooth
Pepper Gray <[email protected]>
arm64/scs: Fix handling of advance_loc4
-------------
Diffstat:
.../bindings/auxdisplay/holtek,ht16k33.yaml | 2 +- .../bindings/connector/usb-connector.yaml | 1 + .../bindings/gpio/microchip,mpfs-gpio.yaml | 4 +- Makefile | 4 +- arch/arm64/kernel/pi/patch-scs.c | 8 + arch/mips/lib/multi3.c | 6 +- arch/mips/mm/cache.c | 3 +- arch/mips/mm/tlb-r4k.c | 2 +- arch/mips/ralink/clk.c | 8 +- arch/riscv/kernel/kgdb.c | 7 +- arch/riscv/kernel/process.c | 4 +- arch/s390/kernel/perf_cpum_sf.c | 6 +- arch/x86/events/intel/core.c | 6 +- arch/x86/kernel/Makefile | 14 ++ arch/x86/mm/Makefile | 2 + arch/x86/platform/geode/geode-common.c | 24 ++- crypto/af_alg.c | 53 ++---- crypto/algif_aead.c | 100 ++--------- crypto/algif_skcipher.c | 6 +- crypto/authencesn.c | 50 +++--- crypto/deflate.c | 11 +- drivers/accel/qaic/qaic_control.c | 47 ++++- drivers/acpi/riscv/rimt.c | 7 + drivers/android/binder/page_range.rs | 8 +- drivers/android/binder/rust_binder_main.rs | 2 +- drivers/bluetooth/hci_h4.c | 3 - drivers/comedi/drivers.c | 8 + drivers/comedi/drivers/dt2815.c | 12 ++ drivers/comedi/drivers/me4000.c | 16 +- drivers/comedi/drivers/me_daq.c | 35 ++-- drivers/comedi/drivers/ni_atmio16d.c | 3 +- drivers/counter/rz-mtu3-cnt.c | 67 +++---- drivers/cpufreq/cpufreq_governor.c | 6 +- drivers/crypto/caam/caamalg_qi2.c | 3 +- drivers/crypto/caam/caamhash.c | 3 +- drivers/crypto/tegra/tegra-se-aes.c | 11 +- drivers/crypto/tegra/tegra-se-hash.c | 30 ++-- drivers/firmware/microchip/mpfs-auto-update.c | 10 +- drivers/gpio/gpio-aspeed.c | 6 +- drivers/gpio/gpio-mxc.c | 10 +- drivers/gpio/gpiolib-cdev.c | 12 +- drivers/gpio/gpiolib-sysfs.c | 14 +- drivers/gpio/gpiolib.c | 175 +++++++++--------- drivers/gpio/gpiolib.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 7 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 +- drivers/gpu/drm/amd/amdgpu/psp_v11_0.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 4 +- .../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 17 +- .../display/dc/resource/dce100/dce100_resource.c | 5 +- .../display/dc/resource/dce110/dce110_resource.c | 5 +- .../display/dc/resource/dce112/dce112_resource.c | 5 +- .../display/dc/resource/dce120/dce120_resource.c | 5 +- .../amd/display/dc/resource/dce60/dce60_resource.c | 13 +- .../amd/display/dc/resource/dce80/dce80_resource.c | 5 +- drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 1 - drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c | 1 - .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 33 +++- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 33 +++- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 1 - drivers/gpu/drm/ast/ast_dp501.c | 2 +- drivers/gpu/drm/drm_file.c | 5 +- drivers/gpu/drm/drm_ioc32.c | 2 + drivers/gpu/drm/drm_mode_config.c | 9 +- drivers/gpu/drm/i915/display/g4x_dp.c | 2 +- drivers/gpu/drm/i915/display/icl_dsi.c | 4 +- drivers/gpu/drm/sysfb/efidrm.c | 46 +++-- drivers/gpu/drm/xe/xe_pxp.c | 11 +- drivers/hid/hid-appletb-kbd.c | 5 +- drivers/hid/hid-core.c | 7 +- drivers/hid/hid-logitech-hidpp.c | 6 +- drivers/hid/hid-multitouch.c | 7 + drivers/hid/wacom_wac.c | 10 ++ drivers/hwmon/asus-ec-sensors.c | 7 +- drivers/hwmon/occ/common.c | 19 +- drivers/hwmon/pmbus/ltc4286.c | 1 + drivers/hwmon/pmbus/pxe1610.c | 5 +- drivers/hwmon/pmbus/tps53679.c | 10 +- drivers/i2c/busses/Kconfig | 2 + drivers/i2c/busses/i2c-tegra.c | 5 +- drivers/iio/accel/adxl313_core.c | 2 + drivers/iio/accel/adxl355_core.c | 2 +- drivers/iio/accel/adxl380.c | 2 +- drivers/iio/adc/ade9000.c | 12 +- drivers/iio/adc/aspeed_adc.c | 1 + drivers/iio/adc/ti-adc161s626.c | 41 +++-- drivers/iio/adc/ti-ads1119.c | 11 +- drivers/iio/adc/ti-ads7950.c | 8 +- drivers/iio/dac/ad5770r.c | 2 +- drivers/iio/gyro/mpu3050-core.c | 32 ++-- drivers/iio/imu/adis16550.c | 8 +- drivers/iio/imu/bmi160/bmi160_core.c | 15 +- drivers/iio/imu/bno055/bno055.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 + drivers/iio/light/vcnl4035.c | 18 +- drivers/iio/light/veml6070.c | 4 +- drivers/iio/orientation/hid-sensor-rotation.c | 24 ++- drivers/input/joystick/xpad.c | 5 + drivers/input/mouse/bcm5974.c | 42 ++++- drivers/input/rmi4/rmi_f54.c | 4 +- drivers/input/serio/i8042-acpipnpio.h | 7 + drivers/misc/fastrpc.c | 5 +- drivers/misc/mei/hw-me.c | 14 +- drivers/net/bonding/bond_main.c | 2 +- drivers/net/ethernet/airoha/airoha_eth.c | 18 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +- drivers/net/ethernet/broadcom/tg3.c | 13 +- drivers/net/ethernet/cadence/macb_pci.c | 10 +- drivers/net/ethernet/faraday/ftgmac100.c | 28 ++- drivers/net/ethernet/freescale/enetc/enetc.c | 13 +- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 10 +- drivers/net/ethernet/freescale/fec_ptp.c | 3 - drivers/net/ethernet/intel/ice/ice_ethtool.c | 11 +- drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 21 ++- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 +- .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/fw.c | 49 ++++-- .../net/ethernet/mellanox/mlx5/core/lag/debugfs.c | 3 + .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 6 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.h | 2 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 13 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 14 +- drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 +- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 9 +- drivers/net/phy/sfp.c | 7 +- drivers/net/virtio_net.c | 20 +-- drivers/net/vxlan/vxlan_core.c | 6 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 15 +- drivers/net/wireless/intel/iwlwifi/cfg/rf-fm.c | 1 + drivers/net/wireless/intel/iwlwifi/cfg/rf-wh.c | 24 +++ drivers/net/wireless/intel/iwlwifi/fw/acpi.h | 1 + drivers/net/wireless/intel/iwlwifi/fw/api/cmdhdr.h | 4 +- drivers/net/wireless/intel/iwlwifi/fw/api/coex.h | 4 +- .../net/wireless/intel/iwlwifi/fw/api/commands.h | 5 + .../net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h | 14 +- drivers/net/wireless/intel/iwlwifi/fw/api/debug.h | 2 +- .../net/wireless/intel/iwlwifi/fw/api/location.h | 8 +- drivers/net/wireless/intel/iwlwifi/fw/api/power.h | 5 +- drivers/net/wireless/intel/iwlwifi/fw/api/scan.h | 88 +++++---- drivers/net/wireless/intel/iwlwifi/fw/api/sta.h | 6 +- drivers/net/wireless/intel/iwlwifi/fw/api/stats.h | 39 ++-- drivers/net/wireless/intel/iwlwifi/fw/api/tx.h | 2 +- drivers/net/wireless/intel/iwlwifi/fw/error-dump.h | 4 +- drivers/net/wireless/intel/iwlwifi/fw/file.h | 74 ++++++-- drivers/net/wireless/intel/iwlwifi/fw/img.h | 12 +- drivers/net/wireless/intel/iwlwifi/fw/runtime.h | 22 ++- drivers/net/wireless/intel/iwlwifi/iwl-config.h | 8 +- drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.h | 4 +- drivers/net/wireless/intel/iwlwifi/iwl-drv.h | 3 +- drivers/net/wireless/intel/iwlwifi/iwl-modparams.h | 4 +- drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 2 +- drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h | 17 +- drivers/net/wireless/intel/iwlwifi/iwl-op-mode.h | 1 + drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 6 +- drivers/net/wireless/intel/iwlwifi/mld/iface.c | 101 +++++++---- drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 19 ++ drivers/net/wireless/intel/iwlwifi/mld/mld.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/mlo.c | 4 +- drivers/net/wireless/intel/iwlwifi/mld/notif.c | 5 + drivers/net/wireless/intel/iwlwifi/mld/scan.c | 30 +++- drivers/net/wireless/intel/iwlwifi/mld/scan.h | 9 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 3 +- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 5 + drivers/net/wireless/microchip/wilc1000/hif.c | 2 +- drivers/net/wireless/virtual/virt_wifi.c | 1 - drivers/nfc/pn533/uart.c | 3 + drivers/nvmem/imx-ocotp-ele.c | 1 + drivers/nvmem/imx-ocotp.c | 1 + drivers/nvmem/zynqmp_nvmem.c | 8 +- drivers/s390/crypto/zcrypt_msgtype6.c | 32 ++-- drivers/spi/spi-amlogic-spifc-a4.c | 12 ++ drivers/spi/spi-cadence-quadspi.c | 17 +- drivers/spi/spi-geni-qcom.c | 9 +- drivers/spi/spi-stm32-ospi.c | 9 +- drivers/staging/gpib/Kconfig | 1 + drivers/staging/gpib/common/gpib_os.c | 96 +++++++--- drivers/staging/gpib/include/gpib_types.h | 8 + drivers/staging/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c | 4 +- drivers/target/loopback/tcm_loop.c | 52 +++++- drivers/target/target_core_file.c | 2 +- drivers/thermal/thermal_core.c | 32 +++- drivers/thunderbolt/nhi.c | 2 +- drivers/tty/vt/vt.c | 18 ++ drivers/usb/cdns3/cdns3-gadget.c | 4 + drivers/usb/class/cdc-acm.c | 9 + drivers/usb/class/cdc-acm.h | 1 + drivers/usb/class/usbtmc.c | 3 + drivers/usb/common/ulpi.c | 5 +- drivers/usb/core/driver.c | 23 ++- drivers/usb/core/offload.c | 102 ++++++----- drivers/usb/core/phy.c | 12 +- drivers/usb/core/quirks.c | 3 + drivers/usb/core/usb.c | 1 + drivers/usb/dwc2/gadget.c | 2 + drivers/usb/gadget/function/f_ecm.c | 35 ++-- drivers/usb/gadget/function/f_eem.c | 59 ++++--- drivers/usb/gadget/function/f_hid.c | 19 +- drivers/usb/gadget/function/f_rndis.c | 49 ++++-- drivers/usb/gadget/function/f_subset.c | 63 ++++--- drivers/usb/gadget/function/f_uac1_legacy.c | 47 +++-- drivers/usb/gadget/function/f_uvc.c | 39 +++- drivers/usb/gadget/function/u_ecm.h | 21 ++- drivers/usb/gadget/function/u_eem.h | 21 ++- drivers/usb/gadget/function/u_ether.c | 16 +- drivers/usb/gadget/function/u_gether.h | 22 ++- drivers/usb/gadget/function/u_rndis.h | 31 +++- drivers/usb/gadget/function/uvc.h | 3 + drivers/usb/gadget/function/uvc_v4l2.c | 5 +- drivers/usb/gadget/udc/dummy_hcd.c | 42 +++-- drivers/usb/host/ehci-brcm.c | 4 +- drivers/usb/host/xhci-sideband.c | 18 +- drivers/usb/misc/usbio.c | 7 +- drivers/usb/serial/io_edgeport.c | 3 + drivers/usb/serial/io_usbvend.h | 1 + drivers/usb/serial/option.c | 4 + drivers/usb/typec/altmodes/thunderbolt.c | 44 ++--- drivers/usb/typec/ucsi/ucsi.c | 9 +- fs/btrfs/ioctl.c | 12 +- fs/btrfs/tree-checker.c | 17 ++ fs/btrfs/zoned.c | 6 +- fs/smb/client/cifsglob.h | 6 + fs/smb/client/file.c | 1 - fs/smb/client/inode.c | 21 +-- fs/smb/client/smb2ops.c | 20 +-- fs/smb/server/smb2pdu.c | 121 +++++++++---- fs/smb/server/smbacl.c | 43 +++++ fs/smb/server/smbacl.h | 2 + include/crypto/if_alg.h | 5 +- include/linux/iio/iio.h | 12 ++ include/linux/netdevice.h | 3 + include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/skbuff.h | 1 + include/linux/usb.h | 10 +- include/net/netfilter/nf_conntrack_expect.h | 20 ++- io_uring/io_uring.c | 62 ++++--- io_uring/io_uring.h | 34 +++- io_uring/net.c | 4 + io_uring/rsrc.c | 4 + kernel/bpf/verifier.c | 10 +- kernel/kallsyms.c | 64 +++++-- kernel/sched/ext.c | 70 +++++--- kernel/sched/ext_idle.c | 33 ++-- kernel/sched/fair.c | 10 +- kernel/trace/bpf_trace.c | 4 + lib/crypto/chacha-block-generic.c | 4 + mm/gup.c | 10 +- mm/hmm.c | 2 +- mm/memory.c | 22 ++- mm/mprotect.c | 2 +- mm/sparse-vmemmap.c | 2 +- mm/vmscan.c | 2 +- net/atm/lec.c | 72 +++++--- net/atm/lec.h | 2 +- net/bluetooth/hci_conn.c | 8 +- net/bluetooth/hci_event.c | 33 ++-- net/bluetooth/hci_sync.c | 14 +- net/bluetooth/mgmt.c | 17 +- net/bluetooth/sco.c | 30 +++- net/bluetooth/smp.c | 11 +- net/bridge/br_arp_nd_proxy.c | 18 +- net/core/dev.c | 38 +++- net/core/skmsg.c | 13 +- net/hsr/hsr_device.c | 32 ++-- net/ipv6/addrconf.c | 6 +- net/ipv6/datagram.c | 10 ++ net/ipv6/icmp.c | 3 + net/ipv6/ioam6.c | 4 +- net/ipv6/ip6_flowlabel.c | 5 - net/ipv6/ip6_tunnel.c | 5 + net/ipv6/ndisc.c | 3 + net/mac80211/tdls.c | 2 +- net/mptcp/protocol.c | 30 ++-- net/netfilter/ipset/ip_set_core.c | 4 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/nf_conntrack_broadcast.c | 8 +- net/netfilter/nf_conntrack_expect.c | 25 ++- net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 13 +- net/netfilter/nf_conntrack_netlink.c | 87 +++------ net/netfilter/nf_conntrack_sip.c | 4 +- net/netfilter/nf_flow_table_offload.c | 196 ++++++++++++++------- net/netfilter/nf_tables_api.c | 7 +- net/netfilter/nfnetlink_log.c | 2 +- net/netfilter/x_tables.c | 23 +++ net/netfilter/xt_cgroup.c | 6 + net/netfilter/xt_rateest.c | 5 + net/qrtr/af_qrtr.c | 31 ++-- net/rds/ib_rdma.c | 7 +- net/sched/cls_api.c | 1 + net/sched/cls_flow.c | 10 +- net/sched/cls_fw.c | 14 +- net/sched/sch_hfsc.c | 4 +- net/sched/sch_netem.c | 5 +- net/x25/x25_in.c | 9 +- net/x25/x25_subr.c | 1 + sound/hda/codecs/realtek/alc269.c | 2 + sound/pci/ctxfi/ctdaio.c | 1 + sound/soc/cirrus/ep93xx-i2s.c | 34 ++-- sound/soc/intel/boards/Kconfig | 2 - sound/soc/qcom/sdw.c | 11 ++ sound/usb/caiaq/device.c | 2 +- sound/usb/qcom/qc_audio_offload.c | 10 +- sound/usb/quirks.c | 2 + tools/objtool/check.c | 5 +- 309 files changed, 3178 insertions(+), 1635 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/277 arm64/scs: Fix handling of advance_loc4
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pepper Gray <[email protected]>
[ Upstream commit d499e9627d70b1269020d59b95ed3e18bee6b8cd ]
DW_CFA_advance_loc4 is defined but no handler is implemented. Its CFA opcode defaults to EDYNSCS_INVALID_CFA_OPCODE triggering an error which wrongfully prevents modules from loading.
--- arch/arm64/kernel/pi/patch-scs.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/arm64/kernel/pi/patch-scs.c +8 -0
@@ -192,6 +192,14 @@ static int scs_handle_fde_frame(const struct eh_frame *frame, size -=2 ;break ; +case DW_CFA_advance_loc4: + loc += *opcode++ * code_alignment_factor; + loc += (*opcode++ <<8 ) * code_alignment_factor; + loc += (*opcode++ <<16 ) * code_alignment_factor; + loc += (*opcode++ <<24 ) * code_alignment_factor; + size -=4 ; +break ; +case DW_CFA_def_cfa:case DW_CFA_offset_extended: size =skip_xleb128 (&opcode, size);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 2/277 HID: logitech-hidpp: Enable MX Master 4 over bluetooth
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Freund <[email protected]>
[ Upstream commit 70031e70ca15ede6a39db4d978e53a6cc720d454 ]
The Logitech MX Master 4 can be connected over bluetooth or through a Logitech Bolt receiver. This change adds support for non-standard HID features, such as high resolution scrolling when the mouse is connected over bluetooth.
Because no Logitech Bolt receiver driver exists yet those features won't be available when the mouse is connected through the receiver.
--- drivers/hid/hid-logitech-hidpp.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hid/hid-logitech-hidpp.c +2 -0
@@ -4667,6 +4667,8 @@ static const struct hid_device_id hidpp_devices[] = { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb038) }, {/* Slim Solar+ K980 Keyboard over Bluetooth */ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb391) }, + { /* MX Master 4 mouse over Bluetooth */ + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb042) }, {} };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 3/277 wifi: mac80211: check tdls flag in ieee80211_tdls_oper
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
[ Upstream commit 7d73872d949c488a1d7c308031d6a9d89b5e0a8b ]
When NL80211_TDLS_ENABLE_LINK is called, the code only checks if the station exists but not whether it is actually a TDLS station. This allows the operation to proceed for non-TDLS stations, causing unintended side effects like modifying channel context and HT protection before failing.
Add a check for sta->sta.tdls early in the ENABLE_LINK case, before any side effects occur, to ensure the operation is only allowed for actual TDLS peers.
--- net/mac80211/tdls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/tdls.c +1 -1
@@ -1449,7 +1449,7 @@ int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev, } sta =sta_info_get (sdata, peer); -if (!sta) +if (!sta || !sta->sta.tdls)return -ENOLINK ;iee80211_tdls_recalc_chanctx (sdata, sta);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 4/277 HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benoît Sevens <[email protected]>
[ Upstream commit 2f1763f62909ccb6386ac50350fa0abbf5bb16a9 ]
The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short report can trigger an out-of-bounds read when copying data into the wacom structure.
Specifically, report 0x03 requires at least 22 bytes to safely read the processed data and battery status, while report 0x04 (which falls through to 0x03) requires 32 bytes.
Add explicit length checks for these report IDs and log a warning if a short report is received.
--- drivers/hid/wacom_wac.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/hid/wacom_wac.c +10 -0
@@ -1208,10 +1208,20 @@ static int wacom_intuos_bt_irq(struct wacom_wac *wacom, size_t len)switch (data[0 ]) {case 0x04 : +if (len <32 ) { +dev_warn (wacom->pen_input->dev.parent, +"Report 0x04 too short: %zu bytes\n" , len); +break ; + }wacom_intuos_bt_process_data (wacom, data + i); i +=10 ; fallthrough;case 0x03 : +if (i ==1 && len <22 ) { +dev_warn (wacom->pen_input->dev.parent, +"Report 0x03 too short: %zu bytes\n" , len); +break ; + }wacom_intuos_bt_process_data (wacom, data + i); i +=10 ;wacom_intuos_bt_process_data (wacom, data + i);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 5/277 atm: lec: fix use-after-free in sock_def_readable()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
[ Upstream commit 922814879542c2e397b0e9641fd36b8202a8e555 ]
A race condition exists between lec_atm_close() setting priv->lecd to NULL and concurrent access to priv->lecd in send_to_lecd(), lec_handle_bridge(), and lec_atm_send(). When the socket is freed via RCU while another thread is still using it, a use-after-free occurs in sock_def_readable() when accessing the socket's wait queue.
The root cause is that lec_atm_close() clears priv->lecd without any synchronization, while callers dereference priv->lecd without any protection against concurrent teardown.
Fix this by converting priv->lecd to an RCU-protected pointer:
- Mark priv->lecd as __rcu in lec.h
- Use rcu_assign_pointer() in lec_atm_close() and lecd_attach() for safe pointer assignment
- Use rcu_access_pointer() for NULL checks that do not dereference the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and lecd_attach()
- Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(), lec_handle_bridge() and lec_atm_send() to safely access lecd
- Use rcu_assign_pointer() followed by synchronize_rcu() in lec_atm_close() to ensure all readers have completed before proceeding. This is safe since lec_atm_close() is called from vcc_release() which holds lock_sock(), a sleeping lock.
- Remove the manual sk_receive_queue drain from lec_atm_close() since vcc_destroy_socket() already drains it after lec_atm_close() returns.
v2: Switch from spinlock + sock_hold/put approach to RCU to properly
fix the race. The v1 spinlock approach had two issues pointed out by Eric Dumazet:
1. priv->lecd was still accessed directly after releasing the lock instead of using a local copy.
2. The spinlock did not prevent packets being queued after lec_atm_close() drains sk_receive_queue since timer and workqueue paths bypass netif_stop_queue().
Note: Syzbot patch testing was attempted but the test VM terminated
unexpectedly with "Connection to localhost closed by remote host", likely due to a QEMU AHCI emulation issue unrelated to this fix. Compile testing with "make W=1 net/atm/lec.o" passes cleanly.
--- net/atm/lec.c | 72 +++++++++++++++++++++++++++++++++------------------ net/atm/lec.h | 2 +- 2 files changed, 48 insertions(+), 26 deletions(-)
net/atm/lec.c +47 -25
@@ -154,10 +154,19 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)/* 0x01 is topology change */ priv =netdev_priv (dev); -atm_force_charge (priv->lecd, skb2->truesize); - sk =sk_atm (priv->lecd); -skb_queue_tail (&sk->sk_receive_queue, skb2); - sk->sk_data_ready(sk); +struct atm_vcc *vcc; + +rcu_read_lock (); + vcc =rcu_dereference (priv->lecd); +if (vcc) { +atm_force_charge (vcc, skb2->truesize); + sk =sk_atm (vcc); +skb_queue_tail (&sk->sk_receive_queue, skb2); + sk->sk_data_ready (sk); + }else { +dev_kfree_skb (skb2); + } + rcu_read_unlock(); } }#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -216,7 +225,7 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,int is_rdesc;pr_debug ("called\n" ); -if (!priv->lecd) { +if (!rcu_access_pointer (priv->lecd)) {pr_info ("%s:No lecd attached\n" , dev->name); dev->stats.tx_errors++;netif_stop_queue (dev);
@@ -449,10 +458,19 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)break ; skb2->len =sizeof (struct atmlec_msg );skb_copy_to_linear_data (skb2, mesg,sizeof (*mesg)); -atm_force_charge (priv->lecd, skb2->truesize); - sk =sk_atm (priv->lecd); -skb_queue_tail (&sk->sk_receive_queue, skb2); - sk->sk_data_ready(sk); +struct atm_vcc *vcc; + +rcu_read_lock (); + vcc =rcu_dereference (priv->lecd); +if (vcc) { +atm_force_charge (vcc, skb2->truesize); + sk =sk_atm (vcc); +skb_queue_tail (&sk->sk_receive_queue, skb2); + sk->sk_data_ready (sk); + }else { +dev_kfree_skb (skb2); + } + rcu_read_unlock(); } }#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -468,23 +486,16 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)static void lec_atm_close (struct atm_vcc *vcc) { -struct sk_buff *skb;struct net_device *dev = (struct net_device *)vcc->proto_data;struct lec_priv *priv =netdev_priv (dev); - priv->lecd =NULL ; +rcu_assign_pointer (priv->lecd,NULL ); +synchronize_rcu ();/* Do something needful? */ netif_stop_queue (dev);lec_arp_destroy (priv); -if (skb_peek (&sk_atm (vcc)->sk_receive_queue)) -pr_info ("%s closing with messages pending\n" , dev->name); -while ((skb =skb_dequeue (&sk_atm (vcc)->sk_receive_queue))) { -atm_return (vcc, skb->truesize); -dev_kfree_skb (skb); - } -pr_info ("%s: Shut down!\n" , dev->name);module_put (THIS_MODULE ); }
@@ -510,12 +521,14 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type, const unsigned char *mac_addr, const unsigned char *atm_addr, struct sk_buff *data) { + struct atm_vcc *vcc;struct sock *sk;struct sk_buff *skb;struct atmlec_msg *mesg; -if (!priv || !priv->lecd) +if (!priv || !rcu_access_pointer (priv->lecd))return -1 ; + skb =alloc_skb (sizeof (struct atmlec_msg ),GFP_ATOMIC );if (!skb)return -1 ;
@@ -532,18 +545,27 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,if (atm_addr)memcpy (&mesg->content.normal.atm_addr, atm_addr,ATM_ESA_LEN ); -atm_force_charge (priv->lecd, skb->truesize); - sk =sk_atm (priv->lecd); +rcu_read_lock (); + vcc =rcu_dereference (priv->lecd); +if (!vcc) { +rcu_read_unlock (); +kfree_skb (skb); +return -1 ; + } + +atm_force_charge (vcc, skb->truesize); + sk =sk_atm (vcc);skb_queue_tail (&sk->sk_receive_queue, skb); sk->sk_data_ready (sk);if (data !=NULL ) {pr_debug ("about to send %d bytes of data\n" , data->len); -atm_force_charge (priv->lecd, data->truesize); +atm_force_charge (vcc, data->truesize);skb_queue_tail (&sk->sk_receive_queue, data); sk->sk_data_ready (sk); } +rcu_read_unlock ();return 0 ; }
@@ -618,7 +640,7 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)atm_return (vcc, skb->truesize);if (*(__be16 *) skb->data ==htons (priv->lecid) || - !priv->lecd || !(dev->flags &IFF_UP )) { + !rcu_access_pointer (priv->lecd) || !(dev->flags &IFF_UP )) {/* * Probably looping back, or if lecd is missing, * lecd has gone down
@@ -753,12 +775,12 @@ static int lecd_attach(struct atm_vcc *vcc, int arg) priv =netdev_priv (dev_lec[i]); }else { priv =netdev_priv (dev_lec[i]); -if (priv->lecd) +if (rcu_access_pointer (priv->lecd))return -EADDRINUSE ; }lec_arp_init (priv); priv->itfnum = i;/* LANE2 addition */ - priv->lecd = vcc; +rcu_assign_pointer (priv->lecd, vcc); vcc->dev = &lecatm_dev;vcc_insert_socket (sk_atm (vcc));
net/atm/lec.h +1 -1
@@ -91,7 +91,7 @@ struct lec_priv {*/ spinlock_t lec_arp_lock;struct atm_vcc *mcast_vcc;/* Default Multicast Send VCC */ -struct atm_vcc *lecd; +struct atm_vcc __rcu *lecd;struct delayed_work lec_arp_work;/* C10 */ unsigned int maximum_unknown_frame_count;/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 6/277 btrfs: dont take device_list_mutex when querying zone info
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <[email protected]>
[ Upstream commit 77603ab10429fe713a03345553ca8dbbfb1d91c6 ]
Shin'ichiro reported sporadic hangs when running generic/013 in our CI system. When enabling lockdep, there is a lockdep splat when calling btrfs_get_dev_zone_info_all_devices() in the mount path that can be triggered by i.e. generic/013:
======================================================
WARNING: possible circular locking dependency detected
7.0.0-rc1+ #355 Not tainted
------------------------------------------------------
mount/1043 is trying to acquire lock:
ffff8881020b5470 (&vblk->vdev_mutex){+.+.}-{4:4}, at: virtblk_report_zones+0xda/0x430
but task is already holding lock:
ffff888102a738e0 (&fs_devs->device_list_mutex){+.+.}-{4:4}, at: btrfs_get_dev_zone_info_all_devices+0x45/0x90
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #4 (&fs_devs->device_list_mutex){+.+.}-{4:4}:
__mutex_lock+0xa3/0x1360 btrfs_create_pending_block_groups+0x1f4/0x9d0 __btrfs_end_transaction+0x3e/0x2e0 btrfs_zoned_reserve_data_reloc_bg+0x2f8/0x390 open_ctree+0x1934/0x23db btrfs_get_tree.cold+0x105/0x26c vfs_get_tree+0x28/0xb0 __do_sys_fsconfig+0x324/0x680 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
-> #3 (btrfs_trans_num_extwriters){++++}-{0:0}:
join_transaction+0xc2/0x5c0 start_transaction+0x17c/0xbc0 btrfs_zoned_reserve_data_reloc_bg+0x2b4/0x390 open_ctree+0x1934/0x23db btrfs_get_tree.cold+0x105/0x26c vfs_get_tree+0x28/0xb0 __do_sys_fsconfig+0x324/0x680 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
-> #2 (btrfs_trans_num_writers){++++}-{0:0}:
lock_release+0x163/0x4b0 __btrfs_end_transaction+0x1c7/0x2e0 btrfs_dirty_inode+0x6f/0xd0 touch_atime+0xe5/0x2c0 btrfs_file_mmap_prepare+0x65/0x90 __mmap_region+0x4b9/0xf00 mmap_region+0xf7/0x120 do_mmap+0x43d/0x610 vm_mmap_pgoff+0xd6/0x190 ksys_mmap_pgoff+0x7e/0xc0 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
-> #1 (&mm->mmap_lock){++++}-{4:4}:
__might_fault+0x68/0xa0 _copy_to_user+0x22/0x70 blkdev_copy_zone_to_user+0x22/0x40 virtblk_report_zones+0x282/0x430 blkdev_report_zones_ioctl+0xfd/0x130 blkdev_ioctl+0x20f/0x2c0 __x64_sys_ioctl+0x86/0xd0 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
-> #0 (&vblk->vdev_mutex){+.+.}-{4:4}:
__lock_acquire+0x1522/0x2680 lock_acquire+0xd5/0x2f0 __mutex_lock+0xa3/0x1360 virtblk_report_zones+0xda/0x430 blkdev_report_zones_cached+0x162/0x190 btrfs_get_dev_zones+0xdc/0x2e0 btrfs_get_dev_zone_info+0x219/0xe80 btrfs_get_dev_zone_info_all_devices+0x62/0x90 open_ctree+0x1200/0x23db btrfs_get_tree.cold+0x105/0x26c vfs_get_tree+0x28/0xb0 __do_sys_fsconfig+0x324/0x680 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
other info that might help us debug this:
Chain exists of:
&vblk->vdev_mutex --> btrfs_trans_num_extwriters --> &fs_devs->device_list_mutex
Possible unsafe locking scenario: CPU0 CPU1
---- ----
lock(&fs_devs->device_list_mutex);
lock(btrfs_trans_num_extwriters);
lock(&fs_devs->device_list_mutex);
lock(&vblk->vdev_mutex);*** DEADLOCK ***
3 locks held by mount/1043:
#0: ffff88811063e878 (&fc->uapi_mutex){+.+.}-{4:4}, at: __do_sys_fsconfig+0x2ae/0x680
#1: ffff88810cb9f0e8 (&type->s_umount_key#31/1){+.+.}-{4:4}, at: alloc_super+0xc0/0x3e0
#2: ffff888102a738e0 (&fs_devs->device_list_mutex){+.+.}-{4:4}, at: btrfs_get_dev_zone_info_all_devices+0x45/0x90
stack backtrace: CPU: 2 UID: 0 PID: 1043 Comm: mount Not tainted 7.0.0-rc1+ #355 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/10/2025 Call Trace: <TASK> dump_stack_lvl+0x5b/0x80 print_circular_bug.cold+0x18d/0x1d8 check_noncircular+0x10d/0x130 __lock_acquire+0x1522/0x2680 ? vmap_small_pages_range_noflush+0x3ef/0x820 lock_acquire+0xd5/0x2f0 ? virtblk_report_zones+0xda/0x430 ? lock_is_held_type+0xcd/0x130 __mutex_lock+0xa3/0x1360 ? virtblk_report_zones+0xda/0x430 ? virtblk_report_zones+0xda/0x430 ? __pfx_copy_zone_info_cb+0x10/0x10 ? virtblk_report_zones+0xda/0x430 virtblk_report_zones+0xda/0x430 ? __pfx_copy_zone_info_cb+0x10/0x10 blkdev_report_zones_cached+0x162/0x190 ? __pfx_copy_zone_info_cb+0x10/0x10 btrfs_get_dev_zones+0xdc/0x2e0 btrfs_get_dev_zone_info+0x219/0xe80 btrfs_get_dev_zone_info_all_devices+0x62/0x90 open_ctree+0x1200/0x23db btrfs_get_tree.cold+0x105/0x26c ? rcu_is_watching+0x18/0x50 vfs_get_tree+0x28/0xb0 __do_sys_fsconfig+0x324/0x680 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f615e27a40e RSP: 002b:00007fff11b18fb8 EFLAGS: 00000246 ORIG_RAX: 00000000000001af RAX: ffffffffffffffda RBX: 000055572e92ab10 RCX: 00007f615e27a40e RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 RBP: 00007fff11b19100 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000055572e92bc40 R14: 00007f615e3faa60 R15: 000055572e92bd08 </TASK>
Don't hold the device_list_mutex while calling into btrfs_get_dev_zone_info() in btrfs_get_dev_zone_info_all_devices() to mitigate the issue. This is safe, as no other thread can touch the device list at the moment of execution.
--- fs/btrfs/zoned.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/btrfs/zoned.c +4 -2
@@ -335,7 +335,10 @@ int btrfs_get_dev_zone_info_all_devices(struct btrfs_fs_info *fs_info)if (!btrfs_fs_incompat (fs_info,ZONED ))return 0 ; -mutex_lock (&fs_devices->device_list_mutex); +/* +* No need to take the device_list mutex here, we're still in the mount +* path and devices cannot be added to or removed from the list yet. +*/ list_for_each_entry (device, &fs_devices->devices, dev_list) {/* We can skip reading of zone info for missing devices */ if (!device->bdev)
@@ -345,7 +348,6 @@ int btrfs_get_dev_zone_info_all_devices(struct btrfs_fs_info *fs_info)if (ret)break ; } -mutex_unlock (&fs_devices->device_list_mutex);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 7/277 tg3: replace placeholder MAC address with device property
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul SAGE <[email protected]>
[ Upstream commit e4c00ba7274b613e3ab19e27eb009f0ec2e28379 ]
On some systems (e.g. iMac 20,1 with BCM57766), the tg3 driver reads a default placeholder mac address (00:10:18:00:00:00) from the mailbox. The correct value on those systems are stored in the 'local-mac-address' property.
This patch, detect the default value and tries to retrieve the correct address from the device_get_mac_address function instead.
The patch has been tested on two different systems:
- iMac 20,1 (BCM57766) model which use the local-mac-address property
- iMac 13,2 (BCM57766) model which can use the mailbox, NVRAM or MAC control registers
--- drivers/net/ethernet/broadcom/tg3.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/net/ethernet/broadcom/tg3.c +11 -0
@@ -17042,6 +17042,13 @@ static int tg3_get_invariants(struct tg3 *tp, const struct pci_device_id *ent)return err; } +static int tg3_is_default_mac_address (u8 *addr) +{ +static const u8 default_mac_address[ETH_ALEN ] = {0x00 ,0x10 ,0x18 ,0x00 ,0x00 ,0x00 }; + +return ether_addr_equal (default_mac_address, addr); +} +static int tg3_get_device_address (struct tg3 *tp,u8 *addr) {u32 hi, lo, mac_offset;
@@ -17115,6 +17122,10 @@ static int tg3_get_device_address(struct tg3 *tp, u8 *addr)if (!is_valid_ether_addr (addr))return -EINVAL ; + +if (tg3_is_default_mac_address (addr)) +return device_get_mac_address (&tp->pdev->dev, addr); +return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 8/277 objtool: Fix Clang jump table detection
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 4e5019216402ad0b4a84cff457b662d26803f103 ]
With Clang, there can be a conditional forward jump between the load of the jump table address and the indirect branch.
Fixes the following warning:
vmlinux.o: warning: objtool: ___bpf_prog_run+0x1c5: sibling call from callable instruction with modified stack frame
--- tools/objtool/check.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
tools/objtool/check.c +2 -3
@@ -2118,12 +2118,11 @@ static void mark_func_jump_tables(struct objtool_file *file, last = insn;/* -* Store back-pointers for unconditional forward jumps such +* Store back-pointers for forward jumps such * that find_jump_table() can back-track using those and * avoid some potentially confusing code. */ -if (insn->type ==INSN_JUMP_UNCONDITIONAL && insn->jump_dest && - insn->offset > last->offset && +if (insn->jump_dest && insn->jump_dest->offset > insn->offset && !insn->jump_dest->first_jump_src) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 9/277 HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <[email protected]>
[ Upstream commit f7a4c78bfeb320299c1b641500fe7761eadbd101 ]
Presently, if the force feedback initialisation fails when probing the Logitech G920 Driving Force Racing Wheel for Xbox One, an error number will be returned and propagated before the userspace infrastructure (sysfs and /dev/input) has been torn down. If userspace ignores the errors and continues to use its references to these dangling entities, a UAF will promptly follow.
We have 2 options; continue to return the error, but ensure that all of the infrastructure is torn down accordingly or continue to treat this condition as a warning by emitting the message but returning success. It is thought that the original author's intention was to emit the warning but keep the device functional, less the force feedback feature, so let's go with that.
--- drivers/hid/hid-logitech-hidpp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hid/hid-logitech-hidpp.c +3 -1
@@ -4486,10 +4486,12 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)if (!ret) ret =hidpp_ff_init (hidpp, &data); -if (ret) +if (ret) {hid_warn (hidpp->hid_dev,"Unable to initialize force feedback support, errno %d\n" , ret); + ret =0 ; + } }/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 10/277 HID: core: Mitigate potential OOB by removing bogus memset()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <[email protected]>
[ Upstream commit 0a3fe972a7cb1404f693d6f1711f32bc1d244b1c ]
The memset() in hid_report_raw_event() has the good intention of clearing out bogus data by zeroing the area from the end of the incoming data string to the assumed end of the buffer. However, as we have previously seen, doing so can easily result in OOB reads and writes in the subsequent thread of execution.
The current suggestion from one of the HID maintainers is to remove the memset() and simply return if the incoming event buffer size is not large enough to fill the associated report.
Suggested-by Benjamin Tissoires <[email protected]>
--- drivers/hid/hid-core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/hid/hid-core.c +4 -3
@@ -2057,9 +2057,10 @@ int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 * rsize = max_buffer_size;if (csize < rsize) { -dbg_hid ("report %d is too short, (%d < %d)\n" , report->id, - csize, rsize); -memset (cdata + csize,0 , rsize - csize); +hid_warn_ratelimited (hid,"Event data for report %d was too short (%d vs %d)\n" , + report->id, rsize, csize); + ret = -EINVAL ; + goto out; }if ((hid->claimed &HID_CLAIMED_HIDDEV ) && hid->hiddev_report_event)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 11/277 HID: multitouch: Check to ensure report responses match the request
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <[email protected]>
[ Upstream commit e716edafedad4952fe3a4a273d2e039a84e8681a ]
It is possible for a malicious (or clumsy) device to respond to a specific report's feature request using a completely different report ID. This can cause confusion in the HID core resulting in nasty side-effects such as OOB writes.
Add a check to ensure that the report ID in the response, matches the one that was requested. If it doesn't, omit reporting the raw event and return early.
--- drivers/hid/hid-multitouch.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/hid/hid-multitouch.c +7 -0
@@ -524,12 +524,19 @@ static void mt_get_feature(struct hid_device *hdev, struct hid_report *report)dev_warn (&hdev->dev,"failed to fetch feature %d\n" , report->id); }else { +/* The report ID in the request and the response should match */ +if (report->id != buf[0 ]) { +hid_err (hdev,"Returned feature report did not match the request\n" ); + goto free; + } + ret =hid_report_raw_event (hdev,HID_FEATURE_REPORT , buf, size,0 );if (ret)dev_warn (&hdev->dev,"failed to report feature\n" ); } +free:kfree (buf); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 12/277 btrfs: reserve enough transaction items for qgroup ioctls
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit f9a4e3015db1aeafbef407650eb8555445ca943e ]
Currently our qgroup ioctls don't reserve any space, they just do a transaction join, which does not reserve any space, neither for the quota tree updates nor for the delayed refs generated when updating the quota tree. The quota root uses the global block reserve, which is fine most of the time since we don't expect a lot of updates to the quota root, or to be too close to -ENOSPC such that other critical metadata updates need to resort to the global reserve.
However this is not optimal, as not reserving proper space may result in a transaction abort due to not reserving space for delayed refs and then abusing the use of the global block reserve.
For example, the following reproducer (which is unlikely to model any real world use case, but just to illustrate the problem), triggers such a transaction abort due to -ENOSPC when running delayed refs:
$ cat test.sh #!/bin/bash
DEV=/dev/nullb0
MNT=/mnt/nullb0
umount $DEV &> /dev/null
# Limit device to 1G so that it's much faster to reproduce the issue. mkfs.btrfs -f -b 1G $DEV
mount -o commit=600 $DEV $MNT
fallocate -l 800M $MNT/filler
btrfs quota enable $MNT
for ((i = 1; i <= 400000; i++)); do
btrfs qgroup create 1/$i $MNT
done
umount $MNT
When running this, we can see in dmesg/syslog that a transaction abort happened:
[436.490] BTRFS error (device nullb0): failed to run delayed ref for logical 30408704 num_bytes 16384 type 176 action 1 ref_mod 1: -28 [436.493] ------------[ cut here ]------------ [436.494] BTRFS: Transaction aborted (error -28) [436.495] WARNING: fs/btrfs/extent-tree.c:2247 at btrfs_run_delayed_refs+0xd9/0x110 [btrfs], CPU#4: umount/2495372 [436.497] Modules linked in: btrfs loop (...) [436.508] CPU: 4 UID: 0 PID: 2495372 Comm: umount Tainted: G W 6.19.0-rc8-btrfs-next-225+ #1 PREEMPT(full) [436.510] Tainted: [W]=WARN [436.511] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [436.513] RIP: 0010:btrfs_run_delayed_refs+0xdf/0x110 [btrfs] [436.514] Code: 0f 82 ea (...) [436.518] RSP: 0018:ffffd511850b7d78 EFLAGS: 00010292 [436.519] RAX: 00000000ffffffe4 RBX: ffff8f120dad37e0 RCX: 0000000002040001 [436.520] RDX: 0000000000000002 RSI: 00000000ffffffe4 RDI: ffffffffc090fd80 [436.522] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffffffc04d1867 [436.523] R10: ffff8f18dc1fffa8 R11: 0000000000000003 R12: ffff8f173aa89400 [436.524] R13: 0000000000000000 R14: ffff8f173aa89400 R15: 0000000000000000 [436.526] FS: 00007fe59045d840(0000) GS:ffff8f192e22e000(0000) knlGS:0000000000000000 [436.527] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [436.528] CR2: 00007fe5905ff2b0 CR3: 000000060710a002 CR4: 0000000000370ef0 [436.530] Call Trace: [436.530] <TASK> [436.530] btrfs_commit_transaction+0x73/0xc00 [btrfs] [436.531] ? btrfs_attach_transaction_barrier+0x1e/0x70 [btrfs] [436.532] sync_filesystem+0x7a/0x90 [436.533] generic_shutdown_super+0x28/0x180 [436.533] kill_anon_super+0x12/0x40 [436.534] btrfs_kill_super+0x12/0x20 [btrfs] [436.534] deactivate_locked_super+0x2f/0xb0 [436.534] cleanup_mnt+0xea/0x180 [436.535] task_work_run+0x58/0xa0 [436.535] exit_to_user_mode_loop+0xed/0x480 [436.536] ? __x64_sys_umount+0x68/0x80 [436.536] do_syscall_64+0x2a5/0xf20 [436.537] entry_SYSCALL_64_after_hwframe+0x76/0x7e [436.537] RIP: 0033:0x7fe5906b6217 [436.538] Code: 0d 00 f7 (...) [436.540] RSP: 002b:00007ffcd87a61f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [436.541] RAX: 0000000000000000 RBX: 00005618b9ecadc8 RCX: 00007fe5906b6217 [436.541] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00005618b9ecb100 [436.542] RBP: 0000000000000000 R08: 00007ffcd87a4fe0 R09: 00000000ffffffff [436.544] R10: 0000000000000103 R11: 0000000000000246 R12: 00007fe59081626c [436.544] R13: 00005618b9ecb100 R14: 0000000000000000 R15: 00005618b9ecacc0 [436.545] </TASK> [436.545] ---[ end trace 0000000000000000 ]---
Fix this by changing the qgroup ioctls to use start transaction instead of joining so that proper space is reserved for the delayed refs generated for the updates to the quota root. This way we don't get any transaction abort.
