6.1.168-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainerPATCH 147/312 net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 2428083101f6883f979cceffa76cd8440751ffe6 ]
__radix_tree_create() allocates and links intermediate nodes into the tree one by one. If a subsequent allocation fails, the already-linked nodes remain in the tree with no corresponding leaf entry. These orphaned internal nodes are never reclaimed because radix_tree_for_each_slot() only visits slots containing leaf values.
The radix_tree API is deprecated in favor of xarray. As suggested by Matthew Wilcox, migrate qrtr_tx_flow from radix_tree to xarray instead of fixing the radix_tree itself [1]. xarray properly handles cleanup of internal nodes — xa_destroy() frees all internal xarray nodes when the qrtr_node is released, preventing the leak.
[1] https://lore.kernel.org/all/[email protected]/T/
--- net/qrtr/af_qrtr.c | 31 +++++++++++++------------------ 1 file changed, 13 insertions(+), 18 deletions(-)
net/qrtr/af_qrtr.c +13 -18
@@ -116,7 +116,7 @@ static DEFINE_XARRAY_ALLOC(qrtr_ports);* @ep: endpoint * @ref: reference count for node * @nid: node id -* @qrtr_tx_flow: tree of qrtr_tx_flow, keyed by node << 32 | port +* @qrtr_tx_flow: xarray of qrtr_tx_flow, keyed by node << 32 | port * @qrtr_tx_lock: lock for qrtr_tx_flow inserts * @rx_queue: receive queue * @item: list item for broadcast list
@@ -127,7 +127,7 @@ struct qrtr_node {struct kref ref;unsigned int nid; -struct radix_tree_root qrtr_tx_flow; +struct xarray qrtr_tx_flow;struct mutex qrtr_tx_lock;/* for qrtr_tx_flow */ struct sk_buff_head rx_queue;
@@ -170,6 +170,7 @@ static void __qrtr_node_release(struct kref *kref)struct qrtr_tx_flow *flow;unsigned long flags;void __rcu **slot; +unsigned long index;spin_lock_irqsave (&qrtr_nodes_lock, flags);/* If the node is a bridge for other nodes, there are possibly
@@ -187,11 +188,9 @@ static void __qrtr_node_release(struct kref *kref)skb_queue_purge (&node->rx_queue);/* Free tx flow counters */ -radix_tree_for_each_slot (slot, &node->qrtr_tx_flow, &iter,0 ) { - flow = *slot; -radix_tree_iter_delete (&node->qrtr_tx_flow, &iter, slot); +xa_for_each (&node->qrtr_tx_flow, index, flow)kfree (flow); - } +xa_destroy (&node->qrtr_tx_flow);kfree (node); }
@@ -226,9 +225,7 @@ static void qrtr_tx_resume(struct qrtr_node *node, struct sk_buff *skb) key = remote_node <<32 | remote_port; -rcu_read_lock (); - flow =radix_tree_lookup (&node->qrtr_tx_flow, key); -rcu_read_unlock (); + flow =xa_load (&node->qrtr_tx_flow, key);if (flow) {spin_lock (&flow->resume_tx.lock); flow->pending =0 ;
@@ -267,12 +264,13 @@ static int qrtr_tx_wait(struct qrtr_node *node, int dest_node, int dest_port,return 0 ;mutex_lock (&node->qrtr_tx_lock); - flow =radix_tree_lookup (&node->qrtr_tx_flow, key); + flow =xa_load (&node->qrtr_tx_flow, key);if (!flow) { flow =kzalloc (sizeof (*flow),GFP_KERNEL );if (flow) {init_waitqueue_head (&flow->resume_tx); -if (radix_tree_insert (&node->qrtr_tx_flow, key, flow)) { +if (xa_err (xa_store (&node->qrtr_tx_flow, key, flow, +GFP_KERNEL ))) {kfree (flow); flow =NULL ; }
@@ -324,9 +322,7 @@ static void qrtr_tx_flow_failed(struct qrtr_node *node, int dest_node,unsigned long key = (u64 )dest_node <<32 | dest_port;struct qrtr_tx_flow *flow; -rcu_read_lock (); - flow =radix_tree_lookup (&node->qrtr_tx_flow, key); -rcu_read_unlock (); + flow =xa_load (&node->qrtr_tx_flow, key);if (flow) {spin_lock_irq (&flow->resume_tx.lock); flow->tx_failed =1 ;
@@ -594,7 +590,7 @@ int qrtr_endpoint_register(struct qrtr_endpoint *ep, unsigned int nid) node->nid =QRTR_EP_NID_AUTO ; node->ep = ep; -INIT_RADIX_TREE (&node->qrtr_tx_flow,GFP_KERNEL ); +xa_init (&node->qrtr_tx_flow);mutex_init (&node->qrtr_tx_lock);qrtr_node_assign (node, nid);
@@ -622,6 +618,7 @@ void qrtr_endpoint_unregister(struct qrtr_endpoint *ep)struct qrtr_tx_flow *flow;struct sk_buff *skb;unsigned long flags; +unsigned long index;void __rcu **slot;mutex_lock (&node->ep_lock);
@@ -644,10 +641,8 @@ void qrtr_endpoint_unregister(struct qrtr_endpoint *ep)/* Wake up any transmitters waiting for resume-tx from the node */ mutex_lock (&node->qrtr_tx_lock); -radix_tree_for_each_slot (slot, &node->qrtr_tx_flow, &iter,0 ) { - flow = *slot; +xa_for_each (&node->qrtr_tx_flow, index, flow)wake_up_interruptible_all (&flow->resume_tx); - }mutex_unlock (&node->qrtr_tx_lock);qrtr_node_release (node);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 148/312 net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yochai Eisenrich <[email protected]>
[ Upstream commit ae05340ccaa9d347fe85415609e075545bec589f ]
When processing Router Advertisements with user options the kernel builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct has three padding fields that are never zeroed and can leak kernel data
The fix is simple, just zeroes the padding fields.
--- net/ipv6/ndisc.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv6/ndisc.c +3 -0
@@ -1216,6 +1216,9 @@ static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt) ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type; ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code; ndmsg->nduseropt_opts_len = opt->nd_opt_len <<3 ; + ndmsg->nduseropt_pad1 =0 ; + ndmsg->nduseropt_pad2 =0 ; + ndmsg->nduseropt_pad3 =0 ;memcpy (ndmsg +1 , opt, opt->nd_opt_len <<3 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 149/312 net/ipv6: ioam6: prevent schema length wraparound in trace fill
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 5e67ba9bb531e1ec6599a82a065dea9040b9ce50 ]
ioam6_fill_trace_data() stores the schema contribution to the trace length in a u8. With bit 22 enabled and the largest schema payload, sclen becomes 1 + 1020 / 4, wraps from 256 to 0, and bypasses the remaining-space check. __ioam6_fill_trace_data() then positions the write cursor without reserving the schema area but still copies the 4-byte schema header and the full schema payload, overrunning the trace buffer.
Keep sclen in an unsigned int so the remaining-space check and the write cursor calculation both see the full schema length.
--- net/ipv6/ioam6.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv6/ioam6.c +2 -2
@@ -648,7 +648,7 @@ static void __ioam6_fill_trace_data(struct sk_buff *skb,struct ioam6_namespace *ns, struct ioam6_trace_hdr *trace, struct ioam6_schema *sc, - u8 sclen, bool is_input) + unsigned int sclen, bool is_input) { struct timespec64 ts;ktime_t tstamp;
@@ -878,7 +878,7 @@ void ioam6_fill_trace_data(struct sk_buff *skb, bool is_input) {struct ioam6_schema *sc; -u8 sclen =0 ; +unsigned int sclen =0 ;/* Skip if Overflow flag is set */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 150/312 tg3: Fix race for querying speed/duplex
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Bogendoerfer <[email protected]>
[ Upstream commit bb417456c7814d1493d98b7dd9c040bf3ce3b4ed ]
When driver signals carrier up via netif_carrier_on() its internal link_up state isn't updated immediately. This leads to inconsistent speed/duplex in /proc/net/bonding/bondX where the speed and duplex is shown as unknown while ethtool shows correct values. Fix this by using netif_carrier_ok() for link checking in get_ksettings function.
--- drivers/net/ethernet/broadcom/tg3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/tg3.c +1 -1
@@ -12217,7 +12217,7 @@ static int tg3_get_link_ksettings(struct net_device *dev,ethtool_convert_legacy_u32_to_link_mode (cmd->link_modes.advertising, advertising); -if (netif_running (dev) && tp->link_up) { +if (netif_running (dev) &&netif_carrier_ok (dev)) { cmd->base.speed = tp->link_config.active_speed; cmd->base.duplex = tp->link_config.active_duplex; ethtool_convert_legacy_u32_to_link_mode(
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 151/312 ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 86ab3e55673a7a49a841838776f1ab18d23a67b5 ]
Sashiko AI-review observed:
In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2 and passed to icmp6_send(), it uses IP6CB(skb2).
IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm at offset 18.
If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO).
This would scan the inner, attacker-controlled IPv6 packet starting at that offset, potentially returning a fake TLV without checking if the remaining packet length can hold the full 18-byte struct ipv6_destopt_hao.
Could mip6_addr_swap() then perform a 16-byte swap that extends past the end of the packet data into skb_shared_info?
Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and ip6ip6_err() to prevent this?
This patch implements the first suggestion.
I am not sure if ip6ip6_err() needs to be changed. A separate patch would be better anyway.
--- net/ipv6/icmp.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv6/icmp.c +3 -0
@@ -677,6 +677,9 @@ int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type,if (!skb2)return 1 ; +/* Remove debris left by IPv4 stack. */ +memset (IP6CB (skb2),0 ,sizeof (*IP6CB (skb2))); +skb_dst_drop (skb2);skb_pull (skb2, nhs);skb_reset_network_header (skb2);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 152/312 ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 2edfa31769a4add828a7e604b21cb82aaaa05925 ]
Oskar Kjos reported the following problem.
ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr value. __ip_options_echo() then reads optlen from attacker-controlled packet data at sptr[rr+1] and copies that many bytes into dopt->__data, a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).
To fix this we clear skb2->cb[], as suggested by Oskar Kjos.
Also add minimal IPv4 header validation (version == 4, ihl >= 5).
--- net/ipv6/ip6_tunnel.c | 5 +++++ 1 file changed, 5 insertions(+)
net/ipv6/ip6_tunnel.c +5 -0
@@ -601,11 +601,16 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,if (!skb2)return 0 ; +/* Remove debris left by IPv6 stack. */ +memset (IPCB (skb2),0 ,sizeof (*IPCB (skb2))); +skb_dst_drop (skb2);skb_pull (skb2, offset);skb_reset_network_header (skb2); eiph =ip_hdr (skb2); +if (eiph->version !=4 || eiph->ihl <5 ) + goto out;/* Try to guess incoming interface */ rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL, eiph->saddr,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 153/312 bridge: br_nd_send: linearize skb before parsing ND options
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yang <[email protected]>
[ Upstream commit a01aee7cafc575bb82f5529e8734e7052f9b16ea ]
br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are in the linear part of request.
Its callers only guarantee that the ICMPv6 header and target address are available, so the option area can still be non-linear. Parsing ns->opt[] in that case can access data past the linear buffer.
Linearize request before option parsing and derive ns from the linear network header.
--- net/bridge/br_arp_nd_proxy.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
net/bridge/br_arp_nd_proxy.c +7 -5
@@ -248,12 +248,12 @@ struct nd_msg *br_is_nd_neigh_msg(struct sk_buff *skb, struct nd_msg *msg)static void br_nd_send (struct net_bridge *br,struct net_bridge_port *p,struct sk_buff *request,struct neighbour *n, -__be16 vlan_proto,u16 vlan_tci,struct nd_msg *ns) +__be16 vlan_proto,u16 vlan_tci) {struct net_device *dev = request->dev;struct net_bridge_vlan_group *vg; +struct nd_msg *na, *ns;struct sk_buff *reply; -struct nd_msg *na;struct ipv6hdr *pip6;int na_olen =8 ;/* opt hdr + ETH_ALEN for target */ int ns_olen;
@@ -261,7 +261,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,u8 *daddr;u16 pvid; -if (!dev) +if (!dev ||skb_linearize (request))return ; len = LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) +
@@ -278,6 +278,8 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,skb_set_mac_header (reply,0 ); daddr =eth_hdr (request)->h_source; + ns = (struct nd_msg *)(skb_network_header (request) + +sizeof (struct ipv6hdr ));/* Do we need option processing ? */ ns_olen = request->len - (skb_network_offset(request) +
@@ -465,9 +467,9 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,if (vid !=0 )br_nd_send (br, p, skb, n, skb->vlan_proto, -skb_vlan_tag_get (skb), msg); +skb_vlan_tag_get (skb));else -br_nd_send (br, p, skb, n,0 ,0 , msg); +br_nd_send (br, p, skb, n,0 ,0 ); replied = true; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 154/312 net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit 4576100b8cd03118267513cafacde164b498b322 ]
m2sm() converts a u32 slope to a u64 scaled value. For large inputs (e.g. m1=4000000000), the result can reach 2^32. rtsc_min() stores the difference of two such u64 values in a u32 variable dsm and uses it as a divisor. When the difference is exactly 2^32 the truncation yields zero, causing a divide-by-zero oops in the concave-curve intersection path:
Oops: divide error: 0000 RIP: 0010:rtsc_min (net/sched/sch_hfsc.c:601) Call Trace: init_ed (net/sched/sch_hfsc.c:629) hfsc_enqueue (net/sched/sch_hfsc.c:1569) [...]
Widen dsm to u64 and replace do_div() with div64_u64() so the full difference is preserved.
--- net/sched/sch_hfsc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/sched/sch_hfsc.c +2 -2
@@ -556,7 +556,7 @@ static void rtsc_min(struct runtime_sc *rtsc, struct internal_sc *isc, u64 x, u64 y) { u64 y1, y2, dx, dy; -u32 dsm; +u64 dsm;if (isc->sm1 <= isc->sm2) {/* service curve is convex */
@@ -599,7 +599,7 @@ rtsc_min(struct runtime_sc *rtsc, struct internal_sc *isc, u64 x, u64 y)*/ dx = (y1 - y) <<SM_SHIFT ; dsm = isc->sm1 - isc->sm2; -do_div (dx, dsm); + dx =div64_u64 (dx, dsm);/* * check if (x, y1) belongs to the 1st segment of rtsc. * if so, add the offset.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 155/312 ASoC: ep93xx: i2s: move enable call to startup callback
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <[email protected]>
[ Upstream commit 80f47122538d40b1a6a2c1a3c2d37b6e51b74224 ]
Make startup/shutdown callbacks symmetric to avoid clock subsystem warnings (reproduced with "aplay --dump-hw-params" + ctrl-c):
WARNING: CPU: 0 PID: 102 at drivers/clk/clk.c:1048 clk_core_disable lrclk already disabled CPU: 0 PID: 102 Comm: aplay Not tainted 6.2.0-rc4 #1 Hardware name: Generic DT based system ... clk_core_disable from clk_core_disable_lock clk_core_disable_lock from ep93xx_i2s_shutdown ep93xx_i2s_shutdown from snd_soc_dai_shutdown snd_soc_dai_shutdown from soc_pcm_clean soc_pcm_clean from soc_pcm_close soc_pcm_close from snd_pcm_release_substream.part.0 snd_pcm_release_substream.part.0 from snd_pcm_release snd_pcm_release from __fput __fput from task_work_run ... WARNING: CPU: 0 PID: 102 at drivers/clk/clk.c:907 clk_core_unprepare lrclk already unprepared CPU: 0 PID: 102 Comm: aplay Tainted: G W 6.2.0-rc4 #1 Hardware name: Generic DT based system ... clk_core_unprepare from clk_unprepare clk_unprepare from ep93xx_i2s_shutdown ep93xx_i2s_shutdown from snd_soc_dai_shutdown snd_soc_dai_shutdown from soc_pcm_clean soc_pcm_clean from soc_pcm_close soc_pcm_close from snd_pcm_release_substream.part.0 snd_pcm_release_substream.part.0 from snd_pcm_release snd_pcm_release from __fput __fput from task_work_run ...
Stable-dep-of: 622363757b22 ("ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure")
--- sound/soc/cirrus/ep93xx-i2s.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
sound/soc/cirrus/ep93xx-i2s.c +11 -1
@@ -208,6 +208,16 @@ static int ep93xx_i2s_dai_probe(struct snd_soc_dai *dai)return 0 ; } +static int ep93xx_i2s_startup (struct snd_pcm_substream *substream, +struct snd_soc_dai *dai) +{ +struct ep93xx_i2s_info *info =snd_soc_dai_get_drvdata (dai); + +ep93xx_i2s_enable (info, substream->stream); + +return 0 ; +} +static void ep93xx_i2s_shutdown (struct snd_pcm_substream *substream,struct snd_soc_dai *dai) {
@@ -348,7 +358,6 @@ static int ep93xx_i2s_hw_params(struct snd_pcm_substream *substream,if (err)return err; -ep93xx_i2s_enable (info, substream->stream);return 0 ; }
@@ -395,6 +404,7 @@ static int ep93xx_i2s_resume(struct snd_soc_component *component)#endif static const struct snd_soc_dai_ops ep93xx_i2s_dai_ops = { + .startup = ep93xx_i2s_startup, .shutdown = ep93xx_i2s_shutdown, .hw_params = ep93xx_i2s_hw_params, .set_sysclk = ep93xx_i2s_set_sysclk,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 156/312 ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jihed Chaibi <[email protected]>
[ Upstream commit 622363757b2286dd2c2984b0d80255cbb35a0495 ]
ep93xx_i2s_enable() calls clk_prepare_enable() on three clocks in sequence (mclk, sclk, lrclk) without checking the return value of any of them. If an intermediate enable fails, the clocks that were already enabled are never rolled back, leaking them until the next disable cycle — which may never come if the stream never started cleanly.
Change ep93xx_i2s_enable() from void to int. Add error checking after each clk_prepare_enable() call and unwind already-enabled clocks on failure. Propagate the error through ep93xx_i2s_startup() and ep93xx_i2s_resume(), both of which already return int.
--- sound/soc/cirrus/ep93xx-i2s.c | 34 ++++++++++++++++++++++++---------- 1 file changed, 24 insertions(+), 10 deletions(-)
sound/soc/cirrus/ep93xx-i2s.c +24 -10
@@ -104,16 +104,28 @@ static inline unsigned ep93xx_i2s_read_reg(struct ep93xx_i2s_info *info,return __raw_readl (info->regs + reg); } -static void ep93xx_i2s_enable (struct ep93xx_i2s_info *info,int stream) +static int ep93xx_i2s_enable (struct ep93xx_i2s_info *info,int stream) {unsigned base_reg; +int err;if ((ep93xx_i2s_read_reg (info,EP93XX_I2S_TX0EN ) &0x1 ) ==0 && (ep93xx_i2s_read_reg (info,EP93XX_I2S_RX0EN ) &0x1 ) ==0 ) {/* Enable clocks */ -clk_prepare_enable (info->mclk); -clk_prepare_enable (info->sclk); -clk_prepare_enable (info->lrclk); + err =clk_prepare_enable (info->mclk); +if (err) +return err; + err =clk_prepare_enable (info->sclk); +if (err) { +clk_disable_unprepare (info->mclk); +return err; + } + err =clk_prepare_enable (info->lrclk); +if (err) { +clk_disable_unprepare (info->sclk); +clk_disable_unprepare (info->mclk); +return err; + }/* Enable i2s */ ep93xx_i2s_write_reg (info,EP93XX_I2S_GLCTRL ,1 );
@@ -132,6 +144,8 @@ static void ep93xx_i2s_enable(struct ep93xx_i2s_info *info, int stream)ep93xx_i2s_write_reg (info,EP93XX_I2S_TXCTRL ,EP93XX_I2S_TXCTRL_TXEMPTY_LVL |EP93XX_I2S_TXCTRL_TXUFIE ); + +return 0 ; }static void ep93xx_i2s_disable (struct ep93xx_i2s_info *info,int stream)
@@ -213,9 +227,7 @@ static int ep93xx_i2s_startup(struct snd_pcm_substream *substream, {struct ep93xx_i2s_info *info =snd_soc_dai_get_drvdata (dai); -ep93xx_i2s_enable (info, substream->stream); - -return 0 ; +return ep93xx_i2s_enable (info, substream->stream); } static void ep93xx_i2s_shutdown(struct snd_pcm_substream *substream,
@@ -389,14 +401,16 @@ static int ep93xx_i2s_suspend(struct snd_soc_component *component)static int ep93xx_i2s_resume (struct snd_soc_component *component) {struct ep93xx_i2s_info *info =snd_soc_component_get_drvdata (component); +int err;if (!snd_soc_component_active (component))return 0 ; -ep93xx_i2s_enable (info,SNDRV_PCM_STREAM_PLAYBACK ); -ep93xx_i2s_enable (info,SNDRV_PCM_STREAM_CAPTURE ); + err =ep93xx_i2s_enable (info,SNDRV_PCM_STREAM_PLAYBACK ); +if (err) +return err; -return 0 ; +return ep93xx_i2s_enable (info,SNDRV_PCM_STREAM_CAPTURE ); }#else #define ep93xx_i2s_suspend NULL
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 157/312 ipv6: prevent possible UaF in addrconf_permanent_addr()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit fd63f185979b047fb22a0dfc6bd94d0cab6a6a70 ]
The mentioned helper try to warn the user about an exceptional condition, but the message is delivered too late, accessing the ipv6 after its possible deletion.
Reorder the statement to avoid the possible UaF; while at it, place the warning outside the idev->lock as it needs no protection.
--- net/ipv6/addrconf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/ipv6/addrconf.c +3 -3
@@ -3566,12 +3566,12 @@ static void addrconf_permanent_addr(struct net *net, struct net_device *dev)if ((ifp->flags &IFA_F_PERMANENT ) &&fixup_permanent_addr (net, idev, ifp) <0 ) {write_unlock_bh (&idev->lock); -in6_ifa_hold (ifp); -ipv6_del_addr (ifp); -write_lock_bh (&idev->lock);net_info_ratelimited ("%s: Failed to add prefix route for address %pI6c; dropping\n" , idev->dev->name, &ifp->addr); +in6_ifa_hold (ifp); +ipv6_del_addr (ifp); +write_lock_bh (&idev->lock); } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 158/312 net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yochai Eisenrich <[email protected]>
[ Upstream commit e6e3eb5ee89ac4c163d46429391c889a1bb5e404 ]
When building netlink messages, tc_chain_fill_node() never initializes the tcm_info field of struct tcmsg. Since the allocation is not zeroed, kernel heap memory is leaked to userspace through this 4-byte field.
The fix simply zeroes tcm_info alongside the other fields that are already initialized.
--- net/sched/cls_api.c | 1 + 1 file changed, 1 insertion(+)
net/sched/cls_api.c +1 -0
@@ -2726,6 +2726,7 @@ static int tc_chain_fill_node(const struct tcf_proto_ops *tmplt_ops, tcm->tcm__pad1 =0 ; tcm->tcm__pad2 =0 ; tcm->tcm_handle =0 ; + tcm->tcm_info =0 ;if (block->q) { tcm->tcm_ifindex =qdisc_dev (block->q)->ifindex; tcm->tcm_parent = block->q->handle;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 159/312 NFC: pn533: bound the UART receive buffer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 30fe3f5f6494f827d812ff179f295a8e532709d6 ]
pn532_receive_buf() appends every incoming byte to dev->recv_skb and only resets the buffer after pn532_uart_rx_is_frame() recognizes a complete frame. A continuous stream of bytes without a valid PN532 frame header therefore keeps growing the skb until skb_put_u8() hits the tail limit.
Drop the accumulated partial frame once the fixed receive buffer is full so malformed UART traffic cannot grow the skb past PN532_UART_SKB_BUFF_LEN.
--- drivers/nfc/pn533/uart.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/nfc/pn533/uart.c +3 -0
@@ -211,6 +211,9 @@ static int pn532_receive_buf(struct serdev_device *serdev,del_timer (&dev->cmd_timeout);for (i =0 ; i < count; i++) { +if (unlikely (!skb_tailroom (dev->recv_skb))) +skb_trim (dev->recv_skb,0 ); +skb_put_u8 (dev->recv_skb, *data++);if (!pn532_uart_rx_is_frame (dev->recv_skb))continue ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 160/312 net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suraj Gupta <[email protected]>
[ Upstream commit 393e0b4f178ec7fce1141dacc3304e3607a92ee9 ]
The XAXIDMA_BD_CTRL_LENGTH_MASK and XAXIDMA_BD_STS_ACTUAL_LEN_MASK macros were defined as 0x007FFFFF (23 bits), but the AXI DMA IP product guide (PG021) specifies the buffer length field as bits 25:0 (26 bits). Update both masks to match the IP documentation.
In practice this had no functional impact, since Ethernet frames are far smaller than 2^23 bytes and the extra bits were always zero, but the masks should still reflect the hardware specification.
--- drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/xilinx/xilinx_axienet.h +2 -2
@@ -103,7 +103,7 @@#define XAXIDMA_BD_HAS_DRE_MASK 0xF00/* Whether has DRE mask */ #define XAXIDMA_BD_WORDLEN_MASK 0xFF/* Whether has DRE mask */ -#define XAXIDMA_BD_CTRL_LENGTH_MASK 0x007FFFFF/* Requested len */ +#define XAXIDMA_BD_CTRL_LENGTH_MASK GENMASK(25, 0)/* Requested len */ #define XAXIDMA_BD_CTRL_TXSOF_MASK 0x08000000/* First tx packet */ #define XAXIDMA_BD_CTRL_TXEOF_MASK 0x04000000/* Last tx packet */ #define XAXIDMA_BD_CTRL_ALL_MASK 0x0C000000/* All control bits */
@@ -129,7 +129,7 @@#define XAXIDMA_BD_CTRL_TXEOF_MASK 0x04000000/* Last tx packet */ #define XAXIDMA_BD_CTRL_ALL_MASK 0x0C000000/* All control bits */ -#define XAXIDMA_BD_STS_ACTUAL_LEN_MASK 0x007FFFFF/* Actual len */ +#define XAXIDMA_BD_STS_ACTUAL_LEN_MASK GENMASK(25, 0)/* Actual len */ #define XAXIDMA_BD_STS_COMPLETE_MASK 0x80000000/* Completed */ #define XAXIDMA_BD_STS_DEC_ERR_MASK 0x40000000/* Decode error */ #define XAXIDMA_BD_STS_SLV_ERR_MASK 0x20000000/* Slave error */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 161/312 bpf: Fix regsafe() for pointers to packet
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Starovoitov <[email protected]>
[ Upstream commit a8502a79e832b861e99218cbd2d8f4312d62e225 ]
In case rold->reg->range == BEYOND_PKT_END && rcur->reg->range == N regsafe() may return true which may lead to current state with valid packet range not being explored. Fix the bug.
--- kernel/bpf/verifier.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
kernel/bpf/verifier.c +6 -1
@@ -11832,8 +11832,13 @@ static bool regsafe(struct bpf_verifier_env *env, struct bpf_reg_state *rold,* since someone could have accessed through (ptr - k), or * even done ptr -= k in a register, to get a safe access. */ -if (rold->range > rcur->range) +if (rold->range <0 || rcur->range <0 ) { +/* special case for [BEYOND|AT]_PKT_END */ +if (rold->range != rcur->range) +return false; + }else if (rold->range > rcur->range) {return false; + }/* If the offsets don't match, we can't trust our alignment; * nor can we be sure that we won't fall out of range. */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 162/312 net: ipv6: flowlabel: defer exclusive option free until RCU teardown
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengchuan Liang <[email protected]>
[ Upstream commit 9ca562bb8e66978b53028fa32b1a190708e6a091 ]
ip6fl_seq_show() walks the global flowlabel hash under the seq-file RCU read-side lock and prints fl->opt->opt_nflen when an option block is present.
Exclusive flowlabels currently free fl->opt as soon as fl->users drops to zero in fl_release(). However, the surrounding struct ip6_flowlabel remains visible in the global hash table until later garbage collection removes it and fl_free_rcu() finally tears it down.
A concurrent /proc/net/ip6_flowlabel reader can therefore race that early kfree() and dereference freed option state, triggering a crash in ip6fl_seq_show().
Fix this by keeping fl->opt alive until fl_free_rcu(). That matches the lifetime already required for the enclosing flowlabel while readers can still reach it under RCU.
--- net/ipv6/ip6_flowlabel.c | 5 ----- 1 file changed, 5 deletions(-)
net/ipv6/ip6_flowlabel.c +0 -5
@@ -133,11 +133,6 @@ static void fl_release(struct ip6_flowlabel *fl)if (time_after (ttd, fl->expires)) fl->expires = ttd; ttd = fl->expires; -if (fl->opt && fl->share ==IPV6_FL_S_EXCL ) { -struct ipv6_txoptions *opt = fl->opt; - fl->opt =NULL ; -kfree (opt); - }if (!timer_pending (&ip6_fl_gc_timer) ||time_after (ip6_fl_gc_timer.expires, ttd))mod_timer (&ip6_fl_gc_timer, ttd);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 163/312 netfilter: flowtable: strictly check for maximum number of actions
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 76522fcdbc3a02b568f5d957f7e66fc194abb893 ]
The maximum number of flowtable hardware offload actions in IPv6 is:
* ethernet mangling (4 payload actions, 2 for each ethernet address)
* SNAT (4 payload actions)
* DNAT (4 payload actions)
* Double VLAN (4 vlan actions, 2 for popping vlan, and 2 for pushing) for QinQ.
* Redirect (1 action)
Which makes 17, while the maximum is 16. But act_ct supports for tunnels actions too. Note that payload action operates at 32-bit word level, so mangling an IPv6 address takes 4 payload actions.
Update flow_action_entry_next() calls to check for the maximum number of supported actions.
While at it, rise the maximum number of actions per flow from 16 to 24 so this works fine with IPv6 setups.
--- net/netfilter/nf_flow_table_offload.c | 196 +++++++++++++++++--------- 1 file changed, 130 insertions(+), 66 deletions(-)
net/netfilter/nf_flow_table_offload.c +130 -66
@@ -13,6 +13,8 @@#include <net/netfilter/nf_conntrack_core.h> #include <net/netfilter/nf_conntrack_tuple.h> +#define NF_FLOW_RULE_ACTION_MAX 24 +static struct workqueue_struct *nf_flow_offload_add_wq;static struct workqueue_struct *nf_flow_offload_del_wq;static struct workqueue_struct *nf_flow_offload_stats_wq;
@@ -215,7 +217,12 @@ static void flow_offload_mangle(struct flow_action_entry *entry,static inline struct flow_action_entry *flow_action_entry_next (struct nf_flow_rule *flow_rule) { -int i = flow_rule->rule->action.num_entries++; +int i; + +if (unlikely (flow_rule->rule->action.num_entries >=NF_FLOW_RULE_ACTION_MAX )) +return NULL ; + + i = flow_rule->rule->action.num_entries++;return &flow_rule->rule->action.entries[i]; }
@@ -233,6 +240,9 @@ static int flow_offload_eth_src(struct net *net,u32 mask, val;u16 val16; +if (!entry0 || !entry1) +return -E2BIG ; + this_tuple = &flow->tuplehash[dir].tuple;switch (this_tuple->xmit_type) {
@@ -283,6 +293,9 @@ static int flow_offload_eth_dst(struct net *net,u8 nud_state;u16 val16; +if (!entry0 || !entry1) +return -E2BIG ; + this_tuple = &flow->tuplehash[dir].tuple;switch (this_tuple->xmit_type) {
@@ -324,16 +337,19 @@ static int flow_offload_eth_dst(struct net *net,return 0 ; } -static void flow_offload_ipv4_snat (struct net *net, -const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_ipv4_snat (struct net *net, +const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {struct flow_action_entry *entry =flow_action_entry_next (flow_rule);u32 mask = ~htonl (0xffffffff );__be32 addr;u32 offset; +if (!entry) +return -E2BIG ; +switch (dir) {case FLOW_OFFLOAD_DIR_ORIGINAL : addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY ].tuple.dst_v4.s_addr;
@@ -344,23 +360,27 @@ static void flow_offload_ipv4_snat(struct net *net, offset = offsetof(struct iphdr , daddr);break ;default : -return ; +return -EOPNOTSUPP ; }flow_offload_mangle (entry,FLOW_ACT_MANGLE_HDR_TYPE_IP4 , offset, &addr, &mask); +return 0 ; } -static void flow_offload_ipv4_dnat (struct net *net, -const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_ipv4_dnat (struct net *net, +const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {struct flow_action_entry *entry =flow_action_entry_next (flow_rule);u32 mask = ~htonl (0xffffffff );__be32 addr;u32 offset; +if (!entry) +return -E2BIG ; +switch (dir) {case FLOW_OFFLOAD_DIR_ORIGINAL : addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY ].tuple.src_v4.s_addr;
@@ -371,14 +391,15 @@ static void flow_offload_ipv4_dnat(struct net *net, offset = offsetof(struct iphdr , saddr);break ;default : -return ; +return -EOPNOTSUPP ; }flow_offload_mangle (entry,FLOW_ACT_MANGLE_HDR_TYPE_IP4 , offset, &addr, &mask); +return 0 ; } -static void flow_offload_ipv6_mangle (struct nf_flow_rule *flow_rule, +static int flow_offload_ipv6_mangle (struct nf_flow_rule *flow_rule,unsigned int offset,const __be32 *addr,const __be32 *mask) {
@@ -387,15 +408,20 @@ static void flow_offload_ipv6_mangle(struct nf_flow_rule *flow_rule,for (i =0 ; i <sizeof (struct in6_addr ) /sizeof (u32); i++) { entry =flow_action_entry_next (flow_rule); +if (!entry) +return -E2BIG ; +flow_offload_mangle (entry,FLOW_ACT_MANGLE_HDR_TYPE_IP6 , offset + i *sizeof (u32), &addr[i], mask); } + +return 0 ; } -static void flow_offload_ipv6_snat (struct net *net, -const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_ipv6_snat (struct net *net, +const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {u32 mask = ~htonl (0xffffffff );const __be32 *addr;
@@ -411,16 +437,16 @@ static void flow_offload_ipv6_snat(struct net *net, offset = offsetof(struct ipv6hdr , daddr);break ;default : -return ; +return -EOPNOTSUPP ; } -flow_offload_ipv6_mangle (flow_rule, offset, addr, &mask); +return flow_offload_ipv6_mangle (flow_rule, offset, addr, &mask); } -static void flow_offload_ipv6_dnat (struct net *net, -const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_ipv6_dnat (struct net *net, +const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {u32 mask = ~htonl (0xffffffff );const __be32 *addr;
@@ -436,10 +462,10 @@ static void flow_offload_ipv6_dnat(struct net *net, offset = offsetof(struct ipv6hdr , saddr);break ;default : -return ; +return -EOPNOTSUPP ; } -flow_offload_ipv6_mangle (flow_rule, offset, addr, &mask); +return flow_offload_ipv6_mangle (flow_rule, offset, addr, &mask); }static int flow_offload_l4proto (const struct flow_offload *flow)
@@ -461,15 +487,18 @@ static int flow_offload_l4proto(const struct flow_offload *flow)return type; } -static void flow_offload_port_snat (struct net *net, -const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_port_snat (struct net *net, +const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {struct flow_action_entry *entry =flow_action_entry_next (flow_rule);u32 mask, port;u32 offset; +if (!entry) +return -E2BIG ; +switch (dir) {case FLOW_OFFLOAD_DIR_ORIGINAL : port =ntohs (flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY ].tuple.dst_port);
@@ -484,22 +513,26 @@ static void flow_offload_port_snat(struct net *net, mask = ~htonl (0xffff );break ;default : -return ; +return -EOPNOTSUPP ; }flow_offload_mangle (entry,flow_offload_l4proto (flow), offset, &port, &mask); +return 0 ; } -static void flow_offload_port_dnat (struct net *net, -const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_port_dnat (struct net *net, +const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {struct flow_action_entry *entry =flow_action_entry_next (flow_rule);u32 mask, port;u32 offset; +if (!entry) +return -E2BIG ; +switch (dir) {case FLOW_OFFLOAD_DIR_ORIGINAL : port =ntohs (flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY ].tuple.src_port);
@@ -514,20 +547,24 @@ static void flow_offload_port_dnat(struct net *net, mask = ~htonl (0xffff0000 );break ;default : -return ; +return -EOPNOTSUPP ; }flow_offload_mangle (entry,flow_offload_l4proto (flow), offset, &port, &mask); +return 0 ; } -static void flow_offload_ipv4_checksum (struct net *net, -const struct flow_offload *flow, -struct nf_flow_rule *flow_rule) +static int flow_offload_ipv4_checksum (struct net *net, +const struct flow_offload *flow, +struct nf_flow_rule *flow_rule) {u8 protonum = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL ].tuple.l4proto;struct flow_action_entry *entry =flow_action_entry_next (flow_rule); +if (!entry) +return -E2BIG ; + entry->id =FLOW_ACTION_CSUM ; entry->csum_flags =TCA_CSUM_UPDATE_FLAG_IPV4HDR ;
@@ -539,12 +576,14 @@ static void flow_offload_ipv4_checksum(struct net *net, entry->csum_flags |=TCA_CSUM_UPDATE_FLAG_UDP ;break ; } + +return 0 ; } -static void flow_offload_redirect (struct net *net, -const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_redirect (struct net *net, +const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {const struct flow_offload_tuple *this_tuple, *other_tuple;struct flow_action_entry *entry;
@@ -562,21 +601,28 @@ static void flow_offload_redirect(struct net *net, ifindex = other_tuple->iifidx;break ;default : -return ; +return -EOPNOTSUPP ; } dev =dev_get_by_index (net, ifindex);if (!dev) -return ; +return -ENODEV ; entry =flow_action_entry_next (flow_rule); +if (!entry) { +dev_put (dev); +return -E2BIG ; + } + entry->id =FLOW_ACTION_REDIRECT ; entry->dev = dev; + +return 0 ; } -static void flow_offload_encap_tunnel (const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_encap_tunnel (const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {const struct flow_offload_tuple *this_tuple;struct flow_action_entry *entry;