--- fs/btrfs/ioctl.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
fs/btrfs/ioctl.c +9 -3
@@ -3749,7 +3749,8 @@ static long btrfs_ioctl_qgroup_assign(struct file *file, void __user *arg) } } - trans =btrfs_join_transaction (root); +/* 2 BTRFS_QGROUP_RELATION_KEY items. */ + trans =btrfs_start_transaction (root,2 );if (IS_ERR (trans)) { ret =PTR_ERR (trans); goto out;
@@ -3821,7 +3822,11 @@ static long btrfs_ioctl_qgroup_create(struct file *file, void __user *arg) goto out; } - trans =btrfs_join_transaction (root); +/* +* 1 BTRFS_QGROUP_INFO_KEY item. +* 1 BTRFS_QGROUP_LIMIT_KEY item. +*/ + trans =btrfs_start_transaction (root,2 );if (IS_ERR (trans)) { ret =PTR_ERR (trans); goto out;
@@ -3870,7 +3875,8 @@ static long btrfs_ioctl_qgroup_limit(struct file *file, void __user *arg) goto drop_write; } - trans =btrfs_join_transaction (root); +/* 1 BTRFS_QGROUP_LIMIT_KEY item. */ + trans =btrfs_start_transaction (root,1 );if (IS_ERR (trans)) { ret =PTR_ERR (trans); goto out;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 13/277 i2c: tegra: Dont mark devices with pins as IRQ safe
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <[email protected]>
[ Upstream commit ec69c9e88315c4be70c283f18c2ff130da6320b5 ]
I2C devices with associated pinctrl states (DPAUX I2C controllers) will change pinctrl state during runtime PM. This requires taking a mutex, so these devices cannot be marked as IRQ safe.
Add PINCTRL as dependency to avoid build errors.
--- drivers/i2c/busses/Kconfig | 2 ++ drivers/i2c/busses/i2c-tegra.c | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-)
drivers/i2c/busses/Kconfig +2 -0
@@ -1218,6 +1218,8 @@ config I2C_TEGRA tristate "NVIDIA Tegra internal I2C controller" depends on ARCH_TEGRA || (COMPILE_TEST && (ARC || ARM || ARM64 || M68K || RISCV || SUPERH || SPARC)) # COMPILE_TEST needs architectures with readsX()/writesX() primitives + depends on PINCTRL + # ARCH_TEGRA implies PINCTRL, but the COMPILE_TEST side doesn't. help If you say yes to this option, support will be included for the I2C controller embedded in NVIDIA Tegra SOCs
drivers/i2c/busses/i2c-tegra.c +4 -1
@@ -1837,8 +1837,11 @@ static int tegra_i2c_probe(struct platform_device *pdev)* * VI I2C device shouldn't be marked as IRQ-safe because VI I2C won't * be used for atomic transfers. ACPI device is not IRQ safe also. +* +* Devices with pinctrl states cannot be marked IRQ-safe as the pinctrl +* state transitions during runtime PM require mutexes. */ -if (!IS_VI (i2c_dev) && !has_acpi_companion (i2c_dev->dev)) +if (!IS_VI (i2c_dev) && !has_acpi_companion (i2c_dev->dev) && !i2c_dev->dev->pins)pm_runtime_irq_safe (i2c_dev->dev);pm_runtime_enable (i2c_dev->dev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 14/277 btrfs: reject root items with drop_progress and zero drop_level
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhengYuan Huang <[email protected]>
[ Upstream commit b17b79ff896305fd74980a5f72afec370ee88ca4 ]
[BUG]
When recovering relocation at mount time, merge_reloc_root() and btrfs_drop_snapshot() both use BUG_ON(level == 0) to guard against an impossible state: a non-zero drop_progress combined with a zero drop_level in a root_item, which can be triggered:
------------[ cut here ]------------ kernel BUG at fs/btrfs/relocation.c:1545! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 1 UID: 0 PID: 283 ... Tainted: 6.18.0+ #16 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Ubuntu 24.04 PC v2, BIOS 1.16.3-debian-1.16.3-2 RIP: 0010:merge_reloc_root+0x1266/0x1650 fs/btrfs/relocation.c:1545 Code: ffff0000 00004589 d7e9acfa ffffe8a1 79bafebe 02000000 Call Trace: merge_reloc_roots+0x295/0x890 fs/btrfs/relocation.c:1861 btrfs_recover_relocation+0xd6e/0x11d0 fs/btrfs/relocation.c:4195 btrfs_start_pre_rw_mount+0xa4d/0x1810 fs/btrfs/disk-io.c:3130 open_ctree+0x5824/0x5fe0 fs/btrfs/disk-io.c:3640 btrfs_fill_super fs/btrfs/super.c:987 [inline] btrfs_get_tree_super fs/btrfs/super.c:1951 [inline] btrfs_get_tree_subvol fs/btrfs/super.c:2094 [inline] btrfs_get_tree+0x111c/0x2190 fs/btrfs/super.c:2128 vfs_get_tree+0x9a/0x370 fs/super.c:1758 fc_mount fs/namespace.c:1199 [inline] do_new_mount_fc fs/namespace.c:3642 [inline] do_new_mount fs/namespace.c:3718 [inline] path_mount+0x5b8/0x1ea0 fs/namespace.c:4028 do_mount fs/namespace.c:4041 [inline] __do_sys_mount fs/namespace.c:4229 [inline] __se_sys_mount fs/namespace.c:4206 [inline] __x64_sys_mount+0x282/0x320 fs/namespace.c:4206 ... RIP: 0033:0x7f969c9a8fde Code: 0f1f4000 48c7c2b0 fffffff7 d8648902 b8ffffff ffc3660f ---[ end trace 0000000000000000 ]---
The bug is reproducible on 7.0.0-rc2-next-20260310 with our dynamic metadata fuzzing tool that corrupts btrfs metadata at runtime.
[CAUSE]
A non-zero drop_progress.objectid means an interrupted btrfs_drop_snapshot() left a resume point on disk, and in that case drop_level must be greater than 0 because the checkpoint is only saved at internal node levels.
Although this invariant is enforced when the kernel writes the root item, it is not validated when the root item is read back from disk. That allows on-disk corruption to provide an invalid state with drop_progress.objectid != 0 and drop_level == 0.
When relocation recovery later processes such a root item, merge_reloc_root() reads drop_level and hits BUG_ON(level == 0). The same invalid metadata can also trigger the corresponding BUG_ON() in btrfs_drop_snapshot().
[FIX]
Fix this by validating the root_item invariant in tree-checker when reading root items from disk: if drop_progress.objectid is non-zero, drop_level must also be non-zero. Reject such malformed metadata with -EUCLEAN before it reaches merge_reloc_root() or btrfs_drop_snapshot() and triggers the BUG_ON.
After the fix, the same corruption is correctly rejected by tree-checker and the BUG_ON is no longer triggered.
--- fs/btrfs/tree-checker.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
fs/btrfs/tree-checker.c +17 -0
@@ -1260,6 +1260,23 @@ static int check_root_item(struct extent_buffer *leaf, struct btrfs_key *key, btrfs_root_drop_level(&ri), BTRFS_MAX_LEVEL - 1);return -EUCLEAN ; } +/* +* If drop_progress.objectid is non-zero, a btrfs_drop_snapshot() was +* interrupted and the resume point was recorded in drop_progress and +* drop_level. In that case drop_level must be >= 1: level 0 is the +* leaf level and drop_snapshot never saves a checkpoint there (it +* only records checkpoints at internal node levels in DROP_REFERENCE +* stage). A zero drop_level combined with a non-zero drop_progress +* objectid indicates on-disk corruption and would cause a BUG_ON in +* merge_reloc_root() and btrfs_drop_snapshot() at mount time. +*/ +if (unlikely (btrfs_disk_key_objectid (&ri.drop_progress) !=0 && +btrfs_root_drop_level (&ri) ==0 )) { +generic_err (leaf, slot, +"invalid root drop_level 0 with non-zero drop_progress objectid %llu" , +btrfs_disk_key_objectid (&ri.drop_progress)); +return -EUCLEAN ; + }/* Flags check */ if (unlikely (btrfs_root_flags (&ri) & ~valid_root_flags)) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 15/277 smb: client: fix generic/694 due to wrong ->i_blocks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit 23b5df09c27aec13962b30d32a4167ebdd043f8e ]
When updating ->i_size, make sure to always update ->i_blocks as well until we query new allocation size from the server.
generic/694 was failing because smb3_simple_falloc() was missing the update of ->i_blocks after calling cifs_setsize(). So, fix this by updating ->i_blocks directly in cifs_setsize(), so all places that call it doesn't need to worry about updating ->i_blocks later.
--- fs/smb/client/cifsglob.h | 6 ++++++ fs/smb/client/file.c | 1 - fs/smb/client/inode.c | 21 ++++++--------------- fs/smb/client/smb2ops.c | 20 ++++---------------- 4 files changed, 16 insertions(+), 32 deletions(-)
fs/smb/client/cifsglob.h +6 -0
@@ -2407,4 +2407,10 @@ static inline int cifs_open_create_options(unsigned int oflags, int opts) return opts; } +/* +* The number of blocks is not related to (i_size / i_blksize), but instead +* 512 byte (2**9) size is required for calculating num blocks. +*/ +#define CIFS_INO_BLOCKS (size) DIV_ROUND_UP_ULL((u64)(size), 512) +#endif /* _CIFS_GLOB_H */
fs/smb/client/file.c +0 -1
@@ -993,7 +993,6 @@ static int cifs_do_truncate(const unsigned int xid, struct dentry *dentry)if (!rc) {netfs_resize_file (&cinode->netfs,0 , true);cifs_setsize (inode,0 ); - inode->i_blocks =0 ; } }if (cfile)
fs/smb/client/inode.c +6 -15
@@ -218,13 +218,7 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr,*/ if (is_size_safe_to_change (cifs_i, fattr->cf_eof, from_readdir)) {i_size_write (inode, fattr->cf_eof); - -/* -* i_blocks is not related to (i_size / i_blksize), -* but instead 512 byte (2**9) size is required for -* calculating num blocks. -*/ - inode->i_blocks = (512 -1 + fattr->cf_bytes) >>9 ; + inode->i_blocks =CIFS_INO_BLOCKS (fattr->cf_bytes); }if (S_ISLNK (fattr->cf_mode) && fattr->cf_symlink_target) {
@@ -3008,6 +3002,11 @@ void cifs_setsize(struct inode *inode, loff_t offset) {spin_lock (&inode->i_lock);i_size_write (inode, offset); +/* +* Until we can query the server for actual allocation size, +* this is best estimate we have for blocks allocated for a file. +*/ + inode->i_blocks =CIFS_INO_BLOCKS (offset);spin_unlock (&inode->i_lock);inode_set_mtime_to_ts (inode,inode_set_ctime_current (inode));truncate_pagecache (inode, offset);
@@ -3080,14 +3079,6 @@ int cifs_file_set_size(const unsigned int xid, struct dentry *dentry,if (rc ==0 ) {netfs_resize_file (&cifsInode->netfs, size, true);cifs_setsize (inode, size); -/* -* i_blocks is not related to (i_size / i_blksize), but instead -* 512 byte (2**9) size is required for calculating num blocks. -* Until we can query the server for actual allocation size, -* this is best estimate we have for blocks allocated for a file -* Number of blocks must be rounded up so size 1 is not 0 blocks -*/ - inode->i_blocks = (512 -1 + size) >>9 ; }return rc;
fs/smb/client/smb2ops.c +4 -16
@@ -1492,6 +1492,7 @@ smb2_close_getattr(const unsigned int xid, struct cifs_tcon *tcon, {struct smb2_file_network_open_info file_inf;struct inode *inode; +u64 asize;int rc; rc = __SMB2_close(xid, tcon, cfile->fid.persistent_fid,
@@ -1515,14 +1516,9 @@ smb2_close_getattr(const unsigned int xid, struct cifs_tcon *tcon,inode_set_atime_to_ts (inode,cifs_NTtimeToUnix (file_inf.LastAccessTime)); -/* -* i_blocks is not related to (i_size / i_blksize), -* but instead 512 byte (2**9) size is required for -* calculating num blocks. -*/ -if (le64_to_cpu (file_inf.AllocationSize) >4096 ) - inode->i_blocks = - (512 -1 +le64_to_cpu (file_inf.AllocationSize)) >>9 ; + asize =le64_to_cpu (file_inf.AllocationSize); +if (asize >4096 ) + inode->i_blocks =CIFS_INO_BLOCKS (asize);/* End of file and Attributes should not have to be updated on close */ spin_unlock (&inode->i_lock);
@@ -2183,14 +2179,6 @@ smb2_duplicate_extents(const unsigned int xid, rc =smb2_set_file_size (xid, tcon, trgtfile, dest_off + len, false);if (rc) goto duplicate_extents_out; - -/* -* Although also could set plausible allocation size (i_blocks) -* here in addition to setting the file size, in reflink -* it is likely that the target file is sparse. Its allocation -* size will be queried on next revalidate, but it is important -* to make sure that file's cached size is updated immediately -*/ netfs_resize_file (netfs_inode (inode), dest_off + len, true);cifs_setsize (inode, dest_off + len); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 16/277 spi: geni-qcom: Check DMA interrupts early in ISR
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Praveen Talari <[email protected]>
[ Upstream commit 8c89a077ca796a2fe248c584e9d7e66cff0388c8 ]
The current interrupt handler only checks the GENI main IRQ status (m_irq) before deciding to return IRQ_NONE. This can lead to spurious IRQ_NONE returns when DMA interrupts are pending but m_irq is zero.
Move the DMA TX/RX status register reads to the beginning of the ISR, right after reading m_irq. Update the early return condition to check all three status registers (m_irq, dma_tx_status, dma_rx_status) before returning IRQ_NONE.
--- drivers/spi/spi-geni-qcom.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/spi/spi-geni-qcom.c +5 -4
@@ -958,10 +958,13 @@ static irqreturn_t geni_spi_isr(int irq, void *data)struct spi_controller *spi = data;struct spi_geni_master *mas =spi_controller_get_devdata (spi);struct geni_se *se = &mas->se; -u32 m_irq; +u32 m_irq, dma_tx_status, dma_rx_status; m_irq =readl (se->base +SE_GENI_M_IRQ_STATUS ); -if (!m_irq) + dma_tx_status =readl_relaxed (se->base +SE_DMA_TX_IRQ_STAT ); + dma_rx_status =readl_relaxed (se->base +SE_DMA_RX_IRQ_STAT ); + +if (!m_irq && !dma_tx_status && !dma_rx_status)return IRQ_NONE ; if (m_irq & (M_CMD_OVERRUN_EN | M_ILLEGAL_CMD_EN | M_CMD_FAILURE_EN |
@@ -1009,8 +1012,6 @@ static irqreturn_t geni_spi_isr(int irq, void *data) } }else if (mas->cur_xfer_mode ==GENI_SE_DMA ) {const struct spi_transfer *xfer = mas->cur_xfer; -u32 dma_tx_status =readl_relaxed (se->base +SE_DMA_TX_IRQ_STAT ); -u32 dma_rx_status =readl_relaxed (se->base +SE_DMA_RX_IRQ_STAT );if (dma_tx_status)writel (dma_tx_status, se->base +SE_DMA_TX_IRQ_CLR );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 17/277 dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
[ Upstream commit 398c0c8bbc8f5a9d2f43863275a427a9d3720b6f ]
Change additionalProperties to unevaluatedProperties because it refs to /schemas/input/matrix-keymap.yaml.
Fix below CHECK_DTBS warnings:arch/arm/boot/dts/nxp/imx/imx6dl-victgo.dtb: keypad@70 (holtek,ht16k33): 'keypad,num-columns', 'keypad,num-rows' do not match any of the regexes: '^pinctrl-[0-9]+$'
from schema $id: http://devicetree.org/schemas/auxdisplay/holtek,ht16k33.yaml#
--- .../devicetree/bindings/auxdisplay/holtek,ht16k33.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/auxdisplay/holtek,ht16k33.yaml +1 -1
@@ -66,7 +66,7 @@ then: required: - refresh-rate-hz -additionalProperties: false +unevaluatedProperties: false examples: - |
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 18/277 wifi: iwlwifi: fix remaining kernel-doc warnings
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 58a4ebe3168813a04bef08f7858a63b199e866e1 ]
Fix the remaining kernel-doc warnings across the driver.
Stable-dep-of: ec66ec6a5a8f ("wifi: iwlwifi: mld: Fix MLO scan timing")
--- drivers/net/wireless/intel/iwlwifi/fw/acpi.h | 1 + .../wireless/intel/iwlwifi/fw/api/cmdhdr.h | 4 +- .../net/wireless/intel/iwlwifi/fw/api/coex.h | 4 +- .../wireless/intel/iwlwifi/fw/api/dbg-tlv.h | 14 ++-- .../net/wireless/intel/iwlwifi/fw/api/debug.h | 2 +- .../wireless/intel/iwlwifi/fw/api/location.h | 8 +- .../net/wireless/intel/iwlwifi/fw/api/power.h | 5 +- .../net/wireless/intel/iwlwifi/fw/api/scan.h | 78 ++++++++++--------- .../net/wireless/intel/iwlwifi/fw/api/sta.h | 6 +- .../net/wireless/intel/iwlwifi/fw/api/stats.h | 39 +++++----- .../net/wireless/intel/iwlwifi/fw/api/tx.h | 2 +- .../wireless/intel/iwlwifi/fw/error-dump.h | 4 +- drivers/net/wireless/intel/iwlwifi/fw/file.h | 74 +++++++++++++----- drivers/net/wireless/intel/iwlwifi/fw/img.h | 12 ++- .../net/wireless/intel/iwlwifi/fw/runtime.h | 22 +++++- .../net/wireless/intel/iwlwifi/iwl-config.h | 2 +- .../net/wireless/intel/iwlwifi/iwl-dbg-tlv.h | 4 +- drivers/net/wireless/intel/iwlwifi/iwl-drv.h | 3 +- .../wireless/intel/iwlwifi/iwl-modparams.h | 4 +- .../wireless/intel/iwlwifi/iwl-nvm-parse.h | 17 ++-- .../net/wireless/intel/iwlwifi/iwl-op-mode.h | 1 + .../net/wireless/intel/iwlwifi/iwl-trans.h | 6 +- 22 files changed, 194 insertions(+), 118 deletions(-)
drivers/net/wireless/intel/iwlwifi/fw/acpi.h +1 -0
@@ -151,6 +151,7 @@ union acpi_object *iwl_acpi_get_dsm_object(struct device *dev, int rev,* @mcc: output buffer (3 bytes) that will get the MCC * * This function tries to read the current MCC from ACPI if available. +* Return: 0 on success, or a negative error code */ int iwl_acpi_get_mcc (struct iwl_fw_runtime *fwrt,char *mcc);
drivers/net/wireless/intel/iwlwifi/fw/api/cmdhdr.h +2 -2
@@ -1,6 +1,6 @@/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */ /* -* Copyright (C) 2005-2014 Intel Corporation +* Copyright (C) 2005-2014, 2025 Intel Corporation * Copyright (C) 2013-2015 Intel Mobile Communications GmbH * Copyright (C) 2016-2017 Intel Deutschland GmbH */
@@ -98,7 +98,7 @@ struct iwl_cmd_header { } __packed;/** -* struct iwl_cmd_header_wide +* struct iwl_cmd_header_wide - wide command header * * This header format appears in the beginning of each command sent from the * driver, and each response/notification received from uCode.
drivers/net/wireless/intel/iwlwifi/fw/api/coex.h +2 -2
@@ -1,6 +1,6 @@/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */ /* -* Copyright (C) 2023-2024 Intel Corporation +* Copyright (C) 2023-2025 Intel Corporation * Copyright (C) 2013-2014, 2018-2019 Intel Corporation * Copyright (C) 2013-2014 Intel Mobile Communications GmbH * Copyright (C) 2017 Intel Deutschland GmbH
@@ -52,7 +52,7 @@ struct iwl_bt_coex_cmd { } __packed;/* BT_COEX_CMD_API_S_VER_6 */ /** -* struct iwl_bt_coex_reduced_txp_update_cmd +* struct iwl_bt_coex_reduced_txp_update_cmd - reduced TX power command * @reduced_txp: bit BT_REDUCED_TX_POWER_BIT to enable / disable, rest of the * bits are the sta_id (value) */
drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h +7 -7
@@ -16,7 +16,7 @@#define IWL_FW_INI_PRESET_DISABLE 0xff/** -* struct iwl_fw_ini_hcmd +* struct iwl_fw_ini_hcmd - debug configuration host command * * @id: the debug configuration command type for instance: 0xf6 / 0xf5 / DHC * @group: the desired cmd group
@@ -199,7 +199,7 @@ struct iwl_fw_ini_region_tlv { } __packed;/* FW_TLV_DEBUG_REGION_API_S_VER_1 */ /** -* struct iwl_fw_ini_debug_info_tlv +* struct iwl_fw_ini_debug_info_tlv - debug info TLV * * debug configuration name for a specific image *
@@ -311,7 +311,7 @@ struct iwl_fw_ini_conf_set_tlv { } __packed;/* FW_TLV_DEBUG_CONFIG_SET_API_S_VER_1 */ /** -* enum iwl_fw_ini_config_set_type +* enum iwl_fw_ini_config_set_type - configuration set type * * @IWL_FW_INI_CONFIG_SET_TYPE_INVALID: invalid config set * @IWL_FW_INI_CONFIG_SET_TYPE_DEVICE_PERIPHERY_MAC: for PERIPHERY MAC configuration
@@ -337,7 +337,7 @@ enum iwl_fw_ini_config_set_type { } __packed;/** -* enum iwl_fw_ini_allocation_id +* enum iwl_fw_ini_allocation_id - allocation ID * * @IWL_FW_INI_ALLOCATION_INVALID: invalid * @IWL_FW_INI_ALLOCATION_ID_DBGC1: allocation meant for DBGC1 configuration
@@ -356,7 +356,7 @@ enum iwl_fw_ini_allocation_id { };/* FW_DEBUG_TLV_ALLOCATION_ID_E_VER_1 */ /** -* enum iwl_fw_ini_buffer_location +* enum iwl_fw_ini_buffer_location - buffer location * * @IWL_FW_INI_LOCATION_INVALID: invalid * @IWL_FW_INI_LOCATION_SRAM_PATH: SRAM location
@@ -373,7 +373,7 @@ enum iwl_fw_ini_buffer_location { };/* FW_DEBUG_TLV_BUFFER_LOCATION_E_VER_1 */ /** -* enum iwl_fw_ini_region_type +* enum iwl_fw_ini_region_type - region type * * @IWL_FW_INI_REGION_INVALID: invalid * @IWL_FW_INI_REGION_TLV: uCode and debug TLVs
@@ -437,7 +437,7 @@ enum iwl_fw_ini_region_device_memory_subtype { };/* FW_TLV_DEBUG_REGION_DEVICE_MEMORY_SUBTYPE_API_E */ /** -* enum iwl_fw_ini_time_point +* enum iwl_fw_ini_time_point - time point type * * Hard coded time points in which the driver can send hcmd or perform dump * collection
drivers/net/wireless/intel/iwlwifi/fw/api/debug.h +1 -1
@@ -421,7 +421,7 @@ struct iwl_dbgc1_info { } __packed;/* INIT_DRAM_FRAGS_ALLOCATIONS_S_VER_1 */ /** -* struct iwl_dbg_host_event_cfg_cmd +* struct iwl_dbg_host_event_cfg_cmd - host event config command * @enabled_severities: enabled severities */ struct iwl_dbg_host_event_cfg_cmd {
drivers/net/wireless/intel/iwlwifi/fw/api/location.h +4 -4
@@ -1092,7 +1092,7 @@ struct iwl_tof_range_req_ap_entry { } __packed;/* LOCATION_RANGE_REQ_AP_ENTRY_CMD_API_S_VER_9 */ /** -* enum iwl_tof_response_mode +* enum iwl_tof_response_mode - TOF response mode * @IWL_MVM_TOF_RESPONSE_ASAP: report each AP measurement separately as soon as * possible (not supported for this release) * @IWL_MVM_TOF_RESPONSE_TIMEOUT: report all AP measurements as a batch upon
@@ -1108,7 +1108,7 @@ enum iwl_tof_response_mode { };/** -* enum iwl_tof_initiator_flags +* enum iwl_tof_initiator_flags - TOF initiator flags * * @IWL_TOF_INITIATOR_FLAGS_FAST_ALGO_DISABLED: disable fast algo, meaning run * the algo on ant A+B, instead of only one of them.
@@ -1409,7 +1409,7 @@ enum iwl_tof_range_request_status { };/** -* enum iwl_tof_entry_status +* enum iwl_tof_entry_status - TOF entry status * * @IWL_TOF_ENTRY_SUCCESS: successful measurement. * @IWL_TOF_ENTRY_GENERAL_FAILURE: General failure.
@@ -1856,7 +1856,7 @@ struct iwl_tof_mcsi_notif { } __packed;/** -* struct iwl_tof_range_abort_cmd +* struct iwl_tof_range_abort_cmd - TOF range abort command * @request_id: corresponds to a range request * @reserved: reserved */
drivers/net/wireless/intel/iwlwifi/fw/api/power.h +3 -2
@@ -620,7 +620,7 @@ struct iwl_sar_offset_mapping_cmd { } __packed;/*SAR_OFFSET_MAPPING_TABLE_CMD_API_S*/ /** -* struct iwl_beacon_filter_cmd +* struct iwl_beacon_filter_cmd - beacon filter command * REPLY_BEACON_FILTERING_CMD = 0xd2 (command) * @bf_energy_delta: Used for RSSI filtering, if in 'normal' state. Send beacon * to driver if delta in Energy values calculated for this and last
@@ -762,7 +762,7 @@ enum iwl_6ghz_ap_type { };/* PHY_AP_TYPE_API_E_VER_1 */ /** -* struct iwl_txpower_constraints_cmd +* struct iwl_txpower_constraints_cmd - TX power constraints command * AP_TX_POWER_CONSTRAINTS_CMD * Used for VLP/LPI/AFC Access Point power constraints for 6GHz channels * @link_id: linkId
@@ -786,4 +786,5 @@ struct iwl_txpower_constraints_cmd {__s8 psd_pwr[IWL_MAX_TX_EIRP_PSD_PWR_MAX_SIZE ]; u8 reserved[3]; } __packed;/* PHY_AP_TX_POWER_CONSTRAINTS_CMD_API_S_VER_1 */ +#endif /* __iwl_fw_api_power_h__ */
drivers/net/wireless/intel/iwlwifi/fw/api/scan.h +41 -37
199 lines not on this page · raw message
drivers/net/wireless/intel/iwlwifi/fw/api/sta.h +3 -3
@@ -1,6 +1,6 @@/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */ /* -* Copyright (C) 2012-2014, 2018-2021, 2023 Intel Corporation +* Copyright (C) 2012-2014, 2018-2021, 2023, 2025 Intel Corporation * Copyright (C) 2013-2014 Intel Mobile Communications GmbH * Copyright (C) 2016-2017 Intel Deutschland GmbH */
@@ -428,7 +428,7 @@ struct iwl_mvm_rm_sta_cmd { } __packed;/* REMOVE_STA_CMD_API_S_VER_2 */ /** -* struct iwl_mvm_mgmt_mcast_key_cmd_v1 +* struct iwl_mvm_mgmt_mcast_key_cmd_v1 - IGTK command * ( MGMT_MCAST_KEY = 0x1f ) * @ctrl_flags: &enum iwl_sta_key_flag * @igtk: IGTK key material
@@ -449,7 +449,7 @@ struct iwl_mvm_mgmt_mcast_key_cmd_v1 { } __packed;/* SEC_MGMT_MULTICAST_KEY_CMD_API_S_VER_1 */ /** -* struct iwl_mvm_mgmt_mcast_key_cmd +* struct iwl_mvm_mgmt_mcast_key_cmd - IGTK command * ( MGMT_MCAST_KEY = 0x1f ) * @ctrl_flags: &enum iwl_sta_key_flag * @igtk: IGTK master key
drivers/net/wireless/intel/iwlwifi/fw/api/stats.h +20 -19
@@ -26,7 +26,7 @@ struct mvm_statistics_div { } __packed;/* STATISTICS_SLOW_DIV_API_S_VER_2 */ /** -* struct mvm_statistics_rx_non_phy +* struct mvm_statistics_rx_non_phy - non-PHY RX statistics * @bogus_cts: CTS received when not expecting CTS * @bogus_ack: ACK received when not expecting ACK * @non_channel_beacons: beacons with our bss id but not on our serving channel
@@ -456,7 +456,7 @@ struct iwl_system_statistics_cmd { } __packed;/* STATISTICS_FW_CMD_API_S_VER_1 */ /** -* enum iwl_fw_statistics_type +* enum iwl_fw_statistics_type - statistics type * * @FW_STATISTICS_OPERATIONAL: operational statistics * @FW_STATISTICS_PHY: phy statistics
@@ -478,7 +478,7 @@ enum iwl_fw_statistics_type {#define IWL_STATISTICS_TYPE_MSK 0x7f/** -* struct iwl_statistics_ntfy_hdr +* struct iwl_statistics_ntfy_hdr - statistics notification header * * @type: struct type * @version: version of the struct
@@ -491,7 +491,7 @@ struct iwl_statistics_ntfy_hdr { };/* STATISTICS_NTFY_HDR_API_S_VER_1 */ /** -* struct iwl_stats_ntfy_per_link +* struct iwl_stats_ntfy_per_link - per-link statistics * * @beacon_filter_average_energy: Average energy [-dBm] of the 2 * antennas.
@@ -514,7 +514,7 @@ struct iwl_stats_ntfy_per_link { } __packed;/* STATISTICS_NTFY_PER_LINK_API_S_VER_1 */ /** -* struct iwl_stats_ntfy_part1_per_link +* struct iwl_stats_ntfy_part1_per_link - part1 per link statistics * * @rx_time: rx time * @tx_time: tx time
@@ -533,7 +533,7 @@ struct iwl_stats_ntfy_part1_per_link { } __packed;/* STATISTICS_FW_NTFY_OPERATIONAL_PART1_PER_LINK_API_S_VER_1 */ /** -* struct iwl_stats_ntfy_per_mac +* struct iwl_stats_ntfy_per_mac - per MAC statistics * * @beacon_filter_average_energy: Average energy [-dBm] of the 2 * antennas.
@@ -556,7 +556,8 @@ struct iwl_stats_ntfy_per_mac { } __packed;/* STATISTICS_NTFY_PER_MAC_API_S_VER_1 */ #define IWL_STATS_MAX_BW_INDEX 5 -/** struct iwl_stats_ntfy_per_phy +/** +* struct iwl_stats_ntfy_per_phy - per PHY statistics * @channel_load: channel load * @channel_load_by_us: device contribution to MCLM * @channel_load_not_by_us: other devices' contribution to MCLM
@@ -588,7 +589,7 @@ struct iwl_stats_ntfy_per_phy {#define IWL_STATS_UNKNOWN_CHANNEL_LOAD 0xffffffff/** -* struct iwl_stats_ntfy_per_sta +* struct iwl_stats_ntfy_per_sta - per STA statistics * * @average_energy: in fact it is minus the energy.. */
@@ -600,7 +601,7 @@ struct iwl_stats_ntfy_per_sta {#define IWL_STATS_MAX_FW_LINKS (IWL_FW_MAX_LINK_ID + 1)/** -* struct iwl_system_statistics_notif_oper +* struct iwl_system_statistics_notif_oper - statistics notification * * @time_stamp: time when the notification is sent from firmware * @per_link: per link statistics, &struct iwl_stats_ntfy_per_link
@@ -615,7 +616,7 @@ struct iwl_system_statistics_notif_oper { } __packed;/* STATISTICS_FW_NTFY_OPERATIONAL_API_S_VER_3 */ /** -* struct iwl_system_statistics_part1_notif_oper +* struct iwl_system_statistics_part1_notif_oper - part1 stats notification * * @time_stamp: time when the notification is sent from firmware * @per_link: per link statistics &struct iwl_stats_ntfy_part1_per_link
@@ -628,7 +629,7 @@ struct iwl_system_statistics_part1_notif_oper { } __packed;/* STATISTICS_FW_NTFY_OPERATIONAL_PART1_API_S_VER_4 */ /** -* struct iwl_system_statistics_end_notif +* struct iwl_system_statistics_end_notif - statistics end notification * * @time_stamp: time when the notification is sent from firmware */
@@ -637,7 +638,7 @@ struct iwl_system_statistics_end_notif { } __packed;/* STATISTICS_FW_NTFY_END_API_S_VER_1 */ /** -* struct iwl_statistics_operational_ntfy +* struct iwl_statistics_operational_ntfy - operational stats notification * * @hdr: general statistics header * @flags: bitmap of possible notification structures
@@ -662,7 +663,7 @@ struct iwl_statistics_operational_ntfy { } __packed;/* STATISTICS_OPERATIONAL_NTFY_API_S_VER_15 */ /** -* struct iwl_statistics_operational_ntfy_ver_14 +* struct iwl_statistics_operational_ntfy_ver_14 - operational stats notification * * @hdr: general statistics header * @flags: bitmap of possible notification structures
@@ -707,7 +708,7 @@ struct iwl_statistics_operational_ntfy_ver_14 { } __packed;/* STATISTICS_OPERATIONAL_NTFY_API_S_VER_14 */ /** -* struct iwl_statistics_phy_ntfy +* struct iwl_statistics_phy_ntfy - PHY statistics notification * * @hdr: general statistics header * RX PHY related statistics
@@ -808,7 +809,7 @@ struct iwl_statistics_phy_ntfy { } __packed;/* STATISTICS_PHY_NTFY_API_S_VER_1 */ /** -* struct iwl_statistics_mac_ntfy +* struct iwl_statistics_mac_ntfy - MAC statistics notification * * @hdr: general statistics header * @bcast_filter_passed_per_mac: bcast filter passed per mac
@@ -827,7 +828,7 @@ struct iwl_statistics_mac_ntfy { } __packed;/* STATISTICS_MAC_NTFY_API_S_VER_1 */ /** -* struct iwl_statistics_rx_ntfy +* struct iwl_statistics_rx_ntfy - RX statistics notification * * @hdr: general statistics header * @rx_agg_mpdu_cnt: aggregation frame count (number of
@@ -867,7 +868,7 @@ struct iwl_statistics_rx_ntfy { } __packed;/* STATISTICS_RX_NTFY_API_S_VER_1 */ /** -* struct iwl_statistics_tx_ntfy +* struct iwl_statistics_tx_ntfy - TX statistics notification * * @hdr: general statistics header * @cts_timeout: timeout when waiting for CTS
@@ -976,7 +977,7 @@ struct iwl_statistics_tx_ntfy { } __packed;/* STATISTICS_TX_NTFY_API_S_VER_1 */ /** -* struct iwl_statistics_duration_ntfy +* struct iwl_statistics_duration_ntfy - burst/duration statistics * * @hdr: general statistics header * @cont_burst_chk_cnt: number of times continuation or
@@ -995,7 +996,7 @@ struct iwl_statistics_duration_ntfy { } __packed;/* STATISTICS_DURATION_NTFY_API_S_VER_1 */ /** -* struct iwl_statistics_he_ntfy +* struct iwl_statistics_he_ntfy - HE statistics * * @hdr: general statistics header * received HE frames
drivers/net/wireless/intel/iwlwifi/fw/api/tx.h +1 -1
@@ -963,7 +963,7 @@ struct iwl_scd_txq_cfg_cmd { } __packed;/* SCD_QUEUE_CFG_CMD_API_S_VER_1 */ /** -* struct iwl_scd_txq_cfg_rsp +* struct iwl_scd_txq_cfg_rsp - scheduler TXQ configuration response * @token: taken from the command * @sta_id: station id from the command * @tid: tid from the command
drivers/net/wireless/intel/iwlwifi/fw/error-dump.h +2 -2
@@ -266,7 +266,7 @@ struct iwl_fw_ini_error_dump_data { } __packed;/** -* struct iwl_fw_ini_dump_entry +* struct iwl_fw_ini_dump_entry - dump entry descriptor * @list: list of dump entries * @size: size of the data * @data: entry data
@@ -305,7 +305,7 @@ struct iwl_fw_ini_fifo_hdr {* @dram_base_addr: base address of dram monitor range * @page_num: page number of memory range * @fifo_hdr: fifo header of memory range -* @fw_pkt: FW packet header of memory range +* @fw_pkt_hdr: FW packet header of memory range * @data: the actual memory */ struct iwl_fw_ini_error_dump_range {
drivers/net/wireless/intel/iwlwifi/fw/file.h +55 -19
198 lines not on this page · raw message
drivers/net/wireless/intel/iwlwifi/fw/img.h +8 -4
@@ -14,14 +14,13 @@#include "error-dump.h" /** -* enum iwl_ucode_type -* -* The type of ucode. +* enum iwl_ucode_type - type of ucode * * @IWL_UCODE_REGULAR: Normal runtime ucode * @IWL_UCODE_INIT: Initial ucode * @IWL_UCODE_WOWLAN: Wake on Wireless enabled ucode * @IWL_UCODE_REGULAR_USNIFFER: Normal runtime ucode when using usniffer image +* @IWL_UCODE_TYPE_MAX: (internal value) */ enum iwl_ucode_type {IWL_UCODE_REGULAR ,
@@ -122,7 +121,7 @@ struct fw_img {#define FW_ADDR_CACHE_CONTROL 0xC0000000UL/** -* struct iwl_fw_paging +* struct iwl_fw_paging - FW paging descriptor * @fw_paging_phys: page phy pointer * @fw_paging_block: pointer to the allocated block * @fw_paging_size: page size
@@ -197,6 +196,11 @@ struct iwl_dump_exclude {* @dump_excl_wowlan: image dump exclusion areas for WoWLAN image * @pnvm_data: PNVM data embedded in the .ucode file, if any * @pnvm_size: size of the embedded PNVM data +* @dbg: debug data, see &struct iwl_fw_dbg +* @default_calib: default calibration data +* @phy_config: PHY configuration flags +* @valid_rx_ant: valid RX antenna bitmap +* @valid_tx_ant: valid TX antenna bitmap */ struct iwl_fw {u32 ucode_ver;
drivers/net/wireless/intel/iwlwifi/fw/runtime.h +21 -1
@@ -45,6 +45,8 @@ struct iwl_fwrt_shared_mem_cfg {* struct iwl_fwrt_dump_data - dump data * @trig: trigger the worker was scheduled upon * @fw_pkt: packet received from FW +* @desc: dump descriptor +* @monitor_only: only dump for monitor * * Note that the decision which part of the union is used * is based on iwl_trans_dbg_ini_valid(): the 'trig' part
@@ -68,6 +70,7 @@ struct iwl_fwrt_dump_data {* struct iwl_fwrt_wk_data - dump worker data struct * @idx: index of the worker * @wk: worker +* @dump_data: dump data */ struct iwl_fwrt_wk_data {u8 idx;
@@ -91,8 +94,8 @@ struct iwl_txf_iter_data {/** * struct iwl_fw_runtime - runtime data for firmware +* @trans: transport pointer * @fw: firmware image -* @cfg: NIC configuration * @dev: device pointer * @ops: user ops * @ops_ctx: user ops context
@@ -117,6 +120,23 @@ struct iwl_txf_iter_data {* zero (default initialization) means it hasn't been read yet, * and BIT(0) is set when it has since function 0 also has this * bitmap and is always supported +* @geo_enabled: WGDS table is present +* @geo_num_profiles: number of geo profiles +* @geo_rev: geo profiles table revision +* @ppag_chains: PPAG table data +* @ppag_flags: PPAG flags +* @reduced_power_flags: reduced power flags +* @sanitize_ctx: context for dump sanitizer +* @sanitize_ops: dump sanitizer ops +* @sar_chain_a_profile: SAR chain A profile +* @sar_chain_b_profile: SAR chain B profile +* @sgom_enabled: SGOM enabled +* @sgom_table: SGOM table +* @timestamp: timestamp marker data +* @timestamp.wk: timestamp marking worker +* @timestamp.seq: timestamp marking sequence +* @timestamp.delay: timestamp marking worker delay +* @tpc_enabled: TPC enabled */ struct iwl_fw_runtime {struct iwl_trans *trans;
drivers/net/wireless/intel/iwlwifi/iwl-config.h +1 -1
@@ -385,7 +385,7 @@ struct iwl_mac_cfg {#define IWL_NUM_RBDS_EHT (512 * 8)/** -* struct iwl_rf_cfg +* struct iwl_rf_cfg - RF/CRF configuration data * @fw_name_pre: Firmware filename prefix. The api version and extension * (.ucode) will be added to filename before loading from disk. The * filename is constructed as <fw_name_pre>-<api>.ucode.
drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.h +2 -2
@@ -1,6 +1,6 @@/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */ /* -* Copyright (C) 2018-2023 Intel Corporation +* Copyright (C) 2018-2023, 2025 Intel Corporation */ #ifndef __iwl_dbg_tlv_h__#define __iwl_dbg_tlv_h__
@@ -32,7 +32,7 @@ union iwl_dbg_tlv_tp_data { };/** -* struct iwl_dbg_tlv_time_point_data +* struct iwl_dbg_tlv_time_point_data - debug time point data * @trig_list: list of triggers * @active_trig_list: list of active triggers * @hcmd_list: list of host commands
drivers/net/wireless/intel/iwlwifi/iwl-drv.h +2 -1
@@ -62,7 +62,8 @@ struct iwl_rf_cfg;* starts the driver: fetches the firmware. This should be called by bus * specific system flows implementations. For example, the bus specific probe * function should do bus related operations only, and then call to this -* function. It returns the driver object or %NULL if an error occurred. +* function. +* Return: the driver object or %NULL if an error occurred. */ struct iwl_drv *iwl_drv_start (struct iwl_trans *trans);
drivers/net/wireless/intel/iwlwifi/iwl-modparams.h +2 -2
@@ -1,6 +1,6 @@/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */ /* -* Copyright (C) 2005-2014, 2018-2022, 2024 Intel Corporation +* Copyright (C) 2005-2014, 2018-2022, 2024-2025 Intel Corporation */ #ifndef __iwl_modparams_h__#define __iwl_modparams_h__
@@ -42,7 +42,7 @@ enum iwl_uapsd_disable { };/** -* struct iwl_mod_params +* struct iwl_mod_params - module parameters for iwlwifi * * Holds the module parameters *
drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h +12 -5
@@ -115,11 +115,12 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,* iwl_parse_nvm_mcc_info - parse MCC (mobile country code) info coming from FW * * This function parses the regulatory channel data received as a -* MCC_UPDATE_CMD command. It returns a newly allocation regulatory domain, -* to be fed into the regulatory core. In case the geo_info is set handle -* accordingly. An ERR_PTR is returned on error. -* If not given to the regulatory core, the user is responsible for freeing -* the regdomain returned here with kfree. +* MCC_UPDATE_CMD command. +* +* Return: a newly allocation regulatory domain, to be given to the regulatory +* core. In case the geo_info is set handle accordingly. An ERR_PTR is +* returned on error. If not given to the regulatory core, the user is +* responsible for freeing the regdomain returned here with kfree(). * * @trans: the transport * @num_of_ch: the number of channels
@@ -140,6 +141,8 @@ iwl_parse_nvm_mcc_info(struct iwl_trans *trans,* This struct holds an NVM section read from the NIC using NVM_ACCESS_CMD, * and saved for later use by the driver. Not all NVM sections are saved * this way, only the needed ones. +* @length: length of the section +* @data: section data */ struct iwl_nvm_section {u16 length;
@@ -148,6 +151,10 @@ struct iwl_nvm_section {/** * iwl_read_external_nvm - Reads external NVM from a file into nvm_sections +* @trans: the transport +* @nvm_file_name: the filename to request +* @nvm_sections: sections data to fill +* Return: 0 on success or an error code */ int iwl_read_external_nvm(struct iwl_trans *trans, const char *nvm_file_name,
drivers/net/wireless/intel/iwlwifi/iwl-op-mode.h +1 -0
@@ -185,6 +185,7 @@ void iwl_opmode_deregister(const char *name);/** * struct iwl_op_mode - operational mode * @ops: pointer to its own ops +* @op_mode_specific: per-opmode data * * This holds an implementation of the mac80211 / fw API. */
drivers/net/wireless/intel/iwlwifi/iwl-trans.h +3 -3
@@ -121,7 +121,7 @@ enum CMD_MODE {#define DEF_CMD_PAYLOAD_SIZE 320/** -* struct iwl_device_cmd +* struct iwl_device_cmd - device command structure * * For allocation of the command and tx queues, this establishes the overall * size of the largest command we send to uCode, except for commands that
@@ -516,7 +516,7 @@ enum iwl_trans_state {*/ /** -* enum iwl_ini_cfg_state +* enum iwl_ini_cfg_state - debug config state * @IWL_INI_CFG_STATE_NOT_LOADED: no debug cfg was given * @IWL_INI_CFG_STATE_LOADED: debug cfg was found and loaded * @IWL_INI_CFG_STATE_CORRUPTED: debug cfg was found and some of the TLVs
@@ -532,7 +532,7 @@ enum iwl_ini_cfg_state {#define IWL_TRANS_NMI_TIMEOUT (HZ / 4)/** -* struct iwl_dram_data +* struct iwl_dram_data - DRAM data descriptor * @physical: page phy pointer * @block: pointer to the allocated block/page * @size: size of the block/page
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 19/277 wifi: iwlwifi: mld: Fix MLO scan timing
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pagadala Yesu Anjaneyulu <[email protected]>
[ Upstream commit ec66ec6a5a8f53e7c70085749e8d68f4431c630f ]
Calculate MLO scan start time based on actual scan start notification from firmware instead of recording time when scan command is sent.
Currently, MLO scan start time was captured immediately after sending the scan command to firmware. However, the actual scan start time may differ due to the FW being busy with a previous scan.
In that case, the link selection code will think that the MLO scan is too old, and will warn.
To fix it, Implement start scan notification handling to capture the precise moment when firmware begins the scan operation.
--- .../wireless/intel/iwlwifi/fw/api/commands.h | 5 ++++ .../net/wireless/intel/iwlwifi/fw/api/scan.h | 10 +++++++ drivers/net/wireless/intel/iwlwifi/mld/mld.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/mlo.c | 4 +-- .../net/wireless/intel/iwlwifi/mld/notif.c | 5 ++++ drivers/net/wireless/intel/iwlwifi/mld/scan.c | 30 +++++++++++++++++-- drivers/net/wireless/intel/iwlwifi/mld/scan.h | 9 ++++-- 7 files changed, 56 insertions(+), 8 deletions(-)
drivers/net/wireless/intel/iwlwifi/fw/api/commands.h +5 -0
@@ -296,6 +296,11 @@ enum iwl_legacy_cmds {*/ SCAN_OFFLOAD_UPDATE_PROFILES_CMD =0x6E , +/** +* @SCAN_START_NOTIFICATION_UMAC: uses &struct iwl_umac_scan_start +*/ + SCAN_START_NOTIFICATION_UMAC = 0xb2, +/** * @MATCH_FOUND_NOTIFICATION: scan match found */
drivers/net/wireless/intel/iwlwifi/fw/api/scan.h +10 -0
@@ -1156,6 +1156,16 @@ enum iwl_umac_scan_abort_status { IWL_UMAC_SCAN_ABORT_STATUS_NOT_FOUND, }; +/** +* struct iwl_umac_scan_start - scan start notification +* @uid: scan id, &enum iwl_umac_scan_uid_offsets +* @reserved: for future use +*/ +struct iwl_umac_scan_start { +__le32 uid; +__le32 reserved; +} __packed;/* SCAN_START_UMAC_API_S_VER_1 */ +/** * struct iwl_umac_scan_complete - scan complete notification * @uid: scan id, &enum iwl_umac_scan_uid_offsets
drivers/net/wireless/intel/iwlwifi/mld/mld.c +1 -0
@@ -171,6 +171,7 @@ static const struct iwl_hcmd_names iwl_mld_legacy_names[] = {HCMD_NAME (MISSED_BEACONS_NOTIFICATION ),HCMD_NAME (MAC_PM_POWER_TABLE ),HCMD_NAME (MFUART_LOAD_NOTIFICATION ), +HCMD_NAME (SCAN_START_NOTIFICATION_UMAC ),HCMD_NAME (RSS_CONFIG_CMD ),HCMD_NAME (SCAN_ITERATION_COMPLETE_UMAC ), HCMD_NAME(REPLY_RX_MPDU_CMD),
drivers/net/wireless/intel/iwlwifi/mld/mlo.c +2 -2
@@ -732,7 +732,7 @@ iwl_mld_set_link_sel_data(struct iwl_mld *mld,/* Ignore any BSS that was not seen in the last MLO scan */ if (ktime_before (link_conf->bss->ts_boottime, - mld->scan.last_mlo_scan_time)) + mld->scan.last_mlo_scan_start_time))continue ; data[n_data].link_id = link_id;
@@ -939,7 +939,7 @@ static void _iwl_mld_select_links(struct iwl_mld *mld,if (!mld_vif->authorized ||hweight16 (usable_links) <=1 )return ; -if (WARN (ktime_before (mld->scan.last_mlo_scan_time, +if (WARN (ktime_before (mld->scan.last_mlo_scan_start_time,ktime_sub_ns (ktime_get_boottime_ns (),5ULL *NSEC_PER_SEC )),"Last MLO scan was too long ago, can't select links\n" ))
drivers/net/wireless/intel/iwlwifi/mld/notif.c +5 -0
@@ -284,6 +284,8 @@ static void iwl_mld_handle_beacon_notification(struct iwl_mld *mld,* at least enough bytes to cover the structure listed in the CMD_VER_ENTRY. */ +CMD_VERSIONS (scan_start_notif, + CMD_VER_ENTRY(1, iwl_umac_scan_start))CMD_VERSIONS (scan_complete_notif, CMD_VER_ENTRY(1, iwl_umac_scan_complete)) CMD_VERSIONS(scan_iter_complete_notif,
@@ -355,6 +357,7 @@ DEFINE_SIMPLE_CANCELLATION(datapath_monitor, iwl_datapath_monitor_notif, link_id) DEFINE_SIMPLE_CANCELLATION(roc, iwl_roc_notif, activity) DEFINE_SIMPLE_CANCELLATION(scan_complete, iwl_umac_scan_complete, uid) +DEFINE_SIMPLE_CANCELLATION(scan_start, iwl_umac_scan_start, uid) DEFINE_SIMPLE_CANCELLATION(probe_resp_data, iwl_probe_resp_data_notif, mac_id) DEFINE_SIMPLE_CANCELLATION(uapsd_misbehaving_ap, iwl_uapsd_misbehaving_ap_notif,
@@ -397,6 +400,8 @@ const struct iwl_rx_handler iwl_mld_rx_handlers[] = { RX_HANDLER_SYNC) RX_HANDLER_NO_OBJECT(LEGACY_GROUP, BA_NOTIF, compressed_ba_notif, RX_HANDLER_SYNC) + RX_HANDLER_OF_SCAN(LEGACY_GROUP, SCAN_START_NOTIFICATION_UMAC, + scan_start_notif) RX_HANDLER_OF_SCAN(LEGACY_GROUP, SCAN_COMPLETE_UMAC, scan_complete_notif) RX_HANDLER_NO_OBJECT(LEGACY_GROUP, SCAN_ITERATION_COMPLETE_UMAC,
drivers/net/wireless/intel/iwlwifi/mld/scan.c +27 -3
@@ -473,6 +473,9 @@ iwl_mld_scan_get_cmd_gen_flags(struct iwl_mld *mld, params->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ) flags |=IWL_UMAC_SCAN_GEN_FLAGS_V2_TRIGGER_UHB_SCAN ; +if (scan_status ==IWL_MLD_SCAN_INT_MLO ) + flags |=IWL_UMAC_SCAN_GEN_FLAGS_V2_NTF_START ; +if (params->enable_6ghz_passive) flags |=IWL_UMAC_SCAN_GEN_FLAGS_V2_6GHZ_PASSIVE_SCAN ;
@@ -1817,9 +1820,6 @@ static void iwl_mld_int_mlo_scan_start(struct iwl_mld *mld, ret =_iwl_mld_single_scan_start (mld, vif, req, &ies,IWL_MLD_SCAN_INT_MLO ); -if (!ret) - mld->scan.last_mlo_scan_time =ktime_get_boottime_ns (); -IWL_DEBUG_SCAN (mld,"Internal MLO scan: ret=%d\n" , ret); }
@@ -1904,6 +1904,30 @@ void iwl_mld_handle_match_found_notif(struct iwl_mld *mld,ieee80211_sched_scan_results (mld->hw); } +void iwl_mld_handle_scan_start_notif (struct iwl_mld *mld, +struct iwl_rx_packet *pkt) +{ +struct iwl_umac_scan_complete *notif = (void *)pkt->data; +u32 uid =le32_to_cpu (notif->uid); + +if (IWL_FW_CHECK (mld, uid >=ARRAY_SIZE (mld->scan.uid_status), +"FW reports out-of-range scan UID %d\n" , uid)) +return ; + +if (IWL_FW_CHECK (mld, !(mld->scan.uid_status[uid] & mld->scan.status), +"FW reports scan UID %d we didn't trigger\n" , uid)) +return ; + +IWL_DEBUG_SCAN (mld,"Scan started: uid=%u type=%u\n" , uid, + mld->scan.uid_status[uid]); +if (IWL_FW_CHECK (mld, mld->scan.uid_status[uid] !=IWL_MLD_SCAN_INT_MLO , +"FW reports scan start notification %d we didn't trigger\n" , + mld->scan.uid_status[uid])) +return ; + + mld->scan.last_mlo_scan_start_time =ktime_get_boottime_ns (); +} +void iwl_mld_handle_scan_complete_notif (struct iwl_mld *mld,struct iwl_rx_packet *pkt) {
drivers/net/wireless/intel/iwlwifi/mld/scan.h +6 -3
@@ -27,6 +27,9 @@ int iwl_mld_sched_scan_start(struct iwl_mld *mld,void iwl_mld_handle_match_found_notif (struct iwl_mld *mld,struct iwl_rx_packet *pkt); +void iwl_mld_handle_scan_start_notif (struct iwl_mld *mld, +struct iwl_rx_packet *pkt); +void iwl_mld_handle_scan_complete_notif (struct iwl_mld *mld,struct iwl_rx_packet *pkt);
@@ -114,8 +117,8 @@ enum iwl_mld_traffic_load {* in jiffies. * @last_start_time_jiffies: stores the last start time in jiffies * (interface up/reset/resume). -* @last_mlo_scan_time: start time of the last MLO scan in nanoseconds since -* boot. +* @last_mlo_scan_start_time: start time of the last MLO scan in nanoseconds +* since boot. */ struct iwl_mld_scan {/* Add here fields that need clean up on restart */
@@ -136,7 +139,7 @@ struct iwl_mld_scan {void *cmd;unsigned long last_6ghz_passive_jiffies;unsigned long last_start_time_jiffies; -u64 last_mlo_scan_time; +u64 last_mlo_scan_start_time; };/**
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 20/277 wifi: iwlwifi: mvm: dont send a 6E related command when not supported
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 323156c3541e23da7e582008a7ac30cd51b60acd ]
MCC_ALLOWED_AP_TYPE_CMD is related to 6E support. Do not send it if the device doesn't support 6E.
Apparently, the firmware is mistakenly advertising support for this command even on AX201 which does not support 6E and then the firmware crashes.
--- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/fw.c +2 -1
@@ -479,7 +479,8 @@ static void iwl_mvm_uats_init(struct iwl_mvm *mvm) .dataflags[0] = IWL_HCMD_DFL_NOCOPY, }; -if (mvm->trans->mac_cfg->device_family <IWL_DEVICE_FAMILY_AX210 ) { +if (mvm->trans->mac_cfg->device_family <IWL_DEVICE_FAMILY_AX210 || + !mvm->trans->cfg->uhb_supported) {IWL_DEBUG_RADIO (mvm,"UATS feature is not supported\n" );return ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 21/277 wifi: iwlwifi: cfg: add new device names
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 30d47d8fe781469ebd4e38240999767f139effb2 ]
Add a couple of device names so that these new devices will be shown correctly.
Stable-dep-of: 687a95d204e7 ("wifi: iwlwifi: mld: correctly set wifi generation data")
--- drivers/net/wireless/intel/iwlwifi/cfg/rf-wh.c | 1 + drivers/net/wireless/intel/iwlwifi/iwl-config.h | 1 + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 3 +++ 3 files changed, 5 insertions(+)
drivers/net/wireless/intel/iwlwifi/cfg/rf-wh.c +1 -0
@@ -13,3 +13,4 @@ const char iwl_killer_be1775i_name[] =const char iwl_be211_name[] ="Intel(R) Wi-Fi 7 BE211 320MHz" ;const char iwl_be213_name[] ="Intel(R) Wi-Fi 7 BE213 160MHz" ; +const char iwl_ax221_name[] ="Intel(R) Wi-Fi 6E AX221 160MHz" ;
drivers/net/wireless/intel/iwlwifi/iwl-config.h +1 -0
@@ -688,6 +688,7 @@ extern const char iwl_killer_bn1850i_name[];extern const char iwl_bn201_name[];extern const char iwl_be221_name[];extern const char iwl_be223_name[]; +extern const char iwl_ax221_name[];#if IS_ENABLED (CONFIG_IWLDVM )extern const struct iwl_rf_cfg iwl5300_agn_cfg;extern const struct iwl_rf_cfg iwl5350_agn_cfg;
drivers/net/wireless/intel/iwlwifi/pcie/drv.c +3 -0
@@ -1061,11 +1061,14 @@ VISIBLE_IF_IWLWIFI_KUNIT const struct iwl_dev_info iwl_dev_info_table[] = {/* WH RF */ IWL_DEV_INFO (iwl_rf_wh, iwl_be211_name,RF_TYPE (WH )), +IWL_DEV_INFO (iwl_rf_wh, iwl_ax221_name,RF_TYPE (WH ),SUBDEV (0x0514 )), +IWL_DEV_INFO (iwl_rf_wh, iwl_ax221_name,RF_TYPE (WH ),SUBDEV (0x4514 )),IWL_DEV_INFO (iwl_rf_wh_160mhz, iwl_be213_name,RF_TYPE (WH ),BW_LIMITED ),/* PE RF */ IWL_DEV_INFO (iwl_rf_pe, iwl_bn201_name,RF_TYPE (PE )),IWL_DEV_INFO (iwl_rf_pe, iwl_be223_name,RF_TYPE (PE ),SUBDEV (0x0524 )), +IWL_DEV_INFO (iwl_rf_pe, iwl_be223_name,RF_TYPE (PE ),SUBDEV (0x4524 )), IWL_DEV_INFO(iwl_rf_pe, iwl_be221_name, RF_TYPE(PE), SUBDEV(0x0324)),/* Killer */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 22/277 wifi: iwlwifi: disable EHT if the device doesnt allow it
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 7ed47d42943fba8ced505f62d4358f63963bb968 ]
We have a few devices that don't allow EHT. Make sure we reflect this towards mac80211 so that we won't try to enable it.
Stable-dep-of: 687a95d204e7 ("wifi: iwlwifi: mld: correctly set wifi generation data")
--- .../net/wireless/intel/iwlwifi/cfg/rf-fm.c | 1 + .../net/wireless/intel/iwlwifi/cfg/rf-wh.c | 23 +++++++++++++++++++ .../net/wireless/intel/iwlwifi/iwl-config.h | 5 +++- .../wireless/intel/iwlwifi/iwl-nvm-parse.c | 2 +- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 6 +++-- 5 files changed, 33 insertions(+), 4 deletions(-)
drivers/net/wireless/intel/iwlwifi/cfg/rf-fm.c +1 -0
@@ -19,6 +19,7 @@ .non_shared_ant = ANT_B, \ .vht_mu_mimo_supported = true, \ .uhb_supported = true, \ + .eht_supported = true, \ .num_rbds = IWL_NUM_RBDS_EHT, \ .nvm_ver =IWL_FM_NVM_VERSION , \ .nvm_type = IWL_NVM_EXT
drivers/net/wireless/intel/iwlwifi/cfg/rf-wh.c +23 -0
@@ -4,8 +4,31 @@*/ #include "iwl-config.h" +/* NVM versions */ +#define IWL_WH_NVM_VERSION 0x0a1d + +#define IWL_DEVICE_WH \ + .ht_params = { \ + .stbc = true, \ + .ldpc = true, \ + .ht40_bands = BIT(NL80211_BAND_2GHZ) | \ + BIT(NL80211_BAND_5GHZ), \ + }, \ + .led_mode = IWL_LED_RF_STATE, \ + .non_shared_ant = ANT_B, \ + .vht_mu_mimo_supported = true, \ + .uhb_supported = true, \ + .num_rbds = IWL_NUM_RBDS_EHT, \ + .nvm_ver = IWL_WH_NVM_VERSION, \ + .nvm_type = IWL_NVM_EXT +/* currently iwl_rf_wh/iwl_rf_wh_160mhz are just defines for the FM ones */ +const struct iwl_rf_cfg iwl_rf_wh_non_eht = { +IWL_DEVICE_WH , + .eht_supported = false, +}; +const char iwl_killer_be1775s_name[] ="Killer(R) Wi-Fi 7 BE1775s 320MHz Wireless Network Adapter (BE211D2W)" ; const char iwl_killer_be1775i_name[] =
drivers/net/wireless/intel/iwlwifi/iwl-config.h +4 -1
@@ -418,6 +418,7 @@ struct iwl_mac_cfg {* @vht_mu_mimo_supported: VHT MU-MIMO support * @nvm_type: see &enum iwl_nvm_type * @uhb_supported: ultra high band channels supported +* @eht_supported: EHT supported * @num_rbds: number of receive buffer descriptors to use * (only used for multi-queue capable devices) *
@@ -450,7 +451,8 @@ struct iwl_rf_cfg { host_interrupt_operation_mode:1, lp_xtal_workaround:1, vht_mu_mimo_supported:1, - uhb_supported:1; + uhb_supported:1, + eht_supported:1;u8 valid_tx_ant;u8 valid_rx_ant;u8 non_shared_ant;
@@ -744,6 +746,7 @@ extern const struct iwl_rf_cfg iwl_rf_fm;extern const struct iwl_rf_cfg iwl_rf_fm_160mhz;#define iwl_rf_wh iwl_rf_fm#define iwl_rf_wh_160mhz iwl_rf_fm_160mhz +extern const struct iwl_rf_cfg iwl_rf_wh_non_eht;#define iwl_rf_pe iwl_rf_fm#endif /* CONFIG_IWLMLD */
drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c +1 -1
@@ -2080,7 +2080,7 @@ struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans, !!(mac_flags &NVM_MAC_SKU_FLAGS_BAND_5_2_ENABLED ); nvm->sku_cap_mimo_disabled = !!(mac_flags &NVM_MAC_SKU_FLAGS_MIMO_DISABLED ); -if (CSR_HW_RFID_TYPE (trans->info.hw_rf_id) >=IWL_CFG_RF_TYPE_FM ) +if (trans->cfg->eht_supported) nvm->sku_cap_11be_enable = true;/* Initialize PHY sku data */
drivers/net/wireless/intel/iwlwifi/pcie/drv.c +4 -2
@@ -1061,8 +1061,10 @@ VISIBLE_IF_IWLWIFI_KUNIT const struct iwl_dev_info iwl_dev_info_table[] = {/* WH RF */ IWL_DEV_INFO (iwl_rf_wh, iwl_be211_name,RF_TYPE (WH )), -IWL_DEV_INFO (iwl_rf_wh, iwl_ax221_name,RF_TYPE (WH ),SUBDEV (0x0514 )), -IWL_DEV_INFO (iwl_rf_wh, iwl_ax221_name,RF_TYPE (WH ),SUBDEV (0x4514 )), +IWL_DEV_INFO (iwl_rf_wh_non_eht, iwl_ax221_name,RF_TYPE (WH ), +SUBDEV (0x0514 )), +IWL_DEV_INFO (iwl_rf_wh_non_eht, iwl_ax221_name,RF_TYPE (WH ), +SUBDEV (0x4514 )), IWL_DEV_INFO(iwl_rf_wh_160mhz, iwl_be213_name, RF_TYPE(WH), BW_LIMITED),/* PE RF */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 23/277 wifi: iwlwifi: mld: correctly set wifi generation data
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 687a95d204e72e52f2e6bc7a994cc82f76b2678f ]
In each MAC context, the firmware expects the wifi generation data, i.e. whether or not HE/EHT (and in the future UHR) is enabled on that MAC.
However, this is currently handled wrong in two ways:
- EHT is only enabled when the interface is also an MLD, but we currently allow (despite the spec) connecting with EHT but without MLO.
- when HE or EHT are used by TDLS peers, the firmware needs to have them enabled regardless of the AP
Fix this by iterating setting up the data depending on the interface type:
- for AP, just set it according to the BSS configuration
- for monitor, set it according to HW capabilities
- otherwise, particularly for client, iterate all stations and then their links on the interface in question and set according to their capabilities, this handles the AP and TDLS peers. Re-calculate this whenever a TDLS station is marked associated or removed so that it's kept updated, for the AP it's already updated on assoc/disassoc.
--- .../net/wireless/intel/iwlwifi/mld/iface.c | 101 ++++++++++++------ .../net/wireless/intel/iwlwifi/mld/mac80211.c | 19 ++++ 2 files changed, 88 insertions(+), 32 deletions(-)
drivers/net/wireless/intel/iwlwifi/mld/iface.c +69 -32
@@ -111,14 +111,75 @@ static bool iwl_mld_is_nic_ack_enabled(struct iwl_mld *mld, IEEE80211_HE_MAC_CAP2_ACK_EN); } -static void iwl_mld_set_he_support (struct iwl_mld *mld, -struct ieee80211_vif *vif, -struct iwl_mac_config_cmd *cmd) +struct iwl_mld_mac_wifi_gen_sta_iter_data { +struct ieee80211_vif *vif; +struct iwl_mac_wifi_gen_support *support; +}; + +static void iwl_mld_mac_wifi_gen_sta_iter (void *_data, +struct ieee80211_sta *sta) { -if (vif->type ==NL80211_IFTYPE_AP ) - cmd->wifi_gen.he_ap_support =1 ; -else - cmd->wifi_gen.he_support =1 ; +struct iwl_mld_sta *mld_sta =iwl_mld_sta_from_mac80211 (sta); +struct iwl_mld_mac_wifi_gen_sta_iter_data *data = _data; +struct ieee80211_link_sta *link_sta; +unsigned int link_id; + +if (mld_sta->vif != data->vif) +return ; + +for_each_sta_active_link (data->vif, sta, link_sta, link_id) { +if (link_sta->he_cap.has_he) + data->support->he_support =1 ; +if (link_sta->eht_cap.has_eht) + data->support->eht_support =1 ; + } +} + +static void iwl_mld_set_wifi_gen (struct iwl_mld *mld, +struct ieee80211_vif *vif, +struct iwl_mac_wifi_gen_support *support) +{ +struct iwl_mld_mac_wifi_gen_sta_iter_data sta_iter_data = { + .vif = vif, + .support = support, + }; +struct ieee80211_bss_conf *link_conf; +unsigned int link_id; + +switch (vif->type) { +case NL80211_IFTYPE_MONITOR : +/* for sniffer, set to HW capabilities */ + support->he_support =1 ; + support->eht_support = mld->trans->cfg->eht_supported; +break ; +case NL80211_IFTYPE_AP : +/* for AP set according to the link configs */ +for_each_vif_active_link (vif, link_conf, link_id) { + support->he_ap_support |= link_conf->he_support; + support->eht_support |= link_conf->eht_support; + } +break ; +default : +/* +* If we have MLO enabled, then the firmware needs to enable +* address translation for the station(s) we add. That depends +* on having EHT enabled in firmware, which in turn depends on +* mac80211 in the iteration below. +* However, mac80211 doesn't enable capabilities on the AP STA +* until it has parsed the association response successfully, +* so set EHT (and HE as a pre-requisite for EHT) when the vif +* is an MLD. +*/ +if (ieee80211_vif_is_mld (vif)) { + support->he_support =1 ; + support->eht_support =1 ; + } + +ieee80211_iterate_stations_mtx (mld->hw, + iwl_mld_mac_wifi_gen_sta_iter, + &sta_iter_data); +break ; + } }/* fill the common part for all interface types */
@@ -128,8 +189,6 @@ static void iwl_mld_mac_cmd_fill_common(struct iwl_mld *mld, u32 action) {struct iwl_mld_vif *mld_vif =iwl_mld_vif_from_mac80211 (vif); -struct ieee80211_bss_conf *link_conf; -unsigned int link_id;lockdep_assert_wiphy (mld->wiphy);
@@ -147,29 +206,7 @@ static void iwl_mld_mac_cmd_fill_common(struct iwl_mld *mld, cmd->nic_not_ack_enabled =cpu_to_le32 (!iwl_mld_is_nic_ack_enabled (mld, vif)); -/* If we have MLO enabled, then the firmware needs to enable -* address translation for the station(s) we add. That depends -* on having EHT enabled in firmware, which in turn depends on -* mac80211 in the code below. -* However, mac80211 doesn't enable HE/EHT until it has parsed -* the association response successfully, so just skip all that -* and enable both when we have MLO. -*/ -if (ieee80211_vif_is_mld (vif)) { -iwl_mld_set_he_support (mld, vif, cmd); - cmd->wifi_gen.eht_support =1 ; -return ; - } - -for_each_vif_active_link (vif, link_conf, link_id) { -if (!link_conf->he_support) -continue ; - -iwl_mld_set_he_support (mld, vif, cmd); - -/* EHT, if supported, was already set above */ -break ; - } +iwl_mld_set_wifi_gen (mld, vif, &cmd->wifi_gen); } static void iwl_mld_fill_mac_cmd_sta(struct iwl_mld *mld,
drivers/net/wireless/intel/iwlwifi/mld/mac80211.c +19 -0
@@ -1686,6 +1686,16 @@ static int iwl_mld_move_sta_state_up(struct iwl_mld *mld,if (vif->type ==NL80211_IFTYPE_STATION )iwl_mld_link_set_2mhz_block (mld, vif, sta); + +if (sta->tdls) { +/* +* update MAC since wifi generation flags may change, +* we also update MAC on association to the AP via the +* vif assoc change +*/ +iwl_mld_mac_fw_action (mld, vif,FW_CTXT_ACTION_MODIFY ); + } +/* Now the link_sta's capabilities are set, update the FW */ iwl_mld_config_tlc (mld, vif, sta);
@@ -1795,6 +1805,15 @@ static int iwl_mld_move_sta_state_down(struct iwl_mld *mld,/* just removed last TDLS STA, so enable PM */ iwl_mld_update_mac_power (mld, vif, false); } + +if (sta->tdls) { +/* +* update MAC since wifi generation flags may change, +* we also update MAC on disassociation to the AP via +* the vif assoc change +*/ +iwl_mld_mac_fw_action (mld, vif,FW_CTXT_ACTION_MODIFY ); + } }else {return -EINVAL ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 24/277 wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Reshma Immaculate Rajkumar <[email protected]>
[ Upstream commit e225b36f83d7926c1f2035923bb0359d851fdb73 ]
During ongoing traffic, a request to stop an AMPDU session for one TID could incorrectly affect other active sessions. This can happen because an incorrect TID reference would be passed when updating the BA session state, causing the wrong session to be stopped. As a result, the affected session would be reduced to a minimal BA size, leading to a noticeable throughput degradation.
Fix this issue by passing the correct argument from ath11k_dp_rx_ampdu_stop() to ath11k_peer_rx_tid_reo_update() during a stop AMPDU session. Instead of passing peer->tx_tid, which is the base address of the array, corresponding to TID 0; pass the value of &peer->rx_tid[params->tid], where the different TID numbers are accounted for.
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath11k/dp_rx.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
drivers/net/wireless/ath/ath11k/dp_rx.c +7 -8
@@ -1,7 +1,7 @@// SPDX-License-Identifier: BSD-3-Clause-Clear /* * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. -* Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved. +* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */ #include <linux/ieee80211.h>
@@ -1110,9 +1110,8 @@ int ath11k_dp_rx_ampdu_stop(struct ath11k *ar,struct ath11k_base *ab = ar->ab;struct ath11k_peer *peer;struct ath11k_sta *arsta =ath11k_sta_to_arsta (params->sta); +struct dp_rx_tid *rx_tid;int vdev_id = arsta->arvif->vdev_id; -dma_addr_t paddr; -bool active;int ret;spin_lock_bh (&ab->base_lock);
@@ -1124,15 +1123,14 @@ int ath11k_dp_rx_ampdu_stop(struct ath11k *ar,return -ENOENT ; } - paddr = peer->rx_tid[params->tid].paddr; - active = peer->rx_tid[params->tid].active; + rx_tid = &peer->rx_tid[params->tid]; -if (!active) { +if (!rx_tid->active) {spin_unlock_bh (&ab->base_lock);return 0 ; } - ret =ath11k_peer_rx_tid_reo_update (ar, peer, peer->rx_tid,1 ,0 , false); + ret =ath11k_peer_rx_tid_reo_update (ar, peer, rx_tid,1 ,0 , false);spin_unlock_bh (&ab->base_lock);if (ret) { ath11k_warn(ab, "failed to update reo for rx tid %d: %d\n",
@@ -1141,7 +1139,8 @@ int ath11k_dp_rx_ampdu_stop(struct ath11k *ar, } ret =ath11k_wmi_peer_rx_reorder_queue_setup (ar, vdev_id, - params->sta->addr, paddr, + params->sta->addr, + rx_tid->paddr, params->tid,1 ,1 );if (ret) ath11k_warn(ab, "failed to send wmi to delete rx tid %d\n",
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 25/277 crypto: caam - fix DMA corruption on long hmac keys
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horia Geantă <[email protected]>
[ Upstream commit 5ddfdcbe10dc5f97afc4e46ca22be2be717e8caf ]
When a key longer than block size is supplied, it is copied and then hashed into the real key. The memory allocated for the copy needs to be rounded to DMA cache alignment, as otherwise the hashed key may corrupt neighbouring memory.
The rounding was performed, but never actually used for the allocation. Fix this by replacing kmemdup with kmalloc for a larger buffer, followed by memcpy.
--- drivers/crypto/caam/caamhash.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/crypto/caam/caamhash.c +2 -1
@@ -441,9 +441,10 @@ static int ahash_setkey(struct crypto_ahash *ahash,if (aligned_len < keylen)return -EOVERFLOW ; - hashed_key =kmemdup (key, keylen,GFP_KERNEL ); + hashed_key =kmalloc (aligned_len,GFP_KERNEL );if (!hashed_key)return -ENOMEM ; +memcpy (hashed_key, key, keylen); ret =hash_digest_key (ctx, &keylen, hashed_key, digestsize);if (ret) goto bad_free_key;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 26/277 crypto: caam - fix overflow on long hmac keys
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horia Geantă <[email protected]>
[ Upstream commit 80688afb9c35b3934ce2d6be9973758915e2e0ef ]
When a key longer than block size is supplied, it is copied and then hashed into the real key. The memory allocated for the copy needs to be rounded to DMA cache alignment, as otherwise the hashed key may corrupt neighbouring memory.
The copying is performed using kmemdup, however this leads to an overflow:
reading more bytes (aligned_len - keylen) from the keylen source buffer. Fix this by replacing kmemdup with kmalloc, followed by memcpy.
--- drivers/crypto/caam/caamalg_qi2.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/crypto/caam/caamalg_qi2.c +2 -1
@@ -3326,9 +3326,10 @@ static int ahash_setkey(struct crypto_ahash *ahash, const u8 *key,if (aligned_len < keylen)return -EOVERFLOW ; - hashed_key =kmemdup (key, aligned_len,GFP_KERNEL ); + hashed_key =kmalloc (aligned_len,GFP_KERNEL );if (!hashed_key)return -ENOMEM ; +memcpy (hashed_key, key, keylen); ret =hash_digest_key (ctx, &keylen, hashed_key, digestsize);if (ret) goto bad_free_key;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 27/277 crypto: deflate - fix spurious -ENOSPC
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit 6d89f743e57cb34e233a8217b394c7ee09abf225 ]
The code in deflate_decompress_one may erroneously return -ENOSPC even if it didn't run out of output space. The error happens under this condition:
- Suppose that there are two input pages, the compressed data fits into the first page and the zlib checksum is placed in the second page.
- The code iterates over the first page, decompresses the data and fully fills the destination buffer, zlib_inflate returns Z_OK becuse zlib hasn't seen the checksum yet.
- The outer do-while loop is iterated again, acomp_walk_next_src sets the input parameters to the second page containing the checksum.
- We go into the inner do-while loop, execute "dcur = acomp_walk_next_dst(&walk);". "dcur" is zero, so we break out of the loop and return -ENOSPC, despite the fact that the decompressed data fit into the destination buffer.
In order to fix this bug, this commit changes the logic when to report the -ENOSPC error. We report the error if the destination buffer is empty *and* if zlib_inflate didn't make any progress consuming the input buffer. If zlib_inflate consumes the trailing checksum, we see that it made progress and we will not return -ENOSPC.
--- crypto/deflate.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
crypto/deflate.c +7 -4
@@ -163,18 +163,21 @@ static int deflate_decompress_one(struct acomp_req *req,do {unsigned int dcur; +unsigned long avail_in; dcur =acomp_walk_next_dst (&walk); -if (!dcur) { - out_of_space = true; -break ; - } stream->avail_out = dcur; stream->next_out = walk.dst.virt.addr; + avail_in = stream->avail_in; ret =zlib_inflate (stream,Z_NO_FLUSH ); +if (!dcur && avail_in == stream->avail_in) { + out_of_space = true; +break ; + } + dcur -= stream->avail_out;acomp_walk_done_dst (&walk, dcur); }while (ret ==Z_OK && stream->avail_in);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 28/277 crypto: af-alg - fix NULL pointer dereference in scatterwalk
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert Szetei <[email protected]>
[ Upstream commit 62397b493e14107ae82d8b80938f293d95425bcb ]
The AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL) when chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL exactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent sendmsg() allocates a new SGL and chains it, but fails to clear the end marker on the previous SGL's last data entry.
This causes the crypto scatterwalk to hit a premature end, returning NULL on sg_next() and leading to a kernel panic during dereference.
Fix this by explicitly unmarking the end of the previous SGL when performing sg_chain() in af_alg_alloc_tsgl().
--- crypto/af_alg.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
crypto/af_alg.c +3 -1
@@ -623,8 +623,10 @@ static int af_alg_alloc_tsgl(struct sock *sk)sg_init_table (sgl->sg,MAX_SGL_ENTS +1 ); sgl->cur =0 ; -if (sg) +if (sg) { +sg_unmark_end (sg +MAX_SGL_ENTS -1 );sg_chain (sg,MAX_SGL_ENTS +1 , sgl->sg); + }list_add_tail (&sgl->list, &ctx->tsgl_list); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 29/277 net: mana: Fix RX skb truesize accounting
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipayaan Roy <[email protected]>
[ Upstream commit f73896b4197ed53cf0894657c899265ef7c86b7a ]
MANA passes rxq->alloc_size to napi_build_skb() for all RX buffers. It is correct for fragment-backed RX buffers, where alloc_size matches the actual backing allocation used for each packet buffer. However, in the non-fragment RX path mana allocates a full page, or a higher-order page, per RX buffer. In that case alloc_size only reflects the usable packet area and not the actual backing memory.
This causes napi_build_skb() to underestimate the skb backing allocation in the single-buffer RX path, so skb->truesize is derived from a value smaller than the real RX buffer allocation.
Fix this by updating alloc_size in the non-fragment RX path to the actual backing allocation size before it is passed to napi_build_skb().
--- drivers/net/ethernet/microsoft/mana/mana_en.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/ethernet/microsoft/mana/mana_en.c +7 -0
@@ -660,6 +660,13 @@ static void mana_get_rxbuf_cfg(struct mana_port_context *apc, } *frag_count =1 ; + +/* In the single-buffer path, napi_build_skb() must see the +* actual backing allocation size so skb->truesize reflects +* the full page (or higher-order page), not just the usable +* packet area. +*/ + *alloc_size =PAGE_SIZE <<get_order (*alloc_size);return ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 30/277 netdevsim: fix build if SKB_EXTENSIONS=n
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingfang Deng <[email protected]>
[ Upstream commit 57a04a13aac1f247d171c3f3aef93efc69e6979e ]
__skb_ext_put() is not declared if SKB_EXTENSIONS is not enabled, which causes a build error:
drivers/net/netdevsim/netdev.c: In function 'nsim_forward_skb':drivers/net/netdevsim/netdev.c:114:25: error: implicit declaration of function '__skb_ext_put'; did you mean 'skb_ext_put'? [-Werror=implicit-function-declaration]
114 | __skb_ext_put(psp_ext);
| ^~~~~~~~~~~~~
| skb_ext_putcc1: some warnings being treated as errors
Add a stub to fix the build.
--- include/linux/skbuff.h | 1 + 1 file changed, 1 insertion(+)
include/linux/skbuff.h +1 -0
@@ -5018,6 +5018,7 @@ static inline bool skb_has_extensions(struct sk_buff *skb) return unlikely(skb->active_extensions); }#else +static inline void __skb_ext_put (struct skb_ext *ext) {}static inline void skb_ext_put (struct sk_buff *skb) {}static inline void skb_ext_reset (struct sk_buff *skb) {}static inline void skb_ext_del (struct sk_buff *skb,int unused) {}
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 31/277 net: fec: fix the PTP periodic output sysfs interface
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Buday Csaba <[email protected]>
[ Upstream commit e8e44c98f789dee45cfd24ffb9d4936e0606d7c6 ]
When the PPS channel configuration was implemented, the channel index for the periodic outputs was configured as the hardware channel number.
The sysfs interface uses a logical channel index, and rejects numbers greater than n_per_out (see period_store() in ptp_sysfs.c). That property was left at 1, since the driver implements channel selection, not simultaneous operation of multiple PTP hardware timer channels.
A second check in fec_ptp_enable() returns -EOPNOTSUPP when the two channel numbers disagree, making channels 1..3 unusable from sysfs.
Fix by removing this redundant check in the FEC PTP driver.
--- drivers/net/ethernet/freescale/fec_ptp.c | 3 --- 1 file changed, 3 deletions(-)
drivers/net/ethernet/freescale/fec_ptp.c +0 -3
@@ -545,9 +545,6 @@ static int fec_ptp_enable(struct ptp_clock_info *ptp,if (rq->perout.flags)return -EOPNOTSUPP ; -if (rq->perout.index != fep->pps_channel) -return -EOPNOTSUPP ; - period.tv_sec = rq->perout.period.sec; period.tv_nsec = rq->perout.period.nsec; period_ns =timespec64_to_ns (&period);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 32/277 net: enetc: reset PIR and CIR if they are not equal when initializing TX ring
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit 0239fd701d33475a39428daa3dc627407cd417a6 ]
Currently the driver does not reset the producer index register (PIR) and consumer index register (CIR) when initializing a TX BD ring. The driver only reads the PIR and CIR and initializes the software indexes. If the TX BD ring is reinitialized when it still contains unsent frames, its PIR and CIR will not be equal after the reinitialization. However, the BDs between CIR and PIR have been freed and become invalid and this can lead to a hardware malfunction, causing the TX BD ring will not work properly.
For ENETC v4, it supports software to set the PIR and CIR, so the driver can reset these two registers if they are not equal when reinitializing the TX BD ring. Therefore, add this solution for ENETC v4. Note that this patch does not work for ENETC v1 because it does not support software to set the PIR and CIR.
--- drivers/net/ethernet/freescale/enetc/enetc.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/enetc/enetc.c +12 -1
@@ -2570,6 +2570,7 @@ EXPORT_SYMBOL_GPL(enetc_free_si_resources);static void enetc_setup_txbdr (struct enetc_hw *hw,struct enetc_bdr *tx_ring) { + struct enetc_si *si = container_of(hw, struct enetc_si, hw);int idx = tx_ring->index;u32 tbmr;
@@ -2583,10 +2584,20 @@ static void enetc_setup_txbdr(struct enetc_hw *hw, struct enetc_bdr *tx_ring)enetc_txbdr_wr (hw, idx,ENETC_TBLENR ,ENETC_RTBLENR_LEN (tx_ring->bd_count)); -/* clearing PI/CI registers for Tx not supported, adjust sw indexes */ +/* For ENETC v1, clearing PI/CI registers for Tx not supported, +* adjust sw indexes +*/ tx_ring->next_to_use =enetc_txbdr_rd (hw, idx,ENETC_TBPIR ); tx_ring->next_to_clean =enetc_txbdr_rd (hw, idx,ENETC_TBCIR ); +if (tx_ring->next_to_use != tx_ring->next_to_clean && + !is_enetc_rev1 (si)) { + tx_ring->next_to_use =0 ; + tx_ring->next_to_clean =0 ; +enetc_txbdr_wr (hw, idx,ENETC_TBPIR ,0 ); +enetc_txbdr_wr (hw, idx,ENETC_TBCIR ,0 ); + } +/* enable Tx ints by setting pkt thr to 1 */ enetc_txbdr_wr (hw, idx,ENETC_TBICR0 ,ENETC_TBICR0_ICEN |0x1 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 33/277 net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 2428083101f6883f979cceffa76cd8440751ffe6 ]
__radix_tree_create() allocates and links intermediate nodes into the tree one by one. If a subsequent allocation fails, the already-linked nodes remain in the tree with no corresponding leaf entry. These orphaned internal nodes are never reclaimed because radix_tree_for_each_slot() only visits slots containing leaf values.
The radix_tree API is deprecated in favor of xarray. As suggested by Matthew Wilcox, migrate qrtr_tx_flow from radix_tree to xarray instead of fixing the radix_tree itself [1]. xarray properly handles cleanup of internal nodes — xa_destroy() frees all internal xarray nodes when the qrtr_node is released, preventing the leak.
[1] https://lore.kernel.org/all/[email protected]/T/
--- net/qrtr/af_qrtr.c | 31 +++++++++++++------------------ 1 file changed, 13 insertions(+), 18 deletions(-)
net/qrtr/af_qrtr.c +13 -18
@@ -118,7 +118,7 @@ static DEFINE_XARRAY_ALLOC(qrtr_ports);* @ep: endpoint * @ref: reference count for node * @nid: node id -* @qrtr_tx_flow: tree of qrtr_tx_flow, keyed by node << 32 | port +* @qrtr_tx_flow: xarray of qrtr_tx_flow, keyed by node << 32 | port * @qrtr_tx_lock: lock for qrtr_tx_flow inserts * @rx_queue: receive queue * @item: list item for broadcast list
@@ -129,7 +129,7 @@ struct qrtr_node {struct kref ref;unsigned int nid; -struct radix_tree_root qrtr_tx_flow; +struct xarray qrtr_tx_flow;struct mutex qrtr_tx_lock;/* for qrtr_tx_flow */ struct sk_buff_head rx_queue;
@@ -172,6 +172,7 @@ static void __qrtr_node_release(struct kref *kref)struct qrtr_tx_flow *flow;unsigned long flags;void __rcu **slot; +unsigned long index;spin_lock_irqsave (&qrtr_nodes_lock, flags);/* If the node is a bridge for other nodes, there are possibly
@@ -189,11 +190,9 @@ static void __qrtr_node_release(struct kref *kref)skb_queue_purge (&node->rx_queue);/* Free tx flow counters */ -radix_tree_for_each_slot (slot, &node->qrtr_tx_flow, &iter,0 ) { - flow = *slot; -radix_tree_iter_delete (&node->qrtr_tx_flow, &iter, slot); +xa_for_each (&node->qrtr_tx_flow, index, flow)kfree (flow); - } +xa_destroy (&node->qrtr_tx_flow);kfree (node); }
@@ -228,9 +227,7 @@ static void qrtr_tx_resume(struct qrtr_node *node, struct sk_buff *skb) key = remote_node <<32 | remote_port; -rcu_read_lock (); - flow =radix_tree_lookup (&node->qrtr_tx_flow, key); -rcu_read_unlock (); + flow =xa_load (&node->qrtr_tx_flow, key);if (flow) {spin_lock (&flow->resume_tx.lock); flow->pending =0 ;
@@ -269,12 +266,13 @@ static int qrtr_tx_wait(struct qrtr_node *node, int dest_node, int dest_port,return 0 ;mutex_lock (&node->qrtr_tx_lock); - flow =radix_tree_lookup (&node->qrtr_tx_flow, key); + flow =xa_load (&node->qrtr_tx_flow, key);if (!flow) { flow =kzalloc (sizeof (*flow),GFP_KERNEL );if (flow) {init_waitqueue_head (&flow->resume_tx); -if (radix_tree_insert (&node->qrtr_tx_flow, key, flow)) { +if (xa_err (xa_store (&node->qrtr_tx_flow, key, flow, +GFP_KERNEL ))) {kfree (flow); flow =NULL ; }
@@ -326,9 +324,7 @@ static void qrtr_tx_flow_failed(struct qrtr_node *node, int dest_node,unsigned long key = (u64 )dest_node <<32 | dest_port;struct qrtr_tx_flow *flow; -rcu_read_lock (); - flow =radix_tree_lookup (&node->qrtr_tx_flow, key); -rcu_read_unlock (); + flow =xa_load (&node->qrtr_tx_flow, key);if (flow) {spin_lock_irq (&flow->resume_tx.lock); flow->tx_failed =1 ;
@@ -599,7 +595,7 @@ int qrtr_endpoint_register(struct qrtr_endpoint *ep, unsigned int nid) node->nid =QRTR_EP_NID_AUTO ; node->ep = ep; -INIT_RADIX_TREE (&node->qrtr_tx_flow,GFP_KERNEL ); +xa_init (&node->qrtr_tx_flow);mutex_init (&node->qrtr_tx_lock);qrtr_node_assign (node, nid);
@@ -627,6 +623,7 @@ void qrtr_endpoint_unregister(struct qrtr_endpoint *ep)struct qrtr_tx_flow *flow;struct sk_buff *skb;unsigned long flags; +unsigned long index;void __rcu **slot;mutex_lock (&node->ep_lock);
@@ -649,10 +646,8 @@ void qrtr_endpoint_unregister(struct qrtr_endpoint *ep)/* Wake up any transmitters waiting for resume-tx from the node */ mutex_lock (&node->qrtr_tx_lock); -radix_tree_for_each_slot (slot, &node->qrtr_tx_flow, &iter,0 ) { - flow = *slot; +xa_for_each (&node->qrtr_tx_flow, index, flow)wake_up_interruptible_all (&flow->resume_tx); - }mutex_unlock (&node->qrtr_tx_lock);qrtr_node_release (node);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 34/277 net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yochai Eisenrich <[email protected]>
[ Upstream commit ae05340ccaa9d347fe85415609e075545bec589f ]
When processing Router Advertisements with user options the kernel builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct has three padding fields that are never zeroed and can leak kernel data
The fix is simple, just zeroes the padding fields.