@@ -584,7 +630,7 @@ static void flow_offload_encap_tunnel(const struct flow_offload *flow, this_tuple = &flow->tuplehash[dir].tuple;if (this_tuple->xmit_type ==FLOW_OFFLOAD_XMIT_DIRECT ) -return ; +return 0 ; dst = this_tuple->dst_cache;if (dst && dst->lwtstate) {
@@ -593,15 +639,19 @@ static void flow_offload_encap_tunnel(const struct flow_offload *flow, tun_info =lwt_tun_info (dst->lwtstate);if (tun_info && (tun_info->mode &IP_TUNNEL_INFO_TX )) { entry =flow_action_entry_next (flow_rule); +if (!entry) +return -E2BIG ; entry->id =FLOW_ACTION_TUNNEL_ENCAP ; entry->tunnel = tun_info; } } + +return 0 ; } -static void flow_offload_decap_tunnel (const struct flow_offload *flow, -enum flow_offload_tuple_dir dir, -struct nf_flow_rule *flow_rule) +static int flow_offload_decap_tunnel (const struct flow_offload *flow, +enum flow_offload_tuple_dir dir, +struct nf_flow_rule *flow_rule) {const struct flow_offload_tuple *other_tuple;struct flow_action_entry *entry;
@@ -609,7 +659,7 @@ static void flow_offload_decap_tunnel(const struct flow_offload *flow, other_tuple = &flow->tuplehash[!dir].tuple;if (other_tuple->xmit_type ==FLOW_OFFLOAD_XMIT_DIRECT ) -return ; +return 0 ; dst = other_tuple->dst_cache;if (dst && dst->lwtstate) {
@@ -618,9 +668,13 @@ static void flow_offload_decap_tunnel(const struct flow_offload *flow, tun_info =lwt_tun_info (dst->lwtstate);if (tun_info && (tun_info->mode &IP_TUNNEL_INFO_TX )) { entry =flow_action_entry_next (flow_rule); +if (!entry) +return -E2BIG ; entry->id =FLOW_ACTION_TUNNEL_DECAP ; } } + +return 0 ; } static int
@@ -632,8 +686,9 @@ nf_flow_rule_route_common(struct net *net, const struct flow_offload *flow,const struct flow_offload_tuple *tuple;int i; -flow_offload_decap_tunnel (flow, dir, flow_rule); -flow_offload_encap_tunnel (flow, dir, flow_rule); +if (flow_offload_decap_tunnel (flow, dir, flow_rule) <0 || +flow_offload_encap_tunnel (flow, dir, flow_rule) <0 ) +return -1 ;if (flow_offload_eth_src (net, flow, dir, flow_rule) <0 ||flow_offload_eth_dst (net, flow, dir, flow_rule) <0 )
@@ -649,6 +704,8 @@ nf_flow_rule_route_common(struct net *net, const struct flow_offload *flow,if (tuple->encap[i].proto ==htons (ETH_P_8021Q )) { entry =flow_action_entry_next (flow_rule); +if (!entry) +return -1 ; entry->id =FLOW_ACTION_VLAN_POP ; } }
@@ -662,6 +719,8 @@ nf_flow_rule_route_common(struct net *net, const struct flow_offload *flow,continue ; entry =flow_action_entry_next (flow_rule); +if (!entry) +return -1 ;switch (other_tuple->encap[i].proto) {case htons (ETH_P_PPP_SES ):
@@ -687,18 +746,22 @@ int nf_flow_rule_route_ipv4(struct net *net, struct flow_offload *flow,return -1 ;if (test_bit (NF_FLOW_SNAT , &flow->flags)) { -flow_offload_ipv4_snat (net, flow, dir, flow_rule); -flow_offload_port_snat (net, flow, dir, flow_rule); +if (flow_offload_ipv4_snat (net, flow, dir, flow_rule) <0 || +flow_offload_port_snat (net, flow, dir, flow_rule) <0 ) +return -1 ; }if (test_bit (NF_FLOW_DNAT , &flow->flags)) { -flow_offload_ipv4_dnat (net, flow, dir, flow_rule); -flow_offload_port_dnat (net, flow, dir, flow_rule); +if (flow_offload_ipv4_dnat (net, flow, dir, flow_rule) <0 || +flow_offload_port_dnat (net, flow, dir, flow_rule) <0 ) +return -1 ; }if (test_bit (NF_FLOW_SNAT , &flow->flags) ||test_bit (NF_FLOW_DNAT , &flow->flags)) -flow_offload_ipv4_checksum (net, flow, flow_rule); +if (flow_offload_ipv4_checksum (net, flow, flow_rule) <0 ) +return -1 ; -flow_offload_redirect (net, flow, dir, flow_rule); +if (flow_offload_redirect (net, flow, dir, flow_rule) <0 ) +return -1 ;return 0 ; }
@@ -712,22 +775,23 @@ int nf_flow_rule_route_ipv6(struct net *net, struct flow_offload *flow,return -1 ;if (test_bit (NF_FLOW_SNAT , &flow->flags)) { -flow_offload_ipv6_snat (net, flow, dir, flow_rule); -flow_offload_port_snat (net, flow, dir, flow_rule); +if (flow_offload_ipv6_snat (net, flow, dir, flow_rule) <0 || +flow_offload_port_snat (net, flow, dir, flow_rule) <0 ) +return -1 ; }if (test_bit (NF_FLOW_DNAT , &flow->flags)) { -flow_offload_ipv6_dnat (net, flow, dir, flow_rule); -flow_offload_port_dnat (net, flow, dir, flow_rule); +if (flow_offload_ipv6_dnat (net, flow, dir, flow_rule) <0 || +flow_offload_port_dnat (net, flow, dir, flow_rule) <0 ) +return -1 ; } -flow_offload_redirect (net, flow, dir, flow_rule); +if (flow_offload_redirect (net, flow, dir, flow_rule) <0 ) +return -1 ;return 0 ; }EXPORT_SYMBOL_GPL (nf_flow_rule_route_ipv6); -#define NF_FLOW_RULE_ACTION_MAX 16 -static struct nf_flow_rule * nf_flow_offload_rule_alloc(struct net *net, const struct flow_offload_work *offload,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 164/312 netfilter: nfnetlink_log: account for netlink header size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 6d52a4a0520a6696bdde51caa11f2d6821cd0c01 ]
This is a followup to an old bug fix: NLMSG_DONE needs to account for the netlink header size, not just the attribute size.
This can result in a WARN splat + drop of the netlink message, but other than this there are no ill effects.
--- net/netfilter/nfnetlink_log.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nfnetlink_log.c +1 -1
@@ -718,7 +718,7 @@ nfulnl_log_packet(struct net *net, +nla_total_size (plen)/* prefix */ +nla_total_size (sizeof (struct nfulnl_msg_packet_hw )) +nla_total_size (sizeof (struct nfulnl_msg_packet_timestamp )) - +nla_total_size (sizeof (struct nfgenmsg ));/* NLMSG_DONE */ + +nlmsg_total_size (sizeof (struct nfgenmsg ));/* NLMSG_DONE */ if (in &&skb_mac_header_was_set (skb)) { size +=nla_total_size (skb->dev->hard_header_len)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 165/312 netfilter: x_tables: ensure names are nul-terminated
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit a958a4f90ddd7de0800b33ca9d7b886b7d40f74e ]
Reject names that lack a \0 character before feeding them to functions that expect c-strings.
Fixes tag is the most recent commit that needs this change.
--- net/netfilter/xt_cgroup.c | 6 ++++++ net/netfilter/xt_rateest.c | 5 +++++ 2 files changed, 11 insertions(+)
net/netfilter/xt_cgroup.c +6 -0
@@ -53,6 +53,9 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par) info->priv =NULL ;if (info->has_path) { +if (strnlen (info->path,sizeof (info->path)) >=sizeof (info->path)) +return -ENAMETOOLONG ; + cgrp =cgroup_get_from_path (info->path);if (IS_ERR (cgrp)) { pr_info_ratelimited("invalid path, errno=%ld\n",
@@ -85,6 +88,9 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par) info->priv =NULL ;if (info->has_path) { +if (strnlen (info->path,sizeof (info->path)) >=sizeof (info->path)) +return -ENAMETOOLONG ; + cgrp =cgroup_get_from_path (info->path);if (IS_ERR (cgrp)) { pr_info_ratelimited("invalid path, errno=%ld\n",
net/netfilter/xt_rateest.c +5 -0
@@ -91,6 +91,11 @@ static int xt_rateest_mt_checkentry(const struct xt_mtchk_param *par) goto err1; } +if (strnlen (info->name1,sizeof (info->name1)) >=sizeof (info->name1)) +return -ENAMETOOLONG ; +if (strnlen (info->name2,sizeof (info->name2)) >=sizeof (info->name2)) +return -ENAMETOOLONG ; + ret = -ENOENT ; est1 =xt_rateest_lookup (par->net, info->name1);if (!est1)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 166/312 netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit b7e8590987aa94c9dc51518fad0e58cb887b1db5 ]
IPSET_ATTR_NAME and IPSET_ATTR_NAMEREF are of NLA_STRING type, they cannot be treated like a c-string.
They either have to be switched to NLA_NUL_STRING, or the compare operations need to use the nla functions.
--- include/linux/netfilter/ipset/ip_set.h | 2 +- net/netfilter/ipset/ip_set_core.c | 4 ++-- net/netfilter/ipset/ip_set_list_set.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-)
include/linux/netfilter/ipset/ip_set.h +1 -1
@@ -309,7 +309,7 @@ enum {/* register and unregister set references */ extern ip_set_id_t ip_set_get_byname (struct net *net, -const char *name,struct ip_set **set); +const struct nlattr *name,struct ip_set **set);extern void ip_set_put_byindex (struct net *net,ip_set_id_t index);extern void ip_set_name_byindex (struct net *net,ip_set_id_t index,char *name);extern ip_set_id_t ip_set_nfnl_get_byindex (struct net *net,ip_set_id_t index);
net/netfilter/ipset/ip_set_core.c +2 -2
@@ -823,7 +823,7 @@ EXPORT_SYMBOL_GPL(ip_set_del);* */ ip_set_id_t -ip_set_get_byname (struct net *net,const char *name,struct ip_set **set) +ip_set_get_byname (struct net *net,const struct nlattr *name,struct ip_set **set) {ip_set_id_t i, index =IPSET_INVALID_ID ;struct ip_set *s;
@@ -832,7 +832,7 @@ ip_set_get_byname(struct net *net, const char *name, struct ip_set **set)rcu_read_lock ();for (i =0 ; i < inst->ip_set_max; i++) { s =rcu_dereference (inst->ip_set_list)[i]; -if (s &&STRNCMP (s->name, name)) { +if (s &&nla_strcmp (name, s->name) ==0 ) {__ip_set_get (s); index = i; *set = s;
net/netfilter/ipset/ip_set_list_set.c +2 -2
@@ -367,7 +367,7 @@ list_set_uadt(struct ip_set *set, struct nlattr *tb[], ret =ip_set_get_extensions (set, tb, &ext);if (ret)return ret; - e.id =ip_set_get_byname (map->net,nla_data (tb[IPSET_ATTR_NAME ]), &s); + e.id =ip_set_get_byname (map->net, tb[IPSET_ATTR_NAME ], &s);if (e.id ==IPSET_INVALID_ID )return -IPSET_ERR_NAME ;/* "Loop detection" */
@@ -389,7 +389,7 @@ list_set_uadt(struct ip_set *set, struct nlattr *tb[],if (tb[IPSET_ATTR_NAMEREF ]) { e.refid =ip_set_get_byname (map->net, -nla_data (tb[IPSET_ATTR_NAMEREF ]), + tb[IPSET_ATTR_NAMEREF ], &s);if (e.refid ==IPSET_INVALID_ID ) { ret = -IPSET_ERR_NAMEREF ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 167/312 netfilter: nf_conntrack_helper: pass helper to expect cleanup
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Tang <[email protected]>
[ Upstream commit a242a9ae58aa46ff7dae51ce64150a93957abe65 ]
nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() to remove expectations belonging to the helper being unregistered. However, it passes NULL instead of the helper pointer as the data argument, so expect_iter_me() never matches any expectation and all of them survive the cleanup.
After unregister returns, nfnl_cthelper_del() frees the helper object immediately. Subsequent expectation dumps or packet-driven init_conntrack() calls then dereference the freed exp->helper, causing a use-after-free.
Pass the actual helper pointer so expectations referencing it are properly destroyed before the helper object is freed.
BUG: KASAN: slab-use-after-free in string+0x38f/0x430 Read of size 1 at addr ffff888003b14d20 by task poc/103 Call Trace: string+0x38f/0x430 vsnprintf+0x3cc/0x1170 seq_printf+0x17a/0x240 exp_seq_show+0x2e5/0x560 seq_read_iter+0x419/0x1280 proc_reg_read+0x1ac/0x270 vfs_read+0x179/0x930 ksys_read+0xef/0x1c0 Freed by task 103: The buggy address is located 32 bytes inside of freed 192-byte region [ffff888003b14d00, ffff888003b14dc0)
--- net/netfilter/nf_conntrack_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_conntrack_helper.c +1 -1
@@ -422,7 +422,7 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)*/ synchronize_rcu (); -nf_ct_expect_iterate_destroy (expect_iter_me,NULL ); +nf_ct_expect_iterate_destroy (expect_iter_me, me);nf_ct_iterate_destroy (unhelp, me); }EXPORT_SYMBOL_GPL (nf_conntrack_helper_unregister);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 168/312 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Tang <[email protected]>
[ Upstream commit 35177c6877134a21315f37d57a5577846225623e ]
ctnetlink_alloc_expect() allocates expectations from a non-zeroing slab cache via nf_ct_expect_alloc(). When CTA_EXPECT_NAT is not present in the netlink message, saved_addr and saved_proto are never initialized. Stale data from a previous slab occupant can then be dumped to userspace by ctnetlink_exp_dump_expect(), which checks these fields to decide whether to emit CTA_EXPECT_NAT.