--- net/ipv6/ndisc.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv6/ndisc.c +3 -0
@@ -1209,6 +1209,9 @@ static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt) ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type; ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code; ndmsg->nduseropt_opts_len = opt->nd_opt_len <<3 ; + ndmsg->nduseropt_pad1 =0 ; + ndmsg->nduseropt_pad2 =0 ; + ndmsg->nduseropt_pad3 =0 ;memcpy (ndmsg +1 , opt, opt->nd_opt_len <<3 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 35/277 net/ipv6: ioam6: prevent schema length wraparound in trace fill
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 5e67ba9bb531e1ec6599a82a065dea9040b9ce50 ]
ioam6_fill_trace_data() stores the schema contribution to the trace length in a u8. With bit 22 enabled and the largest schema payload, sclen becomes 1 + 1020 / 4, wraps from 256 to 0, and bypasses the remaining-space check. __ioam6_fill_trace_data() then positions the write cursor without reserving the schema area but still copies the 4-byte schema header and the full schema payload, overrunning the trace buffer.
Keep sclen in an unsigned int so the remaining-space check and the write cursor calculation both see the full schema length.
--- net/ipv6/ioam6.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv6/ioam6.c +2 -2
@@ -708,7 +708,7 @@ static void __ioam6_fill_trace_data(struct sk_buff *skb,struct ioam6_namespace *ns, struct ioam6_trace_hdr *trace, struct ioam6_schema *sc, - u8 sclen, bool is_input) + unsigned int sclen, bool is_input) { struct net_device *dev = skb_dst_dev(skb);struct timespec64 ts;
@@ -939,7 +939,7 @@ void ioam6_fill_trace_data(struct sk_buff *skb, bool is_input) {struct ioam6_schema *sc; -u8 sclen =0 ; +unsigned int sclen =0 ;/* Skip if Overflow flag is set */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 36/277 tg3: Fix race for querying speed/duplex
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Bogendoerfer <[email protected]>
[ Upstream commit bb417456c7814d1493d98b7dd9c040bf3ce3b4ed ]
When driver signals carrier up via netif_carrier_on() its internal link_up state isn't updated immediately. This leads to inconsistent speed/duplex in /proc/net/bonding/bondX where the speed and duplex is shown as unknown while ethtool shows correct values. Fix this by using netif_carrier_ok() for link checking in get_ksettings function.
--- drivers/net/ethernet/broadcom/tg3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/tg3.c +1 -1
@@ -12300,7 +12300,7 @@ static int tg3_get_link_ksettings(struct net_device *dev,ethtool_convert_legacy_u32_to_link_mode (cmd->link_modes.advertising, advertising); -if (netif_running (dev) && tp->link_up) { +if (netif_running (dev) &&netif_carrier_ok (dev)) { cmd->base.speed = tp->link_config.active_speed; cmd->base.duplex = tp->link_config.active_duplex; ethtool_convert_legacy_u32_to_link_mode(
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 37/277 ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 86ab3e55673a7a49a841838776f1ab18d23a67b5 ]
Sashiko AI-review observed:
In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2 and passed to icmp6_send(), it uses IP6CB(skb2).
IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm at offset 18.
If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO).
This would scan the inner, attacker-controlled IPv6 packet starting at that offset, potentially returning a fake TLV without checking if the remaining packet length can hold the full 18-byte struct ipv6_destopt_hao.
Could mip6_addr_swap() then perform a 16-byte swap that extends past the end of the packet data into skb_shared_info?
Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and ip6ip6_err() to prevent this?
This patch implements the first suggestion.
I am not sure if ip6ip6_err() needs to be changed. A separate patch would be better anyway.
--- net/ipv6/icmp.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv6/icmp.c +3 -0
@@ -675,6 +675,9 @@ int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type,if (!skb2)return 1 ; +/* Remove debris left by IPv4 stack. */ +memset (IP6CB (skb2),0 ,sizeof (*IP6CB (skb2))); +skb_dst_drop (skb2);skb_pull (skb2, nhs);skb_reset_network_header (skb2);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 38/277 ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 2edfa31769a4add828a7e604b21cb82aaaa05925 ]
Oskar Kjos reported the following problem.
ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr value. __ip_options_echo() then reads optlen from attacker-controlled packet data at sptr[rr+1] and copies that many bytes into dopt->__data, a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).
To fix this we clear skb2->cb[], as suggested by Oskar Kjos.
Also add minimal IPv4 header validation (version == 4, ihl >= 5).
--- net/ipv6/ip6_tunnel.c | 5 +++++ 1 file changed, 5 insertions(+)
net/ipv6/ip6_tunnel.c +5 -0
@@ -601,11 +601,16 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,if (!skb2)return 0 ; +/* Remove debris left by IPv6 stack. */ +memset (IPCB (skb2),0 ,sizeof (*IPCB (skb2))); +skb_dst_drop (skb2);skb_pull (skb2, offset);skb_reset_network_header (skb2); eiph =ip_hdr (skb2); +if (eiph->version !=4 || eiph->ihl <5 ) + goto out;/* Try to guess incoming interface */ rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL, eiph->saddr,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 39/277 eth: fbnic: Account for page fragments when updating BDQ tail
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dimitri Daskalakis <[email protected]>
[ Upstream commit b38c55320bf85a84a4f04803c57b261fc87e9b4b ]
FBNIC supports fixed size buffers of 4K. When PAGE_SIZE > 4K, we fragment the page across multiple descriptors (FBNIC_BD_FRAG_COUNT). When refilling the BDQ, the correct number of entries are populated, but tail was only incremented by one. So on a system with 64K pages, HW would get one descriptor refilled for every 16 we populate.
Additionally, we program the ring size in the HW when enabling the BDQ. This was not accounting for page fragments, so on systems with 64K pages, the HW used 1/16th of the ring.
--- drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/meta/fbnic/fbnic_txrx.c +3 -3
@@ -925,7 +925,7 @@ static void fbnic_fill_bdq(struct fbnic_ring *bdq)/* Force DMA writes to flush before writing to tail */ dma_wmb (); -writel (i, bdq->doorbell); +writel (i *FBNIC_BD_FRAG_COUNT , bdq->doorbell); } }
@@ -2546,7 +2546,7 @@ static void fbnic_enable_bdq(struct fbnic_ring *hpq, struct fbnic_ring *ppq) hpq->tail =0 ; hpq->head =0 ; - log_size =fls (hpq->size_mask); + log_size =fls (hpq->size_mask) +ilog2 (FBNIC_BD_FRAG_COUNT );/* Store descriptor ring address and size */ fbnic_ring_wr32 (hpq,FBNIC_QUEUE_BDQ_HPQ_BAL ,lower_32_bits (hpq->dma));
@@ -2558,7 +2558,7 @@ static void fbnic_enable_bdq(struct fbnic_ring *hpq, struct fbnic_ring *ppq)if (!ppq->size_mask) goto write_ctl; - log_size =fls (ppq->size_mask); + log_size =fls (ppq->size_mask) +ilog2 (FBNIC_BD_FRAG_COUNT );/* Add enabling of PPQ to BDQ control */ bdq_ctl |=FBNIC_QUEUE_BDQ_CTL_PPQ_ENABLE ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 40/277 bridge: br_nd_send: linearize skb before parsing ND options
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yang <[email protected]>
[ Upstream commit a01aee7cafc575bb82f5529e8734e7052f9b16ea ]
br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are in the linear part of request.
Its callers only guarantee that the ICMPv6 header and target address are available, so the option area can still be non-linear. Parsing ns->opt[] in that case can access data past the linear buffer.
Linearize request before option parsing and derive ns from the linear network header.
--- net/bridge/br_arp_nd_proxy.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
net/bridge/br_arp_nd_proxy.c +7 -5
@@ -251,12 +251,12 @@ struct nd_msg *br_is_nd_neigh_msg(const struct sk_buff *skb, struct nd_msg *msg)static void br_nd_send (struct net_bridge *br,struct net_bridge_port *p,struct sk_buff *request,struct neighbour *n, -__be16 vlan_proto,u16 vlan_tci,struct nd_msg *ns) +__be16 vlan_proto,u16 vlan_tci) {struct net_device *dev = request->dev;struct net_bridge_vlan_group *vg; +struct nd_msg *na, *ns;struct sk_buff *reply; -struct nd_msg *na;struct ipv6hdr *pip6;int na_olen =8 ;/* opt hdr + ETH_ALEN for target */ int ns_olen;
@@ -264,7 +264,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,u8 *daddr;u16 pvid; -if (!dev) +if (!dev ||skb_linearize (request))return ; len = LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) +
@@ -281,6 +281,8 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,skb_set_mac_header (reply,0 ); daddr =eth_hdr (request)->h_source; + ns = (struct nd_msg *)(skb_network_header (request) + +sizeof (struct ipv6hdr ));/* Do we need option processing ? */ ns_olen = request->len - (skb_network_offset(request) +
@@ -472,9 +474,9 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,if (vid !=0 )br_nd_send (br, p, skb, n, skb->vlan_proto, -skb_vlan_tag_get (skb), msg); +skb_vlan_tag_get (skb));else -br_nd_send (br, p, skb, n,0 ,0 , msg); +br_nd_send (br, p, skb, n,0 ,0 ); replied = true; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 41/277 net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit 4576100b8cd03118267513cafacde164b498b322 ]
m2sm() converts a u32 slope to a u64 scaled value. For large inputs (e.g. m1=4000000000), the result can reach 2^32. rtsc_min() stores the difference of two such u64 values in a u32 variable dsm and uses it as a divisor. When the difference is exactly 2^32 the truncation yields zero, causing a divide-by-zero oops in the concave-curve intersection path:
Oops: divide error: 0000 RIP: 0010:rtsc_min (net/sched/sch_hfsc.c:601) Call Trace: init_ed (net/sched/sch_hfsc.c:629) hfsc_enqueue (net/sched/sch_hfsc.c:1569) [...]
Widen dsm to u64 and replace do_div() with div64_u64() so the full difference is preserved.
--- net/sched/sch_hfsc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/sched/sch_hfsc.c +2 -2
@@ -555,7 +555,7 @@ static void rtsc_min(struct runtime_sc *rtsc, struct internal_sc *isc, u64 x, u64 y) { u64 y1, y2, dx, dy; -u32 dsm; +u64 dsm;if (isc->sm1 <= isc->sm2) {/* service curve is convex */
@@ -598,7 +598,7 @@ rtsc_min(struct runtime_sc *rtsc, struct internal_sc *isc, u64 x, u64 y)*/ dx = (y1 - y) <<SM_SHIFT ; dsm = isc->sm1 - isc->sm2; -do_div (dx, dsm); + dx =div64_u64 (dx, dsm);/* * check if (x, y1) belongs to the 1st segment of rtsc. * if so, add the offset.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 42/277 net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <[email protected]>
[ Upstream commit eeee5a710f26ce57807024ef330fe5a850eaecd8 ]
In commit 8110633db49d7de2 ("net: sfp-bus: allow SFP quirks to override Autoneg and pause bits") we moved the setting of Autoneg and pause bits before the call to SFP quirk when parsing SFP module support.
Since the quirk for Ubiquiti U-Fiber Instant SFP module zeroes the support bits and sets 1000baseX_Full only, the above mentioned commit changed the overall computed support from
1000baseX_Full, Autoneg, Pause, Asym_Pause
to just
1000baseX_Full.
This broke the SFP module for mvneta, which requires Autoneg for 1000baseX since commit c762b7fac1b249a9 ("net: mvneta: deny disabling autoneg for 802.3z modes").
Fix this by setting back the Autoneg, Pause and Asym_Pause bits in the quirk.
--- drivers/net/phy/sfp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/phy/sfp.c +6 -1
@@ -480,11 +480,16 @@ static void sfp_quirk_ubnt_uf_instant(const struct sfp_eeprom_id *id, {/* Ubiquiti U-Fiber Instant module claims that support all transceiver * types including 10G Ethernet which is not truth. So clear all claimed -* modes and set only one mode which module supports: 1000baseX_Full. +* modes and set only one mode which module supports: 1000baseX_Full, +* along with the Autoneg and pause bits. */ linkmode_zero (caps->link_modes);linkmode_set_bit (ETHTOOL_LINK_MODE_1000baseX_Full_BIT, caps->link_modes); +linkmode_set_bit (ETHTOOL_LINK_MODE_Autoneg_BIT, caps->link_modes); +linkmode_set_bit (ETHTOOL_LINK_MODE_Pause_BIT, caps->link_modes); +linkmode_set_bit (ETHTOOL_LINK_MODE_Asym_Pause_BIT, caps->link_modes); +phy_interface_zero (caps->interfaces);__set_bit (PHY_INTERFACE_MODE_1000BASEX , caps->interfaces); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 43/277 net: enetc: check whether the RSS algorithm is Toeplitz
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit d389954a6cae7bf76b7b082ac3511d177b77ef2d ]
Both ENETC v1 and v4 only provide Toeplitz RSS support. This patch adds a validation check to reject attempts to configure other RSS algorithms, avoiding misleading configuration options for users.
--- drivers/net/ethernet/freescale/enetc/enetc_ethtool.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/freescale/enetc/enetc_ethtool.c +4 -0
@@ -770,6 +770,10 @@ static int enetc_set_rxfh(struct net_device *ndev,struct enetc_si *si = priv->si;int err =0 ; +if (rxfh->hfunc !=ETH_RSS_HASH_NO_CHANGE && + rxfh->hfunc !=ETH_RSS_HASH_TOP ) +return -EOPNOTSUPP ; +/* set hash key, if PF */ if (rxfh->key &&enetc_si_is_pf (si))enetc_set_rss_key (si, rxfh->key);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 44/277 net: enetc: do not allow VF to configure the RSS key
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit a142d139168cce8d5776245b5494c7f7f5d7fb7d ]
VFs do not have privilege to configure the RSS key because the registers are owned by the PF. Currently, if VF attempts to configure the RSS key, enetc_set_rxfh() simply skips the configuration and does not generate a warning, which may mislead users into thinking the feature is supported. To improve this situation, add a check to reject RSS key configuration on VFs.
--- drivers/net/ethernet/freescale/enetc/enetc_ethtool.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/enetc/enetc_ethtool.c +5 -1
@@ -775,8 +775,12 @@ static int enetc_set_rxfh(struct net_device *ndev,return -EOPNOTSUPP ;/* set hash key, if PF */ -if (rxfh->key &&enetc_si_is_pf (si)) +if (rxfh->key) { +if (!enetc_si_is_pf (si)) +return -EOPNOTSUPP ; +enetc_set_rss_key (si, rxfh->key); + }/* set RSS table */ if (rxfh->indir)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 45/277 ALSA: usb-audio: Exclude Scarlett Solo 1st Gen from SKIP_IFACE_SETUP
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dag Smedberg <[email protected]>
[ Upstream commit f025ac8c698ac7d29eb3b5025bcdaf7ad675785d ]
Same issue that the Scarlett 2i2 1st Gen had:QUIRK_FLAG_SKIP_IFACE_SETUP causes distorted audio on the Scarlett Solo 1st Gen (1235:801c).
--- sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/quirks.c +1 -0
@@ -2424,6 +2424,7 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { QUIRK_FLAG_VALIDATE_RATES),DEVICE_FLG (0x1235 ,0x8006 ,0 ),/* Focusrite Scarlett 2i2 1st Gen */ DEVICE_FLG (0x1235 ,0x800a ,0 ),/* Focusrite Scarlett 2i4 1st Gen */ +DEVICE_FLG (0x1235 ,0x801c ,0 ),/* Focusrite Scarlett Solo 1st Gen */ VENDOR_FLG (0x1235 ,/* Focusrite Novation */ QUIRK_FLAG_SKIP_IFACE_SETUP ), VENDOR_FLG(0x1511, /* AURALiC */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 46/277 ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jihed Chaibi <[email protected]>
[ Upstream commit 622363757b2286dd2c2984b0d80255cbb35a0495 ]
ep93xx_i2s_enable() calls clk_prepare_enable() on three clocks in sequence (mclk, sclk, lrclk) without checking the return value of any of them. If an intermediate enable fails, the clocks that were already enabled are never rolled back, leaking them until the next disable cycle — which may never come if the stream never started cleanly.
Change ep93xx_i2s_enable() from void to int. Add error checking after each clk_prepare_enable() call and unwind already-enabled clocks on failure. Propagate the error through ep93xx_i2s_startup() and ep93xx_i2s_resume(), both of which already return int.
--- sound/soc/cirrus/ep93xx-i2s.c | 34 ++++++++++++++++++++++++---------- 1 file changed, 24 insertions(+), 10 deletions(-)
sound/soc/cirrus/ep93xx-i2s.c +24 -10
@@ -91,16 +91,28 @@ static inline unsigned ep93xx_i2s_read_reg(struct ep93xx_i2s_info *info,return __raw_readl (info->regs + reg); } -static void ep93xx_i2s_enable (struct ep93xx_i2s_info *info,int stream) +static int ep93xx_i2s_enable (struct ep93xx_i2s_info *info,int stream) {unsigned base_reg; +int err;if ((ep93xx_i2s_read_reg (info,EP93XX_I2S_TX0EN ) &0x1 ) ==0 && (ep93xx_i2s_read_reg (info,EP93XX_I2S_RX0EN ) &0x1 ) ==0 ) {/* Enable clocks */ -clk_prepare_enable (info->mclk); -clk_prepare_enable (info->sclk); -clk_prepare_enable (info->lrclk); + err =clk_prepare_enable (info->mclk); +if (err) +return err; + err =clk_prepare_enable (info->sclk); +if (err) { +clk_disable_unprepare (info->mclk); +return err; + } + err =clk_prepare_enable (info->lrclk); +if (err) { +clk_disable_unprepare (info->sclk); +clk_disable_unprepare (info->mclk); +return err; + }/* Enable i2s */ ep93xx_i2s_write_reg (info,EP93XX_I2S_GLCTRL ,1 );
@@ -119,6 +131,8 @@ static void ep93xx_i2s_enable(struct ep93xx_i2s_info *info, int stream)ep93xx_i2s_write_reg (info,EP93XX_I2S_TXCTRL ,EP93XX_I2S_TXCTRL_TXEMPTY_LVL |EP93XX_I2S_TXCTRL_TXUFIE ); + +return 0 ; }static void ep93xx_i2s_disable (struct ep93xx_i2s_info *info,int stream)
@@ -195,9 +209,7 @@ static int ep93xx_i2s_startup(struct snd_pcm_substream *substream, {struct ep93xx_i2s_info *info =snd_soc_dai_get_drvdata (dai); -ep93xx_i2s_enable (info, substream->stream); - -return 0 ; +return ep93xx_i2s_enable (info, substream->stream); } static void ep93xx_i2s_shutdown(struct snd_pcm_substream *substream,
@@ -373,14 +385,16 @@ static int ep93xx_i2s_suspend(struct snd_soc_component *component)static int ep93xx_i2s_resume (struct snd_soc_component *component) {struct ep93xx_i2s_info *info =snd_soc_component_get_drvdata (component); +int err;if (!snd_soc_component_active (component))return 0 ; -ep93xx_i2s_enable (info,SNDRV_PCM_STREAM_PLAYBACK ); -ep93xx_i2s_enable (info,SNDRV_PCM_STREAM_CAPTURE ); + err =ep93xx_i2s_enable (info,SNDRV_PCM_STREAM_PLAYBACK ); +if (err) +return err; -return 0 ; +return ep93xx_i2s_enable (info,SNDRV_PCM_STREAM_CAPTURE ); }#else #define ep93xx_i2s_suspend NULL
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 47/277 ipv6: prevent possible UaF in addrconf_permanent_addr()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit fd63f185979b047fb22a0dfc6bd94d0cab6a6a70 ]
The mentioned helper try to warn the user about an exceptional condition, but the message is delivered too late, accessing the ipv6 after its possible deletion.
Reorder the statement to avoid the possible UaF; while at it, place the warning outside the idev->lock as it needs no protection.
--- net/ipv6/addrconf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/ipv6/addrconf.c +3 -3
@@ -3621,12 +3621,12 @@ static void addrconf_permanent_addr(struct net *net, struct net_device *dev)if ((ifp->flags &IFA_F_PERMANENT ) &&fixup_permanent_addr (net, idev, ifp) <0 ) {write_unlock_bh (&idev->lock); -in6_ifa_hold (ifp); -ipv6_del_addr (ifp); -write_lock_bh (&idev->lock);net_info_ratelimited ("%s: Failed to add prefix route for address %pI6c; dropping\n" , idev->dev->name, &ifp->addr); +in6_ifa_hold (ifp); +ipv6_del_addr (ifp); +write_lock_bh (&idev->lock); } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 48/277 net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit 514aac3599879a7ed48b7dc19e31145beb6958ac ]
In order to properly cleanup hw rx QDMA queues and bring the device to the initial state, reset rx DMA queue head/tail index. Moreover, reset queued DMA descriptor fields.
--- drivers/net/ethernet/airoha/airoha_eth.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
drivers/net/ethernet/airoha/airoha_eth.c +17 -1
@@ -806,18 +806,34 @@ static int airoha_qdma_init_rx_queue(struct airoha_queue *q,static void airoha_qdma_cleanup_rx_queue (struct airoha_queue *q) { -struct airoha_eth *eth = q->qdma->eth; +struct airoha_qdma *qdma = q->qdma; +struct airoha_eth *eth = qdma->eth; +int qid = q - &qdma->q_rx[0 ];while (q->queued) {struct airoha_queue_entry *e = &q->entry[q->tail]; +struct airoha_qdma_desc *desc = &q->desc[q->tail];struct page *page =virt_to_head_page (e->buf);dma_sync_single_for_cpu (eth->dev, e->dma_addr, e->dma_len,page_pool_get_dma_dir (q->page_pool));page_pool_put_full_page (q->page_pool, page, false); +/* Reset DMA descriptor */ +WRITE_ONCE (desc->ctrl,0 ); +WRITE_ONCE (desc->addr,0 ); +WRITE_ONCE (desc->data,0 ); +WRITE_ONCE (desc->msg0,0 ); +WRITE_ONCE (desc->msg1,0 ); +WRITE_ONCE (desc->msg2,0 ); +WRITE_ONCE (desc->msg3,0 ); + q->tail = (q->tail +1 ) % q->ndesc; q->queued--; } + + q->head = q->tail; +airoha_qdma_rmw (qdma,REG_RX_DMA_IDX (qid),RX_RING_DMA_IDX_MASK , +FIELD_PREP (RX_RING_DMA_IDX_MASK , q->tail)); }static int airoha_qdma_init_rx (struct airoha_qdma *qdma)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 49/277 net: introduce mangleid_features
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit 31c5a71d982b57df75858974634c2f0a338f2fc6 ]
Some/most devices implementing gso_partial need to disable the GSO partial features when the IP ID can't be mangled; to that extend each of them implements something alike the following[1]:
if (skb->encapsulation && !(features & NETIF_F_TSO_MANGLEID)) features &= ~NETIF_F_TSO;
in the ndo_features_check() op, which leads to a bit of duplicate code.
Later patch in the series will implement GSO partial support for virtual devices, and the current status quo will require more duplicate code and a new indirect call in the TX path for them.
Introduce the mangleid_features mask, allowing the core to disable NIC features based on/requiring MANGLEID, without any further intervention from the driver.
The same functionality could be alternatively implemented adding a single boolean flag to the struct net_device, but would require an additional checks in ndo_features_check().
Also note that [1] is incorrect if the NIC additionally implements NETIF_F_GSO_UDP_L4, mangleid_features transparently handle even such a case.
Stable-dep-of: ddc748a391dd ("net: use skb_header_pointer() for TCPv4 GSO frag_off check")
--- include/linux/netdevice.h | 3 +++ net/core/dev.c | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-)
include/linux/netdevice.h +3 -0
@@ -1817,6 +1817,8 @@ enum netdev_reg_state {* * @mpls_features: Mask of features inheritable by MPLS * @gso_partial_features: value(s) from NETIF_F_GSO\* +* @mangleid_features: Mask of features requiring MANGLEID, will be +* disabled together with the latter. * * @ifindex: interface index * @group: The group the device belongs to
@@ -2205,6 +2207,7 @@ struct net_device {netdev_features_t vlan_features;netdev_features_t hw_enc_features;netdev_features_t mpls_features; +netdev_features_t mangleid_features;unsigned int min_mtu;unsigned int max_mtu;
net/core/dev.c +4 -1
@@ -3795,7 +3795,7 @@ static netdev_features_t gso_features_check(const struct sk_buff *skb, inner_ip_hdr(skb) : ip_hdr(skb);if (!(iph->frag_off &htons (IP_DF ))) - features &= ~NETIF_F_TSO_MANGLEID ; + features &= ~dev->mangleid_features; }/* NETIF_F_IPV6_CSUM does not support IPv6 extension headers,
@@ -11295,6 +11295,9 @@ int register_netdevice(struct net_device *dev)if (dev->hw_enc_features &NETIF_F_TSO ) dev->hw_enc_features |=NETIF_F_TSO_MANGLEID ; +/* TSO_MANGLEID belongs in mangleid_features by definition */ + dev->mangleid_features |=NETIF_F_TSO_MANGLEID ; +/* Make NETIF_F_HIGHDMA inheritable to VLAN devices. */ dev->vlan_features |=NETIF_F_HIGHDMA ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 50/277 net: use skb_header_pointer() for TCPv4 GSO frag_off check
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoyu Su <[email protected]>
[ Upstream commit ddc748a391dd8642ba6b2e4fe22e7f2ddf84b7f0 ]
Syzbot reported a KMSAN uninit-value warning in gso_features_check() called from netif_skb_features() [1].
gso_features_check() reads iph->frag_off to decide whether to clear mangleid_features. Accessing the IPv4 header via ip_hdr()/inner_ip_hdr() can rely on skb header offsets that are not always safe for direct dereference on packets injected from PF_PACKET paths.
Use skb_header_pointer() for the TCPv4 frag_off check so the header read is robust whether data is already linear or needs copying.
[1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407
--- net/core/dev.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
net/core/dev.c +8 -3
@@ -3791,10 +3791,15 @@ static netdev_features_t gso_features_check(const struct sk_buff *skb,* segmentation-offloads.rst). */ if (skb_shinfo (skb)->gso_type &SKB_GSO_TCPV4 ) { -struct iphdr *iph = skb->encapsulation ? -inner_ip_hdr (skb) :ip_hdr (skb); +const struct iphdr *iph; +struct iphdr _iph; +int nhoff = skb->encapsulation ? +skb_inner_network_offset (skb) : +skb_network_offset (skb); -if (!(iph->frag_off &htons (IP_DF ))) + iph =skb_header_pointer (skb, nhoff,sizeof (_iph), &_iph); + +if (!iph || !(iph->frag_off &htons (IP_DF ))) features &= ~dev->mangleid_features; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 51/277 net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yochai Eisenrich <[email protected]>
[ Upstream commit e6e3eb5ee89ac4c163d46429391c889a1bb5e404 ]
When building netlink messages, tc_chain_fill_node() never initializes the tcm_info field of struct tcmsg. Since the allocation is not zeroed, kernel heap memory is leaked to userspace through this 4-byte field.
The fix simply zeroes tcm_info alongside the other fields that are already initialized.
--- net/sched/cls_api.c | 1 + 1 file changed, 1 insertion(+)
net/sched/cls_api.c +1 -0
@@ -2969,6 +2969,7 @@ static int tc_chain_fill_node(const struct tcf_proto_ops *tmplt_ops, tcm->tcm__pad1 =0 ; tcm->tcm__pad2 =0 ; tcm->tcm_handle =0 ; + tcm->tcm_info =0 ;if (block->q) { tcm->tcm_ifindex =qdisc_dev (block->q)->ifindex; tcm->tcm_parent = block->q->handle;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 52/277 bnxt_en: set backing store type from query type
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 4ee937107d52f9e5c350e4b5e629760e328b3d9f ]
bnxt_hwrm_func_backing_store_qcaps_v2() stores resp->type from the firmware response in ctxm->type and later uses that value to index fixed backing-store metadata arrays such as ctx_arr[] and bnxt_bstore_to_trace[].
ctxm->type is fixed by the current backing-store query type and matches the array index of ctx->ctx_arr. Set ctxm->type from the current loop variable instead of depending on resp->type.
Also update the loop to advance type from next_valid_type in the for statement, which keeps the control flow simpler for non-valid and unchanged entries.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +4 -4
@@ -8607,7 +8607,7 @@ static int bnxt_hwrm_func_backing_store_qcaps_v2(struct bnxt *bp)struct hwrm_func_backing_store_qcaps_v2_output *resp;struct hwrm_func_backing_store_qcaps_v2_input *req;struct bnxt_ctx_mem_info *ctx = bp->ctx; -u16 type; +u16 type, next_type =0 ;int rc; rc =hwrm_req_init (bp, req,HWRM_FUNC_BACKING_STORE_QCAPS_V2 );
@@ -8623,7 +8623,7 @@ static int bnxt_hwrm_func_backing_store_qcaps_v2(struct bnxt *bp) resp =hwrm_req_hold (bp, req); -for (type =0 ; type <BNXT_CTX_V2_MAX ; ) { +for (type =0 ; type <BNXT_CTX_V2_MAX ; type = next_type) {struct bnxt_ctx_mem_type *ctxm = &ctx->ctx_arr[type];u8 init_val, init_off, i;u32 max_entries;
@@ -8636,7 +8636,7 @@ static int bnxt_hwrm_func_backing_store_qcaps_v2(struct bnxt *bp)if (rc) goto ctx_done; flags =le32_to_cpu (resp->flags); - type =le16_to_cpu (resp->next_valid_type); + next_type =le16_to_cpu (resp->next_valid_type);if (!(flags &BNXT_CTX_MEM_TYPE_VALID )) {bnxt_free_one_ctx_mem (bp, ctxm, true);continue ;
@@ -8651,7 +8651,7 @@ static int bnxt_hwrm_func_backing_store_qcaps_v2(struct bnxt *bp)else continue ; } - ctxm->type =le16_to_cpu (resp->type); + ctxm->type = type; ctxm->entry_size = entry_size; ctxm->flags = flags; ctxm->instance_bmap =le32_to_cpu (resp->instance_bit_map);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 53/277 crypto: algif_aead - Revert to operating out-of-place
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 ]
This mostly reverts commit 72548b093ee3 except for the copying of the associated data.
There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
--- crypto/af_alg.c | 49 ++++---------------- crypto/algif_aead.c | 100 ++++++++-------------------------------- crypto/algif_skcipher.c | 6 +-- include/crypto/if_alg.h | 5 +- 4 files changed, 34 insertions(+), 126 deletions(-)
crypto/af_alg.c +10 -39
@@ -637,15 +637,13 @@ static int af_alg_alloc_tsgl(struct sock *sk)/** * af_alg_count_tsgl - Count number of TX SG entries * -* The counting starts from the beginning of the SGL to @bytes. If -* an @offset is provided, the counting of the SG entries starts at the @offset. +* The counting starts from the beginning of the SGL to @bytes. * * @sk: socket of connection to user space * @bytes: Count the number of SG entries holding given number of bytes. -* @offset: Start the counting of SG entries from the given offset. * Return: Number of TX SG entries found given the constraints */ -unsigned int af_alg_count_tsgl (struct sock *sk,size_t bytes,size_t offset) +unsigned int af_alg_count_tsgl (struct sock *sk,size_t bytes) {const struct alg_sock *ask =alg_sk (sk);const struct af_alg_ctx *ctx = ask->private;
@@ -660,25 +658,11 @@ unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset)const struct scatterlist *sg = sgl->sg;for (i =0 ; i < sgl->cur; i++) { -size_t bytes_count; - -/* Skip offset */ -if (offset >= sg[i].length) { - offset -= sg[i].length; - bytes -= sg[i].length; -continue ; - } - - bytes_count = sg[i].length - offset; - - offset =0 ; sgl_count++; - -/* If we have seen requested number of bytes, stop */ -if (bytes_count >= bytes) +if (sg[i].length >= bytes)return sgl_count; - bytes -= bytes_count; + bytes -= sg[i].length; } }
@@ -690,19 +674,14 @@ EXPORT_SYMBOL_GPL(af_alg_count_tsgl);* af_alg_pull_tsgl - Release the specified buffers from TX SGL * * If @dst is non-null, reassign the pages to @dst. The caller must release -* the pages. If @dst_offset is given only reassign the pages to @dst starting -* at the @dst_offset (byte). The caller must ensure that @dst is large -* enough (e.g. by using af_alg_count_tsgl with the same offset). +* the pages. * * @sk: socket of connection to user space * @used: Number of bytes to pull from TX SGL * @dst: If non-NULL, buffer is reassigned to dst SGL instead of releasing. The * caller must release the buffers in dst. -* @dst_offset: Reassign the TX SGL from given offset. All buffers before -* reaching the offset is released. */ -void af_alg_pull_tsgl (struct sock *sk,size_t used,struct scatterlist *dst, -size_t dst_offset) +void af_alg_pull_tsgl (struct sock *sk,size_t used,struct scatterlist *dst) {struct alg_sock *ask =alg_sk (sk);struct af_alg_ctx *ctx = ask->private;
@@ -727,18 +706,10 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,* SG entries in dst. */ if (dst) { -if (dst_offset >= plen) { -/* discard page before offset */ - dst_offset -= plen; - }else { -/* reassign page to dst after offset */ -get_page (page); -sg_set_page (dst + j, page, - plen - dst_offset, - sg[i].offset + dst_offset); - dst_offset =0 ; - j++; - } +/* reassign page to dst after offset */ +get_page (page); +sg_set_page (dst + j, page, plen, sg[i].offset); + j++; } sg[i].length -= plen;
crypto/algif_aead.c +19 -81
141 lines not on this page · raw message
crypto/algif_skcipher.c +3 -3
@@ -138,7 +138,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,* Create a per request TX SGL for this request which tracks the * SG entries from the global TX SGL. */ - areq->tsgl_entries =af_alg_count_tsgl (sk, len,0 ); + areq->tsgl_entries =af_alg_count_tsgl (sk, len);if (!areq->tsgl_entries) areq->tsgl_entries =1 ; areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl),
@@ -149,7 +149,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg, goto free; }sg_init_table (areq->tsgl, areq->tsgl_entries); -af_alg_pull_tsgl (sk, len, areq->tsgl,0 ); +af_alg_pull_tsgl (sk, len, areq->tsgl);/* Initialize the crypto operation */ skcipher_request_set_tfm (&areq->cra_u.skcipher_req, tfm);
@@ -363,7 +363,7 @@ static void skcipher_sock_destruct(struct sock *sk)struct alg_sock *pask =alg_sk (psk);struct crypto_skcipher *tfm = pask->private; -af_alg_pull_tsgl (sk, ctx->used,NULL ,0 ); +af_alg_pull_tsgl (sk, ctx->used,NULL );sock_kzfree_s (sk, ctx->iv,crypto_skcipher_ivsize (tfm));if (ctx->state)sock_kzfree_s (sk, ctx->state,crypto_skcipher_statesize (tfm));
include/crypto/if_alg.h +2 -3
@@ -230,9 +230,8 @@ static inline bool af_alg_readable(struct sock *sk)return PAGE_SIZE <=af_alg_rcvbuf (sk); } -unsigned int af_alg_count_tsgl (struct sock *sk,size_t bytes,size_t offset); -void af_alg_pull_tsgl (struct sock *sk,size_t used,struct scatterlist *dst, -size_t dst_offset); +unsigned int af_alg_count_tsgl (struct sock *sk,size_t bytes); +void af_alg_pull_tsgl (struct sock *sk,size_t used,struct scatterlist *dst);void af_alg_wmem_wakeup (struct sock *sk);int af_alg_wait_for_data (struct sock *sk,unsigned flags,unsigned min); int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 54/277 crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit e02494114ebf7c8b42777c6cd6982f113bfdbec7 ]
When decrypting data that is not in-place (src != dst), there is no need to save the high-order sequence bits in dst as it could simply be re-copied from the source.
However, the data to be hashed need to be rearranged accordingly.
Thanks,
--- crypto/authencesn.c | 48 +++++++++++++++++++++++++++------------------ 1 file changed, 29 insertions(+), 19 deletions(-)
crypto/authencesn.c +29 -19
@@ -207,6 +207,7 @@ static int crypto_authenc_esn_decrypt_tail(struct aead_request *req,u8 *ohash = areq_ctx->tail;unsigned int cryptlen = req->cryptlen - authsize;unsigned int assoclen = req->assoclen; +struct scatterlist *src = req->src;struct scatterlist *dst = req->dst;u8 *ihash = ohash +crypto_ahash_digestsize (auth);u32 tmp[2 ];
@@ -214,23 +215,27 @@ static int crypto_authenc_esn_decrypt_tail(struct aead_request *req,if (!authsize) goto decrypt; -/* Move high-order bits of sequence number back. */ -scatterwalk_map_and_copy (tmp, dst,4 ,4 ,0 ); -scatterwalk_map_and_copy (tmp +1 , dst, assoclen + cryptlen,4 ,0 ); -scatterwalk_map_and_copy (tmp, dst,0 ,8 ,1 ); +if (src == dst) { +/* Move high-order bits of sequence number back. */ +scatterwalk_map_and_copy (tmp, dst,4 ,4 ,0 ); +scatterwalk_map_and_copy (tmp +1 , dst, assoclen + cryptlen,4 ,0 ); +scatterwalk_map_and_copy (tmp, dst,0 ,8 ,1 ); + }else +memcpy_sglist (dst, src, assoclen);if (crypto_memneq (ihash, ohash, authsize))return -EBADMSG ; decrypt: -sg_init_table (areq_ctx->dst,2 ); +if (src != dst) + src =scatterwalk_ffwd (areq_ctx->src, src, assoclen); dst =scatterwalk_ffwd (areq_ctx->dst, dst, assoclen);skcipher_request_set_tfm (skreq, ctx->enc);skcipher_request_set_callback (skreq, flags, req->base.complete, req->base.data); -skcipher_request_set_crypt (skreq, dst, dst, cryptlen, req->iv); +skcipher_request_set_crypt (skreq, src, dst, cryptlen, req->iv);return crypto_skcipher_decrypt (skreq); }
@@ -255,6 +260,7 @@ static int crypto_authenc_esn_decrypt(struct aead_request *req)unsigned int assoclen = req->assoclen;unsigned int cryptlen = req->cryptlen;u8 *ihash = ohash +crypto_ahash_digestsize (auth); +struct scatterlist *src = req->src;struct scatterlist *dst = req->dst;u32 tmp[2 ];int err;
@@ -262,24 +268,28 @@ static int crypto_authenc_esn_decrypt(struct aead_request *req)if (assoclen <8 )return -EINVAL ; - cryptlen -= authsize; - -if (req->src != dst) -memcpy_sglist (dst, req->src, assoclen + cryptlen); +if (!authsize) + goto tail; + cryptlen -= authsize;scatterwalk_map_and_copy (ihash, req->src, assoclen + cryptlen, authsize,0 ); -if (!authsize) - goto tail; -/* Move high-order bits of sequence number to the end. */ -scatterwalk_map_and_copy (tmp, dst,0 ,8 ,0 ); -scatterwalk_map_and_copy (tmp, dst,4 ,4 ,1 ); -scatterwalk_map_and_copy (tmp +1 , dst, assoclen + cryptlen,4 ,1 ); - -sg_init_table (areq_ctx->dst,2 ); - dst =scatterwalk_ffwd (areq_ctx->dst, dst,4 ); +scatterwalk_map_and_copy (tmp, src,0 ,8 ,0 ); +if (src == dst) { +scatterwalk_map_and_copy (tmp, dst,4 ,4 ,1 ); +scatterwalk_map_and_copy (tmp +1 , dst, assoclen + cryptlen,4 ,1 ); + dst =scatterwalk_ffwd (areq_ctx->dst, dst,4 ); + }else { +scatterwalk_map_and_copy (tmp, dst,0 ,4 ,1 ); +scatterwalk_map_and_copy (tmp +1 , dst, assoclen + cryptlen -4 ,4 ,1 ); + + src =scatterwalk_ffwd (areq_ctx->src, src,8 ); + dst =scatterwalk_ffwd (areq_ctx->dst, dst,4 ); +memcpy_sglist (dst, src, assoclen + cryptlen -8 ); + dst = req->dst; + }ahash_request_set_tfm (ahreq, auth);ahash_request_set_crypt (ahreq, dst, ohash, assoclen + cryptlen);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 55/277 net: bonding: fix use-after-free in bond_xmit_broadcast()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit 2884bf72fb8f03409e423397319205de48adca16 ]
bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concurrent slave enslave/release can mutate the slave list during RCU-protected iteration, changing which slave is "last" mid-loop. This causes the original skb to be double-consumed (double-freed).
Replace the racy bond_is_last_slave() check with a simple index comparison (i + 1 == slaves_count) against the pre-snapshot slave count taken via READ_ONCE() before the loop. This preserves the zero-copy optimization for the last slave while making the "last" determination stable against concurrent list mutations.
The UAF can trigger the following crash:
==================================================================
BUG: KASAN: slab-use-after-free in skb_clone Read of size 8 at addr ffff888100ef8d40 by task exploit/147 CPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:597) skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334) bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593) dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887) __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838) ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136) ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219) ip6_output (net/ipv6/ip6_output.c:250) ip6_send_skb (net/ipv6/ip6_output.c:1985) udp_v6_send_skb (net/ipv6/udp.c:1442) udpv6_sendmsg (net/ipv6/udp.c:1733) __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Allocated by task 147: Freed by task 147: The buggy address belongs to the object at ffff888100ef8c80 which belongs to the cache skbuff_head_cache of size 224
The buggy address is located 192 bytes inside of
freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60)
Memory state around the buggy address:
ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================--- drivers/net/bonding/bond_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/bonding/bond_main.c +1 -1
@@ -5300,7 +5300,7 @@ static netdev_tx_t bond_xmit_broadcast(struct sk_buff *skb,if (!(bond_slave_is_up (slave) && slave->link ==BOND_LINK_UP ))continue ; -if (bond_is_last_slave (bond, slave)) { +if (i +1 == slaves_count) { skb2 = skb; skb_used = true; }else {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 56/277 NFC: pn533: bound the UART receive buffer
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 30fe3f5f6494f827d812ff179f295a8e532709d6 ]
pn532_receive_buf() appends every incoming byte to dev->recv_skb and only resets the buffer after pn532_uart_rx_is_frame() recognizes a complete frame. A continuous stream of bytes without a valid PN532 frame header therefore keeps growing the skb until skb_put_u8() hits the tail limit.
Drop the accumulated partial frame once the fixed receive buffer is full so malformed UART traffic cannot grow the skb past PN532_UART_SKB_BUFF_LEN.
--- drivers/nfc/pn533/uart.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/nfc/pn533/uart.c +3 -0
@@ -211,6 +211,9 @@ static size_t pn532_receive_buf(struct serdev_device *serdev,timer_delete (&dev->cmd_timeout);for (i =0 ; i < count; i++) { +if (unlikely (!skb_tailroom (dev->recv_skb))) +skb_trim (dev->recv_skb,0 ); +skb_put_u8 (dev->recv_skb, *data++);if (!pn532_uart_rx_is_frame (dev->recv_skb))continue ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 57/277 net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suraj Gupta <[email protected]>
[ Upstream commit 393e0b4f178ec7fce1141dacc3304e3607a92ee9 ]
The XAXIDMA_BD_CTRL_LENGTH_MASK and XAXIDMA_BD_STS_ACTUAL_LEN_MASK macros were defined as 0x007FFFFF (23 bits), but the AXI DMA IP product guide (PG021) specifies the buffer length field as bits 25:0 (26 bits). Update both masks to match the IP documentation.
In practice this had no functional impact, since Ethernet frames are far smaller than 2^23 bytes and the extra bits were always zero, but the masks should still reflect the hardware specification.
--- drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/xilinx/xilinx_axienet.h +2 -2
@@ -105,7 +105,7 @@#define XAXIDMA_BD_HAS_DRE_MASK 0xF00/* Whether has DRE mask */ #define XAXIDMA_BD_WORDLEN_MASK 0xFF/* Whether has DRE mask */ -#define XAXIDMA_BD_CTRL_LENGTH_MASK 0x007FFFFF/* Requested len */ +#define XAXIDMA_BD_CTRL_LENGTH_MASK GENMASK(25, 0)/* Requested len */ #define XAXIDMA_BD_CTRL_TXSOF_MASK 0x08000000/* First tx packet */ #define XAXIDMA_BD_CTRL_TXEOF_MASK 0x04000000/* Last tx packet */ #define XAXIDMA_BD_CTRL_ALL_MASK 0x0C000000/* All control bits */
@@ -130,7 +130,7 @@#define XAXIDMA_BD_CTRL_TXEOF_MASK 0x04000000/* Last tx packet */ #define XAXIDMA_BD_CTRL_ALL_MASK 0x0C000000/* All control bits */ -#define XAXIDMA_BD_STS_ACTUAL_LEN_MASK 0x007FFFFF/* Actual len */ +#define XAXIDMA_BD_STS_ACTUAL_LEN_MASK GENMASK(25, 0)/* Actual len */ #define XAXIDMA_BD_STS_COMPLETE_MASK 0x80000000/* Completed */ #define XAXIDMA_BD_STS_DEC_ERR_MASK 0x40000000/* Decode error */ #define XAXIDMA_BD_STS_SLV_ERR_MASK 0x20000000/* Slave error */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 58/277 net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suraj Gupta <[email protected]>
[ Upstream commit d1978d03e86785872871bff9c2623174b10740de ]
When a TX packet spans multiple buffer descriptors (scatter-gather), axienet_free_tx_chain sums the per-BD actual length from descriptor status into a caller-provided accumulator. That sum is reset on each NAPI poll. If the BDs for a single packet complete across different polls, the earlier bytes are lost and never credited to BQL. This causes BQL to think bytes are permanently in-flight, eventually stalling the TX queue.
The SKB pointer is stored only on the last BD of a packet. When that BD completes, use skb->len for the byte count instead of summing per-BD status lengths. This matches netdev_sent_queue(), which debits skb->len, and naturally survives across polls because no partial packet contributes to the accumulator.
--- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/net/ethernet/xilinx/xilinx_axienet_main.c +4 -5
@@ -770,8 +770,8 @@ static int axienet_device_reset(struct net_device *ndev)* @first_bd: Index of first descriptor to clean up * @nr_bds: Max number of descriptors to clean up * @force: Whether to clean descriptors even if not complete -* @sizep: Pointer to a u32 filled with the total sum of all bytes -* in all cleaned-up descriptors. Ignored if NULL. +* @sizep: Pointer to a u32 accumulating the total byte count of +* completed packets (using skb->len). Ignored if NULL. * @budget: NAPI budget (use 0 when not called from NAPI poll) * * Would either be called after a successful transmit operation, or after
@@ -805,6 +805,8 @@ static int axienet_free_tx_chain(struct axienet_local *lp, u32 first_bd, DMA_TO_DEVICE);if (cur_p->skb && (status &XAXIDMA_BD_STS_COMPLETE_MASK )) { +if (sizep) + *sizep += cur_p->skb->len;napi_consume_skb (cur_p->skb, budget); packets++; }
@@ -818,9 +820,6 @@ static int axienet_free_tx_chain(struct axienet_local *lp, u32 first_bd,wmb (); cur_p->cntrl =0 ; cur_p->status =0 ; - -if (sizep) - *sizep += status &XAXIDMA_BD_STS_ACTUAL_LEN_MASK ; }if (!force) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 59/277 ASoC: Intel: boards: fix unmet dependency on PINCTRL
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Braha <[email protected]>
[ Upstream commit e920c36f2073d533bdf19ba6ab690432c8173b63 ]
This reverts commit c073f0757663 ("ASoC: Intel: sof_sdw: select PINCTRL_CS42L43 and SPI_CS42L43")
Currently, SND_SOC_INTEL_SOUNDWIRE_SOF_MACH selects PINCTRL_CS42L43 without also selecting or depending on PINCTRL, despite PINCTRL_CS42L43 depending on PINCTRL.
See the following Kbuild warning:
WARNING: unmet direct dependencies detected for PINCTRL_CS42L43
Depends on [n]: PINCTRL [=n] && MFD_CS42L43 [=m]
Selected by [m]:
- SND_SOC_INTEL_SOUNDWIRE_SOF_MACH [=m] && SOUND [=y] && SND [=m] && SND_SOC [=m] && SND_SOC_INTEL_MACH [=y] && (SND_SOC_SOF_INTEL_COMMON [=m] || !SND_SOC_SOF_INTEL_COMMON [=m]) && SND_SOC_SOF_INTEL_SOUNDWIRE [=m] && I2C [=y] && SPI_MASTER [=y] && ACPI [=y] && (MFD_INTEL_LPSS [=n] || COMPILE_TEST [=y]) && (SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES [=n] || COMPILE_TEST [=y]) && SOUNDWIRE [=m]
In response to v1 of this patch [1], Arnd pointed out that there is no compile-time dependency sof_sdw and the PINCTRL_CS42L43 driver. After testing, I can confirm that the kernel compiled with SND_SOC_INTEL_SOUNDWIRE_SOF_MACH enabled and PINCTRL_CS42L43 disabled.
This unmet dependency was detected by kconfirm, a static analysis tool for Kconfig.
--- sound/soc/intel/boards/Kconfig | 2 -- 1 file changed, 2 deletions(-)
sound/soc/intel/boards/Kconfig +0 -2
@@ -525,8 +525,6 @@ config SND_SOC_INTEL_SOUNDWIRE_SOF_MACH select SND_SOC_CS42L43_SDW select MFD_CS42L43 select MFD_CS42L43_SDW - select PINCTRL_CS42L43 - select SPI_CS42L43 select SND_SOC_CS35L56_SPI select SND_SOC_CS35L56_SDW select SND_SOC_DMIC
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 60/277 bpf: Fix regsafe() for pointers to packet
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Starovoitov <[email protected]>
[ Upstream commit a8502a79e832b861e99218cbd2d8f4312d62e225 ]
In case rold->reg->range == BEYOND_PKT_END && rcur->reg->range == N regsafe() may return true which may lead to current state with valid packet range not being explored. Fix the bug.
--- kernel/bpf/verifier.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
kernel/bpf/verifier.c +6 -1
@@ -18985,8 +18985,13 @@ static bool regsafe(struct bpf_verifier_env *env, struct bpf_reg_state *rold,* since someone could have accessed through (ptr - k), or * even done ptr -= k in a register, to get a safe access. */ -if (rold->range > rcur->range) +if (rold->range <0 || rcur->range <0 ) { +/* special case for [BEYOND|AT]_PKT_END */ +if (rold->range != rcur->range) +return false; + }else if (rold->range > rcur->range) {return false; + }/* If the offsets don't match, we can't trust our alignment; * nor can we be sure that we won't fall out of range. */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 61/277 net: ipv6: flowlabel: defer exclusive option free until RCU teardown
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengchuan Liang <[email protected]>
[ Upstream commit 9ca562bb8e66978b53028fa32b1a190708e6a091 ]
ip6fl_seq_show() walks the global flowlabel hash under the seq-file RCU read-side lock and prints fl->opt->opt_nflen when an option block is present.
Exclusive flowlabels currently free fl->opt as soon as fl->users drops to zero in fl_release(). However, the surrounding struct ip6_flowlabel remains visible in the global hash table until later garbage collection removes it and fl_free_rcu() finally tears it down.
A concurrent /proc/net/ip6_flowlabel reader can therefore race that early kfree() and dereference freed option state, triggering a crash in ip6fl_seq_show().
Fix this by keeping fl->opt alive until fl_free_rcu(). That matches the lifetime already required for the enclosing flowlabel while readers can still reach it under RCU.
--- net/ipv6/ip6_flowlabel.c | 5 ----- 1 file changed, 5 deletions(-)
net/ipv6/ip6_flowlabel.c +0 -5
@@ -133,11 +133,6 @@ static void fl_release(struct ip6_flowlabel *fl)if (time_after (ttd, fl->expires)) fl->expires = ttd; ttd = fl->expires; -if (fl->opt && fl->share ==IPV6_FL_S_EXCL ) { -struct ipv6_txoptions *opt = fl->opt; - fl->opt =NULL ; -kfree (opt); - }if (!timer_pending (&ip6_fl_gc_timer) ||time_after (ip6_fl_gc_timer.expires, ttd))mod_timer (&ip6_fl_gc_timer, ttd);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 62/277 mptcp: add eat_recv_skb helper
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit 436510df0cafb1bc36f12e92e0e76599be28d8f4 ]
This patch extracts the free skb related code in __mptcp_recvmsg_mskq() into a new helper mptcp_eat_recv_skb().
This new helper will be used in the next patch.
Stable-dep-of: 5dd8025a49c2 ("mptcp: fix soft lockup in mptcp_recvmsg()")
--- net/mptcp/protocol.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
net/mptcp/protocol.c +12 -7
@@ -1963,6 +1963,17 @@ static int mptcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)static void mptcp_rcv_space_adjust (struct mptcp_sock *msk,int copied); +static void mptcp_eat_recv_skb (struct sock *sk,struct sk_buff *skb) +{ +/* avoid the indirect call, we know the destructor is sock_rfree */ + skb->destructor =NULL ; + skb->sk =NULL ; +atomic_sub (skb->truesize, &sk->sk_rmem_alloc); +sk_mem_uncharge (sk, skb->truesize); +__skb_unlink (skb, &sk->sk_receive_queue); +skb_attempt_defer_free (skb); +} + static int __mptcp_recvmsg_mskq(struct sock *sk, struct msghdr *msg, size_t len, int flags, int copied_total, struct scm_timestamping_internal *tss,
@@ -2017,13 +2028,7 @@ static int __mptcp_recvmsg_mskq(struct sock *sk, struct msghdr *msg,break ; } -/* avoid the indirect call, we know the destructor is sock_rfree */ - skb->destructor =NULL ; - skb->sk =NULL ; -atomic_sub (skb->truesize, &sk->sk_rmem_alloc); -sk_mem_uncharge (sk, skb->truesize); -__skb_unlink (skb, &sk->sk_receive_queue); -skb_attempt_defer_free (skb); +mptcp_eat_recv_skb (sk, skb); }if (copied >= len)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 63/277 mptcp: fix soft lockup in mptcp_recvmsg()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Xiasong <[email protected]>
[ Upstream commit 5dd8025a49c268ab6b94d978532af3ad341132a7 ]
syzbot reported a soft lockup in mptcp_recvmsg() [0].
When receiving data with MSG_PEEK | MSG_WAITALL flags, the skb is not removed from the sk_receive_queue. This causes sk_wait_data() to always find available data and never perform actual waiting, leading to a soft lockup.
Fix this by adding a 'last' parameter to track the last peeked skb. This allows sk_wait_data() to make informed waiting decisions and prevent infinite loops when MSG_PEEK is used.
[0]:
watchdog: BUG: soft lockup - CPU#2 stuck for 156s! [server:1963] Modules linked in: CPU: 2 UID: 0 PID: 1963 Comm: server Not tainted 6.19.0-rc8 #61 PREEMPT(none) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:sk_wait_data+0x15/0x190 Code: 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 56 41 55 41 54 49 89 f4 55 48 89 d5 53 48 89 fb <48> 83 ec 30 65 48 8b 05 17 a4 6b 01 48 89 44 24 28 31 c0 65 48 8b RSP: 0018:ffffc90000603ca0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff888102bf0800 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffc90000603d18 RDI: ffff888102bf0800 RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000101 R10: 0000000000000000 R11: 0000000000000075 R12: ffffc90000603d18 R13: ffff888102bf0800 R14: ffff888102bf0800 R15: 0000000000000000 FS: 00007f6e38b8c4c0(0000) GS:ffff8881b877e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055aa7bff1680 CR3: 0000000105cbe000 CR4: 00000000000006f0 Call Trace: <TASK> mptcp_recvmsg+0x547/0x8c0 net/mptcp/protocol.c:2329 inet_recvmsg+0x11f/0x130 net/ipv4/af_inet.c:891 sock_recvmsg+0x94/0xc0 net/socket.c:1100 __sys_recvfrom+0xb2/0x130 net/socket.c:2256 __x64_sys_recvfrom+0x1f/0x30 net/socket.c:2267 do_syscall_64+0x59/0x2d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:131 RIP: 0033:0x7f6e386a4a1d Code: 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8d 05 f1 de 2c 00 41 89 ca 8b 00 85 c0 75 20 45 31 c9 45 31 c0 b8 2d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 6b f3 c3 66 0f 1f 84 00 00 00 00 00 41 56 41 RSP: 002b:00007ffc3c4bb078 EFLAGS: 00000246 ORIG_RAX: 000000000000002d RAX: ffffffffffffffda RBX: 000000000000861e RCX: 00007f6e386a4a1d RDX: 00000000000003ff RSI: 00007ffc3c4bb150 RDI: 0000000000000004 RBP: 00007ffc3c4bb570 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000103 R11: 0000000000000246 R12: 00005605dbc00be0 R13: 00007ffc3c4bb650 R14: 0000000000000000 R15: 0000000000000000 </TASK>
--- net/mptcp/protocol.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
net/mptcp/protocol.c +8 -3
@@ -1977,7 +1977,7 @@ static void mptcp_eat_recv_skb(struct sock *sk, struct sk_buff *skb)static int __mptcp_recvmsg_mskq (struct sock *sk,struct msghdr *msg,size_t len,int flags,int copied_total,struct scm_timestamping_internal *tss, -int *cmsg_flags) +int *cmsg_flags,struct sk_buff **last) {struct mptcp_sock *msk =mptcp_sk (sk);struct sk_buff *skb, *tmp;
@@ -1994,6 +1994,7 @@ static int __mptcp_recvmsg_mskq(struct sock *sk, struct msghdr *msg,/* skip already peeked skbs */ if (total_data_len + data_len <= copied_total) { total_data_len += data_len; + *last = skb;continue ; }
@@ -2029,6 +2030,8 @@ static int __mptcp_recvmsg_mskq(struct sock *sk, struct msghdr *msg, }mptcp_eat_recv_skb (sk, skb); + }else { + *last = skb; }if (copied >= len)
@@ -2223,10 +2226,12 @@ static int mptcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, cmsg_flags =MPTCP_CMSG_INQ ;while (copied < len) { +struct sk_buff *last =NULL ;int err, bytes_read; bytes_read =__mptcp_recvmsg_mskq (sk, msg, len - copied, flags, - copied, &tss, &cmsg_flags); + copied, &tss, &cmsg_flags, + &last);if (unlikely (bytes_read <0 )) {if (!copied) copied = bytes_read;
@@ -2278,7 +2283,7 @@ static int mptcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,pr_debug ("block timeout %ld\n" , timeo);mptcp_cleanup_rbuf (msk, copied); - err =sk_wait_data (sk, &timeo,NULL ); + err =sk_wait_data (sk, &timeo, last);if (err <0 ) { err = copied ? : err; goto out_err;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 64/277 net: stmmac: skip VLAN restore when VLAN hash ops are missing
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Piekos <[email protected]>
[ Upstream commit 48b3cd69265f346f64b93064723492da46206e9b ]
stmmac_vlan_restore() unconditionally calls stmmac_vlan_update() when NETIF_F_VLAN_FEATURES is set. On platforms where priv->hw->vlan (or ->update_vlan_hash) is not provided, stmmac_update_vlan_hash() returns -EINVAL via stmmac_do_void_callback(), resulting in a spurious "Failed to restore VLANs" error even when no VLAN filtering is in use.
Remove not needed comment.
Remove not used return value from stmmac_vlan_restore().
Tested on Orange Pi Zero 3.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +4 -10
@@ -139,7 +139,7 @@ static void stmmac_tx_timer_arm(struct stmmac_priv *priv, u32 queue);static void stmmac_flush_tx_descriptors (struct stmmac_priv *priv,int queue);static void stmmac_set_dma_operation_mode (struct stmmac_priv *priv,u32 txmode,u32 rxmode,u32 chan); -static int stmmac_vlan_restore (struct stmmac_priv *priv); +static void stmmac_vlan_restore (struct stmmac_priv *priv);#ifdef CONFIG_DEBUG_FS static const struct net_device_ops stmmac_netdev_ops;
@@ -6668,21 +6668,15 @@ static int stmmac_vlan_rx_kill_vid(struct net_device *ndev, __be16 proto, u16 vireturn ret; } -static int stmmac_vlan_restore (struct stmmac_priv *priv) +static void stmmac_vlan_restore (struct stmmac_priv *priv) { -int ret; -if (!(priv->dev->features &NETIF_F_VLAN_FEATURES )) -return 0 ; +return ;if (priv->hw->num_vlan)stmmac_restore_hw_vlan_rx_fltr (priv, priv->dev, priv->hw); - ret =stmmac_vlan_update (priv, priv->num_double_vlans); -if (ret) -netdev_err (priv->dev,"Failed to restore VLANs\n" ); - -return ret; +stmmac_vlan_update (priv, priv->num_double_vlans); }static int stmmac_bpf (struct net_device *dev,struct netdev_bpf *bpf)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 65/277 ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen (8016) from SKIP_IFACE_SETUP
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geoffrey D. Bennett <[email protected]>
[ Upstream commit a0dafdbd1049a8ea661a1a471be1b840bd8aed13 ]
Same issue as the other 1st Gen Scarletts: QUIRK_FLAG_SKIP_IFACE_SETUP causes distorted audio on this revision of the Scarlett 2i2 1st Gen (1235:8016).
--- sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/quirks.c +1 -0
@@ -2424,6 +2424,7 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { QUIRK_FLAG_VALIDATE_RATES),DEVICE_FLG (0x1235 ,0x8006 ,0 ),/* Focusrite Scarlett 2i2 1st Gen */ DEVICE_FLG (0x1235 ,0x800a ,0 ),/* Focusrite Scarlett 2i4 1st Gen */ +DEVICE_FLG (0x1235 ,0x8016 ,0 ),/* Focusrite Scarlett 2i2 1st Gen */ DEVICE_FLG (0x1235 ,0x801c ,0 ),/* Focusrite Scarlett Solo 1st Gen */ VENDOR_FLG (0x1235 ,/* Focusrite Novation */ QUIRK_FLAG_SKIP_IFACE_SETUP),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 66/277 netfilter: flowtable: strictly check for maximum number of actions
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 76522fcdbc3a02b568f5d957f7e66fc194abb893 ]
The maximum number of flowtable hardware offload actions in IPv6 is:
* ethernet mangling (4 payload actions, 2 for each ethernet address)
* SNAT (4 payload actions)
* DNAT (4 payload actions)
* Double VLAN (4 vlan actions, 2 for popping vlan, and 2 for pushing) for QinQ.
* Redirect (1 action)
Which makes 17, while the maximum is 16. But act_ct supports for tunnels actions too. Note that payload action operates at 32-bit word level, so mangling an IPv6 address takes 4 payload actions.
Update flow_action_entry_next() calls to check for the maximum number of supported actions.
While at it, rise the maximum number of actions per flow from 16 to 24 so this works fine with IPv6 setups.
--- net/netfilter/nf_flow_table_offload.c | 196 +++++++++++++++++--------- 1 file changed, 130 insertions(+), 66 deletions(-)
net/netfilter/nf_flow_table_offload.c +130 -66
@@ -13,6 +13,8 @@#include <net/netfilter/nf_conntrack_core.h> #include <net/netfilter/nf_conntrack_tuple.h> +#define NF_FLOW_RULE_ACTION_MAX 24 +static struct workqueue_struct *nf_flow_offload_add_wq;static struct workqueue_struct *nf_flow_offload_del_wq;static struct workqueue_struct *nf_flow_offload_stats_wq;
@@ -215,7 +217,12 @@ static void flow_offload_mangle(struct flow_action_entry *entry,static inline struct flow_action_entry *flow_action_entry_next (struct nf_flow_rule *flow_rule) { -int i = flow_rule->rule->action.num_entries++; +int i; + +if (unlikely (flow_rule->rule->action.num_entries >=NF_FLOW_RULE_ACTION_MAX )) +return NULL ; + + i = flow_rule->rule->action.num_entries++;return &flow_rule->rule->action.entries[i]; }
@@ -233,6 +240,9 @@ static int flow_offload_eth_src(struct net *net,u32 mask, val;u16 val16; +if (!entry0 || !entry1) +return -E2BIG ; + this_tuple = &flow->tuplehash[dir].tuple;switch (this_tuple->xmit_type) {
@@ -283,6 +293,9 @@ static int flow_offload_eth_dst(struct net *net,u8 nud_state;u16 val16; +if (!entry0 || !entry1) +return -E2BIG ; + this_tuple = &flow->tuplehash[dir].tuple;switch (this_tuple->xmit_type) {
@@ -324,16 +337,19 @@ static int flow_offload_eth_dst(struct net *net,return 0 ; } -static void flow_offload_ipv4_snat (struct net *net, -const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_ipv4_snat (struct net *net, +const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {struct flow_action_entry *entry =flow_action_entry_next (flow_rule);u32 mask = ~htonl (0xffffffff );__be32 addr;u32 offset; +if (!entry) +return -E2BIG ; +switch (dir) {case FLOW_OFFLOAD_DIR_ORIGINAL : addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY ].tuple.dst_v4.s_addr;
@@ -344,23 +360,27 @@ static void flow_offload_ipv4_snat(struct net *net, offset = offsetof(struct iphdr , daddr);break ;default : -return ; +return -EOPNOTSUPP ; }flow_offload_mangle (entry,FLOW_ACT_MANGLE_HDR_TYPE_IP4 , offset, &addr, &mask); +return 0 ; } -static void flow_offload_ipv4_dnat (struct net *net, -const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_ipv4_dnat (struct net *net, +const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {struct flow_action_entry *entry =flow_action_entry_next (flow_rule);u32 mask = ~htonl (0xffffffff );__be32 addr;u32 offset; +if (!entry) +return -E2BIG ; +switch (dir) {case FLOW_OFFLOAD_DIR_ORIGINAL : addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY ].tuple.src_v4.s_addr;
@@ -371,14 +391,15 @@ static void flow_offload_ipv4_dnat(struct net *net, offset = offsetof(struct iphdr , saddr);break ;default : -return ; +return -EOPNOTSUPP ; }flow_offload_mangle (entry,FLOW_ACT_MANGLE_HDR_TYPE_IP4 , offset, &addr, &mask); +return 0 ; } -static void flow_offload_ipv6_mangle (struct nf_flow_rule *flow_rule, +static int flow_offload_ipv6_mangle (struct nf_flow_rule *flow_rule,unsigned int offset,const __be32 *addr,const __be32 *mask) {
@@ -387,15 +408,20 @@ static void flow_offload_ipv6_mangle(struct nf_flow_rule *flow_rule,for (i =0 ; i <sizeof (struct in6_addr ) /sizeof (u32); i++) { entry =flow_action_entry_next (flow_rule); +if (!entry) +return -E2BIG ; +flow_offload_mangle (entry,FLOW_ACT_MANGLE_HDR_TYPE_IP6 , offset + i *sizeof (u32), &addr[i], mask); } + +return 0 ; } -static void flow_offload_ipv6_snat (struct net *net, -const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_ipv6_snat (struct net *net, +const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {u32 mask = ~htonl (0xffffffff );const __be32 *addr;
@@ -411,16 +437,16 @@ static void flow_offload_ipv6_snat(struct net *net, offset = offsetof(struct ipv6hdr , daddr);break ;default : -return ; +return -EOPNOTSUPP ; } -flow_offload_ipv6_mangle (flow_rule, offset, addr, &mask); +return flow_offload_ipv6_mangle (flow_rule, offset, addr, &mask); } -static void flow_offload_ipv6_dnat (struct net *net, -const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_ipv6_dnat (struct net *net, +const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {u32 mask = ~htonl (0xffffffff );const __be32 *addr;
@@ -436,10 +462,10 @@ static void flow_offload_ipv6_dnat(struct net *net, offset = offsetof(struct ipv6hdr , saddr);break ;default : -return ; +return -EOPNOTSUPP ; } -flow_offload_ipv6_mangle (flow_rule, offset, addr, &mask); +return flow_offload_ipv6_mangle (flow_rule, offset, addr, &mask); }static int flow_offload_l4proto (const struct flow_offload *flow)
@@ -461,15 +487,18 @@ static int flow_offload_l4proto(const struct flow_offload *flow)return type; } -static void flow_offload_port_snat (struct net *net, -const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_port_snat (struct net *net, +const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {struct flow_action_entry *entry =flow_action_entry_next (flow_rule);u32 mask, port;u32 offset; +if (!entry) +return -E2BIG ; +switch (dir) {case FLOW_OFFLOAD_DIR_ORIGINAL : port =ntohs (flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY ].tuple.dst_port);
@@ -484,22 +513,26 @@ static void flow_offload_port_snat(struct net *net, mask = ~htonl (0xffff );break ;default : -return ; +return -EOPNOTSUPP ; }flow_offload_mangle (entry,flow_offload_l4proto (flow), offset, &port, &mask); +return 0 ; } -static void flow_offload_port_dnat (struct net *net, -const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_port_dnat (struct net *net, +const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {struct flow_action_entry *entry =flow_action_entry_next (flow_rule);u32 mask, port;u32 offset; +if (!entry) +return -E2BIG ; +switch (dir) {case FLOW_OFFLOAD_DIR_ORIGINAL : port =ntohs (flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY ].tuple.src_port);
@@ -514,20 +547,24 @@ static void flow_offload_port_dnat(struct net *net, mask = ~htonl (0xffff0000 );break ;default : -return ; +return -EOPNOTSUPP ; }flow_offload_mangle (entry,flow_offload_l4proto (flow), offset, &port, &mask); +return 0 ; } -static void flow_offload_ipv4_checksum (struct net *net, -const struct flow_offload *flow, -struct nf_flow_rule *flow_rule) +static int flow_offload_ipv4_checksum (struct net *net, +const struct flow_offload *flow, +struct nf_flow_rule *flow_rule) {u8 protonum = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL ].tuple.l4proto;struct flow_action_entry *entry =flow_action_entry_next (flow_rule); +if (!entry) +return -E2BIG ; + entry->id =FLOW_ACTION_CSUM ; entry->csum_flags =TCA_CSUM_UPDATE_FLAG_IPV4HDR ;
@@ -539,12 +576,14 @@ static void flow_offload_ipv4_checksum(struct net *net, entry->csum_flags |=TCA_CSUM_UPDATE_FLAG_UDP ;break ; } + +return 0 ; } -static void flow_offload_redirect (struct net *net, -const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_redirect (struct net *net, +const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {const struct flow_offload_tuple *this_tuple, *other_tuple;struct flow_action_entry *entry;
@@ -562,21 +601,28 @@ static void flow_offload_redirect(struct net *net, ifindex = other_tuple->iifidx;break ;default : -return ; +return -EOPNOTSUPP ; } dev =dev_get_by_index (net, ifindex);if (!dev) -return ; +return -ENODEV ; entry =flow_action_entry_next (flow_rule); +if (!entry) { +dev_put (dev); +return -E2BIG ; + } + entry->id =FLOW_ACTION_REDIRECT ; entry->dev = dev; + +return 0 ; } -static void flow_offload_encap_tunnel (const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_encap_tunnel (const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {const struct flow_offload_tuple *this_tuple;struct flow_action_entry *entry;
@@ -584,7 +630,7 @@ static void flow_offload_encap_tunnel(const struct flow_offload *flow, this_tuple = &flow->tuplehash[dir].tuple;if (this_tuple->xmit_type ==FLOW_OFFLOAD_XMIT_DIRECT ) -return ; +return 0 ; dst = this_tuple->dst_cache;if (dst && dst->lwtstate) {
@@ -593,15 +639,19 @@ static void flow_offload_encap_tunnel(const struct flow_offload *flow, tun_info =lwt_tun_info (dst->lwtstate);if (tun_info && (tun_info->mode &IP_TUNNEL_INFO_TX )) { entry =flow_action_entry_next (flow_rule); +if (!entry) +return -E2BIG ; entry->id =FLOW_ACTION_TUNNEL_ENCAP ; entry->tunnel = tun_info; } } + +return 0 ; } -static void flow_offload_decap_tunnel (const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_decap_tunnel (const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {const struct flow_offload_tuple *other_tuple;struct flow_action_entry *entry;
@@ -609,7 +659,7 @@ static void flow_offload_decap_tunnel(const struct flow_offload *flow, other_tuple = &flow->tuplehash[!dir].tuple;if (other_tuple->xmit_type ==FLOW_OFFLOAD_XMIT_DIRECT ) -return ; +return 0 ; dst = other_tuple->dst_cache;if (dst && dst->lwtstate) {
@@ -618,9 +668,13 @@ static void flow_offload_decap_tunnel(const struct flow_offload *flow, tun_info =lwt_tun_info (dst->lwtstate);if (tun_info && (tun_info->mode &IP_TUNNEL_INFO_TX )) { entry =flow_action_entry_next (flow_rule); +if (!entry) +return -E2BIG ; entry->id =FLOW_ACTION_TUNNEL_DECAP ; } } + +return 0 ; } static int
@@ -632,8 +686,9 @@ nf_flow_rule_route_common(struct net *net, const struct flow_offload *flow,const struct flow_offload_tuple *tuple;int i; -flow_offload_decap_tunnel (flow, dir, flow_rule); -flow_offload_encap_tunnel (flow, dir, flow_rule); +if (flow_offload_decap_tunnel (flow, dir, flow_rule) <0 || +flow_offload_encap_tunnel (flow, dir, flow_rule) <0 ) +return -1 ;if (flow_offload_eth_src (net, flow, dir, flow_rule) <0 ||flow_offload_eth_dst (net, flow, dir, flow_rule) <0 )
@@ -649,6 +704,8 @@ nf_flow_rule_route_common(struct net *net, const struct flow_offload *flow,if (tuple->encap[i].proto ==htons (ETH_P_8021Q )) { entry =flow_action_entry_next (flow_rule); +if (!entry) +return -1 ; entry->id =FLOW_ACTION_VLAN_POP ; } }
@@ -662,6 +719,8 @@ nf_flow_rule_route_common(struct net *net, const struct flow_offload *flow,continue ; entry =flow_action_entry_next (flow_rule); +if (!entry) +return -1 ;switch (other_tuple->encap[i].proto) {case htons (ETH_P_PPP_SES ):
@@ -687,18 +746,22 @@ int nf_flow_rule_route_ipv4(struct net *net, struct flow_offload *flow,return -1 ;if (test_bit (NF_FLOW_SNAT , &flow->flags)) { -flow_offload_ipv4_snat (net, flow, dir, flow_rule); -flow_offload_port_snat (net, flow, dir, flow_rule); +if (flow_offload_ipv4_snat (net, flow, dir, flow_rule) <0 || +flow_offload_port_snat (net, flow, dir, flow_rule) <0 ) +return -1 ; }if (test_bit (NF_FLOW_DNAT , &flow->flags)) { -flow_offload_ipv4_dnat (net, flow, dir, flow_rule); -flow_offload_port_dnat (net, flow, dir, flow_rule); +if (flow_offload_ipv4_dnat (net, flow, dir, flow_rule) <0 || +flow_offload_port_dnat (net, flow, dir, flow_rule) <0 ) +return -1 ; }if (test_bit (NF_FLOW_SNAT , &flow->flags) ||test_bit (NF_FLOW_DNAT , &flow->flags)) -flow_offload_ipv4_checksum (net, flow, flow_rule); +if (flow_offload_ipv4_checksum (net, flow, flow_rule) <0 ) +return -1 ; -flow_offload_redirect (net, flow, dir, flow_rule); +if (flow_offload_redirect (net, flow, dir, flow_rule) <0 ) +return -1 ;return 0 ; }
@@ -712,22 +775,23 @@ int nf_flow_rule_route_ipv6(struct net *net, struct flow_offload *flow,return -1 ;if (test_bit (NF_FLOW_SNAT , &flow->flags)) { -flow_offload_ipv6_snat (net, flow, dir, flow_rule); -flow_offload_port_snat (net, flow, dir, flow_rule); +if (flow_offload_ipv6_snat (net, flow, dir, flow_rule) <0 || +flow_offload_port_snat (net, flow, dir, flow_rule) <0 ) +return -1 ; }if (test_bit (NF_FLOW_DNAT , &flow->flags)) { -flow_offload_ipv6_dnat (net, flow, dir, flow_rule); -flow_offload_port_dnat (net, flow, dir, flow_rule); +if (flow_offload_ipv6_dnat (net, flow, dir, flow_rule) <0 || +flow_offload_port_dnat (net, flow, dir, flow_rule) <0 ) +return -1 ; } -flow_offload_redirect (net, flow, dir, flow_rule); +if (flow_offload_redirect (net, flow, dir, flow_rule) <0 ) +return -1 ;return 0 ; }EXPORT_SYMBOL_GPL (nf_flow_rule_route_ipv6); -#define NF_FLOW_RULE_ACTION_MAX 16 -static struct nf_flow_rule * nf_flow_offload_rule_alloc(struct net *net, const struct flow_offload_work *offload,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 67/277 netfilter: nfnetlink_log: account for netlink header size
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 6d52a4a0520a6696bdde51caa11f2d6821cd0c01 ]
This is a followup to an old bug fix: NLMSG_DONE needs to account for the netlink header size, not just the attribute size.
This can result in a WARN splat + drop of the netlink message, but other than this there are no ill effects.
--- net/netfilter/nfnetlink_log.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nfnetlink_log.c +1 -1
@@ -726,7 +726,7 @@ nfulnl_log_packet(struct net *net, +nla_total_size (plen)/* prefix */ +nla_total_size (sizeof (struct nfulnl_msg_packet_hw )) +nla_total_size (sizeof (struct nfulnl_msg_packet_timestamp )) - +nla_total_size (sizeof (struct nfgenmsg ));/* NLMSG_DONE */ + +nlmsg_total_size (sizeof (struct nfgenmsg ));/* NLMSG_DONE */ if (in &&skb_mac_header_was_set (skb)) { size +=nla_total_size (skb->dev->hard_header_len)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 68/277 netfilter: x_tables: ensure names are nul-terminated
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit a958a4f90ddd7de0800b33ca9d7b886b7d40f74e ]
Reject names that lack a \0 character before feeding them to functions that expect c-strings.
Fixes tag is the most recent commit that needs this change.
--- net/netfilter/xt_cgroup.c | 6 ++++++ net/netfilter/xt_rateest.c | 5 +++++ 2 files changed, 11 insertions(+)
net/netfilter/xt_cgroup.c +6 -0
@@ -65,6 +65,9 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par) info->priv =NULL ;if (info->has_path) { +if (strnlen (info->path,sizeof (info->path)) >=sizeof (info->path)) +return -ENAMETOOLONG ; + cgrp =cgroup_get_from_path (info->path);if (IS_ERR (cgrp)) { pr_info_ratelimited("invalid path, errno=%ld\n",
@@ -102,6 +105,9 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par) info->priv =NULL ;if (info->has_path) { +if (strnlen (info->path,sizeof (info->path)) >=sizeof (info->path)) +return -ENAMETOOLONG ; + cgrp =cgroup_get_from_path (info->path);if (IS_ERR (cgrp)) { pr_info_ratelimited("invalid path, errno=%ld\n",
net/netfilter/xt_rateest.c +5 -0
@@ -91,6 +91,11 @@ static int xt_rateest_mt_checkentry(const struct xt_mtchk_param *par) goto err1; } +if (strnlen (info->name1,sizeof (info->name1)) >=sizeof (info->name1)) +return -ENAMETOOLONG ; +if (strnlen (info->name2,sizeof (info->name2)) >=sizeof (info->name2)) +return -ENAMETOOLONG ; + ret = -ENOENT ; est1 =xt_rateest_lookup (par->net, info->name1);if (!est1)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 69/277 netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit b7e8590987aa94c9dc51518fad0e58cb887b1db5 ]
IPSET_ATTR_NAME and IPSET_ATTR_NAMEREF are of NLA_STRING type, they cannot be treated like a c-string.
They either have to be switched to NLA_NUL_STRING, or the compare operations need to use the nla functions.
--- include/linux/netfilter/ipset/ip_set.h | 2 +- net/netfilter/ipset/ip_set_core.c | 4 ++-- net/netfilter/ipset/ip_set_list_set.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-)
include/linux/netfilter/ipset/ip_set.h +1 -1
@@ -309,7 +309,7 @@ enum {/* register and unregister set references */ extern ip_set_id_t ip_set_get_byname (struct net *net, -const char *name,struct ip_set **set); +const struct nlattr *name,struct ip_set **set);extern void ip_set_put_byindex (struct net *net,ip_set_id_t index);extern void ip_set_name_byindex (struct net *net,ip_set_id_t index,char *name);extern ip_set_id_t ip_set_nfnl_get_byindex (struct net *net,ip_set_id_t index);
net/netfilter/ipset/ip_set_core.c +2 -2
@@ -821,7 +821,7 @@ EXPORT_SYMBOL_GPL(ip_set_del);* */ ip_set_id_t -ip_set_get_byname (struct net *net,const char *name,struct ip_set **set) +ip_set_get_byname (struct net *net,const struct nlattr *name,struct ip_set **set) {ip_set_id_t i, index =IPSET_INVALID_ID ;struct ip_set *s;
@@ -830,7 +830,7 @@ ip_set_get_byname(struct net *net, const char *name, struct ip_set **set)rcu_read_lock ();for (i =0 ; i < inst->ip_set_max; i++) { s =rcu_dereference (inst->ip_set_list)[i]; -if (s &&STRNCMP (s->name, name)) { +if (s &&nla_strcmp (name, s->name) ==0 ) {__ip_set_get (s); index = i; *set = s;
net/netfilter/ipset/ip_set_list_set.c +2 -2
@@ -367,7 +367,7 @@ list_set_uadt(struct ip_set *set, struct nlattr *tb[], ret =ip_set_get_extensions (set, tb, &ext);if (ret)return ret; - e.id =ip_set_get_byname (map->net,nla_data (tb[IPSET_ATTR_NAME ]), &s); + e.id =ip_set_get_byname (map->net, tb[IPSET_ATTR_NAME ], &s);if (e.id ==IPSET_INVALID_ID )return -IPSET_ERR_NAME ;/* "Loop detection" */
@@ -389,7 +389,7 @@ list_set_uadt(struct ip_set *set, struct nlattr *tb[],if (tb[IPSET_ATTR_NAMEREF ]) { e.refid =ip_set_get_byname (map->net, -nla_data (tb[IPSET_ATTR_NAMEREF ]), + tb[IPSET_ATTR_NAMEREF ], &s);if (e.refid ==IPSET_INVALID_ID ) { ret = -IPSET_ERR_NAMEREF ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 70/277 netfilter: nf_conntrack_helper: pass helper to expect cleanup
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Tang <[email protected]>
[ Upstream commit a242a9ae58aa46ff7dae51ce64150a93957abe65 ]
nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() to remove expectations belonging to the helper being unregistered. However, it passes NULL instead of the helper pointer as the data argument, so expect_iter_me() never matches any expectation and all of them survive the cleanup.
After unregister returns, nfnl_cthelper_del() frees the helper object immediately. Subsequent expectation dumps or packet-driven init_conntrack() calls then dereference the freed exp->helper, causing a use-after-free.
Pass the actual helper pointer so expectations referencing it are properly destroyed before the helper object is freed.
BUG: KASAN: slab-use-after-free in string+0x38f/0x430 Read of size 1 at addr ffff888003b14d20 by task poc/103 Call Trace: string+0x38f/0x430 vsnprintf+0x3cc/0x1170 seq_printf+0x17a/0x240 exp_seq_show+0x2e5/0x560 seq_read_iter+0x419/0x1280 proc_reg_read+0x1ac/0x270 vfs_read+0x179/0x930 ksys_read+0xef/0x1c0 Freed by task 103: The buggy address is located 32 bytes inside of freed 192-byte region [ffff888003b14d00, ffff888003b14dc0)
--- net/netfilter/nf_conntrack_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_conntrack_helper.c +1 -1
@@ -419,7 +419,7 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)*/ synchronize_rcu (); -nf_ct_expect_iterate_destroy (expect_iter_me,NULL ); +nf_ct_expect_iterate_destroy (expect_iter_me, me);nf_ct_iterate_destroy (unhelp, me); }EXPORT_SYMBOL_GPL (nf_conntrack_helper_unregister);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 71/277 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Tang <[email protected]>
[ Upstream commit 35177c6877134a21315f37d57a5577846225623e ]
ctnetlink_alloc_expect() allocates expectations from a non-zeroing slab cache via nf_ct_expect_alloc(). When CTA_EXPECT_NAT is not present in the netlink message, saved_addr and saved_proto are never initialized. Stale data from a previous slab occupant can then be dumped to userspace by ctnetlink_exp_dump_expect(), which checks these fields to decide whether to emit CTA_EXPECT_NAT.
The safe sibling nf_ct_expect_init(), used by the packet path, explicitly zeroes these fields.
Zero saved_addr, saved_proto and dir in the else branch, guarded by IS_ENABLED(CONFIG_NF_NAT) since these fields only exist when NAT is enabled.
Confirmed by priming the expect slab with NAT-bearing expectations, freeing them, creating a new expectation without CTA_EXPECT_NAT, and observing that the ctnetlink dump emits a spurious CTA_EXPECT_NAT containing stale data from the prior allocation.
--- net/netfilter/nf_conntrack_netlink.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/netfilter/nf_conntrack_netlink.c +6 -0
@@ -3576,6 +3576,12 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, exp, nf_ct_l3num(ct));if (err <0 ) goto err_out; +#if IS_ENABLED (CONFIG_NF_NAT ) + } else { +memset (&exp->saved_addr,0 ,sizeof (exp->saved_addr)); +memset (&exp->saved_proto,0 ,sizeof (exp->saved_proto)); + exp->dir =0 ; +#endif }return exp; err_out:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 72/277 netfilter: nf_conntrack_expect: honor expectation helper field
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 9c42bc9db90a154bc61ae337a070465f3393485a ]
The expectation helper field is mostly unused. As a result, the netfilter codebase relies on accessing the helper through exp->master.
Always set on the expectation helper field so it can be used to reach the helper.
nf_ct_expect_init() is called from packet path where the skb owns the ct object, therefore accessing exp->master for the newly created expectation is safe. This saves a lot of updates in all callsites to pass the ct object as parameter to nf_ct_expect_init().
This is a preparation patches for follow up fixes.