The safe sibling nf_ct_expect_init(), used by the packet path, explicitly zeroes these fields.
Zero saved_addr, saved_proto and dir in the else branch, guarded by IS_ENABLED(CONFIG_NF_NAT) since these fields only exist when NAT is enabled.
Confirmed by priming the expect slab with NAT-bearing expectations, freeing them, creating a new expectation without CTA_EXPECT_NAT, and observing that the ctnetlink dump emits a spurious CTA_EXPECT_NAT containing stale data from the prior allocation.
--- net/netfilter/nf_conntrack_netlink.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/netfilter/nf_conntrack_netlink.c +6 -0
@@ -3569,6 +3569,12 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, exp, nf_ct_l3num(ct));if (err <0 ) goto err_out; +#if IS_ENABLED (CONFIG_NF_NAT ) + } else { +memset (&exp->saved_addr,0 ,sizeof (exp->saved_addr)); +memset (&exp->saved_proto,0 ,sizeof (exp->saved_proto)); + exp->dir =0 ; +#endif }return exp; err_out:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 169/312 netfilter: Reorder fields in struct nf_conntrack_expect
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 61e03e912da8212c3de2529054502e8388dfd484 ]
Group some variables based on their sizes to reduce holes.
On x86_64, this shrinks the size of 'struct nf_conntrack_expect' from 264 to 256 bytes.
This structure deserve a dedicated cache, so reducing its size looks nice.
Stable-dep-of: 917b61fa2042 ("netfilter: ctnetlink: ignore explicit helper on new expectations")
--- include/net/netfilter/nf_conntrack_expect.h | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
include/net/netfilter/nf_conntrack_expect.h +9 -9
@@ -26,6 +26,15 @@ struct nf_conntrack_expect {struct nf_conntrack_tuple tuple;struct nf_conntrack_tuple_mask mask; +/* Usage count. */ +refcount_t use; + +/* Flags */ +unsigned int flags; + +/* Expectation class */ +unsigned int class; +/* Function to call after setup and insertion */ void (*expectfn)(struct nf_conn *new,struct nf_conntrack_expect *this);
@@ -39,15 +48,6 @@ struct nf_conntrack_expect {/* Timer function; deletes the expectation. */ struct timer_list timeout; -/* Usage count. */ -refcount_t use; - -/* Flags */ -unsigned int flags; - -/* Expectation class */ -unsigned int class; -#if IS_ENABLED (CONFIG_NF_NAT )union nf_inet_addr saved_addr;/* This is the original per-proto part, used to map the
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 170/312 netfilter: nf_conntrack_expect: honor expectation helper field
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 9c42bc9db90a154bc61ae337a070465f3393485a ]
The expectation helper field is mostly unused. As a result, the netfilter codebase relies on accessing the helper through exp->master.
Always set on the expectation helper field so it can be used to reach the helper.
nf_ct_expect_init() is called from packet path where the skb owns the ct object, therefore accessing exp->master for the newly created expectation is safe. This saves a lot of updates in all callsites to pass the ct object as parameter to nf_ct_expect_init().
This is a preparation patches for follow up fixes.
Stable-dep-of: 917b61fa2042 ("netfilter: ctnetlink: ignore explicit helper on new expectations")
--- include/net/netfilter/nf_conntrack_expect.h | 2 +- net/netfilter/nf_conntrack_broadcast.c | 2 +- net/netfilter/nf_conntrack_expect.c | 14 +++++++++++++- net/netfilter/nf_conntrack_h323_main.c | 12 ++++++------ net/netfilter/nf_conntrack_helper.c | 7 ++++++- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nf_conntrack_sip.c | 2 +- 7 files changed, 29 insertions(+), 12 deletions(-)
include/net/netfilter/nf_conntrack_expect.h +1 -1
@@ -40,7 +40,7 @@ struct nf_conntrack_expect { struct nf_conntrack_expect *this);/* Helper to assign to new connection */ -struct nf_conntrack_helper *helper; +struct nf_conntrack_helper __rcu *helper;/* The conntrack of the master connection */ struct nf_conn *master;
net/netfilter/nf_conntrack_broadcast.c +1 -1
@@ -70,7 +70,7 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb, exp->expectfn =NULL ; exp->flags =NF_CT_EXPECT_PERMANENT ; exp->class =NF_CT_EXPECT_CLASS_DEFAULT ; - exp->helper =NULL ; +rcu_assign_pointer (exp->helper, helper);nf_ct_expect_related (exp,0 );nf_ct_expect_put (exp);
net/netfilter/nf_conntrack_expect.c +13 -1
@@ -309,12 +309,19 @@ struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me) }EXPORT_SYMBOL_GPL (nf_ct_expect_alloc); +/* This function can only be used from packet path, where accessing +* master's helper is safe, because the packet holds a reference on +* the conntrack object. Never use it from control plane. +*/ void nf_ct_expect_init (struct nf_conntrack_expect *exp,unsigned int class,u_int8_t family,const union nf_inet_addr *saddr,const union nf_inet_addr *daddr,u_int8_t proto,const __be16 *src,const __be16 *dst) { +struct nf_conntrack_helper *helper =NULL ; +struct nf_conn *ct = exp->master; +struct nf_conn_help *help;int len;if (family ==AF_INET )
@@ -325,7 +332,12 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class, exp->flags =0 ; exp->class = class; exp->expectfn =NULL ; - exp->helper =NULL ; + + help =nfct_help (ct); +if (help) + helper =rcu_dereference (help->helper); + +rcu_assign_pointer (exp->helper, helper); exp->tuple.src.l3num = family; exp->tuple.dst.protonum = proto;
net/netfilter/nf_conntrack_h323_main.c +6 -6
@@ -642,7 +642,7 @@ static int expect_h245(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3, &ct->tuplehash[!dir].tuple.dst.u3, IPPROTO_TCP, NULL, &port); - exp->helper = &nf_conntrack_helper_h245; +rcu_assign_pointer (exp->helper, &nf_conntrack_helper_h245); nathook =rcu_dereference (nfct_h323_nat_hook); if (memcmp(&ct->tuplehash[dir].tuple.src.u3,
@@ -766,7 +766,7 @@ static int expect_callforwarding(struct sk_buff *skb,nf_ct_expect_init (exp,NF_CT_EXPECT_CLASS_DEFAULT ,nf_ct_l3num (ct), &ct->tuplehash[!dir].tuple.src.u3, &addr,IPPROTO_TCP ,NULL , &port); - exp->helper = nf_conntrack_helper_q931; +rcu_assign_pointer (exp->helper, nf_conntrack_helper_q931); nathook =rcu_dereference (nfct_h323_nat_hook); if (memcmp(&ct->tuplehash[dir].tuple.src.u3,
@@ -1233,7 +1233,7 @@ static int expect_q931(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3 : NULL, &ct->tuplehash[!dir].tuple.dst.u3, IPPROTO_TCP, NULL, &port); - exp->helper = nf_conntrack_helper_q931; +rcu_assign_pointer (exp->helper, nf_conntrack_helper_q931); exp->flags =NF_CT_EXPECT_PERMANENT ;/* Accept multiple calls */ nathook =rcu_dereference (nfct_h323_nat_hook);
@@ -1305,7 +1305,7 @@ static int process_gcf(struct sk_buff *skb, struct nf_conn *ct,nf_ct_expect_init (exp,NF_CT_EXPECT_CLASS_DEFAULT ,nf_ct_l3num (ct), &ct->tuplehash[!dir].tuple.src.u3, &addr,IPPROTO_UDP ,NULL , &port); - exp->helper = nf_conntrack_helper_ras; +rcu_assign_pointer (exp->helper, nf_conntrack_helper_ras);if (nf_ct_expect_related (exp,0 ) ==0 ) {pr_debug ("nf_ct_ras: expect RAS " );
@@ -1522,7 +1522,7 @@ static int process_acf(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3, &addr, IPPROTO_TCP, NULL, &port); exp->flags =NF_CT_EXPECT_PERMANENT ; - exp->helper = nf_conntrack_helper_q931; +rcu_assign_pointer (exp->helper, nf_conntrack_helper_q931);if (nf_ct_expect_related (exp,0 ) ==0 ) {pr_debug ("nf_ct_ras: expect Q.931 " );
@@ -1576,7 +1576,7 @@ static int process_lcf(struct sk_buff *skb, struct nf_conn *ct, &ct->tuplehash[!dir].tuple.src.u3, &addr, IPPROTO_TCP, NULL, &port); exp->flags =NF_CT_EXPECT_PERMANENT ; - exp->helper = nf_conntrack_helper_q931; +rcu_assign_pointer (exp->helper, nf_conntrack_helper_q931);if (nf_ct_expect_related (exp,0 ) ==0 ) {pr_debug ("nf_ct_ras: expect Q.931 " );
net/netfilter/nf_conntrack_helper.c +6 -1
@@ -402,7 +402,7 @@ static bool expect_iter_me(struct nf_conntrack_expect *exp, void *data)const struct nf_conntrack_helper *me = data;const struct nf_conntrack_helper *this; -if (exp->helper == me) +if (rcu_access_pointer (exp->helper) == me)return true; this = rcu_dereference_protected(help->helper,
@@ -424,6 +424,11 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)nf_ct_expect_iterate_destroy (expect_iter_me, me);nf_ct_iterate_destroy (unhelp, me); + +/* nf_ct_iterate_destroy() does an unconditional synchronize_rcu() as +* last step, this ensures rcu readers of exp->helper are done. +* No need for another synchronize_rcu() here. +*/ }EXPORT_SYMBOL_GPL (nf_conntrack_helper_unregister);
net/netfilter/nf_conntrack_netlink.c +1 -1
@@ -3559,7 +3559,7 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, exp->class = class; exp->master = ct; - exp->helper = helper; +rcu_assign_pointer (exp->helper, helper); exp->tuple = *tuple; exp->mask.src.u3 = mask->src.u3; exp->mask.src.u.all = mask->src.u.all;
net/netfilter/nf_conntrack_sip.c +1 -1
@@ -1303,7 +1303,7 @@ static int process_register_request(struct sk_buff *skb, unsigned int protoff,nf_ct_expect_init (exp,SIP_EXPECT_SIGNALLING ,nf_ct_l3num (ct), saddr, &daddr, proto,NULL , &port); exp->timeout.expires = sip_timeout *HZ ; - exp->helper = helper; +rcu_assign_pointer (exp->helper, helper); exp->flags =NF_CT_EXPECT_PERMANENT |NF_CT_EXPECT_INACTIVE ; hooks =rcu_dereference (nf_nat_sip_hooks);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 171/312 netfilter: nf_conntrack_expect: use expect->helper
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit f01794106042ee27e54af6fdf5b319a2fe3df94d ]
Use expect->helper in ctnetlink and /proc to dump the helper name. Using nfct_help() without holding a reference to the master conntrack is unsafe.
Use exp->master->helper in ctnetlink path if userspace does not provide an explicit helper when creating an expectation to retain the existing behaviour. The ctnetlink expectation path holds the reference on the master conntrack and nf_conntrack_expect lock and the nfnetlink glue path refers to the master ct that is attached to the skb.