Stable-dep-of: 917b61fa2042 ("netfilter: ctnetlink: ignore explicit helper on new expectations")
--- include/net/netfilter/nf_conntrack_expect.h | 2 +- net/netfilter/nf_conntrack_broadcast.c | 2 +- net/netfilter/nf_conntrack_expect.c | 14 +++++++++++++- net/netfilter/nf_conntrack_h323_main.c | 12 ++++++------ net/netfilter/nf_conntrack_helper.c | 7 ++++++- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nf_conntrack_sip.c | 2 +- 7 files changed, 29 insertions(+), 12 deletions(-)
include/net/netfilter/nf_conntrack_expect.h +1 -1
@@ -40,7 +40,7 @@ struct nf_conntrack_expect { struct nf_conntrack_expect *this);/* Helper to assign to new connection */ -struct nf_conntrack_helper *helper; +struct nf_conntrack_helper __rcu *helper;/* The conntrack of the master connection */ struct nf_conn *master;
net/netfilter/nf_conntrack_broadcast.c +1 -1
@@ -70,7 +70,7 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb, exp->expectfn =NULL ; exp->flags =NF_CT_EXPECT_PERMANENT ; exp->class =NF_CT_EXPECT_CLASS_DEFAULT ; - exp->helper =NULL ; +rcu_assign_pointer (exp->helper, helper);nf_ct_expect_related (exp,0 );nf_ct_expect_put (exp);
net/netfilter/nf_conntrack_expect.c +13 -1
@@ -309,12 +309,19 @@ struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me) }EXPORT_SYMBOL_GPL (nf_ct_expect_alloc); +/* This function can only be used from packet path, where accessing +* master's helper is safe, because the packet holds a reference on +* the conntrack object. Never use it from control plane. +*/ void nf_ct_expect_init (struct nf_conntrack_expect *exp,unsigned int class,u_int8_t family,const union nf_inet_addr *saddr,const union nf_inet_addr *daddr,u_int8_t proto,const __be16 *src,const __be16 *dst) { +struct nf_conntrack_helper *helper =NULL ; +struct nf_conn *ct = exp->master; +struct nf_conn_help *help;int len;if (family ==AF_INET )
@@ -325,7 +332,12 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class, exp->flags =0 ; exp->class = class; exp->expectfn =NULL ; - exp->helper =NULL ; + + help =nfct_help (ct); +if (help) + helper =rcu_dereference (help->helper); + +rcu_assign_pointer (exp->helper, helper); exp->tuple.src.l3num = family; exp->tuple.dst.protonum = proto;
net/netfilter/nf_conntrack_h323_main.c +6 -6
@@ -642,7 +642,7 @@ static int expect_h245(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3, &ct->tuplehash[!dir].tuple.dst.u3, IPPROTO_TCP, NULL, &port); - exp->helper = &nf_conntrack_helper_h245; +rcu_assign_pointer (exp->helper, &nf_conntrack_helper_h245); nathook =rcu_dereference (nfct_h323_nat_hook); if (memcmp(&ct->tuplehash[dir].tuple.src.u3,
@@ -766,7 +766,7 @@ static int expect_callforwarding(struct sk_buff *skb,nf_ct_expect_init (exp,NF_CT_EXPECT_CLASS_DEFAULT ,nf_ct_l3num (ct), &ct->tuplehash[!dir].tuple.src.u3, &addr,IPPROTO_TCP ,NULL , &port); - exp->helper = nf_conntrack_helper_q931; +rcu_assign_pointer (exp->helper, nf_conntrack_helper_q931); nathook =rcu_dereference (nfct_h323_nat_hook); if (memcmp(&ct->tuplehash[dir].tuple.src.u3,
@@ -1233,7 +1233,7 @@ static int expect_q931(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3 : NULL, &ct->tuplehash[!dir].tuple.dst.u3, IPPROTO_TCP, NULL, &port); - exp->helper = nf_conntrack_helper_q931; +rcu_assign_pointer (exp->helper, nf_conntrack_helper_q931); exp->flags =NF_CT_EXPECT_PERMANENT ;/* Accept multiple calls */ nathook =rcu_dereference (nfct_h323_nat_hook);
@@ -1305,7 +1305,7 @@ static int process_gcf(struct sk_buff *skb, struct nf_conn *ct,nf_ct_expect_init (exp,NF_CT_EXPECT_CLASS_DEFAULT ,nf_ct_l3num (ct), &ct->tuplehash[!dir].tuple.src.u3, &addr,IPPROTO_UDP ,NULL , &port); - exp->helper = nf_conntrack_helper_ras; +rcu_assign_pointer (exp->helper, nf_conntrack_helper_ras);if (nf_ct_expect_related (exp,0 ) ==0 ) {pr_debug ("nf_ct_ras: expect RAS " );
@@ -1522,7 +1522,7 @@ static int process_acf(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3, &addr, IPPROTO_TCP, NULL, &port); exp->flags =NF_CT_EXPECT_PERMANENT ; - exp->helper = nf_conntrack_helper_q931; +rcu_assign_pointer (exp->helper, nf_conntrack_helper_q931);if (nf_ct_expect_related (exp,0 ) ==0 ) {pr_debug ("nf_ct_ras: expect Q.931 " );
@@ -1576,7 +1576,7 @@ static int process_lcf(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3, &addr, IPPROTO_TCP, NULL, &port); exp->flags =NF_CT_EXPECT_PERMANENT ; - exp->helper = nf_conntrack_helper_q931; +rcu_assign_pointer (exp->helper, nf_conntrack_helper_q931);if (nf_ct_expect_related (exp,0 ) ==0 ) {pr_debug ("nf_ct_ras: expect Q.931 " );
net/netfilter/nf_conntrack_helper.c +6 -1
@@ -399,7 +399,7 @@ static bool expect_iter_me(struct nf_conntrack_expect *exp, void *data)const struct nf_conntrack_helper *me = data;const struct nf_conntrack_helper *this; -if (exp->helper == me) +if (rcu_access_pointer (exp->helper) == me)return true; this = rcu_dereference_protected(help->helper,
@@ -421,6 +421,11 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)nf_ct_expect_iterate_destroy (expect_iter_me, me);nf_ct_iterate_destroy (unhelp, me); + +/* nf_ct_iterate_destroy() does an unconditional synchronize_rcu() as +* last step, this ensures rcu readers of exp->helper are done. +* No need for another synchronize_rcu() here. +*/ }EXPORT_SYMBOL_GPL (nf_conntrack_helper_unregister);
net/netfilter/nf_conntrack_netlink.c +1 -1
@@ -3566,7 +3566,7 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, exp->class = class; exp->master = ct; - exp->helper = helper; +rcu_assign_pointer (exp->helper, helper); exp->tuple = *tuple; exp->mask.src.u3 = mask->src.u3; exp->mask.src.u.all = mask->src.u.all;
net/netfilter/nf_conntrack_sip.c +1 -1
@@ -1303,7 +1303,7 @@ static int process_register_request(struct sk_buff *skb, unsigned int protoff,nf_ct_expect_init (exp,SIP_EXPECT_SIGNALLING ,nf_ct_l3num (ct), saddr, &daddr, proto,NULL , &port); exp->timeout.expires = sip_timeout *HZ ; - exp->helper = helper; +rcu_assign_pointer (exp->helper, helper); exp->flags =NF_CT_EXPECT_PERMANENT |NF_CT_EXPECT_INACTIVE ; hooks =rcu_dereference (nf_nat_sip_hooks);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 73/277 netfilter: nf_conntrack_expect: use expect->helper
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit f01794106042ee27e54af6fdf5b319a2fe3df94d ]
Use expect->helper in ctnetlink and /proc to dump the helper name. Using nfct_help() without holding a reference to the master conntrack is unsafe.
Use exp->master->helper in ctnetlink path if userspace does not provide an explicit helper when creating an expectation to retain the existing behaviour. The ctnetlink expectation path holds the reference on the master conntrack and nf_conntrack_expect lock and the nfnetlink glue path refers to the master ct that is attached to the skb.
Stable-dep-of: 917b61fa2042 ("netfilter: ctnetlink: ignore explicit helper on new expectations")
--- net/netfilter/nf_conntrack_expect.c | 2 +- net/netfilter/nf_conntrack_helper.c | 6 +----- net/netfilter/nf_conntrack_netlink.c | 24 ++++++++++-------------- net/netfilter/nf_conntrack_sip.c | 2 +- 4 files changed, 13 insertions(+), 21 deletions(-)
net/netfilter/nf_conntrack_expect.c +1 -1
@@ -670,7 +670,7 @@ static int exp_seq_show(struct seq_file *s, void *v)if (expect->flags &NF_CT_EXPECT_USERSPACE )seq_printf (s,"%sUSERSPACE" , delim); - helper =rcu_dereference (nfct_help (expect->master)->helper); + helper =rcu_dereference (expect->helper);if (helper) {seq_printf (s,"%s%s" , expect->flags ?" " :"" , helper->name);if (helper->expect_policy[expect->class].name[0 ])
net/netfilter/nf_conntrack_helper.c +1 -5
@@ -395,14 +395,10 @@ EXPORT_SYMBOL_GPL(nf_conntrack_helper_register);static bool expect_iter_me (struct nf_conntrack_expect *exp,void *data) { -struct nf_conn_help *help =nfct_help (exp->master);const struct nf_conntrack_helper *me = data;const struct nf_conntrack_helper *this; -if (rcu_access_pointer (exp->helper) == me) -return true; - - this =rcu_dereference_protected (help->helper, + this =rcu_dereference_protected (exp->helper,lockdep_is_held (&nf_conntrack_expect_lock));return this == me; }
net/netfilter/nf_conntrack_netlink.c +10 -14
@@ -3005,7 +3005,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb, {struct nf_conn *master = exp->master;long timeout = ((long )exp->timeout.expires - (long )jiffies) /HZ ; -struct nf_conn_help *help; +struct nf_conntrack_helper *helper;#if IS_ENABLED (CONFIG_NF_NAT )struct nlattr *nest_parms;struct nf_conntrack_tuple nat_tuple = {};
@@ -3050,15 +3050,12 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb, nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) || nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class))) goto nla_put_failure; - help =nfct_help (master); -if (help) { -struct nf_conntrack_helper *helper; - helper =rcu_dereference (help->helper); -if (helper && -nla_put_string (skb,CTA_EXPECT_HELP_NAME , helper->name)) - goto nla_put_failure; - } + helper =rcu_dereference (exp->helper); +if (helper && +nla_put_string (skb,CTA_EXPECT_HELP_NAME , helper->name)) + goto nla_put_failure; + expfn =nf_ct_helper_expectfn_find_by_symbol (exp->expectfn);if (expfn !=NULL &&nla_put_string (skb,CTA_EXPECT_FN , expfn->name))
@@ -3387,12 +3384,9 @@ static int ctnetlink_get_expect(struct sk_buff *skb,static bool expect_iter_name (struct nf_conntrack_expect *exp,void *data) {struct nf_conntrack_helper *helper; -const struct nf_conn_help *m_help;const char *name = data; - m_help =nfct_help (exp->master); - - helper =rcu_dereference (m_help->helper); + helper =rcu_dereference (exp->helper);if (!helper)return false;
@@ -3527,9 +3521,9 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,struct nf_conntrack_tuple *tuple, struct nf_conntrack_tuple *mask) { - u_int32_t class = 0; struct nf_conntrack_expect *exp;struct nf_conn_help *help; +u32 class =0 ;int err; help =nfct_help (ct);
@@ -3566,6 +3560,8 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, exp->class = class; exp->master = ct; +if (!helper) + helper =rcu_dereference (help->helper);rcu_assign_pointer (exp->helper, helper); exp->tuple = *tuple; exp->mask.src.u3 = mask->src.u3;
net/netfilter/nf_conntrack_sip.c +1 -1
@@ -924,7 +924,7 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff, exp =__nf_ct_expect_find (net,nf_ct_zone (ct), &tuple);if (!exp || exp->master == ct || -nfct_help (exp->master)->helper !=nfct_help (ct)->helper || + exp->helper !=nfct_help (ct)->helper || exp->class != class)break ;#if IS_ENABLED (CONFIG_NF_NAT )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 74/277 netfilter: nf_conntrack_expect: store netns and zone in expectation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 02a3231b6d82efe750da6554ebf280e4a6f78756 ]
__nf_ct_expect_find() and nf_ct_expect_find_get() are called under rcu_read_lock() but they dereference the master conntrack via exp->master.
Since the expectation does not hold a reference on the master conntrack, this could be dying conntrack or different recycled conntrack than the real master due to SLAB_TYPESAFE_RCU.
Store the netns, the master_tuple and the zone in struct nf_conntrack_expect as a safety measure.
This patch is required by the follow up fix not to dump expectations that do not belong to this netns.
Stable-dep-of: 917b61fa2042 ("netfilter: ctnetlink: ignore explicit helper on new expectations")
--- include/net/netfilter/nf_conntrack_expect.h | 18 +++++++++++++++++- net/netfilter/nf_conntrack_broadcast.c | 6 +++++- net/netfilter/nf_conntrack_expect.c | 9 +++++++-- net/netfilter/nf_conntrack_netlink.c | 5 +++++ 4 files changed, 34 insertions(+), 4 deletions(-)
include/net/netfilter/nf_conntrack_expect.h +17 -1
@@ -22,10 +22,16 @@ struct nf_conntrack_expect {/* Hash member */ struct hlist_node hnode; +/* Network namespace */ +possible_net_t net; +/* We expect this tuple, with the following mask */ struct nf_conntrack_tuple tuple;struct nf_conntrack_tuple_mask mask; +#ifdef CONFIG_NF_CONNTRACK_ZONES +struct nf_conntrack_zone zone; +#endif /* Usage count. */ refcount_t use;
@@ -62,7 +68,17 @@ struct nf_conntrack_expect {static inline struct net *nf_ct_exp_net (struct nf_conntrack_expect *exp) { -return nf_ct_net (exp->master); +return read_pnet (&exp->net); +} + +static inline bool nf_ct_exp_zone_equal_any (const struct nf_conntrack_expect *a, +const struct nf_conntrack_zone *b) +{ +#ifdef CONFIG_NF_CONNTRACK_ZONES +return a->zone.id == b->id; +#else +return true; +#endif }#define NF_CT_EXP_POLICY_NAME_LEN 16
net/netfilter/nf_conntrack_broadcast.c +5 -1
@@ -21,6 +21,7 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb, unsigned int timeout) {const struct nf_conntrack_helper *helper; +struct net *net =read_pnet (&ct->ct_net);struct nf_conntrack_expect *exp;struct iphdr *iph =ip_hdr (skb);struct rtable *rt =skb_rtable (skb);
@@ -71,7 +72,10 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb, exp->flags =NF_CT_EXPECT_PERMANENT ; exp->class =NF_CT_EXPECT_CLASS_DEFAULT ;rcu_assign_pointer (exp->helper, helper); - +write_pnet (&exp->net, net); +#ifdef CONFIG_NF_CONNTRACK_ZONES + exp->zone = ct->zone; +#endif nf_ct_expect_related (exp,0 );nf_ct_expect_put (exp);
net/netfilter/nf_conntrack_expect.c +7 -2
@@ -112,8 +112,8 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple, const struct net *net) {return nf_ct_tuple_mask_cmp (tuple, &i->tuple, &i->mask) && -net_eq (net,nf_ct_net (i->master)) && -nf_ct_zone_equal_any (i->master, zone); +net_eq (net,read_pnet (&i->net)) && +nf_ct_exp_zone_equal_any (i, zone); }bool nf_ct_remove_expect (struct nf_conntrack_expect *exp)
@@ -321,6 +321,7 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class, {struct nf_conntrack_helper *helper =NULL ;struct nf_conn *ct = exp->master; +struct net *net =read_pnet (&ct->ct_net);struct nf_conn_help *help;int len;
@@ -338,6 +339,10 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class, helper =rcu_dereference (help->helper);rcu_assign_pointer (exp->helper, helper); +write_pnet (&exp->net, net); +#ifdef CONFIG_NF_CONNTRACK_ZONES + exp->zone = ct->zone; +#endif exp->tuple.src.l3num = family; exp->tuple.dst.protonum = proto;
net/netfilter/nf_conntrack_netlink.c +5 -0
@@ -3521,6 +3521,7 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,struct nf_conntrack_tuple *tuple, struct nf_conntrack_tuple *mask) { + struct net *net = read_pnet(&ct->ct_net);struct nf_conntrack_expect *exp;struct nf_conn_help *help;u32 class =0 ;
@@ -3560,6 +3561,10 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, exp->class = class; exp->master = ct; +write_pnet (&exp->net, net); +#ifdef CONFIG_NF_CONNTRACK_ZONES + exp->zone = ct->zone; +#endif if (!helper) helper =rcu_dereference (help->helper);rcu_assign_pointer (exp->helper, helper);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 75/277 netfilter: ctnetlink: ignore explicit helper on new expectations
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 917b61fa2042f11e2af4c428e43f08199586633a ]
Use the existing master conntrack helper, anything else is not really supported and it just makes validation more complicated, so just ignore what helper userspace suggests for this expectation.
This was uncovered when validating CTA_EXPECT_CLASS via different helper provided by userspace than the existing master conntrack helper:
BUG: KASAN: slab-out-of-bounds in nf_ct_expect_related_report+0x2479/0x27c0 Read of size 4 at addr ffff8880043fe408 by task poc/102 Call Trace: nf_ct_expect_related_report+0x2479/0x27c0 ctnetlink_create_expect+0x22b/0x3b0 ctnetlink_new_expect+0x4bd/0x5c0 nfnetlink_rcv_msg+0x67a/0x950 netlink_rcv_skb+0x120/0x350
Allowing to read kernel memory bytes off the expectation boundary.
CTA_EXPECT_HELP_NAME is still used to offer the helper name to userspace via netlink dump.
--- net/netfilter/nf_conntrack_netlink.c | 54 +++++----------------------- 1 file changed, 9 insertions(+), 45 deletions(-)
net/netfilter/nf_conntrack_netlink.c +9 -45
@@ -2635,7 +2635,6 @@ static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {static struct nf_conntrack_expect *ctnetlink_alloc_expect (const struct nlattr *const cda[],struct nf_conn *ct, -struct nf_conntrack_helper *helper,struct nf_conntrack_tuple *tuple,struct nf_conntrack_tuple *mask);
@@ -2864,7 +2863,6 @@ ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct, {struct nlattr *cda[CTA_EXPECT_MAX +1 ];struct nf_conntrack_tuple tuple, mask; -struct nf_conntrack_helper *helper =NULL ;struct nf_conntrack_expect *exp;int err;
@@ -2878,17 +2876,8 @@ ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct,if (err <0 )return err; -if (cda[CTA_EXPECT_HELP_NAME ]) { -const char *helpname =nla_data (cda[CTA_EXPECT_HELP_NAME ]); - - helper =__nf_conntrack_helper_find (helpname,nf_ct_l3num (ct), -nf_ct_protonum (ct)); -if (helper ==NULL ) -return -EOPNOTSUPP ; - } - exp =ctnetlink_alloc_expect ((const struct nlattr *const *)cda, ct, - helper, &tuple, &mask); + &tuple, &mask);if (IS_ERR (exp))return PTR_ERR (exp);
@@ -3517,11 +3506,11 @@ ctnetlink_parse_expect_nat(const struct nlattr *attr,static struct nf_conntrack_expect *ctnetlink_alloc_expect (const struct nlattr *const cda[],struct nf_conn *ct, -struct nf_conntrack_helper *helper,struct nf_conntrack_tuple *tuple,struct nf_conntrack_tuple *mask) {struct net *net =read_pnet (&ct->ct_net); +struct nf_conntrack_helper *helper;struct nf_conntrack_expect *exp;struct nf_conn_help *help;u32 class =0 ;
@@ -3531,7 +3520,11 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,if (!help)return ERR_PTR (-EOPNOTSUPP ); -if (cda[CTA_EXPECT_CLASS ] && helper) { + helper =rcu_dereference (help->helper); +if (!helper) +return ERR_PTR (-EOPNOTSUPP ); + +if (cda[CTA_EXPECT_CLASS ]) { class =ntohl (nla_get_be32 (cda[CTA_EXPECT_CLASS ]));if (class > helper->expect_class_max)return ERR_PTR (-EINVAL );
@@ -3565,8 +3558,6 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,#ifdef CONFIG_NF_CONNTRACK_ZONES exp->zone = ct->zone;#endif -if (!helper) - helper =rcu_dereference (help->helper);rcu_assign_pointer (exp->helper, helper); exp->tuple = *tuple; exp->mask.src.u3 = mask->src.u3;
@@ -3598,7 +3589,6 @@ ctnetlink_create_expect(struct net *net, {struct nf_conntrack_tuple tuple, mask, master_tuple;struct nf_conntrack_tuple_hash *h =NULL ; -struct nf_conntrack_helper *helper =NULL ;struct nf_conntrack_expect *exp;struct nf_conn *ct;int err;
@@ -3624,33 +3614,7 @@ ctnetlink_create_expect(struct net *net, ct =nf_ct_tuplehash_to_ctrack (h);rcu_read_lock (); -if (cda[CTA_EXPECT_HELP_NAME ]) { -const char *helpname =nla_data (cda[CTA_EXPECT_HELP_NAME ]); - - helper =__nf_conntrack_helper_find (helpname, u3, -nf_ct_protonum (ct)); -if (helper ==NULL ) { -rcu_read_unlock (); -#ifdef CONFIG_MODULES -if (request_module ("nfct-helper-%s" , helpname) <0 ) { - err = -EOPNOTSUPP ; - goto err_ct; - } -rcu_read_lock (); - helper =__nf_conntrack_helper_find (helpname, u3, -nf_ct_protonum (ct)); -if (helper) { - err = -EAGAIN ; - goto err_rcu; - } -rcu_read_unlock (); -#endif - err = -EOPNOTSUPP ; - goto err_ct; - } - } - - exp =ctnetlink_alloc_expect (cda, ct, helper, &tuple, &mask); + exp =ctnetlink_alloc_expect (cda, ct, &tuple, &mask);if (IS_ERR (exp)) { err =PTR_ERR (exp); goto err_rcu;
@@ -3660,8 +3624,8 @@ ctnetlink_create_expect(struct net *net,nf_ct_expect_put (exp); err_rcu:rcu_read_unlock (); -err_ct:nf_ct_put (ct); +return err; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 76/277 netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 3d5d488f11776738deab9da336038add95d342d1 ]
Weiming Shi says:
xt_match and xt_target structs registered with NFPROTO_UNSPEC can be loaded by any protocol family through nft_compat. When such a match/target sets .hooks to restrict which hooks it may run on, the bitmask uses NF_INET_* constants. This is only correct for families whose hook layout matches NF_INET_*: IPv4, IPv6, INET, and bridge all share the same five hooks (PRE_ROUTING ... POST_ROUTING).
ARP only has three hooks (IN=0, OUT=1, FORWARD=2) with different semantics. Because NF_ARP_OUT == 1 == NF_INET_LOCAL_IN, the .hooks validation silently passes for the wrong reasons, allowing matches to run on ARP chains where the hook assumptions (e.g. state->in being set on input hooks) do not hold. This leads to NULL pointer dereferences; xt_devgroup is one concrete example:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000044: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000220-0x0000000000000227] RIP: 0010:devgroup_mt+0xff/0x350 Call Trace: <TASK> nft_match_eval (net/netfilter/nft_compat.c:407) nft_do_chain (net/netfilter/nf_tables_core.c:285) nft_do_chain_arp (net/netfilter/nft_chain_filter.c:61) nf_hook_slow (net/netfilter/core.c:623) arp_xmit (net/ipv4/arp.c:666) </TASK> Kernel panic - not syncing: Fatal exception in interrupt
Fix it by restricting arptables to NFPROTO_ARP extensions only. Note that arptables-legacy only supports:
- arpt_CLASSIFY
- arpt_mangle
- arpt_MARK
that provide explicit NFPROTO_ARP match/target declarations.
--- net/netfilter/x_tables.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
net/netfilter/x_tables.c +23 -0
@@ -501,6 +501,17 @@ int xt_check_match(struct xt_mtchk_param *par, par->match->table, par->table);return -EINVAL ; } + +/* NFPROTO_UNSPEC implies NF_INET_* hooks which do not overlap with +* NF_ARP_IN,OUT,FORWARD, allow explicit extensions with NFPROTO_ARP +* support. +*/ +if (par->family ==NFPROTO_ARP && + par->match->family !=NFPROTO_ARP ) { +pr_info_ratelimited ("%s_tables: %s match: not valid for this family\n" , + xt_prefix[par->family], par->match->name); +return -EINVAL ; + }if (par->match->hooks && (par->hook_mask & ~par->match->hooks) !=0 ) {char used[64 ], allow[64 ];
@@ -1016,6 +1027,18 @@ int xt_check_target(struct xt_tgchk_param *par, par->target->table, par->table);return -EINVAL ; } + +/* NFPROTO_UNSPEC implies NF_INET_* hooks which do not overlap with +* NF_ARP_IN,OUT,FORWARD, allow explicit extensions with NFPROTO_ARP +* support. +*/ +if (par->family ==NFPROTO_ARP && + par->target->family !=NFPROTO_ARP ) { +pr_info_ratelimited ("%s_tables: %s target: not valid for this family\n" , + xt_prefix[par->family], par->target->name); +return -EINVAL ; + } +if (par->target->hooks && (par->hook_mask & ~par->target->hooks) !=0 ) {char used[64 ], allow[64 ];
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 77/277 netfilter: nf_tables: reject immediate NF_QUEUE verdict
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit da107398cbd4bbdb6bffecb2ce86d5c9384f4cec ]
nft_queue is always used from userspace nftables to deliver the NF_QUEUE verdict. Immediately emitting an NF_QUEUE verdict is never used by the userspace nft tools, so reject immediate NF_QUEUE verdicts.
The arp family does not provide queue support, but such an immediate verdict is still reachable. Globally reject NF_QUEUE immediate verdicts to address this issue.
--- net/netfilter/nf_tables_api.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +5 -2
@@ -11833,8 +11833,6 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,switch (data->verdict.code) {case NF_ACCEPT :case NF_DROP : -case NF_QUEUE : -break ;case NFT_CONTINUE :case NFT_BREAK :case NFT_RETURN :
@@ -11869,6 +11867,11 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, data->verdict.chain = chain;break ; +case NF_QUEUE : +/* The nft_queue expression is used for this purpose, an +* immediate NF_QUEUE verdict should not ever be seen here. +*/ + fallthrough;default :return -EINVAL ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 78/277 Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit a834a0b66ec6fb743377201a0f4229bb2503f4ce ]
hci_cmd_sync_run() may run the work immediately if called from existing sync work (otherwise it queues a new sync work). In this case it fails to call the destroy() function.
On immediate run, make it behave same way as if item was queued
successfully: call destroy, and return 0.
The only callsite is hci_abort_conn() via hci_cmd_sync_run_once(), and this changes its return value. However, its return value is not used except as the return value for hci_disconnect(), and nothing uses the return value of hci_disconnect(). Hence there should be no behavior change anywhere.
--- net/bluetooth/hci_sync.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
net/bluetooth/hci_sync.c +9 -2
@@ -801,8 +801,15 @@ int hci_cmd_sync_run(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,return -ENETDOWN ;/* If on cmd_sync_work then run immediately otherwise queue */ -if (current_work () == &hdev->cmd_sync_work) -return func (hdev, data); +if (current_work () == &hdev->cmd_sync_work) { +int err; + + err =func (hdev, data); +if (destroy) +destroy (hdev, data, err); + +return 0 ; + }return hci_cmd_sync_submit (hdev, func, data, destroy); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 79/277 Bluetooth: SCO: fix race conditions in sco_sock_connect()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <[email protected]>
[ Upstream commit 8a5b0135d4a5d9683203a3d9a12a711ccec5936b ]
sco_sock_connect() checks sk_state and sk_type without holding the socket lock. Two concurrent connect() syscalls on the same socket can both pass the check and enter sco_connect(), leading to use-after-free.
The buggy scenario involves three participants and was confirmed with additional logging instrumentation:
Thread A (connect): HCI disconnect: Thread B (connect):
sco_sock_connect(sk) sco_sock_connect(sk)
sk_state==BT_OPEN sk_state==BT_OPEN
(pass, no lock) (pass, no lock)
sco_connect(sk): sco_connect(sk):
hci_dev_lock hci_dev_lock
hci_connect_sco <- blocked
-> hcon1
sco_conn_add->conn1
lock_sock(sk)
sco_chan_add:
conn1->sk = sk
sk->conn = conn1
sk_state=BT_CONNECT
release_sock
hci_dev_unlock
hci_dev_lock
sco_conn_del:
lock_sock(sk)
sco_chan_del:
sk->conn=NULL
conn1->sk=NULL
sk_state=
BT_CLOSED
SOCK_ZAPPED
release_sock
hci_dev_unlock
(unblocked)
hci_connect_sco
-> hcon2
sco_conn_add
-> conn2
lock_sock(sk)
sco_chan_add:
sk->conn=conn2
sk_state=
BT_CONNECT
// zombie sk!
release_sock
hci_dev_unlockThread B revives a BT_CLOSED + SOCK_ZAPPED socket back to BT_CONNECT. Subsequent cleanup triggers double sock_put() and use-after-free. Meanwhile conn1 is leaked as it was orphaned when sco_conn_del() cleared the association.
Fix this by:
- Moving lock_sock() before the sk_state/sk_type checks in sco_sock_connect() to serialize concurrent connect attempts
- Fixing the sk_type != SOCK_SEQPACKET check to actually return the error instead of just assigning it
- Adding a state re-check in sco_connect() after lock_sock() to catch state changes during the window between the locks
- Adding sco_pi(sk)->conn check in sco_chan_add() to prevent double-attach of a socket to multiple connections
- Adding hci_conn_drop() on sco_chan_add failure to prevent HCI connection leaks
--- net/bluetooth/sco.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-)
net/bluetooth/sco.c +21 -5
@@ -298,7 +298,7 @@ static int sco_chan_add(struct sco_conn *conn, struct sock *sk,int err =0 ;sco_conn_lock (conn); -if (conn->sk) +if (conn->sk ||sco_pi (sk)->conn) err = -EBUSY ;else __sco_chan_add (conn, sk, parent);
@@ -353,9 +353,20 @@ static int sco_connect(struct sock *sk)lock_sock (sk); +/* Recheck state after reacquiring the socket lock, as another +* thread may have changed it (e.g., closed the socket). +*/ +if (sk->sk_state !=BT_OPEN && sk->sk_state !=BT_BOUND ) { +release_sock (sk); +hci_conn_drop (hcon); + err = -EBADFD ; + goto unlock; + } + err =sco_chan_add (conn, sk,NULL );if (err) {release_sock (sk); +hci_conn_drop (hcon); goto unlock; }
@@ -656,13 +667,18 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen addr->sa_family != AF_BLUETOOTH)return -EINVAL ; -if (sk->sk_state !=BT_OPEN && sk->sk_state !=BT_BOUND ) +lock_sock (sk); + +if (sk->sk_state !=BT_OPEN && sk->sk_state !=BT_BOUND ) { +release_sock (sk);return -EBADFD ; + } -if (sk->sk_type !=SOCK_SEQPACKET ) - err = -EINVAL ; +if (sk->sk_type !=SOCK_SEQPACKET ) { +release_sock (sk); +return -EINVAL ; + } -lock_sock (sk);/* Set destination address and psm */ bacpy (&sco_pi (sk)->dst, &sa->sco_bdaddr);release_sock (sk);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 80/277 Bluetooth: hci_h4: Fix race during initialization
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Rissanen <[email protected]>
[ Upstream commit 0ffac654e95c1bdfe2d4edf28fb18d6ba1f103e6 ]
Commit 5df5dafc171b ("Bluetooth: hci_uart: Fix another race during initialization") fixed a race for hci commands sent during initialization. However, there is still a race that happens if an hci event from one of these commands is received before HCI_UART_REGISTERED has been set at the end of hci_uart_register_dev(). The event will be ignored which causes the command to fail with a timeout in the log:
"Bluetooth: hci0: command 0x1003 tx timeout"
This is because the hci event receive path (hci_uart_tty_receive -> h4_recv) requires HCI_UART_REGISTERED to be set in h4_recv(), while the hci command transmit path (hci_uart_send_frame -> h4_enqueue) only requires HCI_UART_PROTO_INIT to be set in hci_uart_send_frame().
The check for HCI_UART_REGISTERED was originally added in commit c2578202919a ("Bluetooth: Fix H4 crash from incoming UART packets") to fix a crash caused by hu->hdev being null dereferenced. That can no longer happen: once HCI_UART_PROTO_INIT is set in hci_uart_register_dev() all pointers (hu, hu->priv and hu->hdev) are valid, and hci_uart_tty_receive() already calls h4_recv() on HCI_UART_PROTO_INIT or HCI_UART_PROTO_READY.
Remove the check for HCI_UART_REGISTERED in h4_recv() to fix the race condition.
--- drivers/bluetooth/hci_h4.c | 3 --- 1 file changed, 3 deletions(-)
drivers/bluetooth/hci_h4.c +0 -3
@@ -109,9 +109,6 @@ static int h4_recv(struct hci_uart *hu, const void *data, int count) {struct h4_struct *h4 = hu->priv; -if (!test_bit (HCI_UART_REGISTERED , &hu->flags)) -return -EUNATCH ; - h4->rx_skb =h4_recv_buf (hu, h4->rx_skb, data, count, h4_recv_pkts,ARRAY_SIZE (h4_recv_pkts));if (IS_ERR (h4->rx_skb)) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 81/277 Bluetooth: MGMT: validate LTK enc_size on load
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keenan Dong <[email protected]>
[ Upstream commit b8dbe9648d69059cfe3a28917bfbf7e61efd7f15 ]
Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An enc_size larger than the 16-byte key buffer can therefore overflow the reply stack buffer.
Reject oversized enc_size values while validating the management LTK record so invalid keys never reach the stored key state.
--- net/bluetooth/mgmt.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/mgmt.c +3 -0
@@ -7166,6 +7166,9 @@ static bool ltk_is_valid(struct mgmt_ltk_info *key)if (key->initiator !=0x00 && key->initiator !=0x01 )return false; +if (key->enc_size >sizeof (key->val)) +return false; +switch (key->addr.type) {case BDADDR_LE_PUBLIC :return true;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 82/277 Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit a2639a7f0f5bf7d73f337f8f077c19415c62ed2c ]
hci_conn lookup and field access must be covered by hdev lock in set_cig_params_sync, otherwise it's possible it is freed concurrently.
Take hdev lock to prevent hci_conn from being deleted or modified concurrently. Just RCU lock is not suitable here, as we also want to avoid "tearing" in the configuration.
--- net/bluetooth/hci_conn.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/bluetooth/hci_conn.c +7 -1
@@ -1826,9 +1826,13 @@ static int set_cig_params_sync(struct hci_dev *hdev, void *data)u8 aux_num_cis =0 ;u8 cis_id; +hci_dev_lock (hdev); + conn =hci_conn_hash_lookup_cig (hdev, cig_id); -if (!conn) +if (!conn) { +hci_dev_unlock (hdev);return 0 ; + } qos = &conn->iso_qos; pdu->cig_id = cig_id;
@@ -1867,6 +1871,8 @@ static int set_cig_params_sync(struct hci_dev *hdev, void *data) } pdu->num_cis = aux_num_cis; +hci_dev_unlock (hdev); +if (!pdu->num_cis)return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 83/277 Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit b255531b27da336571411248c2a72a350662bd09 ]
hci_conn lookup and field access must be covered by hdev lock in hci_le_remote_conn_param_req_evt, otherwise it's possible it is freed concurrently.
Extend the hci_dev_lock critical section to cover all conn usage.
--- net/bluetooth/hci_event.c | 33 ++++++++++++++++++++------------- 1 file changed, 20 insertions(+), 13 deletions(-)
net/bluetooth/hci_event.c +20 -13
@@ -6653,25 +6653,31 @@ static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev, void *data, latency =le16_to_cpu (ev->latency); timeout =le16_to_cpu (ev->timeout); +hci_dev_lock (hdev); + hcon =hci_conn_hash_lookup_handle (hdev, handle); -if (!hcon || hcon->state !=BT_CONNECTED ) -return send_conn_param_neg_reply (hdev, handle, -HCI_ERROR_UNKNOWN_CONN_ID ); +if (!hcon || hcon->state !=BT_CONNECTED ) { +send_conn_param_neg_reply (hdev, handle, +HCI_ERROR_UNKNOWN_CONN_ID ); + goto unlock; + } -if (max > hcon->le_conn_max_interval) -return send_conn_param_neg_reply (hdev, handle, -HCI_ERROR_INVALID_LL_PARAMS ); +if (max > hcon->le_conn_max_interval) { +send_conn_param_neg_reply (hdev, handle, +HCI_ERROR_INVALID_LL_PARAMS ); + goto unlock; + } -if (hci_check_conn_params (min, max, latency, timeout)) -return send_conn_param_neg_reply (hdev, handle, -HCI_ERROR_INVALID_LL_PARAMS ); +if (hci_check_conn_params (min, max, latency, timeout)) { +send_conn_param_neg_reply (hdev, handle, +HCI_ERROR_INVALID_LL_PARAMS ); + goto unlock; + }if (hcon->role ==HCI_ROLE_MASTER ) {struct hci_conn_params *params;u8 store_hint; -hci_dev_lock (hdev); - params =hci_conn_params_lookup (hdev, &hcon->dst, hcon->dst_type);if (params) {
@@ -6684,8 +6690,6 @@ static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev, void *data, store_hint =0x00 ; } -hci_dev_unlock (hdev); -mgmt_new_conn_param (hdev, &hcon->dst, hcon->dst_type, store_hint, min, max, latency, timeout); }
@@ -6699,6 +6703,9 @@ static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev, void *data, cp.max_ce_len =0 ;hci_send_cmd (hdev,HCI_OP_LE_CONN_PARAM_REQ_REPLY ,sizeof (cp), &cp); + +unlock: +hci_dev_unlock (hdev); } static void hci_le_direct_adv_report_evt(struct hci_dev *hdev, void *data,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 84/277 Bluetooth: MGMT: validate mesh send advertising payload length
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keenan Dong <[email protected]>
[ Upstream commit bda93eec78cdbfe5cda00785cefebd443e56b88b ]
mesh_send() currently bounds MGMT_OP_MESH_SEND by total command length, but it never verifies that the bytes supplied for the flexible adv_data[] array actually match the embedded adv_data_len field. MGMT_MESH_SEND_SIZE only covers the fixed header, so a truncated command can still pass the existing 20..50 byte range check and later drive the async mesh send path past the end of the queued command buffer.
Keep rejecting zero-length and oversized advertising payloads, but validate adv_data_len explicitly and require the command length to exactly match the flexible array size before queueing the request.
--- net/bluetooth/mgmt.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
net/bluetooth/mgmt.c +11 -3
@@ -2466,6 +2466,7 @@ static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)struct mgmt_mesh_tx *mesh_tx;struct mgmt_cp_mesh_send *send = data;struct mgmt_rp_mesh_read_features rp; +u16 expected_len;bool sending;int err =0 ;
@@ -2473,12 +2474,19 @@ static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))return mgmt_cmd_status (sk, hdev->id,MGMT_OP_MESH_SEND ,MGMT_STATUS_NOT_SUPPORTED ); -if (!hci_dev_test_flag (hdev,HCI_LE_ENABLED ) || - len <=MGMT_MESH_SEND_SIZE || - len > (MGMT_MESH_SEND_SIZE +31 )) +if (!hci_dev_test_flag (hdev,HCI_LE_ENABLED )) +return mgmt_cmd_status (sk, hdev->id,MGMT_OP_MESH_SEND , +MGMT_STATUS_REJECTED ); + +if (!send->adv_data_len || send->adv_data_len >31 )return mgmt_cmd_status (sk, hdev->id,MGMT_OP_MESH_SEND ,MGMT_STATUS_REJECTED ); + expected_len =struct_size (send, adv_data, send->adv_data_len); +if (expected_len != len) +return mgmt_cmd_status (sk, hdev->id,MGMT_OP_MESH_SEND , +MGMT_STATUS_INVALID_PARAMS ); +hci_dev_lock (hdev);memset (&rp,0 ,sizeof (rp));
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 85/277 rds: ib: reject FRMR registration before IB connection is established
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit a54ecccfae62c5c85259ae5ea5d9c20009519049 ]
rds_ib_get_mr() extracts the rds_ib_connection from conn->c_transport_data and passes it to rds_ib_reg_frmr() for FRWR memory registration. On a fresh outgoing connection, ic is allocated in rds_ib_conn_alloc() with i_cm_id = NULL because the connection worker has not yet called rds_ib_conn_path_connect() to create the rdma_cm_id. When sendmsg() with RDS_CMSG_RDMA_MAP is called on such a connection, the sendmsg path parses the control message before any connection establishment, allowing rds_ib_post_reg_frmr() to dereference ic->i_cm_id->qp and crash the kernel.
The existing guard in rds_ib_reg_frmr() only checks for !ic (added in commit 9e630bcb7701), which does not catch this case since ic is allocated early and is always non-NULL once the connection object exists.
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:rds_ib_post_reg_frmr+0x50e/0x920 Call Trace: rds_ib_post_reg_frmr (net/rds/ib_frmr.c:167) rds_ib_map_frmr (net/rds/ib_frmr.c:252) rds_ib_reg_frmr (net/rds/ib_frmr.c:430) rds_ib_get_mr (net/rds/ib_rdma.c:615) __rds_rdma_map (net/rds/rdma.c:295) rds_cmsg_rdma_map (net/rds/rdma.c:860) rds_sendmsg (net/rds/send.c:1363) ____sys_sendmsg do_syscall_64
Add a check in rds_ib_get_mr() that verifies ic, i_cm_id, and qp are all non-NULL before proceeding with FRMR registration, mirroring the guard already present in rds_ib_post_inv(). Return -ENODEV when the connection is not ready, which the existing error handling in rds_cmsg_send() converts to -EAGAIN for userspace retry and triggers rds_conn_connect_if_down() to start the connection worker.
--- net/rds/ib_rdma.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/rds/ib_rdma.c +6 -1
@@ -604,8 +604,13 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,return ibmr; } -if (conn) +if (conn) { ic = conn->c_transport_data; +if (!ic || !ic->i_cm_id || !ic->i_cm_id->qp) { + ret = -ENODEV ; + goto out; + } + }if (!rds_ibdev->mr_8k_pool || !rds_ibdev->mr_1m_pool) { ret = -ENODEV ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 86/277 bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready().
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit ad8391d37f334ee73ba91926f8b4e4cf6d31ea04 ]
syzbot reported use-after-free of AF_UNIX socket's sk->sk_socket in sk_psock_verdict_data_ready(). [0]
In unix_stream_sendmsg(), the peer socket's ->sk_data_ready() is called after dropping its unix_state_lock().
Although the sender socket holds the peer's refcount, it does not prevent the peer's sock_orphan(), and the peer's sk_socket might be freed after one RCU grace period.
Let's fetch the peer's sk->sk_socket and sk->sk_socket->ops under RCU in sk_psock_verdict_data_ready().
[0]:
BUG: KASAN: slab-use-after-free in sk_psock_verdict_data_ready+0xec/0x590 net/core/skmsg.c:1278 Read of size 8 at addr ffff8880594da860 by task syz.4.1842/11013 CPU: 1 UID: 0 PID: 11013 Comm: syz.4.1842 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xba/0x230 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 sk_psock_verdict_data_ready+0xec/0x590 net/core/skmsg.c:1278 unix_stream_sendmsg+0x8a3/0xe80 net/unix/af_unix.c:2482 sock_sendmsg_nosec net/socket.c:721 [inline] __sock_sendmsg net/socket.c:736 [inline] ____sys_sendmsg+0x972/0x9f0 net/socket.c:2585 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2639 __sys_sendmsg net/socket.c:2671 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2674 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7facf899c819 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007facf9827028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007facf8c15fa0 RCX: 00007facf899c819 RDX: 0000000000000000 RSI: 0000200000000500 RDI: 0000000000000004 RBP: 00007facf8a32c91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007facf8c16038 R14: 00007facf8c15fa0 R15: 00007ffd41b01c78 </TASK> Allocated by task 11013: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4538 [inline] slab_alloc_node mm/slub.c:4866 [inline] kmem_cache_alloc_lru_noprof+0x2b8/0x640 mm/slub.c:4885 sock_alloc_inode+0x28/0xc0 net/socket.c:316 alloc_inode+0x6a/0x1b0 fs/inode.c:347 new_inode_pseudo include/linux/fs.h:3003 [inline] sock_alloc net/socket.c:631 [inline] __sock_create+0x12d/0x9d0 net/socket.c:1562 sock_create net/socket.c:1656 [inline] __sys_socketpair+0x1c4/0x560 net/socket.c:1803 __do_sys_socketpair net/socket.c:1856 [inline] __se_sys_socketpair net/socket.c:1853 [inline] __x64_sys_socketpair+0x9b/0xb0 net/socket.c:1853 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 15: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2685 [inline] slab_free mm/slub.c:6165 [inline] kmem_cache_free+0x187/0x630 mm/slub.c:6295 rcu_do_batch kernel/rcu/tree.c:2617 [inline] rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869 handle_softirqs+0x22a/0x870 kernel/softirq.c:622 run_ksoftirqd+0x36/0x60 kernel/softirq.c:1063 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
--- net/core/skmsg.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
net/core/skmsg.c +8 -5
@@ -1267,17 +1267,20 @@ static int sk_psock_verdict_recv(struct sock *sk, struct sk_buff *skb)static void sk_psock_verdict_data_ready (struct sock *sk) { -struct socket *sock = sk->sk_socket; -const struct proto_ops *ops; +const struct proto_ops *ops =NULL ; +struct socket *sock;int copied;trace_sk_data_ready (sk); -if (unlikely (!sock)) -return ; - ops =READ_ONCE (sock->ops); +rcu_read_lock (); + sock =READ_ONCE (sk->sk_socket); +if (likely (sock)) + ops =READ_ONCE (sock->ops); +rcu_read_unlock ();if (!ops || !ops->read_skb)return ; + copied = ops->read_skb (sk, sk_psock_verdict_recv);if (copied >=0 ) {struct sk_psock *psock;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 87/277 net/sched: sch_netem: fix out-of-bounds access in packet corruption
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yucheng Lu <[email protected]>
[ Upstream commit d64cb81dcbd54927515a7f65e5e24affdc73c14b ]
In netem_enqueue(), the packet corruption logic uses get_random_u32_below(skb_headlen(skb)) to select an index for modifying skb->data. When an AF_PACKET TX_RING sends fully non-linear packets over an IPIP tunnel, skb_headlen(skb) evaluates to 0.