Stable-dep-of: 917b61fa2042 ("netfilter: ctnetlink: ignore explicit helper on new expectations")
--- net/netfilter/nf_conntrack_expect.c | 2 +- net/netfilter/nf_conntrack_helper.c | 6 +----- net/netfilter/nf_conntrack_netlink.c | 24 ++++++++++-------------- net/netfilter/nf_conntrack_sip.c | 2 +- 4 files changed, 13 insertions(+), 21 deletions(-)
net/netfilter/nf_conntrack_expect.c +1 -1
@@ -670,7 +670,7 @@ static int exp_seq_show(struct seq_file *s, void *v)if (expect->flags &NF_CT_EXPECT_USERSPACE )seq_printf (s,"%sUSERSPACE" , delim); - helper =rcu_dereference (nfct_help (expect->master)->helper); + helper =rcu_dereference (expect->helper);if (helper) {seq_printf (s,"%s%s" , expect->flags ?" " :"" , helper->name);if (helper->expect_policy[expect->class].name[0 ])
net/netfilter/nf_conntrack_helper.c +1 -5
@@ -398,14 +398,10 @@ EXPORT_SYMBOL_GPL(nf_conntrack_helper_register);static bool expect_iter_me (struct nf_conntrack_expect *exp,void *data) { -struct nf_conn_help *help =nfct_help (exp->master);const struct nf_conntrack_helper *me = data;const struct nf_conntrack_helper *this; -if (rcu_access_pointer (exp->helper) == me) -return true; - - this =rcu_dereference_protected (help->helper, + this =rcu_dereference_protected (exp->helper,lockdep_is_held (&nf_conntrack_expect_lock));return this == me; }
net/netfilter/nf_conntrack_netlink.c +10 -14
@@ -2998,7 +2998,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb, {struct nf_conn *master = exp->master;long timeout = ((long )exp->timeout.expires - (long )jiffies) /HZ ; -struct nf_conn_help *help; +struct nf_conntrack_helper *helper;#if IS_ENABLED (CONFIG_NF_NAT )struct nlattr *nest_parms;struct nf_conntrack_tuple nat_tuple = {};
@@ -3043,15 +3043,12 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb, nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) || nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class))) goto nla_put_failure; - help =nfct_help (master); -if (help) { -struct nf_conntrack_helper *helper; - helper =rcu_dereference (help->helper); -if (helper && -nla_put_string (skb,CTA_EXPECT_HELP_NAME , helper->name)) - goto nla_put_failure; - } + helper =rcu_dereference (exp->helper); +if (helper && +nla_put_string (skb,CTA_EXPECT_HELP_NAME , helper->name)) + goto nla_put_failure; + expfn =nf_ct_helper_expectfn_find_by_symbol (exp->expectfn);if (expfn !=NULL &&nla_put_string (skb,CTA_EXPECT_FN , expfn->name))
@@ -3380,12 +3377,9 @@ static int ctnetlink_get_expect(struct sk_buff *skb,static bool expect_iter_name (struct nf_conntrack_expect *exp,void *data) {struct nf_conntrack_helper *helper; -const struct nf_conn_help *m_help;const char *name = data; - m_help =nfct_help (exp->master); - - helper =rcu_dereference (m_help->helper); + helper =rcu_dereference (exp->helper);if (!helper)return false;
@@ -3520,9 +3514,9 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,struct nf_conntrack_tuple *tuple, struct nf_conntrack_tuple *mask) { - u_int32_t class = 0; struct nf_conntrack_expect *exp;struct nf_conn_help *help; +u32 class =0 ;int err; help =nfct_help (ct);
@@ -3559,6 +3553,8 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, exp->class = class; exp->master = ct; +if (!helper) + helper =rcu_dereference (help->helper);rcu_assign_pointer (exp->helper, helper); exp->tuple = *tuple; exp->mask.src.u3 = mask->src.u3;
net/netfilter/nf_conntrack_sip.c +1 -1
@@ -924,7 +924,7 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff, exp =__nf_ct_expect_find (net,nf_ct_zone (ct), &tuple);if (!exp || exp->master == ct || -nfct_help (exp->master)->helper !=nfct_help (ct)->helper || + exp->helper !=nfct_help (ct)->helper || exp->class != class)break ;#if IS_ENABLED (CONFIG_NF_NAT )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 172/312 netfilter: nf_conntrack_expect: store netns and zone in expectation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 02a3231b6d82efe750da6554ebf280e4a6f78756 ]
__nf_ct_expect_find() and nf_ct_expect_find_get() are called under rcu_read_lock() but they dereference the master conntrack via exp->master.
Since the expectation does not hold a reference on the master conntrack, this could be dying conntrack or different recycled conntrack than the real master due to SLAB_TYPESAFE_RCU.
Store the netns, the master_tuple and the zone in struct nf_conntrack_expect as a safety measure.
This patch is required by the follow up fix not to dump expectations that do not belong to this netns.
Stable-dep-of: 917b61fa2042 ("netfilter: ctnetlink: ignore explicit helper on new expectations")
--- include/net/netfilter/nf_conntrack_expect.h | 18 +++++++++++++++++- net/netfilter/nf_conntrack_broadcast.c | 6 +++++- net/netfilter/nf_conntrack_expect.c | 9 +++++++-- net/netfilter/nf_conntrack_netlink.c | 5 +++++ 4 files changed, 34 insertions(+), 4 deletions(-)
include/net/netfilter/nf_conntrack_expect.h +17 -1
@@ -22,10 +22,16 @@ struct nf_conntrack_expect {/* Hash member */ struct hlist_node hnode; +/* Network namespace */ +possible_net_t net; +/* We expect this tuple, with the following mask */ struct nf_conntrack_tuple tuple;struct nf_conntrack_tuple_mask mask; +#ifdef CONFIG_NF_CONNTRACK_ZONES +struct nf_conntrack_zone zone; +#endif /* Usage count. */ refcount_t use;
@@ -62,7 +68,17 @@ struct nf_conntrack_expect {static inline struct net *nf_ct_exp_net (struct nf_conntrack_expect *exp) { -return nf_ct_net (exp->master); +return read_pnet (&exp->net); +} + +static inline bool nf_ct_exp_zone_equal_any (const struct nf_conntrack_expect *a, +const struct nf_conntrack_zone *b) +{ +#ifdef CONFIG_NF_CONNTRACK_ZONES +return a->zone.id == b->id; +#else +return true; +#endif }#define NF_CT_EXP_POLICY_NAME_LEN 16
net/netfilter/nf_conntrack_broadcast.c +5 -1
@@ -21,6 +21,7 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb, unsigned int timeout) {const struct nf_conntrack_helper *helper; +struct net *net =read_pnet (&ct->ct_net);struct nf_conntrack_expect *exp;struct iphdr *iph =ip_hdr (skb);struct rtable *rt =skb_rtable (skb);
@@ -71,7 +72,10 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb, exp->flags =NF_CT_EXPECT_PERMANENT ; exp->class =NF_CT_EXPECT_CLASS_DEFAULT ;rcu_assign_pointer (exp->helper, helper); - +write_pnet (&exp->net, net); +#ifdef CONFIG_NF_CONNTRACK_ZONES + exp->zone = ct->zone; +#endif nf_ct_expect_related (exp,0 );nf_ct_expect_put (exp);
net/netfilter/nf_conntrack_expect.c +7 -2
@@ -112,8 +112,8 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple, const struct net *net) {return nf_ct_tuple_mask_cmp (tuple, &i->tuple, &i->mask) && -net_eq (net,nf_ct_net (i->master)) && -nf_ct_zone_equal_any (i->master, zone); +net_eq (net,read_pnet (&i->net)) && +nf_ct_exp_zone_equal_any (i, zone); }bool nf_ct_remove_expect (struct nf_conntrack_expect *exp)
@@ -321,6 +321,7 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class, {struct nf_conntrack_helper *helper =NULL ;struct nf_conn *ct = exp->master; +struct net *net =read_pnet (&ct->ct_net);struct nf_conn_help *help;int len;
@@ -338,6 +339,10 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class, helper =rcu_dereference (help->helper);rcu_assign_pointer (exp->helper, helper); +write_pnet (&exp->net, net); +#ifdef CONFIG_NF_CONNTRACK_ZONES + exp->zone = ct->zone; +#endif exp->tuple.src.l3num = family; exp->tuple.dst.protonum = proto;
net/netfilter/nf_conntrack_netlink.c +5 -0
@@ -3514,6 +3514,7 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,struct nf_conntrack_tuple *tuple, struct nf_conntrack_tuple *mask) { + struct net *net = read_pnet(&ct->ct_net);struct nf_conntrack_expect *exp;struct nf_conn_help *help;u32 class =0 ;
@@ -3553,6 +3554,10 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, exp->class = class; exp->master = ct; +write_pnet (&exp->net, net); +#ifdef CONFIG_NF_CONNTRACK_ZONES + exp->zone = ct->zone; +#endif if (!helper) helper =rcu_dereference (help->helper);rcu_assign_pointer (exp->helper, helper);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 173/312 netfilter: ctnetlink: ignore explicit helper on new expectations
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 917b61fa2042f11e2af4c428e43f08199586633a ]
Use the existing master conntrack helper, anything else is not really supported and it just makes validation more complicated, so just ignore what helper userspace suggests for this expectation.
This was uncovered when validating CTA_EXPECT_CLASS via different helper provided by userspace than the existing master conntrack helper:
BUG: KASAN: slab-out-of-bounds in nf_ct_expect_related_report+0x2479/0x27c0 Read of size 4 at addr ffff8880043fe408 by task poc/102 Call Trace: nf_ct_expect_related_report+0x2479/0x27c0 ctnetlink_create_expect+0x22b/0x3b0 ctnetlink_new_expect+0x4bd/0x5c0 nfnetlink_rcv_msg+0x67a/0x950 netlink_rcv_skb+0x120/0x350
Allowing to read kernel memory bytes off the expectation boundary.
CTA_EXPECT_HELP_NAME is still used to offer the helper name to userspace via netlink dump.
--- net/netfilter/nf_conntrack_netlink.c | 54 +++++----------------------- 1 file changed, 9 insertions(+), 45 deletions(-)
net/netfilter/nf_conntrack_netlink.c +9 -45
@@ -2628,7 +2628,6 @@ static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {static struct nf_conntrack_expect *ctnetlink_alloc_expect (const struct nlattr *const cda[],struct nf_conn *ct, -struct nf_conntrack_helper *helper,struct nf_conntrack_tuple *tuple,struct nf_conntrack_tuple *mask);
@@ -2857,7 +2856,6 @@ ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct, {struct nlattr *cda[CTA_EXPECT_MAX +1 ];struct nf_conntrack_tuple tuple, mask; -struct nf_conntrack_helper *helper =NULL ;struct nf_conntrack_expect *exp;int err;
@@ -2871,17 +2869,8 @@ ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct,if (err <0 )return err; -if (cda[CTA_EXPECT_HELP_NAME ]) { -const char *helpname =nla_data (cda[CTA_EXPECT_HELP_NAME ]); - - helper =__nf_conntrack_helper_find (helpname,nf_ct_l3num (ct), -nf_ct_protonum (ct)); -if (helper ==NULL ) -return -EOPNOTSUPP ; - } - exp =ctnetlink_alloc_expect ((const struct nlattr *const *)cda, ct, - helper, &tuple, &mask); + &tuple, &mask);if (IS_ERR (exp))return PTR_ERR (exp);
@@ -3510,11 +3499,11 @@ ctnetlink_parse_expect_nat(const struct nlattr *attr,static struct nf_conntrack_expect *ctnetlink_alloc_expect (const struct nlattr *const cda[],struct nf_conn *ct, -struct nf_conntrack_helper *helper,struct nf_conntrack_tuple *tuple,struct nf_conntrack_tuple *mask) {struct net *net =read_pnet (&ct->ct_net); +struct nf_conntrack_helper *helper;struct nf_conntrack_expect *exp;struct nf_conn_help *help;u32 class =0 ;
@@ -3524,7 +3513,11 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,if (!help)return ERR_PTR (-EOPNOTSUPP ); -if (cda[CTA_EXPECT_CLASS ] && helper) { + helper =rcu_dereference (help->helper); +if (!helper) +return ERR_PTR (-EOPNOTSUPP ); + +if (cda[CTA_EXPECT_CLASS ]) { class =ntohl (nla_get_be32 (cda[CTA_EXPECT_CLASS ]));if (class > helper->expect_class_max)return ERR_PTR (-EINVAL );
@@ -3558,8 +3551,6 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,#ifdef CONFIG_NF_CONNTRACK_ZONES exp->zone = ct->zone;#endif -if (!helper) - helper =rcu_dereference (help->helper);rcu_assign_pointer (exp->helper, helper); exp->tuple = *tuple; exp->mask.src.u3 = mask->src.u3;
@@ -3591,7 +3582,6 @@ ctnetlink_create_expect(struct net *net, {struct nf_conntrack_tuple tuple, mask, master_tuple;struct nf_conntrack_tuple_hash *h =NULL ; -struct nf_conntrack_helper *helper =NULL ;struct nf_conntrack_expect *exp;struct nf_conn *ct;int err;
@@ -3617,33 +3607,7 @@ ctnetlink_create_expect(struct net *net, ct =nf_ct_tuplehash_to_ctrack (h);rcu_read_lock (); -if (cda[CTA_EXPECT_HELP_NAME ]) { -const char *helpname =nla_data (cda[CTA_EXPECT_HELP_NAME ]); - - helper =__nf_conntrack_helper_find (helpname, u3, -nf_ct_protonum (ct)); -if (helper ==NULL ) { -rcu_read_unlock (); -#ifdef CONFIG_MODULES -if (request_module ("nfct-helper-%s" , helpname) <0 ) { - err = -EOPNOTSUPP ; - goto err_ct; - } -rcu_read_lock (); - helper =__nf_conntrack_helper_find (helpname, u3, -nf_ct_protonum (ct)); -if (helper) { - err = -EAGAIN ; - goto err_rcu; - } -rcu_read_unlock (); -#endif - err = -EOPNOTSUPP ; - goto err_ct; - } - } - - exp =ctnetlink_alloc_expect (cda, ct, helper, &tuple, &mask); + exp =ctnetlink_alloc_expect (cda, ct, &tuple, &mask);if (IS_ERR (exp)) { err =PTR_ERR (exp); goto err_rcu;
@@ -3653,8 +3617,8 @@ ctnetlink_create_expect(struct net *net,nf_ct_expect_put (exp); err_rcu:rcu_read_unlock (); -err_ct:nf_ct_put (ct); +return err; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 174/312 netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 3d5d488f11776738deab9da336038add95d342d1 ]
Weiming Shi says:
xt_match and xt_target structs registered with NFPROTO_UNSPEC can be loaded by any protocol family through nft_compat. When such a match/target sets .hooks to restrict which hooks it may run on, the bitmask uses NF_INET_* constants. This is only correct for families whose hook layout matches NF_INET_*: IPv4, IPv6, INET, and bridge all share the same five hooks (PRE_ROUTING ... POST_ROUTING).