Passing 0 to get_random_u32_below() takes the variable-ceil slow path which returns an unconstrained 32-bit random integer. Using this unconstrained value as an offset into skb->data results in an out-of-bounds memory access.
Fix this by verifying skb_headlen(skb) is non-zero before attempting to corrupt the linear data area. Fully non-linear packets will silently bypass the corruption logic.
--- net/sched/sch_netem.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/sched/sch_netem.c +3 -2
@@ -518,8 +518,9 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, goto finish_segs; } - skb->data[get_random_u32_below (skb_headlen (skb))] ^= -1 <<get_random_u32_below (8 ); +if (skb_headlen (skb)) + skb->data[get_random_u32_below (skb_headlen (skb))] ^= +1 <<get_random_u32_below (8 ); }if (unlikely (q->t_len >= sch->limit)) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 88/277 net: macb: fix clk handling on PCI glue driver removal
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit ce8fe5287b87e24e225c342f3b0ec04f0b3680fe ]
platform_device_unregister() may still want to use the registered clks during runtime resume callback.
Note that there is a commit d82d5303c4c5 ("net: macb: fix use after free on rmmod") that addressed the similar problem of clk vs platform device unregistration but just moved the bug to another place.
Save the pointers to clks into local variables for reuse after platform device is unregistered.
BUG: KASAN: use-after-free in clk_prepare+0x5a/0x60 Read of size 8 at addr ffff888104f85e00 by task modprobe/597 CPU: 2 PID: 597 Comm: modprobe Not tainted 6.1.164+ #114 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x8d/0xba print_report+0x17f/0x496 kasan_report+0xd9/0x180 clk_prepare+0x5a/0x60 macb_runtime_resume+0x13d/0x410 [macb] pm_generic_runtime_resume+0x97/0xd0 __rpm_callback+0xc8/0x4d0 rpm_callback+0xf6/0x230 rpm_resume+0xeeb/0x1a70 __pm_runtime_resume+0xb4/0x170 bus_remove_device+0x2e3/0x4b0 device_del+0x5b3/0xdc0 platform_device_del+0x4e/0x280 platform_device_unregister+0x11/0x50 pci_device_remove+0xae/0x210 device_remove+0xcb/0x180 device_release_driver_internal+0x529/0x770 driver_detach+0xd4/0x1a0 bus_remove_driver+0x135/0x260 driver_unregister+0x72/0xb0 pci_unregister_driver+0x26/0x220 __do_sys_delete_module+0x32e/0x550 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 </TASK> Allocated by task 519: kasan_save_stack+0x2c/0x50 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x8e/0x90 __clk_register+0x458/0x2890 clk_hw_register+0x1a/0x60 __clk_hw_register_fixed_rate+0x255/0x410 clk_register_fixed_rate+0x3c/0xa0 macb_probe+0x1d8/0x42e [macb_pci] local_pci_probe+0xd7/0x190 pci_device_probe+0x252/0x600 really_probe+0x255/0x7f0 __driver_probe_device+0x1ee/0x330 driver_probe_device+0x4c/0x1f0 __driver_attach+0x1df/0x4e0 bus_for_each_dev+0x15d/0x1f0 bus_add_driver+0x486/0x5e0 driver_register+0x23a/0x3d0 do_one_initcall+0xfd/0x4d0 do_init_module+0x18b/0x5a0 load_module+0x5663/0x7950 __do_sys_finit_module+0x101/0x180 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Freed by task 597: kasan_save_stack+0x2c/0x50 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x50 __kasan_slab_free+0x106/0x180 __kmem_cache_free+0xbc/0x320 clk_unregister+0x6de/0x8d0 macb_remove+0x73/0xc0 [macb_pci] pci_device_remove+0xae/0x210 device_remove+0xcb/0x180 device_release_driver_internal+0x529/0x770 driver_detach+0xd4/0x1a0 bus_remove_driver+0x135/0x260 driver_unregister+0x72/0xb0 pci_unregister_driver+0x26/0x220 __do_sys_delete_module+0x32e/0x550 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
--- drivers/net/ethernet/cadence/macb_pci.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/cadence/macb_pci.c +4 -2
@@ -109,10 +109,12 @@ static void macb_remove(struct pci_dev *pdev) {struct platform_device *plat_dev =pci_get_drvdata (pdev);struct macb_platform_data *plat_data =dev_get_platdata (&plat_dev->dev); +struct clk *pclk = plat_data->pclk; +struct clk *hclk = plat_data->hclk; -clk_unregister (plat_data->pclk); -clk_unregister (plat_data->hclk);platform_device_unregister (plat_dev); +clk_unregister (pclk); +clk_unregister (hclk); }static const struct pci_device_id dev_id_table[] = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 89/277 net: macb: properly unregister fixed rate clocks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit f0f367a4f459cc8118aadc43c6bba53c60d93f8d ]
The additional resources allocated with clk_register_fixed_rate() need to be released with clk_unregister_fixed_rate(), otherwise they are lost.
--- drivers/net/ethernet/cadence/macb_pci.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/cadence/macb_pci.c +4 -4
@@ -96,10 +96,10 @@ static int macb_probe(struct pci_dev *pdev, const struct pci_device_id *id)return 0 ; err_plat_dev_register: -clk_unregister (plat_data.hclk); +clk_unregister_fixed_rate (plat_data.hclk); err_hclk_register: -clk_unregister (plat_data.pclk); +clk_unregister_fixed_rate (plat_data.pclk); err_pclk_register:return err;
@@ -113,8 +113,8 @@ static void macb_remove(struct pci_dev *pdev)struct clk *hclk = plat_data->hclk;platform_device_unregister (plat_dev); -clk_unregister (pclk); -clk_unregister (hclk); +clk_unregister_fixed_rate (pclk); +clk_unregister_fixed_rate (hclk); }static const struct pci_device_id dev_id_table[] = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 90/277 net/mlx5: lag: Check for LAG device before creating debugfs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shay Drory <[email protected]>
[ Upstream commit bf16bca6653679d8a514d6c1c5a2c67065033f14 ]
__mlx5_lag_dev_add_mdev() may return 0 (success) even when an error occurs that is handled gracefully. Consequently, the initialization flow proceeds to call mlx5_ldev_add_debugfs() even when there is no valid LAG context.
mlx5_ldev_add_debugfs() blindly created the debugfs directory and attributes. This exposed interfaces (like the members file) that rely on a valid ldev pointer, leading to potential NULL pointer dereferences if accessed when ldev is NULL.
Add a check to verify that mlx5_lag_dev(dev) returns a valid pointer before attempting to create the debugfs entries.
--- drivers/net/ethernet/mellanox/mlx5/core/lag/debugfs.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/lag/debugfs.c +3 -0
@@ -160,8 +160,11 @@ DEFINE_SHOW_ATTRIBUTE(members);void mlx5_ldev_add_debugfs (struct mlx5_core_dev *dev) { +struct mlx5_lag *ldev =mlx5_lag_dev (dev);struct dentry *dbg; +if (!ldev) +return ; dbg =debugfs_create_dir ("lag" ,mlx5_debugfs_get_dev_root (dev)); dev->priv.dbg.lag_debugfs = dbg;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 91/277 net/mlx5: Avoid "No data available" when FW version queries fail
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saeed Mahameed <[email protected]>
[ Upstream commit 10dc35f6a443d488f219d1a1e3fb8f8dac422070 ]
Avoid printing the misleading "kernel answers: No data available" devlink output when querying firmware or pending firmware version fails (e.g. MLX5 fw state errors / flash failures).
FW can fail on loading the pending flash image and get its version due to various reasons, examples:
mlxfw: Firmware flash failed: key not applicable, err (7)mlx5_fw_image_pending: can't read pending fw version while fw state is 1
and the resulting:
$ devlink dev info kernel answers: No data available
Instead, just report 0 or 0xfff.. versions in case of failure to indicate a problem, and let other information be shown.
after the fix:
$ devlink dev info
pci/0000:00:06.0:
driver mlx5_core
serial_number xxx...
board.serial_number MT2225300179
versions:
fixed:
fw.psid MT_0000000436
running:
fw.version 22.41.0188
fw 22.41.0188
stored:
fw.version 255.255.65535
fw 255.255.65535--- .../net/ethernet/mellanox/mlx5/core/devlink.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/fw.c | 53 ++++++++++++------- .../ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +- 3 files changed, 37 insertions(+), 24 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/devlink.c +1 -3
@@ -107,9 +107,7 @@ mlx5_devlink_info_get(struct devlink *devlink, struct devlink_info_req *req,if (err)return err; - err =mlx5_fw_version_query (dev, &running_fw, &stored_fw); -if (err) -return err; +mlx5_fw_version_query (dev, &running_fw, &stored_fw); snprintf(version_str, sizeof(version_str), "%d.%d.%04d", mlx5_fw_ver_major(running_fw), mlx5_fw_ver_minor(running_fw),
drivers/net/ethernet/mellanox/mlx5/core/fw.c +34 -19
82 lines not on this page · raw message
drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h +2 -2
@@ -391,8 +391,8 @@ int mlx5_port_max_linkspeed(struct mlx5_core_dev *mdev, u32 *speed);int mlx5_firmware_flash (struct mlx5_core_dev *dev,const struct firmware *fw,struct netlink_ext_ack *extack); -int mlx5_fw_version_query (struct mlx5_core_dev *dev, -u32 *running_ver,u32 *stored_ver); +void mlx5_fw_version_query (struct mlx5_core_dev *dev,u32 *running_ver, +u32 *stored_ver);#ifdef CONFIG_MLX5_CORE_EN int mlx5e_init (void );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 92/277 net/mlx5: Fix switchdev mode rollback in case of failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saeed Mahameed <[email protected]>
[ Upstream commit 403186400a1a6166efe7031edc549c15fee4723f ]
If for some internal reason switchdev mode fails, we rollback to legacy mode, before this patch, rollback will unregister the uplink netdev and leave it unregistered causing the below kernel bug.
To fix this, we need to avoid netdev unregister by setting the proper rollback flag 'MLX5_PRIV_FLAGS_SWITCH_LEGACY' to indicate legacy mode.
devlink (431) used greatest stack depth: 11048 bytes left
mlx5_core 0000:00:03.0: E-Switch: Disable: mode(LEGACY), nvfs(0), \ necvfs(0), active vports(0) mlx5_core 0000:00:03.0: E-Switch: Supported tc chains and prios offload mlx5_core 0000:00:03.0: Loading uplink representor for vport 65535 mlx5_core 0000:00:03.0: mlx5_cmd_out_err:816:(pid 456): \ QUERY_HCA_CAP(0x100) op_mod(0x0) failed, \ status bad parameter(0x3), syndrome (0x3a3846), err(-22) mlx5_core 0000:00:03.0 enp0s3np0 (unregistered): Unloading uplink \ representor for vport 65535 ------------[ cut here ]------------ kernel BUG at net/core/dev.c:12070! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 456 Comm: devlink Not tainted 6.16.0-rc3+ \ #9 PREEMPT(voluntary) RIP: 0010:unregister_netdevice_many_notify+0x123/0xae0 ... Call Trace: [ 90.923094] unregister_netdevice_queue+0xad/0xf0 [ 90.923323] unregister_netdev+0x1c/0x40 [ 90.923522] mlx5e_vport_rep_unload+0x61/0xc6 [ 90.923736] esw_offloads_enable+0x8e6/0x920 [ 90.923947] mlx5_eswitch_enable_locked+0x349/0x430 [ 90.924182] ? is_mp_supported+0x57/0xb0 [ 90.924376] mlx5_devlink_eswitch_mode_set+0x167/0x350 [ 90.924628] devlink_nl_eswitch_set_doit+0x6f/0xf0 [ 90.924862] genl_family_rcv_msg_doit+0xe8/0x140 [ 90.925088] genl_rcv_msg+0x18b/0x290 [ 90.925269] ? __pfx_devlink_nl_pre_doit+0x10/0x10 [ 90.925506] ? __pfx_devlink_nl_eswitch_set_doit+0x10/0x10 [ 90.925766] ? __pfx_devlink_nl_post_doit+0x10/0x10 [ 90.926001] ? __pfx_genl_rcv_msg+0x10/0x10 [ 90.926206] netlink_rcv_skb+0x52/0x100 [ 90.926393] genl_rcv+0x28/0x40 [ 90.926557] netlink_unicast+0x27d/0x3d0 [ 90.926749] netlink_sendmsg+0x1f7/0x430 [ 90.926942] __sys_sendto+0x213/0x220 [ 90.927127] ? __sys_recvmsg+0x6a/0xd0 [ 90.927312] __x64_sys_sendto+0x24/0x30 [ 90.927504] do_syscall_64+0x50/0x1c0 [ 90.927687] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 90.927929] RIP: 0033:0x7f7d0363e047
--- drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +2 -0
@@ -3623,6 +3623,8 @@ int esw_offloads_enable(struct mlx5_eswitch *esw)return 0 ; err_vports: +/* rollback to legacy, indicates don't unregister the uplink netdev */ + esw->dev->priv.flags |=MLX5_PRIV_FLAGS_SWITCH_LEGACY ;mlx5_esw_offloads_rep_unload (esw,MLX5_VPORT_UPLINK ); err_uplink:esw_offloads_steering_cleanup (esw);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 93/277 bnxt_en: Restore default stat ctxs for ULP when resource is available
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavan Chebbi <[email protected]>
[ Upstream commit 071dbfa304e85a6b04a593e950d18fa170997288 ]
During resource reservation, if the L2 driver does not have enough MSIX vectors to provide to the RoCE driver, it sets the stat ctxs for ULP also to 0 so that we don't have to reserve it unnecessarily.
However, subsequently the user may reduce L2 rings thereby freeing up some resources that the L2 driver can now earmark for RoCE. In this case, the driver should restore the default ULP stat ctxs to make sure that all RoCE resources are ready for use.
The RoCE driver may fail to initialize in this scenario without this fix.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +2 -0
@@ -7991,6 +7991,8 @@ static int __bnxt_reserve_rings(struct bnxt *bp) ulp_msix =bnxt_get_avail_msix (bp, bp->ulp_num_msix_want);if (!ulp_msix)bnxt_set_ulp_stat_ctxs (bp,0 ); +else +bnxt_set_dflt_ulp_stat_ctxs (bp);if (ulp_msix > bp->ulp_num_msix_want) ulp_msix = bp->ulp_num_msix_want;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 94/277 net/x25: Fix potential double free of skb
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schiller <[email protected]>
[ Upstream commit d10a26aa4d072320530e6968ef945c8c575edf61 ]
When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at line 48 and returns 1 (error).
This error propagates back through the call chain:
x25_queue_rx_frame returns 1
|
v
x25_state3_machine receives the return value 1 and takes the else
branch at line 278, setting queued=0 and returning 0
|
v
x25_process_rx_frame returns queued=0
|
vx25_backlog_rcv at line 452 sees queued=0 and calls kfree_skb(skb) again
This would free the same skb twice. Looking at x25_backlog_rcv:
net/x25/x25_in.c:x25_backlog_rcv() {
...
queued = x25_process_rx_frame(sk, skb);
...
if (!queued)
kfree_skb(skb);
}--- net/x25/x25_in.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
net/x25/x25_in.c +2 -3
@@ -44,10 +44,9 @@ static int x25_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more)if (x25->fraglen >0 ) {/* End of fragment */ int len = x25->fraglen + skb->len; -if ((skbn =alloc_skb (len,GFP_ATOMIC )) ==NULL ){ -kfree_skb (skb); + skbn =alloc_skb (len,GFP_ATOMIC ); +if (!skbn)return 1 ; - }skb_queue_tail (&x25->fragment_queue, skb);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 95/277 net/x25: Fix overflow when accumulating packets
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schiller <[email protected]>
[ Upstream commit a1822cb524e89b4cd2cf0b82e484a2335496a6d9 ]
Add a check to ensure that x25_sock.fraglen does not overflow.
The fraglen also needs to be resetted when purging fragment_queue in x25_clear_queues().
--- net/x25/x25_in.c | 4 ++++ net/x25/x25_subr.c | 1 + 2 files changed, 5 insertions(+)
net/x25/x25_in.c +4 -0
@@ -34,6 +34,10 @@ static int x25_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more)struct sk_buff *skbo, *skbn = skb;struct x25_sock *x25 =x25_sk (sk); +/* make sure we don't overflow */ +if (x25->fraglen + skb->len >USHRT_MAX ) +return 1 ; +if (more) { x25->fraglen += skb->len;skb_queue_tail (&x25->fragment_queue, skb);
net/x25/x25_subr.c +1 -0
@@ -40,6 +40,7 @@ void x25_clear_queues(struct sock *sk)skb_queue_purge (&x25->interrupt_in_queue);skb_queue_purge (&x25->interrupt_out_queue);skb_queue_purge (&x25->fragment_queue); + x25->fraglen =0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 96/277 net/sched: cls_fw: fix NULL pointer dereference on shared blocks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit faeea8bbf6e958bf3c00cb08263109661975987c ]
The old-method path in fw_classify() calls tcf_block_q() and dereferences q->handle. Shared blocks leave block->q NULL, causing a NULL deref when an empty cls_fw filter is attached to a shared block and a packet with a nonzero major skb mark is classified.
Reject the configuration in fw_change() when the old method (no TCA_OPTIONS) is used on a shared block, since fw_classify()'s old-method path needs block->q which is NULL for shared blocks.
The fixed null-ptr-deref calling stack:
KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:fw_classify (net/sched/cls_fw.c:81) Call Trace: tcf_classify (./include/net/tc_wrapper.h:197 net/sched/cls_api.c:1764 net/sched/cls_api.c:1860) tc_run (net/core/dev.c:4401) __dev_queue_xmit (net/core/dev.c:4535 net/core/dev.c:4790)
--- net/sched/cls_fw.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
net/sched/cls_fw.c +12 -2
@@ -247,8 +247,18 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,struct nlattr *tb[TCA_FW_MAX +1 ];int err; -if (!opt) -return handle ? -EINVAL :0 ;/* Succeed if it is old method. */ +if (!opt) { +if (handle) +return -EINVAL ; + +if (tcf_block_shared (tp->chain->block)) { +NL_SET_ERR_MSG (extack, +"Must specify mark when attaching fw filter to block" ); +return -EINVAL ; + } + +return 0 ;/* Succeed if it is old method. */ + } err =nla_parse_nested_deprecated (tb,TCA_FW_MAX , opt, fw_policy,NULL );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 97/277 net/sched: cls_flow: fix NULL pointer dereference on shared blocks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit 1a280dd4bd1d616a01d6ffe0de284c907b555504 ]
flow_change() calls tcf_block_q() and dereferences q->handle to derive a default baseclass. Shared blocks leave block->q NULL, causing a NULL deref when a flow filter without a fully qualified baseclass is created on a shared block.
Check tcf_block_shared() before accessing block->q and return -EINVAL for shared blocks. This avoids the null-deref shown below:
=======================================================================
KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:flow_change (net/sched/cls_flow.c:508) Call Trace: tc_new_tfilter (net/sched/cls_api.c:2432) rtnetlink_rcv_msg (net/core/rtnetlink.c:6980) [...] =======================================================================
--- net/sched/cls_flow.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
net/sched/cls_flow.c +9 -1
@@ -503,8 +503,16 @@ static int flow_change(struct net *net, struct sk_buff *in_skb, }if (TC_H_MAJ (baseclass) ==0 ) { -struct Qdisc *q =tcf_block_q (tp->chain->block); +struct tcf_block *block = tp->chain->block; +struct Qdisc *q; +if (tcf_block_shared (block)) { +NL_SET_ERR_MSG (extack, +"Must specify baseclass when attaching flow filter to block" ); + goto err2; + } + + q =tcf_block_q (block); baseclass =TC_H_MAKE (q->handle, baseclass); }if (TC_H_MIN (baseclass) ==0 )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 98/277 net: hsr: fix VLAN add unwind on slave errors
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luka Gejak <[email protected]>
[ Upstream commit 2e3514e63bfb0e972b1f19668547a455d0129e88 ]
When vlan_vid_add() fails for a secondary slave, the error path calls vlan_vid_del() on the failing port instead of the peer slave that had already succeeded. This results in asymmetric VLAN state across the HSR pair.
Fix this by switching to a centralized unwind path that removes the VID from any slave device that was already programmed.
--- net/hsr/hsr_device.c | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-)
net/hsr/hsr_device.c +17 -15
@@ -532,8 +532,8 @@ static void hsr_change_rx_flags(struct net_device *dev, int change)static int hsr_ndo_vlan_rx_add_vid (struct net_device *dev,__be16 proto,u16 vid) { -bool is_slave_a_added = false; -bool is_slave_b_added = false; +struct net_device *slave_a_dev =NULL ; +struct net_device *slave_b_dev =NULL ;struct hsr_port *port;struct hsr_priv *hsr;int ret =0 ;
@@ -549,33 +549,35 @@ static int hsr_ndo_vlan_rx_add_vid(struct net_device *dev,switch (port->type) {case HSR_PT_SLAVE_A :if (ret) { -/* clean up Slave-B */ netdev_err (dev,"add vid failed for Slave-A\n" ); -if (is_slave_b_added) -vlan_vid_del (port->dev, proto, vid); -return ret; + goto unwind; } - - is_slave_a_added = true; + slave_a_dev = port->dev;break ; -case HSR_PT_SLAVE_B :if (ret) { -/* clean up Slave-A */ netdev_err (dev,"add vid failed for Slave-B\n" ); -if (is_slave_a_added) -vlan_vid_del (port->dev, proto, vid); -return ret; + goto unwind; } - - is_slave_b_added = true; + slave_b_dev = port->dev;break ;default : +if (ret) + goto unwind;break ; } }return 0 ; + +unwind: +if (slave_a_dev) +vlan_vid_del (slave_a_dev, proto, vid); + +if (slave_b_dev) +vlan_vid_del (slave_b_dev, proto, vid); + +return ret; } static int hsr_ndo_vlan_rx_kill_vid(struct net_device *dev,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 99/277 ipv6: avoid overflows in ip6_datagram_send_ctl()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 4e453375561fc60820e6b9d8ebeb6b3ee177d42e ]
Yiming Qian reported :
<quote>
I believe I found a locally triggerable kernel bug in the IPv6 sendmsg ancillary-data path that can panic the kernel via skb_under_panic() (local DoS).
The core issue is a mismatch between:
- a 16-bit length accumulator (struct ipv6_txoptions::opt_flen, type __u16) and
- a pointer to the *last* provided destination-options header (opt->dst1opt)
when multiple IPV6_DSTOPTS control messages (cmsgs) are provided.
- include/net/ipv6.h:
- struct ipv6_txoptions::opt_flen is __u16 (wrap possible).
(lines 291-307, especially 298)
- net/ipv6/datagram.c:ip6_datagram_send_ctl():
- Accepts repeated IPV6_DSTOPTS and accumulates into opt_flen
without rejecting duplicates. (lines 909-933)
- net/ipv6/ip6_output.c:__ip6_append_data():
- Uses opt->opt_flen + opt->opt_nflen to compute header
sizes/headroom decisions. (lines 1448-1466, especially 1463-1465)
- net/ipv6/ip6_output.c:__ip6_make_skb():
- Calls ipv6_push_frag_opts() if opt->opt_flen is non-zero.
(lines 1930-1934)
- net/ipv6/exthdrs.c:ipv6_push_frag_opts() / ipv6_push_exthdr():
- Push size comes from ipv6_optlen(opt->dst1opt) (based on the
pointed-to header). (lines 1179-1185 and 1206-1211)
1. opt_flen is a 16-bit accumulator:
- include/net/ipv6.h:298 defines __u16 opt_flen; /* after fragment hdr */.
2. ip6_datagram_send_ctl() accepts *repeated* IPV6_DSTOPTS cmsgs and increments opt_flen each time:
- In net/ipv6/datagram.c:909-933, for IPV6_DSTOPTS:
- It computes len = ((hdr->hdrlen + 1) << 3);
- It checks CAP_NET_RAW using `ns_capable(net->user_ns,
CAP_NET_RAW)`. (line 922)
- Then it does:
- opt->opt_flen += len; (line 927)
- opt->dst1opt = hdr; (line 928)
There is no duplicate rejection here (unlike the legacy IPV6_2292DSTOPTS path which rejects duplicates at net/ipv6/datagram.c:901-904).
If enough large IPV6_DSTOPTS cmsgs are provided, opt_flen wraps while dst1opt still points to a large (2048-byte) destination-options header.
In the attached PoC (poc.c):
- 32 cmsgs with hdrlen=255 => len = (255+1)*8 = 2048
- 1 cmsg with hdrlen=0 => len = 8
- Total increment: 32*2048 + 8 = 65544, so (__u16)opt_flen == 8
- The last cmsg is 2048 bytes, so dst1opt points to a 2048-byte header.
3. The transmit path sizes headers using the wrapped opt_flen:
- In net/ipv6/ip6_output.c:1463-1465:
- `headersize = sizeof(struct ipv6hdr) + (opt ? opt->opt_flen +
opt->opt_nflen : 0) + ...;`
With wrapped opt_flen, headersize/headroom decisions underestimate what will be pushed later.
4. When building the final skb, the actual push length comes from dst1opt and is not limited by wrapped opt_flen:
- In net/ipv6/ip6_output.c:1930-1934:
- if (opt->opt_flen) proto = ipv6_push_frag_opts(skb, opt, proto);
- In net/ipv6/exthdrs.c:1206-1211, ipv6_push_frag_opts() pushes dst1opt via ipv6_push_exthdr().
- In net/ipv6/exthdrs.c:1179-1184, ipv6_push_exthdr() does:
- skb_push(skb, ipv6_optlen(opt));
- memcpy(h, opt, ipv6_optlen(opt));
With insufficient headroom, skb_push() underflows and triggers skb_under_panic() -> BUG():
- net/core/skbuff.c:2669-2675 (skb_push() calls skb_under_panic())
- net/core/skbuff.c:207-214 (skb_panic() ends in BUG())
- The IPV6_DSTOPTS cmsg path requires CAP_NET_RAW in the target netns user namespace (ns_capable(net->user_ns, CAP_NET_RAW)).
- Root (or any task with CAP_NET_RAW) can trigger this without user namespaces.
- An unprivileged uid=1000 user can trigger this if unprivileged user namespaces are enabled and it can create a userns+netns to obtain namespaced CAP_NET_RAW (the attached PoC does this).
- Local denial of service: kernel BUG/panic (system crash).
- Reproducible with a small userspace PoC.
</quote>
This patch does not reject duplicated options, as this might break some user applications.
Instead, it makes sure to adjust opt_flen and opt_nflen to correctly reflect the size of the current option headers, preventing the overflows and the potential for panics.
This applies to IPV6_DSTOPTS, IPV6_HOPOPTS, and IPV6_RTHDR.
Specifically:
When a new IPV6_DSTOPTS is processed, the length of the old opt->dst1opt is subtracted from opt->opt_flen before adding the new length.
When a new IPV6_HOPOPTS is processed, the length of the old opt->dst0opt is subtracted from opt->opt_nflen.
When a new Routing Header (IPV6_RTHDR or IPV6_2292RTHDR) is processed, the length of the old opt->srcrt is subtracted from opt->opt_nflen.
In the special case within IPV6_2292RTHDR handling where dst1opt is moved to dst0opt, the length of the old opt->dst0opt is subtracted from opt->opt_nflen before the new one is added.
--- net/ipv6/datagram.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
net/ipv6/datagram.c +10 -0
@@ -762,6 +762,7 @@ int ip6_datagram_send_ctl(struct net *net, struct sock *sk, {struct in6_pktinfo *src_info;struct cmsghdr *cmsg; +struct ipv6_rt_hdr *orthdr;struct ipv6_rt_hdr *rthdr;struct ipv6_opt_hdr *hdr;struct ipv6_txoptions *opt = ipc6->opt;
@@ -923,9 +924,13 @@ int ip6_datagram_send_ctl(struct net *net, struct sock *sk, goto exit_f; }if (cmsg->cmsg_type ==IPV6_DSTOPTS ) { +if (opt->dst1opt) + opt->opt_flen -=ipv6_optlen (opt->dst1opt); opt->opt_flen += len; opt->dst1opt = hdr; }else { +if (opt->dst0opt) + opt->opt_nflen -=ipv6_optlen (opt->dst0opt); opt->opt_nflen += len; opt->dst0opt = hdr; }
@@ -968,12 +973,17 @@ int ip6_datagram_send_ctl(struct net *net, struct sock *sk, goto exit_f; } + orthdr = opt->srcrt; +if (orthdr) + opt->opt_nflen -= ((orthdr->hdrlen +1 ) <<3 ); opt->opt_nflen += len; opt->srcrt = rthdr;if (cmsg->cmsg_type ==IPV6_2292RTHDR && opt->dst1opt) {int dsthdrlen = ((opt->dst1opt->hdrlen+1 )<<3 ); +if (opt->dst0opt) + opt->opt_nflen -=ipv6_optlen (opt->dst0opt); opt->opt_nflen += dsthdrlen; opt->dst0opt = opt->dst1opt; opt->dst1opt =NULL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 100/277 eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dimitri Daskalakis <[email protected]>
[ Upstream commit ec7067e661193403a7a00980bda8612db5954142 ]
On systems with 64K pages, RX queues will be wedged if users set the descriptor count to the current minimum (16). Fbnic fragments large pages into 4K chunks, and scales down the ring size accordingly. With 64K pages and 16 descriptors, the ring size mask is 0 and will never be filled.
32 descriptors is another special case that wedges the RX rings. Internally, the rings track pages for the head/tail pointers, not page fragments. So with 32 descriptors, there's only 1 usable page as one ring slot is kept empty to disambiguate between an empty/full ring. As a result, the head pointer never advances and the HW stalls after consuming 16 page fragments.
--- drivers/net/ethernet/meta/fbnic/fbnic_txrx.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/meta/fbnic/fbnic_txrx.h +1 -1
@@ -38,7 +38,7 @@ struct fbnic_net;#define FBNIC_MAX_XDPQS 128u/* These apply to TWQs, TCQ, RCQ */ -#define FBNIC_QUEUE_SIZE_MIN 16u +#define FBNIC_QUEUE_SIZE_MIN 64u#define FBNIC_QUEUE_SIZE_MAX SZ_64K#define FBNIC_TXQ_SIZE_DEFAULT 1024
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 101/277 bpf: reject direct access to nullable PTR_TO_BUF pointers
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Tang <[email protected]>
[ Upstream commit b0db1accbc7395657c2b79db59fa9fae0d6656f3 ]
check_mem_access() matches PTR_TO_BUF via base_type() which strips PTR_MAYBE_NULL, allowing direct dereference without a null check.
Map iterator ctx->key and ctx->value are PTR_TO_BUF | PTR_MAYBE_NULL. On stop callbacks these are NULL, causing a kernel NULL dereference.
Add a type_may_be_null() guard to the PTR_TO_BUF branch, matching the existing PTR_TO_BTF_ID pattern.
--- kernel/bpf/verifier.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/bpf/verifier.c +2 -1
@@ -7737,7 +7737,8 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn }else if (reg->type ==CONST_PTR_TO_MAP ) { err =check_ptr_to_map_access (env, regs, regno, off, size, t, value_regno); - }else if (base_type (reg->type) ==PTR_TO_BUF ) { + }else if (base_type (reg->type) ==PTR_TO_BUF && + !type_may_be_null (reg->type)) {bool rdonly_mem =type_is_rdonly_mem (reg->type);u32 *max_access;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 102/277 bpf: Reject sleepable kprobe_multi programs at attach time
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Varun R Mallya <[email protected]>
[ Upstream commit eb7024bfcc5f68ed11ed9dd4891a3073c15f04a8 ]
kprobe.multi programs run in atomic/RCU context and cannot sleep. However, bpf_kprobe_multi_link_attach() did not validate whether the program being attached had the sleepable flag set, allowing sleepable helpers such as bpf_copy_from_user() to be invoked from a non-sleepable context.
This causes a "sleeping function called from invalid context" splat:
BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:169 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1787, name: sudo preempt_count: 1, expected: 0 RCU nest depth: 2, expected: 0
Fix this by rejecting sleepable programs early in bpf_kprobe_multi_link_attach(), before any further processing.
--- kernel/trace/bpf_trace.c | 4 ++++ 1 file changed, 4 insertions(+)
kernel/trace/bpf_trace.c +4 -0
@@ -2739,6 +2739,10 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *prif (!is_kprobe_multi (prog))return -EINVAL ; +/* kprobe_multi is not allowed to be sleepable. */ +if (prog->sleepable) +return -EINVAL ; +/* Writing to context is not allowed for kprobes. */ if (prog->aux->kprobe_write_ctx)return -EINVAL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 103/277 Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug"
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Lankhorst <[email protected]>
commit 45ebe43ea00d6b9f5b3e0db9c35b8ca2a96b7e70 upstream.
This reverts commit 6bee098b91417654703e17eb5c1822c6dfd0c01d.
Den 2026-03-25 kl. 22:11, skrev Simona Vetter:
Quoted 96 lines · Guenter Roeck
Quoted 8 lines
Hi,
Quoted 5 lines · Maarten Lankhorst
When trying to do a rather aggressive test of igt's "
xe_module_load--r reload" with a full desktop environment and game running I noticed a few OOPSes when dereferencing freed pointers, related to framebuffers and property blobs after the compositor exits.Quoted 7 lines
Quoted 4 lines
Solve this by guarding the freeing in
drm_filewith drm_dev_enter/exit, and immediately put the references from structdrm_fileobjects duringdrm_dev_unplug().With this patch in v6.18.20, I get the warning backtraces below. The backtraces are gone with the patch reverted.
Yeah, this needs to be reverted, reasoning below. Maarten, can you please take care of that and feed the revert through the usual channels? I don't think it's critical enough that we need to fast-track this into drm.git directly.
Quoting the patch here again:
Quoted 17 lines
drivers/gpu/drm/drm_file.c | 5 ++++- drivers/gpu/drm/drm_mode_config.c | 9 ++++++--- 2 files changed, 10 insertions(+), 4 deletions(-)drivers/gpu/drm/drm_file.c +1
-0@@ -233,6 +233,7 @@ static void drm_events_release(struct drm_file *file_priv)void drm_file_free (struct drm_file *file) {struct drm_device *dev; +int idx;if (!file)return ;drivers/gpu/drm/drm_file.c void drm_file_free(struct drm_file *file) · line 254
Quoted 6 lines
drivers/gpu/drm/drm_file.c +2
-1@@ -249,9 +250,11 @@ void drm_file_free(struct drm_file *file)drm_events_release (file); -if (drm_core_check_feature (dev,DRIVER_MODESET )) { +if (drm_core_check_feature (dev,DRIVER_MODESET ) && +drm_dev_enter (dev, &idx)) {This is misplaced for two reasons:
- Even if we'd want to guarantee that we hold a drm_dev_enter/exit reference during framebuffer teardown, we'd need to do this
_consistentlyover all callsites. Not ad-hoc in just one place that a testcase hits. This also means kerneldoc updates of the relevant hooks and at least a bunch of acks from other driver people to document the consensus.- More importantly, this is driver responsibilities in general unless we have extremely good reasons to the contrary. Which means this must be placed in xe.
Quoted 11 lines
drivers/gpu/drm/drm_file.c +1
-0drm_fb_release (file);drm_property_destroy_user_blobs (dev, file); +drm_dev_exit (idx); }if (drm_core_check_feature (dev,DRIVER_SYNCOBJ ))drivers/gpu/drm/drm_mode_config.c +0
-0drivers/gpu/drm/drm_mode_config.c void drm_mode_config_cleanup(struct drm_device *dev) · line 587
Quoted 6 lines
drivers/gpu/drm/drm_mode_config.c +2
-1@@ -583,10 +583,13 @@ void drm_mode_config_cleanup(struct drm_device *dev)*/ WARN_ON (!list_empty (&dev->mode_config.fb_list));list_for_each_entry_safe (fb, fbt, &dev->mode_config.fb_list, head) { -struct drm_printer p =drm_dbg_printer (dev,DRM_UT_KMS ,"[leaked fb]" ); +if (list_empty (&fb->filp_head) ||drm_framebuffer_read_refcount (fb) >1 ) { +struct drm_printer p =drm_dbg_printer (dev,DRM_UT_KMS ,"[leaked fb]" );This is also wrong:
- Firstly, it's a completely independent bug, we do not smash two bugfixes into one patch.
- Secondly, it's again a driver bug:
drm_mode_cleanupmust be called when the lastdrm_devicereference disappears (hence the existence ofdrmm_mode_config_init), not when the driver gets unbound. The fact that this shows up in a callchain from a devres cleanup means the intel driver gets this wrong (like almost everyone else because historically we didn't know better).If we don't follow this rule, then we get races with this code here running concurrently with
drm_filefb cleanups, which just does not work. Review pointed that out, but then shrugged it off with a confused explanation:
Quoted 6 lines
https://lore.kernel.org/all/[email protected]/
Yes this also means a lot of the other
drm_deviceteardown that drivers do happens way too early. There is a massive can of worms here of a magnitude that most likely is much, much bigger than what you can backport to stable kernels. Hotunplug is _hard_.
Back to the drawing board, and fixing it in the intel display driver instead.
--- drivers/gpu/drm/drm_file.c | 5 +---- drivers/gpu/drm/drm_mode_config.c | 9 +++------ 2 files changed, 4 insertions(+), 10 deletions(-)
drivers/gpu/drm/drm_file.c +1 -4
@@ -233,7 +233,6 @@ static void drm_events_release(struct drvoid drm_file_free (struct drm_file *file) {struct drm_device *dev; -int idx;if (!file)return ;
@@ -250,11 +249,9 @@ void drm_file_free(struct drm_file *filedrm_events_release (file); -if (drm_core_check_feature (dev,DRIVER_MODESET ) && -drm_dev_enter (dev, &idx)) { +if (drm_core_check_feature (dev,DRIVER_MODESET )) {drm_fb_release (file);drm_property_destroy_user_blobs (dev, file); -drm_dev_exit (idx); }if (drm_core_check_feature (dev,DRIVER_SYNCOBJ ))
drivers/gpu/drm/drm_mode_config.c +3 -6
@@ -570,13 +570,10 @@ void drm_mode_config_cleanup(struct drm_*/ WARN_ON (!list_empty (&dev->mode_config.fb_list));list_for_each_entry_safe (fb, fbt, &dev->mode_config.fb_list, head) { -if (list_empty (&fb->filp_head) ||drm_framebuffer_read_refcount (fb) >1 ) { -struct drm_printer p =drm_dbg_printer (dev,DRM_UT_KMS ,"[leaked fb]" ); +struct drm_printer p =drm_dbg_printer (dev,DRM_UT_KMS ,"[leaked fb]" ); -drm_printf (&p,"framebuffer[%u]:\n" , fb->base.id); -drm_framebuffer_print_info (&p,1 , fb); - } -list_del_init (&fb->filp_head); +drm_printf (&p,"framebuffer[%u]:\n" , fb->base.id); +drm_framebuffer_print_info (&p,1 , fb);drm_framebuffer_free (&fb->base.refcount); }
Greg Kroah-Hartman
maintainerPATCH 104/277 iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 773ef9f95385bae52dcb7fd129fefba3a71a04db ]
Fix an off-by-one error in the BNO055_SCAN_CH_COUNT macro. The count is derived by taking the difference of the last and first register addresses, dividing by the size of each channel (2 bytes). It needs to also add 1 to account for the fact that the count is inclusive of both the first and last channels.
Thanks to the aligned_s64 timestamp field, there was already extra padding in the buffer, so there were no runtime issues caused by this bug.
--- drivers/iio/imu/bno055/bno055.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/imu/bno055/bno055.c +1 -1
@@ -64,7 +64,7 @@#define BNO055_GRAVITY_DATA_X_LSB_REG 0x2E#define BNO055_GRAVITY_DATA_Y_LSB_REG 0x30#define BNO055_GRAVITY_DATA_Z_LSB_REG 0x32 -#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2) +#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2 + 1)#define BNO055_TEMP_REG 0x34#define BNO055_CALIB_STAT_REG 0x35#define BNO055_CALIB_STAT_MAGN_SHIFT 0
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 105/277 gpio: rename gpio_chip_hwgpio() to gpiod_hwgpio()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit df900536e85819f6168783d5f6b3908d47811fdd ]
This function takes a GPIO descriptor as first argument. Make its naming consistent with the rest of the GPIO codebase and use the gpiod_ prefix.