ARP only has three hooks (IN=0, OUT=1, FORWARD=2) with different semantics. Because NF_ARP_OUT == 1 == NF_INET_LOCAL_IN, the .hooks validation silently passes for the wrong reasons, allowing matches to run on ARP chains where the hook assumptions (e.g. state->in being set on input hooks) do not hold. This leads to NULL pointer dereferences; xt_devgroup is one concrete example:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000044: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000220-0x0000000000000227] RIP: 0010:devgroup_mt+0xff/0x350 Call Trace: <TASK> nft_match_eval (net/netfilter/nft_compat.c:407) nft_do_chain (net/netfilter/nf_tables_core.c:285) nft_do_chain_arp (net/netfilter/nft_chain_filter.c:61) nf_hook_slow (net/netfilter/core.c:623) arp_xmit (net/ipv4/arp.c:666) </TASK> Kernel panic - not syncing: Fatal exception in interrupt
Fix it by restricting arptables to NFPROTO_ARP extensions only. Note that arptables-legacy only supports:
- arpt_CLASSIFY
- arpt_mangle
- arpt_MARK
that provide explicit NFPROTO_ARP match/target declarations.
--- net/netfilter/x_tables.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
net/netfilter/x_tables.c +23 -0
@@ -501,6 +501,17 @@ int xt_check_match(struct xt_mtchk_param *par, par->match->table, par->table);return -EINVAL ; } + +/* NFPROTO_UNSPEC implies NF_INET_* hooks which do not overlap with +* NF_ARP_IN,OUT,FORWARD, allow explicit extensions with NFPROTO_ARP +* support. +*/ +if (par->family ==NFPROTO_ARP && + par->match->family !=NFPROTO_ARP ) { +pr_info_ratelimited ("%s_tables: %s match: not valid for this family\n" , + xt_prefix[par->family], par->match->name); +return -EINVAL ; + }if (par->match->hooks && (par->hook_mask & ~par->match->hooks) !=0 ) {char used[64 ], allow[64 ];
@@ -1016,6 +1027,18 @@ int xt_check_target(struct xt_tgchk_param *par, par->target->table, par->table);return -EINVAL ; } + +/* NFPROTO_UNSPEC implies NF_INET_* hooks which do not overlap with +* NF_ARP_IN,OUT,FORWARD, allow explicit extensions with NFPROTO_ARP +* support. +*/ +if (par->family ==NFPROTO_ARP && + par->target->family !=NFPROTO_ARP ) { +pr_info_ratelimited ("%s_tables: %s target: not valid for this family\n" , + xt_prefix[par->family], par->target->name); +return -EINVAL ; + } +if (par->target->hooks && (par->hook_mask & ~par->target->hooks) !=0 ) {char used[64 ], allow[64 ];
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 175/312 netfilter: nf_tables: reject immediate NF_QUEUE verdict
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit da107398cbd4bbdb6bffecb2ce86d5c9384f4cec ]
nft_queue is always used from userspace nftables to deliver the NF_QUEUE verdict. Immediately emitting an NF_QUEUE verdict is never used by the userspace nft tools, so reject immediate NF_QUEUE verdicts.
The arp family does not provide queue support, but such an immediate verdict is still reachable. Globally reject NF_QUEUE immediate verdicts to address this issue.
--- net/netfilter/nf_tables_api.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +5 -2
@@ -10468,8 +10468,6 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,switch (data->verdict.code) {case NF_ACCEPT :case NF_DROP : -case NF_QUEUE : -break ;case NFT_CONTINUE :case NFT_BREAK :case NFT_RETURN :
@@ -10504,6 +10502,11 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, data->verdict.chain = chain;break ; +case NF_QUEUE : +/* The nft_queue expression is used for this purpose, an +* immediate NF_QUEUE verdict should not ever be seen here. +*/ + fallthrough;default :return -EINVAL ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 176/312 Bluetooth: SCO: fix race conditions in sco_sock_connect()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <[email protected]>
[ Upstream commit 8a5b0135d4a5d9683203a3d9a12a711ccec5936b ]
sco_sock_connect() checks sk_state and sk_type without holding the socket lock. Two concurrent connect() syscalls on the same socket can both pass the check and enter sco_connect(), leading to use-after-free.
The buggy scenario involves three participants and was confirmed with additional logging instrumentation:
Thread A (connect): HCI disconnect: Thread B (connect):
sco_sock_connect(sk) sco_sock_connect(sk)
sk_state==BT_OPEN sk_state==BT_OPEN
(pass, no lock) (pass, no lock)
sco_connect(sk): sco_connect(sk):
hci_dev_lock hci_dev_lock
hci_connect_sco <- blocked
-> hcon1
sco_conn_add->conn1
lock_sock(sk)
sco_chan_add:
conn1->sk = sk
sk->conn = conn1
sk_state=BT_CONNECT
release_sock
hci_dev_unlock
hci_dev_lock
sco_conn_del:
lock_sock(sk)
sco_chan_del:
sk->conn=NULL
conn1->sk=NULL
sk_state=
BT_CLOSED
SOCK_ZAPPED
release_sock
hci_dev_unlock
(unblocked)
hci_connect_sco
-> hcon2
sco_conn_add
-> conn2
lock_sock(sk)
sco_chan_add:
sk->conn=conn2
sk_state=
BT_CONNECT
// zombie sk!
release_sock
hci_dev_unlockThread B revives a BT_CLOSED + SOCK_ZAPPED socket back to BT_CONNECT. Subsequent cleanup triggers double sock_put() and use-after-free. Meanwhile conn1 is leaked as it was orphaned when sco_conn_del() cleared the association.
Fix this by:
- Moving lock_sock() before the sk_state/sk_type checks in sco_sock_connect() to serialize concurrent connect attempts
- Fixing the sk_type != SOCK_SEQPACKET check to actually return the error instead of just assigning it
- Adding a state re-check in sco_connect() after lock_sock() to catch state changes during the window between the locks
- Adding sco_pi(sk)->conn check in sco_chan_add() to prevent double-attach of a socket to multiple connections
- Adding hci_conn_drop() on sco_chan_add failure to prevent HCI connection leaks
--- net/bluetooth/sco.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-)
net/bluetooth/sco.c +21 -5
@@ -239,7 +239,7 @@ static int sco_chan_add(struct sco_conn *conn, struct sock *sk,int err =0 ;sco_conn_lock (conn); -if (conn->sk) +if (conn->sk ||sco_pi (sk)->conn) err = -EBUSY ;else __sco_chan_add (conn, sk, parent);
@@ -293,9 +293,20 @@ static int sco_connect(struct sock *sk)lock_sock (sk); +/* Recheck state after reacquiring the socket lock, as another +* thread may have changed it (e.g., closed the socket). +*/ +if (sk->sk_state !=BT_OPEN && sk->sk_state !=BT_BOUND ) { +release_sock (sk); +hci_conn_drop (hcon); + err = -EBADFD ; + goto unlock; + } + err =sco_chan_add (conn, sk,NULL );if (err) {release_sock (sk); +hci_conn_drop (hcon); goto unlock; }
@@ -613,13 +624,18 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen addr->sa_family != AF_BLUETOOTH)return -EINVAL ; -if (sk->sk_state !=BT_OPEN && sk->sk_state !=BT_BOUND ) +lock_sock (sk); + +if (sk->sk_state !=BT_OPEN && sk->sk_state !=BT_BOUND ) { +release_sock (sk);return -EBADFD ; + } -if (sk->sk_type !=SOCK_SEQPACKET ) - err = -EINVAL ; +if (sk->sk_type !=SOCK_SEQPACKET ) { +release_sock (sk); +return -EINVAL ; + } -lock_sock (sk);/* Set destination address and psm */ bacpy (&sco_pi (sk)->dst, &sa->sco_bdaddr);release_sock (sk);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 177/312 Bluetooth: MGMT: validate LTK enc_size on load
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keenan Dong <[email protected]>
[ Upstream commit b8dbe9648d69059cfe3a28917bfbf7e61efd7f15 ]
Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An enc_size larger than the 16-byte key buffer can therefore overflow the reply stack buffer.
Reject oversized enc_size values while validating the management LTK record so invalid keys never reach the stored key state.
--- net/bluetooth/mgmt.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/mgmt.c +3 -0
@@ -7224,6 +7224,9 @@ static bool ltk_is_valid(struct mgmt_ltk_info *key)if (key->initiator !=0x00 && key->initiator !=0x01 )return false; +if (key->enc_size >sizeof (key->val)) +return false; +switch (key->addr.type) {case BDADDR_LE_PUBLIC :return true;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 178/312 Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit b255531b27da336571411248c2a72a350662bd09 ]
hci_conn lookup and field access must be covered by hdev lock in hci_le_remote_conn_param_req_evt, otherwise it's possible it is freed concurrently.
Extend the hci_dev_lock critical section to cover all conn usage.
--- net/bluetooth/hci_event.c | 33 ++++++++++++++++++++------------- 1 file changed, 20 insertions(+), 13 deletions(-)
net/bluetooth/hci_event.c +20 -13
@@ -6629,25 +6629,31 @@ static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev, void *data, latency =le16_to_cpu (ev->latency); timeout =le16_to_cpu (ev->timeout); +hci_dev_lock (hdev); + hcon =hci_conn_hash_lookup_handle (hdev, handle); -if (!hcon || hcon->state !=BT_CONNECTED ) -return send_conn_param_neg_reply (hdev, handle, -HCI_ERROR_UNKNOWN_CONN_ID ); +if (!hcon || hcon->state !=BT_CONNECTED ) { +send_conn_param_neg_reply (hdev, handle, +HCI_ERROR_UNKNOWN_CONN_ID ); + goto unlock; + } -if (max > hcon->le_conn_max_interval) -return send_conn_param_neg_reply (hdev, handle, -HCI_ERROR_INVALID_LL_PARAMS ); +if (max > hcon->le_conn_max_interval) { +send_conn_param_neg_reply (hdev, handle, +HCI_ERROR_INVALID_LL_PARAMS ); + goto unlock; + } -if (hci_check_conn_params (min, max, latency, timeout)) -return send_conn_param_neg_reply (hdev, handle, -HCI_ERROR_INVALID_LL_PARAMS ); +if (hci_check_conn_params (min, max, latency, timeout)) { +send_conn_param_neg_reply (hdev, handle, +HCI_ERROR_INVALID_LL_PARAMS ); + goto unlock; + }if (hcon->role ==HCI_ROLE_MASTER ) {struct hci_conn_params *params;u8 store_hint; -hci_dev_lock (hdev); - params =hci_conn_params_lookup (hdev, &hcon->dst, hcon->dst_type);if (params) {
@@ -6660,8 +6666,6 @@ static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev, void *data, store_hint =0x00 ; } -hci_dev_unlock (hdev); -mgmt_new_conn_param (hdev, &hcon->dst, hcon->dst_type, store_hint, min, max, latency, timeout); }
@@ -6675,6 +6679,9 @@ static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev, void *data, cp.max_ce_len =0 ;hci_send_cmd (hdev,HCI_OP_LE_CONN_PARAM_REQ_REPLY ,sizeof (cp), &cp); + +unlock: +hci_dev_unlock (hdev); } static void hci_le_direct_adv_report_evt(struct hci_dev *hdev, void *data,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 179/312 Bluetooth: MGMT: validate mesh send advertising payload length
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keenan Dong <[email protected]>
[ Upstream commit bda93eec78cdbfe5cda00785cefebd443e56b88b ]
mesh_send() currently bounds MGMT_OP_MESH_SEND by total command length, but it never verifies that the bytes supplied for the flexible adv_data[] array actually match the embedded adv_data_len field. MGMT_MESH_SEND_SIZE only covers the fixed header, so a truncated command can still pass the existing 20..50 byte range check and later drive the async mesh send path past the end of the queued command buffer.
Keep rejecting zero-length and oversized advertising payloads, but validate adv_data_len explicitly and require the command length to exactly match the flexible array size before queueing the request.