Stable-dep-of: 6df6ea4b3d15 ("gpiolib: clear requested flag if line is invalid")
--- drivers/gpio/gpio-aspeed.c | 6 ++--- drivers/gpio/gpiolib-cdev.c | 12 +++++----- drivers/gpio/gpiolib-sysfs.c | 14 +++++------ drivers/gpio/gpiolib.c | 46 ++++++++++++++++++------------------ drivers/gpio/gpiolib.h | 2 +- 5 files changed, 40 insertions(+), 40 deletions(-)
drivers/gpio/gpio-aspeed.c +3 -3
@@ -24,7 +24,7 @@/* * These two headers aren't meant to be used by GPIO drivers. We need -* them in order to access gpio_chip_hwgpio() which we need to implement +* them in order to access gpiod_hwgpio() which we need to implement * the aspeed specific API which allows the coprocessor to request * access to some GPIOs and to arbitrate between coprocessor and ARM. */
@@ -942,7 +942,7 @@ int aspeed_gpio_copro_grab_gpio(struct gpio_desc *desc, {struct gpio_chip *chip =gpiod_to_chip (desc);struct aspeed_gpio *gpio =gpiochip_get_data (chip); -int rc =0 , bindex, offset =gpio_chip_hwgpio (desc); +int rc =0 , bindex, offset =gpiod_hwgpio (desc);const struct aspeed_gpio_bank *bank =to_bank (offset);if (!aspeed_gpio_support_copro (gpio))
@@ -987,7 +987,7 @@ int aspeed_gpio_copro_release_gpio(struct gpio_desc *desc) {struct gpio_chip *chip =gpiod_to_chip (desc);struct aspeed_gpio *gpio =gpiochip_get_data (chip); -int rc =0 , bindex, offset =gpio_chip_hwgpio (desc); +int rc =0 , bindex, offset =gpiod_hwgpio (desc);if (!aspeed_gpio_support_copro (gpio))return -EOPNOTSUPP ;
drivers/gpio/gpiolib-cdev.c +6 -6
@@ -676,7 +676,7 @@ static enum hte_return process_hw_ts_thread(void *p) } le.line_seqno = line->line_seqno; le.seqno = (lr->num_lines ==1 ) ? le.line_seqno : line->req_seqno; - le.offset =gpio_chip_hwgpio (line->desc); + le.offset =gpiod_hwgpio (line->desc);linereq_put_event (lr, &le);
@@ -793,7 +793,7 @@ static irqreturn_t edge_irq_thread(int irq, void *p) line->line_seqno++; le.line_seqno = line->line_seqno; le.seqno = (lr->num_lines ==1 ) ? le.line_seqno : line->req_seqno; - le.offset =gpio_chip_hwgpio (line->desc); + le.offset =gpiod_hwgpio (line->desc);linereq_put_event (lr, &le);
@@ -891,7 +891,7 @@ static void debounce_work_func(struct work_struct *work) lr = line->req; le.timestamp_ns =line_event_timestamp (line); - le.offset =gpio_chip_hwgpio (line->desc); + le.offset =gpiod_hwgpio (line->desc);#ifdef CONFIG_HTE if (edflags &GPIO_V2_LINE_FLAG_EVENT_CLOCK_HTE ) {/* discard events except the last one */
@@ -1591,7 +1591,7 @@ static void linereq_show_fdinfo(struct seq_file *out, struct file *file)for (i =0 ; i < lr->num_lines; i++)seq_printf (out,"gpio-line:\t%d\n" , - gpio_chip_hwgpio(lr->lines[i].desc)); + gpiod_hwgpio(lr->lines[i].desc)); }#endif
@@ -2244,7 +2244,7 @@ static void gpio_desc_to_lineinfo(struct gpio_desc *desc,return ;memset (info,0 ,sizeof (*info)); - info->offset =gpio_chip_hwgpio (desc); + info->offset =gpiod_hwgpio (desc);if (desc->name)strscpy (info->name, desc->name,sizeof (info->name));
@@ -2550,7 +2550,7 @@ static int lineinfo_changed_notify(struct notifier_block *nb,struct gpio_desc *desc = data;struct file *fp; -if (!test_bit (gpio_chip_hwgpio (desc), cdev->watched_lines)) +if (!test_bit (gpiod_hwgpio (desc), cdev->watched_lines))return NOTIFY_DONE ;/* Keep the file descriptor alive for the duration of the notification. */
drivers/gpio/gpiolib-sysfs.c +7 -7
@@ -244,7 +244,7 @@ static int gpio_sysfs_request_irq(struct gpiod_data *data, unsigned char flags)* Remove this redundant call (along with the corresponding unlock) * when those drivers have been fixed. */ - ret =gpiochip_lock_as_irq (guard.gc,gpio_chip_hwgpio (desc)); + ret =gpiochip_lock_as_irq (guard.gc,gpiod_hwgpio (desc));if (ret <0 ) goto err_clr_bits;
@@ -258,7 +258,7 @@ static int gpio_sysfs_request_irq(struct gpiod_data *data, unsigned char flags)return 0 ; err_unlock: -gpiochip_unlock_as_irq (guard.gc,gpio_chip_hwgpio (desc)); +gpiochip_unlock_as_irq (guard.gc,gpiod_hwgpio (desc)); err_clr_bits:clear_bit (GPIOD_FLAG_EDGE_RISING , &desc->flags);clear_bit (GPIOD_FLAG_EDGE_FALLING , &desc->flags);
@@ -280,7 +280,7 @@ static void gpio_sysfs_free_irq(struct gpiod_data *data) data->irq_flags =0 ;free_irq (data->irq, data); -gpiochip_unlock_as_irq (guard.gc,gpio_chip_hwgpio (desc)); +gpiochip_unlock_as_irq (guard.gc,gpiod_hwgpio (desc));clear_bit (GPIOD_FLAG_EDGE_RISING , &desc->flags);clear_bit (GPIOD_FLAG_EDGE_FALLING , &desc->flags); }
@@ -478,10 +478,10 @@ static int export_gpio_desc(struct gpio_desc *desc)if (!guard.gc)return -ENODEV ; - offset =gpio_chip_hwgpio (desc); + offset =gpiod_hwgpio (desc);if (!gpiochip_line_is_valid (guard.gc, offset)) {pr_debug_ratelimited ("%s: GPIO %d masked\n" , __func__, -gpio_chip_hwgpio (desc)); +gpiod_hwgpio (desc));return -EINVAL ; }
@@ -823,7 +823,7 @@ int gpiod_export(struct gpio_desc *desc, bool direction_may_change) } desc_data->chip_attr_group.name =kasprintf (GFP_KERNEL ,"gpio%u" , -gpio_chip_hwgpio (desc)); +gpiod_hwgpio (desc));if (!desc_data->chip_attr_group.name) { status = -ENOMEM ; goto err_put_dirent;
@@ -843,7 +843,7 @@ int gpiod_export(struct gpio_desc *desc, bool direction_may_change)if (status) goto err_free_name; - path =kasprintf (GFP_KERNEL ,"gpio%u/value" ,gpio_chip_hwgpio (desc)); + path =kasprintf (GFP_KERNEL ,"gpio%u/value" ,gpiod_hwgpio (desc));if (!path) { status = -ENOMEM ; goto err_remove_groups;
drivers/gpio/gpiolib.c +23 -23
177 lines not on this page · raw message
drivers/gpio/gpiolib.h +1 -1
@@ -276,7 +276,7 @@ const char *gpiod_get_label(struct gpio_desc *desc);/* * Return the GPIO number of the passed descriptor relative to its chip */ -static inline int gpio_chip_hwgpio (const struct gpio_desc *desc) +static inline int gpiod_hwgpio (const struct gpio_desc *desc) {return desc - &desc->gdev->descs[0 ]; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 106/277 gpiolib: clear requested flag if line is invalid
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Barnabás Pőcze <[email protected]>
[ Upstream commit 6df6ea4b3d1567dbe6442f308735c23b63007c7f ]
If gpiochip_line_is_valid() fails, then -EINVAL is returned, but desc->flags will have GPIOD_FLAG_REQUESTED set, which will result in subsequent calls misleadingly returning -EBUSY.
Fix that by clearing the flag in case of failure.
--- drivers/gpio/gpiolib.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpio/gpiolib.c +4 -2
@@ -2447,8 +2447,10 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label)return -EBUSY ; offset =gpiod_hwgpio (desc); -if (!gpiochip_line_is_valid (guard.gc, offset)) -return -EINVAL ; +if (!gpiochip_line_is_valid (guard.gc, offset)) { + ret = -EINVAL ; + goto out_clear_bit; + }/* NOTE: gpio_request() can be called in early boot, * before IRQs are enabled, for non-sleeping (SOC) GPIOs.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 107/277 accel/qaic: Handle DBC deactivation if the owner went away
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Youssef Samir <[email protected]>
[ Upstream commit 2feec5ae5df785658924ab6bd91280dc3926507c ]
When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles this by calling decode_deactivate() to release the resources allocated for that DBC. Since that handling is done in the qaic_manage_ioctl() context, if the user goes away before receiving and handling the deactivation, the host will be out-of-sync with the DBCs available for use, and the DBC resources will not be freed unless the device is removed. If another user loads and requests to activate a network, then the device assigns the same DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false, leading the user process to hang.
As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions that are received after the user has gone away.
--- drivers/accel/qaic/qaic_control.c | 47 +++++++++++++++++++++++++++++-- 1 file changed, 45 insertions(+), 2 deletions(-)
drivers/accel/qaic/qaic_control.c +45 -2
@@ -910,7 +910,7 @@ static int decode_deactivate(struct qaic_device *qdev, void *trans, u32 *msg_len*/ return -ENODEV ; -if (status) { +if (usr && status) {/* * Releasing resources failed on the device side, which puts * us in a bind since they may still be in use, so enable the
@@ -1105,6 +1105,9 @@ static void *msg_xfer(struct qaic_device *qdev, struct wrapper_list *wrappers, umutex_lock (&qdev->cntl_mutex);if (!list_empty (&elem.list))list_del (&elem.list); +/* resp_worker() processed the response but the wait was interrupted */ +else if (ret == -ERESTARTSYS ) + ret =0 ;if (!ret && !elem.buf) ret = -ETIMEDOUT ;else if (ret >0 && !elem.buf)
@@ -1415,9 +1418,49 @@ static void resp_worker(struct work_struct *work) }mutex_unlock (&qdev->cntl_mutex); -if (!found) +if (!found) { +/* +* The user might have gone away at this point without waiting +* for QAIC_TRANS_DEACTIVATE_FROM_DEV transaction coming from +* the device. If this is not handled correctly, the host will +* not know that the DBC[n] has been freed on the device. +* Due to this failure in synchronization between the device and +* the host, if another user requests to activate a network, and +* the device assigns DBC[n] again, save_dbc_buf() will hang, +* waiting for dbc[n]->in_use to be set to false, which will not +* happen unless the qaic_dev_reset_clean_local_state() gets +* called by resetting the device (or re-inserting the module). +* +* As a solution, we look for QAIC_TRANS_DEACTIVATE_FROM_DEV +* transactions in the message before disposing of it, then +* handle releasing the DBC resources. +* +* Since the user has gone away, if the device could not +* deactivate the network (status != 0), there is no way to +* enable and reassign the DBC to the user. We can put trust in +* the device that it will release all the active DBCs in +* response to the QAIC_TRANS_TERMINATE_TO_DEV transaction, +* otherwise, the user can issue an soc_reset to the device. +*/ +u32 msg_count =le32_to_cpu (msg->hdr.count); +u32 msg_len =le32_to_cpu (msg->hdr.len); +u32 len =0 ; +int j; + +for (j =0 ; j < msg_count && len < msg_len; ++j) { +struct wire_trans_hdr *trans_hdr; + + trans_hdr = (struct wire_trans_hdr *)(msg->data + len); +if (le32_to_cpu (trans_hdr->type) ==QAIC_TRANS_DEACTIVATE_FROM_DEV ) { +if (decode_deactivate (qdev, trans_hdr, &len,NULL )) + len +=le32_to_cpu (trans_hdr->len); + }else { + len +=le32_to_cpu (trans_hdr->len); + } + }/* request must have timed out, drop packet */ kfree (msg); + }kfree (resp); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 108/277 io_uring/rsrc: reject zero-length fixed buffer import
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Tang <[email protected]>
[ Upstream commit 111a12b422a8cfa93deabaef26fec48237163214 ]
validate_fixed_range() admits buf_addr at the exact end of the registered region when len is zero, because the check uses strict greater-than (buf_end > imu->ubuf + imu->len). io_import_fixed() then computes offset == imu->len, which causes the bvec skip logic to advance past the last bio_vec entry and read bv_offset from out-of-bounds slab memory.
Return early from io_import_fixed() when len is zero. A zero-length import has no data to transfer and should not walk the bvec array at all.
BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0 Read of size 4 at addr ffff888002bcc254 by task poc/103 Call Trace: io_import_reg_buf+0x697/0x7f0 io_write_fixed+0xd9/0x250 __io_issue_sqe+0xad/0x710 io_issue_sqe+0x7d/0x1100 io_submit_sqes+0x86a/0x23c0 __do_sys_io_uring_enter+0xa98/0x1590 Allocated by task 103: The buggy address is located 12 bytes to the right of allocated 584-byte region [ffff888002bcc000, ffff888002bcc248)
--- io_uring/rsrc.c | 4 ++++ 1 file changed, 4 insertions(+)
io_uring/rsrc.c +4 -0
@@ -1082,6 +1082,10 @@ static int io_import_fixed(int ddir, struct iov_iter *iter,return ret;if (!(imu->dir & (1 << ddir)))return -EFAULT ; +if (unlikely (!len)) { +iov_iter_bvec (iter, ddir,NULL ,0 ,0 ); +return 0 ; + } offset = buf_addr - imu->ubuf;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 109/277 hwmon: (tps53679) Fix array access with zero-length block read
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
[ Upstream commit 0e211f6aaa6a00fd0ee0c1eea5498f168c6725e6 ]
i2c_smbus_read_block_data() can return 0, indicating a zero-length read. When this happens, tps53679_identify_chip() accesses buf[ret - 1] which is buf[-1], reading one byte before the buffer on the stack.
Fix by changing the check from "ret < 0" to "ret <= 0", treating a zero-length read as an error (-EIO), which prevents the out-of-bounds array access.
Also fix a typo in the adjacent comment: "if present" instead of duplicate "if".
--- drivers/hwmon/pmbus/tps53679.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/hwmon/pmbus/tps53679.c +3 -3
@@ -103,10 +103,10 @@ static int tps53679_identify_chip(struct i2c_client *client, } ret =i2c_smbus_read_block_data (client,PMBUS_IC_DEVICE_ID , buf); -if (ret <0 ) -return ret; +if (ret <=0 ) +return ret <0 ? ret : -EIO ; -/* Adjust length if null terminator if present */ +/* Adjust length if null terminator is present */ buf_len = (buf[ret -1 ] !='\x00' ? ret : ret -1 ); id_len =strlen (id);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 110/277 hwmon: (pxe1610) Check return value of page-select write in probe
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
[ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check the return value. If the write fails, subsequent register reads operate on an indeterminate page, leading to silent misconfiguration.
Check the return value and propagate the error using dev_err_probe(), which also handles -EPROBE_DEFER correctly without log spam.
--- drivers/hwmon/pmbus/pxe1610.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/hwmon/pmbus/pxe1610.c +4 -1
@@ -104,7 +104,10 @@ static int pxe1610_probe(struct i2c_client *client)* By default this device doesn't boot to page 0, so set page 0 * to access all pmbus registers. */ -i2c_smbus_write_byte_data (client,PMBUS_PAGE ,0 ); + ret =i2c_smbus_write_byte_data (client,PMBUS_PAGE ,0 ); +if (ret <0 ) +return dev_err_probe (&client->dev, ret, +"Failed to set page 0\n" );/* Read Manufacturer id */ ret =i2c_smbus_read_block_data (client,PMBUS_MFR_ID , buf);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 111/277 hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
[ Upstream commit a9d2fbd3ad0e6ac588386e699beeccfe7516755f ]
ltc4286.c uses PMBus core symbols exported in the PMBUS namespace, such as pmbus_do_probe(), but does not declare MODULE_IMPORT_NS("PMBUS").
Add the missing namespace import to avoid modpost warnings.
--- drivers/hwmon/pmbus/ltc4286.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/pmbus/ltc4286.c +1 -0
@@ -173,3 +173,4 @@ module_i2c_driver(ltc4286_driver);MODULE_AUTHOR ("Delphine CC Chiu <[email protected]>" );MODULE_DESCRIPTION ("PMBUS driver for LTC4286 and compatibles" );MODULE_LICENSE ("GPL" ); +MODULE_IMPORT_NS ("PMBUS" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 112/277 dt-bindings: gpio: fix microchip #interrupt-cells
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamie Gibbons <[email protected]>
[ Upstream commit 6b5ef8c88854b343b733b574ea8754c9dab61f41 ]
The GPIO controller on PolarFire SoC supports more than one type of interrupt and needs two interrupt cells.
--- .../devicetree/bindings/gpio/microchip,mpfs-gpio.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml +2 -2
@@ -34,7 +34,7 @@ properties: const: 2 "#interrupt-cells": - const: 1 + const: 2 ngpios: description:
@@ -83,7 +83,7 @@ examples: gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; interrupts = <53>, <53>, <53>, <53>, <53>, <53>, <53>, <53>, <53>, <53>, <53>, <53>,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 113/277 spi: stm32-ospi: Fix resource leak in remove() callback
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
[ Upstream commit 73cd1f97946ae3796544448ff12c07f399bb2881 ]
The remove() callback returned early if pm_runtime_resume_and_get() failed, skipping the cleanup of spi controller and other resources.
Remove the early return so cleanup completes regardless of PM resume result.
--- drivers/spi/spi-stm32-ospi.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/spi/spi-stm32-ospi.c +1 -4
@@ -963,11 +963,8 @@ static int stm32_ospi_probe(struct platform_device *pdev)static void stm32_ospi_remove (struct platform_device *pdev) {struct stm32_ospi *ospi =platform_get_drvdata (pdev); -int ret; - ret =pm_runtime_resume_and_get (ospi->dev); -if (ret <0 ) -return ; +pm_runtime_resume_and_get (ospi->dev);spi_unregister_controller (ospi->ctrl);/* Disable ospi */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 114/277 spi: stm32-ospi: Fix reset control leak on probe error
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
[ Upstream commit 5a570c8d6e55689253f6fcc4a198c56cca7e39d6 ]
When spi_register_controller() fails after reset_control_acquire() succeeds, the reset control is never released. This causes a resource leak in the error path.
Add the missing reset_control_release() call in the error path.
--- drivers/spi/spi-stm32-ospi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/spi/spi-stm32-ospi.c +3 -1
@@ -939,13 +939,15 @@ static int stm32_ospi_probe(struct platform_device *pdev)if (ret) {/* Disable ospi */ writel_relaxed (0 , ospi->regs_base +OSPI_CR ); - goto err_pm_resume; + goto err_reset_control; }pm_runtime_put_autosuspend (ospi->dev);return 0 ; +err_reset_control: +reset_control_release (ospi->rstc); err_pm_resume:pm_runtime_put_sync_suspend (ospi->dev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 115/277 drm/xe/pxp: Clean up termination status on failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Ceraolo Spurio <[email protected]>
[ Upstream commit e2628e670bb0923fcdc00828bfcd67b26a7df020 ]
If the PXP HW termination fails during PXP start, the normal completion code won't be called, so the termination will remain uncomplete. To avoid unnecessary waits, mark the termination as completed from the error path. Note that we already do this if the termination fails when handling a termination irq from the HW.
--- drivers/gpu/drm/xe/xe_pxp.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/xe/xe_pxp.c +1 -0
@@ -603,6 +603,7 @@ static int pxp_start(struct xe_pxp *pxp, u8 type)drm_err (&pxp->xe->drm,"PXP termination failed before start\n" );mutex_lock (&pxp->mutex); pxp->status =XE_PXP_ERROR ; +complete_all (&pxp->termination); goto out_unlock; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 116/277 drm/xe/pxp: Remove incorrect handling of impossible state during suspend
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Ceraolo Spurio <[email protected]>
[ Upstream commit 4fed244954c2dc9aafa333d08f66b14345225e03 ]
The default case of the PXP suspend switch is incorrectly exiting without releasing the lock. However, this case is impossible to hit because we're switching on an enum and all the valid enum values have their own cases. Therefore, we can just get rid of the default case and rely on the compiler to warn us if a new enum value is added and we forget to add it to the switch.
--- drivers/gpu/drm/xe/xe_pxp.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/gpu/drm/xe/xe_pxp.c +0 -6
@@ -891,11 +891,6 @@ int xe_pxp_pm_suspend(struct xe_pxp *pxp) pxp->key_instance++; needs_queue_inval = true;break ; -default : -drm_err (&pxp->xe->drm,"unexpected state during PXP suspend: %u" , - pxp->status); - ret = -EIO ; - goto out; }/*
@@ -920,7 +915,6 @@ int xe_pxp_pm_suspend(struct xe_pxp *pxp) pxp->last_suspend_key_instance = pxp->key_instance; -out:return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 117/277 drm/xe/pxp: Clear restart flag in pxp_start after jumping back
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Ceraolo Spurio <[email protected]>
[ Upstream commit 76903b2057c8677c2c006e87fede15f496555dc0 ]
If we don't clear the flag we'll keep jumping back at the beginning of the function once we reach the end.
--- drivers/gpu/drm/xe/xe_pxp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_pxp.c +3 -1
@@ -532,7 +532,7 @@ static int __exec_queue_add(struct xe_pxp *pxp, struct xe_exec_queue *q)static int pxp_start (struct xe_pxp *pxp,u8 type) {int ret =0 ; -bool restart = false; +bool restart;if (!xe_pxp_is_enabled (pxp))return -ENODEV ;
@@ -561,6 +561,8 @@ static int pxp_start(struct xe_pxp *pxp, u8 type) msecs_to_jiffies(PXP_ACTIVATION_TIMEOUT_MS)))return -ETIMEDOUT ; + restart = false; +mutex_lock (&pxp->mutex);/* If PXP is not already active, turn it on */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 118/277 hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
[ Upstream commit ca34ee6d0307a0b4e52c870dfc1bb8a3c3eb956e ]
tps53676_identify() uses strncmp() to compare the device ID buffer against a byte sequence containing embedded non-printable bytes (\x53\x67\x60). strncmp() is semantically wrong for binary data comparison; use memcmp() instead.
Additionally, the buffer from i2c_smbus_read_block_data() is not NUL-terminated, so printing it with "%s" in the error path is undefined behavior and may read past the buffer. Use "%*ph" to hex-dump the actual bytes returned.
Per the datasheet, the expected device ID is the 6-byte sequence 54 49 53 67 60 00 ("TI\x53\x67\x60\x00"), so compare all 6 bytes including the trailing NUL.
--- drivers/hwmon/pmbus/tps53679.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/pmbus/tps53679.c +2 -2
@@ -175,8 +175,8 @@ static int tps53676_identify(struct i2c_client *client, ret =i2c_smbus_read_block_data (client,PMBUS_IC_DEVICE_ID , buf);if (ret <0 )return ret; -if (strncmp ("TI\x53\x67\x60" , buf,5 )) { -dev_err (&client->dev,"Unexpected device ID: %s\n" , buf); +if (ret !=6 ||memcmp (buf,"TI\x53\x67\x60\x00" ,6 )) { +dev_err (&client->dev,"Unexpected device ID: %*ph\n" , ret, buf);return -ENODEV ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 119/277 spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
[ Upstream commit b0dc7e7c56573e7a52080f25f3179a45f3dd7e6f ]
aml_sfc_probe() registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add a devm cleanup action after successful registration so nand_ecc_unregister_on_host_hw_engine() runs automatically on probe failures and during device removal.
--- drivers/spi/spi-amlogic-spifc-a4.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/spi/spi-amlogic-spifc-a4.c +12 -0
@@ -1066,6 +1066,13 @@ static const struct nand_ecc_engine_ops aml_sfc_ecc_engine_ops = { .finish_io_req = aml_sfc_ecc_finish_io_req, }; +static void aml_sfc_unregister_ecc_engine (void *data) +{ +struct nand_ecc_engine *eng = data; + +nand_ecc_unregister_on_host_hw_engine (eng); +} +static int aml_sfc_clk_init (struct aml_sfc *sfc) { sfc->gate_clk =devm_clk_get_enabled (sfc->dev,"gate" );
@@ -1149,6 +1156,11 @@ static int aml_sfc_probe(struct platform_device *pdev)if (ret)return dev_err_probe (&pdev->dev, ret,"failed to register Aml host ecc engine.\n" ); + ret =devm_add_action_or_reset (dev, aml_sfc_unregister_ecc_engine, + &sfc->ecc_eng); +if (ret) +return dev_err_probe (dev, ret,"failed to add ECC unregister action\n" ); + ret =of_property_read_u32 (np,"amlogic,rx-adj" , &val);if (!ret) sfc->rx_adj = val;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 120/277 hwmon: (occ) Fix missing newline in occ_show_extended()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
[ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag is set, the sysfs_emit format string "%u" is missing the trailing newline that the sysfs ABI expects. The else branch correctly uses "%4phN\n", and all other show functions in this file include the trailing newline.
Add the missing "\n" for consistency and correct sysfs output.
--- drivers/hwmon/occ/common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/occ/common.c +1 -1
@@ -725,7 +725,7 @@ static ssize_t occ_show_extended(struct device *dev,switch (sattr->nr) {case 0 :if (extn->flags &EXTN_FLAG_SENSOR_ID ) { - rc =sysfs_emit (buf,"%u" , + rc =sysfs_emit (buf,"%u\n" ,get_unaligned_be32 (&extn->sensor_id)); }else { rc =sysfs_emit (buf,"%4phN\n" , extn->name);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 121/277 drm/sysfb: Fix efidrm error handling and memory type mismatch
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit 5e77923a3eb39cce91bf08ed7670f816bf86d4af ]
Fix incorrect error checking and memory type confusion in efidrm_device_create(). devm_memremap() returns error pointers, not NULL, and returns system memory while devm_ioremap() returns I/O memory. The code incorrectly passes system memory to iosys_map_set_vaddr_iomem().
Restructure to handle each memory type separately. Use devm_ioremap*() with ERR_PTR(-ENXIO) for WC/UC, and devm_memremap() with ERR_CAST() for WT/WB.
--- drivers/gpu/drm/sysfb/efidrm.c | 46 +++++++++++++++++++++++----------- 1 file changed, 31 insertions(+), 15 deletions(-)
drivers/gpu/drm/sysfb/efidrm.c +31 -15
@@ -150,7 +150,6 @@ static struct efidrm_device *efidrm_device_create(struct drm_driver *drv,struct drm_sysfb_device *sysfb;struct drm_device *dev;struct resource *mem =NULL ; -void __iomem *screen_base =NULL ;struct drm_plane *primary_plane;struct drm_crtc *crtc;struct drm_encoder *encoder;
@@ -235,21 +234,38 @@ static struct efidrm_device *efidrm_device_create(struct drm_driver *drv, mem_flags =efidrm_get_mem_flags (dev, res->start, vsize); -if (mem_flags &EFI_MEMORY_WC ) - screen_base =devm_ioremap_wc (&pdev->dev, mem->start,resource_size (mem)); -else if (mem_flags &EFI_MEMORY_UC ) - screen_base =devm_ioremap (&pdev->dev, mem->start,resource_size (mem)); -else if (mem_flags &EFI_MEMORY_WT ) - screen_base =devm_memremap (&pdev->dev, mem->start,resource_size (mem), -MEMREMAP_WT ); -else if (mem_flags &EFI_MEMORY_WB ) - screen_base =devm_memremap (&pdev->dev, mem->start,resource_size (mem), -MEMREMAP_WB ); -else +if (mem_flags &EFI_MEMORY_WC ) { +void __iomem *screen_base =devm_ioremap_wc (&pdev->dev, mem->start, +resource_size (mem)); + +if (!screen_base) +return ERR_PTR (-ENXIO ); +iosys_map_set_vaddr_iomem (&sysfb->fb_addr, screen_base); + }else if (mem_flags &EFI_MEMORY_UC ) { +void __iomem *screen_base =devm_ioremap (&pdev->dev, mem->start, +resource_size (mem)); + +if (!screen_base) +return ERR_PTR (-ENXIO ); +iosys_map_set_vaddr_iomem (&sysfb->fb_addr, screen_base); + }else if (mem_flags &EFI_MEMORY_WT ) { +void *screen_base =devm_memremap (&pdev->dev, mem->start, +resource_size (mem),MEMREMAP_WT ); + +if (IS_ERR (screen_base)) +return ERR_CAST (screen_base); +iosys_map_set_vaddr (&sysfb->fb_addr, screen_base); + }else if (mem_flags &EFI_MEMORY_WB ) { +void *screen_base =devm_memremap (&pdev->dev, mem->start, +resource_size (mem),MEMREMAP_WB ); + +if (IS_ERR (screen_base)) +return ERR_CAST (screen_base); +iosys_map_set_vaddr (&sysfb->fb_addr, screen_base); + }else {drm_err (dev,"invalid mem_flags: 0x%llx\n" , mem_flags); -if (!screen_base) -return ERR_PTR (-ENOMEM ); -iosys_map_set_vaddr_iomem (&sysfb->fb_addr, screen_base); +return ERR_PTR (-EINVAL ); + }/* * Modesetting
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 122/277 hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corey Hickey <[email protected]>
[ Upstream commit cffff6df669a438ecac506dadd49a53d4475a796 ]
On the Asus PRIME X670E-PRO WIFI, the driver reports a constant value of zero for T_Sensor. On this board, the register for T_Sensor is at a different address, as found by experimentation and confirmed by comparison to an independent temperature reading.
* sensor disconnected: -62.0°C
* ambient temperature: +22.0°C
* held between fingers: +30.0°C
Introduce SENSOR_TEMP_T_SENSOR_ALT1 to support the PRIME X670E-PRO WIFI without causing a regression for other 600-series boards
--- drivers/hwmon/asus-ec-sensors.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/hwmon/asus-ec-sensors.c +6 -1
@@ -111,6 +111,8 @@ enum ec_sensors { ec_sensor_temp_mb,/* "T_Sensor" temperature sensor reading [℃] */ ec_sensor_temp_t_sensor, +/* like ec_sensor_temp_t_sensor, but at an alternate address [℃] */ + ec_sensor_temp_t_sensor_alt1,/* VRM temperature [℃] */ ec_sensor_temp_vrm,/* CPU Core voltage [mV] */
@@ -156,6 +158,7 @@ enum ec_sensors {#define SENSOR_TEMP_CPU_PACKAGE BIT(ec_sensor_temp_cpu_package)#define SENSOR_TEMP_MB BIT(ec_sensor_temp_mb)#define SENSOR_TEMP_T_SENSOR BIT(ec_sensor_temp_t_sensor) +#define SENSOR_TEMP_T_SENSOR_ALT1 BIT(ec_sensor_temp_t_sensor_alt1)#define SENSOR_TEMP_VRM BIT(ec_sensor_temp_vrm)#define SENSOR_IN_CPU_CORE BIT(ec_sensor_in_cpu_core)#define SENSOR_FAN_CPU_OPT BIT(ec_sensor_fan_cpu_opt)
@@ -272,6 +275,8 @@ static const struct ec_sensor_info sensors_family_amd_600[] = { EC_SENSOR("VRM", hwmon_temp, 1, 0x00, 0x33), [ec_sensor_temp_t_sensor] = EC_SENSOR("T_Sensor", hwmon_temp, 1, 0x00, 0x36), + [ec_sensor_temp_t_sensor_alt1] = + EC_SENSOR("T_Sensor", hwmon_temp, 1, 0x00, 0x37), [ec_sensor_fan_cpu_opt] = EC_SENSOR("CPU_Opt", hwmon_fan, 2, 0x00, 0xb0), [ec_sensor_temp_water_in] =
@@ -489,7 +494,7 @@ static const struct ec_board_info board_info_prime_x570_pro = {static const struct ec_board_info board_info_prime_x670e_pro_wifi = { .sensors =SENSOR_TEMP_CPU |SENSOR_TEMP_CPU_PACKAGE |SENSOR_TEMP_MB |SENSOR_TEMP_VRM | -SENSOR_TEMP_T_SENSOR |SENSOR_FAN_CPU_OPT , +SENSOR_TEMP_T_SENSOR_ALT1 |SENSOR_FAN_CPU_OPT , .mutex_path =ACPI_GLOBAL_LOCK_PSEUDO_PATH , .family = family_amd_600_series, };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 123/277 mips: ralink: update CPU clock index
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shiji Yang <[email protected]>
[ Upstream commit 43985a62bab9d35e5e9af41118ce2f44c01b97d2 ]
Update CPU clock index to match the clock driver changes.
--- arch/mips/ralink/clk.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/mips/ralink/clk.c +4 -4
@@ -21,16 +21,16 @@ static const char *clk_cpu(int *idx) {switch (ralink_soc) {case RT2880_SOC : - *idx =0 ; + *idx =1 ;return "ralink,rt2880-sysc" ;case RT3883_SOC : - *idx =0 ; + *idx =1 ;return "ralink,rt3883-sysc" ;case RT305X_SOC_RT3050 : - *idx =0 ; + *idx =1 ;return "ralink,rt3050-sysc" ;case RT305X_SOC_RT3052 : - *idx =0 ; + *idx =1 ;return "ralink,rt3052-sysc" ;case RT305X_SOC_RT3350 : *idx =1 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 124/277 sched/fair: Fix zero_vruntime tracking fix
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 1319ea57529e131822bab56bf417c8edc2db9ae8 ]
John reported that stress-ng-yield could make his machine unhappy and managed to bisect it to commit b3d99f43c72b ("sched/fair: Fix zero_vruntime tracking").
The combination of yield and that commit was specific enough to hypothesize the following scenario:
Suppose we have 2 runnable tasks, both doing yield. Then one will be eligible and one will not be, because the average position must be in between these two entities.
Therefore, the runnable task will be eligible, and be promoted a full slice (all the tasks do is yield after all). This causes it to jump over the other task and now the other task is eligible and current is no longer. So we schedule.
Since we are runnable, there is no {de,en}queue. All we have is the __{en,de}queue_entity() from {put_prev,set_next}_task(). But per the fingered commit, those two no longer move zero_vruntime.
All that moves zero_vruntime are tick and full {de,en}queue.
This means, that if the two tasks playing leapfrog can reach the critical speed to reach the overflow point inside one tick's worth of time, we're up a creek.
Additionally, when multiple cgroups are involved, there is no guarantee the tick will in fact hit every cgroup in a timely manner. Statistically speaking it will, but that same statistics does not rule out the possibility of one cgroup not getting a tick for a significant amount of time -- however unlikely.
Therefore, just like with the yield() case, force an update at the end of every slice. This ensures the update is never more than a single slice behind and the whole thing is within 2 lag bounds as per the comment on entity_key().
--- kernel/sched/fair.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
kernel/sched/fair.c +3 -7
@@ -707,7 +707,7 @@ void update_zero_vruntime(struct cfs_rq *cfs_rq, s64 delta)* Called in: * - place_entity() -- before enqueue * - update_entity_lag() -- before dequeue -* - entity_tick() +* - update_deadline() -- slice expiration * * This means it is one entry 'behind' but that puts it close enough to where * the bound on entity_key() is at most two lag bounds.
@@ -1121,6 +1121,7 @@ static bool update_deadline(struct cfs_rq *cfs_rq, struct sched_entity *se)* EEVDF: vd_i = ve_i + r_i / w_i */ se->deadline = se->vruntime +calc_delta_fair (se->slice, se); +avg_vruntime (cfs_rq);/* * The task has consumed its request, reschedule.
@@ -5635,11 +5636,6 @@ entity_tick(struct cfs_rq *cfs_rq, struct sched_entity *curr, int queued)update_load_avg (cfs_rq, curr,UPDATE_TG );update_cfs_group (curr); -/* -* Pulls along cfs_rq::zero_vruntime. -*/ -avg_vruntime (cfs_rq); -#ifdef CONFIG_SCHED_HRTICK /* * queued ticks are scheduled to match the slice, so don't bother
@@ -9086,7 +9082,7 @@ static void yield_task_fair(struct rq *rq)*/ if (entity_eligible (cfs_rq, se)) { se->vruntime = se->deadline; - se->deadline +=calc_delta_fair (se->slice, se); +update_deadline (cfs_rq, se); } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 125/277 perf/x86: Fix potential bad container_of in intel_pmu_hw_config
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit dbde07f06226438cd2cf1179745fa1bec5d8914a ]
Auto counter reload may have a group of events with software events present within it. The software event PMU isn't the x86_hybrid_pmu and a container_of operation in intel_pmu_set_acr_caused_constr (via the hybrid helper) could cause out of bound memory reads. Avoid this by guarding the call to intel_pmu_set_acr_caused_constr with an is_x86_event check.
--- arch/x86/events/intel/core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/x86/events/intel/core.c +4 -2
@@ -4441,8 +4441,10 @@ static int intel_pmu_hw_config(struct perf_event *event)intel_pmu_set_acr_caused_constr (leader, idx++, cause_mask);if (leader->nr_siblings) { -for_each_sibling_event (sibling, leader) -intel_pmu_set_acr_caused_constr (sibling, idx++, cause_mask); +for_each_sibling_event (sibling, leader) { +if (is_x86_event (sibling)) +intel_pmu_set_acr_caused_constr (sibling, idx++, cause_mask); + } }if (leader != event)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 126/277 riscv: kgdb: fix several debug register assignment bugs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Walmsley <[email protected]>
[ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
Fix several bugs in the RISC-V kgdb implementation:
- The element of dbg_reg_def[] that is supposed to pertain to the S1 register embeds instead the struct pt_regs offset of the A1 register. Fix this to use the S1 register offset in struct pt_regs.
- The sleeping_thread_to_gdb_regs() function copies the value of the S10 register into the gdb_regs[] array element meant for the S9 register, and copies the value of the S11 register into the array element meant for the S10 register. It also neglects to copy the value of the S11 register. Fix all of these issues.
--- arch/riscv/kernel/kgdb.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
arch/riscv/kernel/kgdb.c +4 -3
@@ -175,7 +175,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = { {DBG_REG_T1, GDB_SIZEOF_REG, offsetof(struct pt_regs, t1)}, {DBG_REG_T2, GDB_SIZEOF_REG, offsetof(struct pt_regs, t2)}, {DBG_REG_FP, GDB_SIZEOF_REG, offsetof(struct pt_regs, s0)}, - {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)}, + {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, s1)}, {DBG_REG_A0, GDB_SIZEOF_REG, offsetof(struct pt_regs, a0)}, {DBG_REG_A1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)}, {DBG_REG_A2, GDB_SIZEOF_REG, offsetof(struct pt_regs, a2)},
@@ -244,8 +244,9 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task) gdb_regs[DBG_REG_S6_OFF ] = task->thread.s[6 ]; gdb_regs[DBG_REG_S7_OFF ] = task->thread.s[7 ]; gdb_regs[DBG_REG_S8_OFF ] = task->thread.s[8 ]; - gdb_regs[DBG_REG_S9_OFF ] = task->thread.s[10 ]; - gdb_regs[DBG_REG_S10_OFF ] = task->thread.s[11 ]; + gdb_regs[DBG_REG_S9_OFF ] = task->thread.s[9 ]; + gdb_regs[DBG_REG_S10_OFF ] = task->thread.s[10 ]; + gdb_regs[DBG_REG_S11_OFF ] = task->thread.s[11 ]; gdb_regs[DBG_REG_EPC_OFF ] = task->thread.ra; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 127/277 riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zishun Yi <[email protected]>
[ Upstream commit 3033b2b1e3949274f33a140e2a97571b5a307298 ]
In set_tagged_addr_ctrl(), when PR_TAGGED_ADDR_ENABLE is not set, pmlen is correctly set to 0, but it forgets to reset pmm. This results in the CPU pmm state not corresponding to the software pmlen state.
Fix this by resetting pmm along with pmlen.
--- arch/riscv/kernel/process.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/riscv/kernel/process.c +3 -1
@@ -324,8 +324,10 @@ long set_tagged_addr_ctrl(struct task_struct *task, unsigned long arg)if (arg &PR_TAGGED_ADDR_ENABLE && (tagged_addr_disabled || !pmlen))return -EINVAL ; -if (!(arg &PR_TAGGED_ADDR_ENABLE )) +if (!(arg &PR_TAGGED_ADDR_ENABLE )) { pmlen =PMLEN_0 ; + pmm =ENVCFG_PMM_PMLEN_0 ; + }if (mmap_write_lock_killable (mm))return -EINTR ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 128/277 ACPI: RIMT: Add dependency between iommu and devices
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sunil V L <[email protected]>
[ Upstream commit 9156585280f161fc1c3552cf1860559edb2bb7e3 ]
EPROBE_DEFER ensures IOMMU devices are probed before the devices that depend on them. During shutdown, however, the IOMMU may be removed first, leading to issues. To avoid this, a device link is added which enforces the correct removal order.
--- drivers/acpi/riscv/rimt.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/riscv/rimt.c +7 -0
@@ -263,6 +263,13 @@ static int rimt_iommu_xlate(struct device *dev, struct acpi_rimt_node *node, u32if (!rimt_fwnode)return -EPROBE_DEFER ; +/* +* EPROBE_DEFER ensures IOMMU is probed before the devices that +* depend on them. During shutdown, however, the IOMMU may be removed +* first, leading to issues. To avoid this, a device link is added +* which enforces the correct removal order. +*/ +device_link_add (dev, rimt_fwnode->dev,DL_FLAG_AUTOREMOVE_CONSUMER );return acpi_iommu_fwspec_init (dev, deviceid, rimt_fwnode); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 129/277 drm/ioc32: stop speculation on the drm_compat_ioctl path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit f8995c2df519f382525ca4bc90553ad2ec611067 upstream.
The drm compat ioctl path takes a user controlled pointer, and then dereferences it into a table of function pointers, the signature method of spectre problems. Fix this up by calling array_index_nospec() on the index to the function pointer list.
--- drivers/gpu/drm/drm_ioc32.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/drm_ioc32.c +2 -0
@@ -28,6 +28,7 @@* IN THE SOFTWARE. */ #include <linux/compat.h> +#include <linux/nospec.h> #include <linux/ratelimit.h> #include <linux/export.h>
@@ -374,6 +375,7 @@ long drm_compat_ioctl(struct file *filp,if (nr >=ARRAY_SIZE (drm_compat_ioctls))return drm_ioctl (filp, cmd, arg); + nr =array_index_nospec (nr,ARRAY_SIZE (drm_compat_ioctls)); fn = drm_compat_ioctls[nr].fn;if (!fn)return drm_ioctl (filp, cmd, arg);
Greg Kroah-Hartman
maintainerPATCH 130/277 rust_binder: use AssertSync for BINDER_VM_OPS
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
commit ec327abae5edd1d5b60ea9f920212970133171d2 upstream.
When declaring an immutable global variable in Rust, the compiler checks that it looks thread safe, because it is generally safe to access said global variable. When using C bindings types for these globals, we don't really want this check, because it is conservative and assumes pointers are not thread safe.
In the case of BINDER_VM_OPS, this is a challenge when combined with the patch 'userfaultfd: introduce vm_uffd_ops' [1], which introduces a pointer field to vm_operations_struct. It previously only held function pointers, which are considered thread safe.
Rust Binder should not be assuming that vm_operations_struct contains no pointer fields, so to fix this, use AssertSync (which Rust Binder has already declared for another similar global of type struct file_operations with the same problem). This ensures that even if another commit adds a pointer field to vm_operations_struct, this does not cause problems.
--- drivers/android/binder/page_range.rs | 8 +++++--- drivers/android/binder/rust_binder_main.rs | 2 +- 2 files changed, 6 insertions(+), 4 deletions(-)
drivers/android/binder/page_range.rs +5 -3
@@ -13,6 +13,8 @@// // The shrinker will use trylock methods because it locks them in a different order. +use crate ::AssertSync ; +use core::{ marker::PhantomPinned , mem::{size_of, size_of_val,MaybeUninit },
@@ -143,14 +145,14 @@ pub(crate) struct ShrinkablePageRange { }// We do not define any ops. For now, used only to check identity of vmas. -static BINDER_VM_OPS : bindings::vm_operations_struct = pin_init::zeroed (); +static BINDER_VM_OPS :AssertSync <bindings::vm_operations_struct > =AssertSync (pin_init::zeroed ());// To ensure that we do not accidentally install pages into or zap pages from the wrong vma, we // check its vm_ops and private data before using it. fn check_vma (vma: &virt::VmaRef , owner: *const ShrinkablePageRange ) ->Option <&virt::VmaMixedMap > {// SAFETY: Just reading the vm_ops pointer of any active vma is safe. let vm_ops =unsafe { (*vma.as_ptr ()).vm_ops }; -if !ptr::eq (vm_ops, &BINDER_VM_OPS ) { +if !ptr::eq (vm_ops, &BINDER_VM_OPS .0 ) {return None ; }
@@ -342,7 +344,7 @@ impl ShrinkablePageRange {// SAFETY: We own the vma, and we don't use any methods on VmaNew that rely on // `vm_ops`. -unsafe { (*vma.as_ptr ()).vm_ops = &BINDER_VM_OPS }; +unsafe { (*vma.as_ptr ()).vm_ops = &BINDER_VM_OPS .0 };Ok (num_pages) }
drivers/android/binder/rust_binder_main.rs +1 -1
@@ -300,7 +300,7 @@ impl kernel::Module for BinderModule {/// Makes the inner type Sync. #[repr(transparent)] pub struct AssertSync <T >(T ); -// SAFETY: Used only to insert `file_operations` into a global, which is safe. +// SAFETY: Used only to insert C bindings types into globals, which is safe. unsafe impl <T >Sync for AssertSync <T > {}/// File operations that rust_binderfs.c can use.
Greg Kroah-Hartman
maintainerPATCH 131/277 wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yasuaki Torimaru <[email protected]>
commit d049e56b1739101d1c4d81deedb269c52a8dbba0 upstream.
The variable valuesize is declared as u8 but accumulates the total length of all SSIDs to scan. Each SSID contributes up to 33 bytes (IEEE80211_MAX_SSID_LEN + 1), and with WILC_MAX_NUM_PROBED_SSID (10) SSIDs the total can reach 330, which wraps around to 74 when stored in a u8.
This causes kmalloc to allocate only 75 bytes while the subsequent memcpy writes up to 331 bytes into the buffer, resulting in a 256-byte heap buffer overflow.
Widen valuesize from u8 to u32 to accommodate the full range.
--- drivers/net/wireless/microchip/wilc1000/hif.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/microchip/wilc1000/hif.c +1 -1
@@ -163,7 +163,7 @@ int wilc_scan(struct wilc_vif *vif, u8 su32 index =0 ;u32 i, scan_timeout;u8 *buffer; -u8 valuesize =0 ; +u32 valuesize =0 ;u8 *search_ssid_vals =NULL ;const u8 ch_list_len = request->n_channels;struct host_if_drv *hif_drv = vif->hif_drv;
Greg Kroah-Hartman
maintainerPATCH 132/277 wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Velichayshiy <[email protected]>
commit 744fabc338e87b95c4d1ff7c95bc8c0f834c6d99 upstream.
The memcpy function assumes the dynamic array notif->matches is at least as large as the number of bytes to copy. Otherwise, results->matches may contain unwanted data. To guarantee safety, extend the validation in one of the checks to ensure sufficient packet length.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/d3.c +1 -1
@@ -2834,7 +2834,7 @@ static void iwl_mvm_nd_match_info_handleif (IS_ERR_OR_NULL (vif))return ; -if (len <sizeof (struct iwl_scan_offload_match_info )) { +if (len <sizeof (struct iwl_scan_offload_match_info ) + matches_len) {IWL_ERR (mvm,"Invalid scan match info notification\n" );return ; }