--- net/bluetooth/mgmt.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
net/bluetooth/mgmt.c +11 -3
@@ -2471,6 +2471,7 @@ static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)struct mgmt_mesh_tx *mesh_tx;struct mgmt_cp_mesh_send *send = data;struct mgmt_rp_mesh_read_features rp; +u16 expected_len;bool sending;int err =0 ;
@@ -2478,12 +2479,19 @@ static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))return mgmt_cmd_status (sk, hdev->id,MGMT_OP_MESH_SEND ,MGMT_STATUS_NOT_SUPPORTED ); -if (!hci_dev_test_flag (hdev,HCI_LE_ENABLED ) || - len <=MGMT_MESH_SEND_SIZE || - len > (MGMT_MESH_SEND_SIZE +31 )) +if (!hci_dev_test_flag (hdev,HCI_LE_ENABLED )) +return mgmt_cmd_status (sk, hdev->id,MGMT_OP_MESH_SEND , +MGMT_STATUS_REJECTED ); + +if (!send->adv_data_len || send->adv_data_len >31 )return mgmt_cmd_status (sk, hdev->id,MGMT_OP_MESH_SEND ,MGMT_STATUS_REJECTED ); + expected_len =struct_size (send, adv_data, send->adv_data_len); +if (expected_len != len) +return mgmt_cmd_status (sk, hdev->id,MGMT_OP_MESH_SEND , +MGMT_STATUS_INVALID_PARAMS ); +hci_dev_lock (hdev);memset (&rp,0 ,sizeof (rp));
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 180/312 rds: ib: reject FRMR registration before IB connection is established
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit a54ecccfae62c5c85259ae5ea5d9c20009519049 ]
rds_ib_get_mr() extracts the rds_ib_connection from conn->c_transport_data and passes it to rds_ib_reg_frmr() for FRWR memory registration. On a fresh outgoing connection, ic is allocated in rds_ib_conn_alloc() with i_cm_id = NULL because the connection worker has not yet called rds_ib_conn_path_connect() to create the rdma_cm_id. When sendmsg() with RDS_CMSG_RDMA_MAP is called on such a connection, the sendmsg path parses the control message before any connection establishment, allowing rds_ib_post_reg_frmr() to dereference ic->i_cm_id->qp and crash the kernel.
The existing guard in rds_ib_reg_frmr() only checks for !ic (added in commit 9e630bcb7701), which does not catch this case since ic is allocated early and is always non-NULL once the connection object exists.
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:rds_ib_post_reg_frmr+0x50e/0x920 Call Trace: rds_ib_post_reg_frmr (net/rds/ib_frmr.c:167) rds_ib_map_frmr (net/rds/ib_frmr.c:252) rds_ib_reg_frmr (net/rds/ib_frmr.c:430) rds_ib_get_mr (net/rds/ib_rdma.c:615) __rds_rdma_map (net/rds/rdma.c:295) rds_cmsg_rdma_map (net/rds/rdma.c:860) rds_sendmsg (net/rds/send.c:1363) ____sys_sendmsg do_syscall_64
Add a check in rds_ib_get_mr() that verifies ic, i_cm_id, and qp are all non-NULL before proceeding with FRMR registration, mirroring the guard already present in rds_ib_post_inv(). Return -ENODEV when the connection is not ready, which the existing error handling in rds_cmsg_send() converts to -EAGAIN for userspace retry and triggers rds_conn_connect_if_down() to start the connection worker.
--- net/rds/ib_rdma.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/rds/ib_rdma.c +6 -1
@@ -608,8 +608,13 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,return ibmr; } -if (conn) +if (conn) { ic = conn->c_transport_data; +if (!ic || !ic->i_cm_id || !ic->i_cm_id->qp) { + ret = -ENODEV ; + goto out; + } + }if (!rds_ibdev->mr_8k_pool || !rds_ibdev->mr_1m_pool) { ret = -ENODEV ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 181/312 net: macb: fix clk handling on PCI glue driver removal
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit ce8fe5287b87e24e225c342f3b0ec04f0b3680fe ]
platform_device_unregister() may still want to use the registered clks during runtime resume callback.
Note that there is a commit d82d5303c4c5 ("net: macb: fix use after free on rmmod") that addressed the similar problem of clk vs platform device unregistration but just moved the bug to another place.
Save the pointers to clks into local variables for reuse after platform device is unregistered.
BUG: KASAN: use-after-free in clk_prepare+0x5a/0x60 Read of size 8 at addr ffff888104f85e00 by task modprobe/597 CPU: 2 PID: 597 Comm: modprobe Not tainted 6.1.164+ #114 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x8d/0xba print_report+0x17f/0x496 kasan_report+0xd9/0x180 clk_prepare+0x5a/0x60 macb_runtime_resume+0x13d/0x410 [macb] pm_generic_runtime_resume+0x97/0xd0 __rpm_callback+0xc8/0x4d0 rpm_callback+0xf6/0x230 rpm_resume+0xeeb/0x1a70 __pm_runtime_resume+0xb4/0x170 bus_remove_device+0x2e3/0x4b0 device_del+0x5b3/0xdc0 platform_device_del+0x4e/0x280 platform_device_unregister+0x11/0x50 pci_device_remove+0xae/0x210 device_remove+0xcb/0x180 device_release_driver_internal+0x529/0x770 driver_detach+0xd4/0x1a0 bus_remove_driver+0x135/0x260 driver_unregister+0x72/0xb0 pci_unregister_driver+0x26/0x220 __do_sys_delete_module+0x32e/0x550 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 </TASK> Allocated by task 519: kasan_save_stack+0x2c/0x50 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x8e/0x90 __clk_register+0x458/0x2890 clk_hw_register+0x1a/0x60 __clk_hw_register_fixed_rate+0x255/0x410 clk_register_fixed_rate+0x3c/0xa0 macb_probe+0x1d8/0x42e [macb_pci] local_pci_probe+0xd7/0x190 pci_device_probe+0x252/0x600 really_probe+0x255/0x7f0 __driver_probe_device+0x1ee/0x330 driver_probe_device+0x4c/0x1f0 __driver_attach+0x1df/0x4e0 bus_for_each_dev+0x15d/0x1f0 bus_add_driver+0x486/0x5e0 driver_register+0x23a/0x3d0 do_one_initcall+0xfd/0x4d0 do_init_module+0x18b/0x5a0 load_module+0x5663/0x7950 __do_sys_finit_module+0x101/0x180 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Freed by task 597: kasan_save_stack+0x2c/0x50 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x50 __kasan_slab_free+0x106/0x180 __kmem_cache_free+0xbc/0x320 clk_unregister+0x6de/0x8d0 macb_remove+0x73/0xc0 [macb_pci] pci_device_remove+0xae/0x210 device_remove+0xcb/0x180 device_release_driver_internal+0x529/0x770 driver_detach+0xd4/0x1a0 bus_remove_driver+0x135/0x260 driver_unregister+0x72/0xb0 pci_unregister_driver+0x26/0x220 __do_sys_delete_module+0x32e/0x550 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
--- drivers/net/ethernet/cadence/macb_pci.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/cadence/macb_pci.c +4 -2
@@ -110,10 +110,12 @@ static void macb_remove(struct pci_dev *pdev) {struct platform_device *plat_dev =pci_get_drvdata (pdev);struct macb_platform_data *plat_data =dev_get_platdata (&plat_dev->dev); +struct clk *pclk = plat_data->pclk; +struct clk *hclk = plat_data->hclk; -clk_unregister (plat_data->pclk); -clk_unregister (plat_data->hclk);platform_device_unregister (plat_dev); +clk_unregister (pclk); +clk_unregister (hclk); }static const struct pci_device_id dev_id_table[] = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 182/312 net: macb: properly unregister fixed rate clocks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit f0f367a4f459cc8118aadc43c6bba53c60d93f8d ]
The additional resources allocated with clk_register_fixed_rate() need to be released with clk_unregister_fixed_rate(), otherwise they are lost.
--- drivers/net/ethernet/cadence/macb_pci.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/cadence/macb_pci.c +4 -4
@@ -97,10 +97,10 @@ static int macb_probe(struct pci_dev *pdev, const struct pci_device_id *id)return 0 ; err_plat_dev_register: -clk_unregister (plat_data.hclk); +clk_unregister_fixed_rate (plat_data.hclk); err_hclk_register: -clk_unregister (plat_data.pclk); +clk_unregister_fixed_rate (plat_data.pclk); err_pclk_register:return err;
@@ -114,8 +114,8 @@ static void macb_remove(struct pci_dev *pdev)struct clk *hclk = plat_data->hclk;platform_device_unregister (plat_dev); -clk_unregister (pclk); -clk_unregister (hclk); +clk_unregister_fixed_rate (pclk); +clk_unregister_fixed_rate (hclk); }static const struct pci_device_id dev_id_table[] = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 183/312 net/mlx5: lag: Check for LAG device before creating debugfs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shay Drory <[email protected]>
[ Upstream commit bf16bca6653679d8a514d6c1c5a2c67065033f14 ]
__mlx5_lag_dev_add_mdev() may return 0 (success) even when an error occurs that is handled gracefully. Consequently, the initialization flow proceeds to call mlx5_ldev_add_debugfs() even when there is no valid LAG context.
mlx5_ldev_add_debugfs() blindly created the debugfs directory and attributes. This exposed interfaces (like the members file) that rely on a valid ldev pointer, leading to potential NULL pointer dereferences if accessed when ldev is NULL.
Add a check to verify that mlx5_lag_dev(dev) returns a valid pointer before attempting to create the debugfs entries.
--- drivers/net/ethernet/mellanox/mlx5/core/lag/debugfs.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/lag/debugfs.c +3 -0
@@ -163,8 +163,11 @@ DEFINE_SHOW_ATTRIBUTE(members);void mlx5_ldev_add_debugfs (struct mlx5_core_dev *dev) { +struct mlx5_lag *ldev =mlx5_lag_dev (dev);struct dentry *dbg; +if (!ldev) +return ; dbg =debugfs_create_dir ("lag" ,mlx5_debugfs_get_dev_root (dev)); dev->priv.dbg.lag_debugfs = dbg;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 184/312 net/mlx5: Avoid "No data available" when FW version queries fail
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saeed Mahameed <[email protected]>
[ Upstream commit 10dc35f6a443d488f219d1a1e3fb8f8dac422070 ]
Avoid printing the misleading "kernel answers: No data available" devlink output when querying firmware or pending firmware version fails (e.g. MLX5 fw state errors / flash failures).
FW can fail on loading the pending flash image and get its version due to various reasons, examples:
mlxfw: Firmware flash failed: key not applicable, err (7)mlx5_fw_image_pending: can't read pending fw version while fw state is 1
and the resulting:
$ devlink dev info kernel answers: No data available
Instead, just report 0 or 0xfff.. versions in case of failure to indicate a problem, and let other information be shown.
after the fix:
$ devlink dev info
pci/0000:00:06.0:
driver mlx5_core
serial_number xxx...
board.serial_number MT2225300179
versions:
fixed:
fw.psid MT_0000000436
running:
fw.version 22.41.0188
fw 22.41.0188
stored:
fw.version 255.255.65535
fw 255.255.65535--- .../net/ethernet/mellanox/mlx5/core/devlink.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/fw.c | 53 ++++++++++++------- .../ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +- 3 files changed, 37 insertions(+), 24 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/devlink.c +1 -3
@@ -54,9 +54,7 @@ mlx5_devlink_info_get(struct devlink *devlink, struct devlink_info_req *req,if (err)return err; - err =mlx5_fw_version_query (dev, &running_fw, &stored_fw); -if (err) -return err; +mlx5_fw_version_query (dev, &running_fw, &stored_fw); snprintf(version_str, sizeof(version_str), "%d.%d.%04d", mlx5_fw_ver_major(running_fw), mlx5_fw_ver_minor(running_fw),
drivers/net/ethernet/mellanox/mlx5/core/fw.c +34 -19
82 lines not on this page · raw message
drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h +2 -2
@@ -262,8 +262,8 @@ void mlx5_dm_cleanup(struct mlx5_core_dev *dev);int mlx5_firmware_flash (struct mlx5_core_dev *dev,const struct firmware *fw,struct netlink_ext_ack *extack); -int mlx5_fw_version_query (struct mlx5_core_dev *dev, -u32 *running_ver,u32 *stored_ver); +void mlx5_fw_version_query (struct mlx5_core_dev *dev,u32 *running_ver, +u32 *stored_ver);#ifdef CONFIG_MLX5_CORE_EN int mlx5e_init (void );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 185/312 net/x25: Fix potential double free of skb
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schiller <[email protected]>
[ Upstream commit d10a26aa4d072320530e6968ef945c8c575edf61 ]
When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at line 48 and returns 1 (error).
This error propagates back through the call chain:
x25_queue_rx_frame returns 1
|
v
x25_state3_machine receives the return value 1 and takes the else
branch at line 278, setting queued=0 and returning 0
|
v
x25_process_rx_frame returns queued=0
|
vx25_backlog_rcv at line 452 sees queued=0 and calls kfree_skb(skb) again
This would free the same skb twice. Looking at x25_backlog_rcv:
net/x25/x25_in.c:x25_backlog_rcv() {
...
queued = x25_process_rx_frame(sk, skb);
...
if (!queued)
kfree_skb(skb);
}--- net/x25/x25_in.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
net/x25/x25_in.c +2 -3
@@ -44,10 +44,9 @@ static int x25_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more)if (x25->fraglen >0 ) {/* End of fragment */ int len = x25->fraglen + skb->len; -if ((skbn =alloc_skb (len,GFP_ATOMIC )) ==NULL ){ -kfree_skb (skb); + skbn =alloc_skb (len,GFP_ATOMIC ); +if (!skbn)return 1 ; - }skb_queue_tail (&x25->fragment_queue, skb);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 186/312 net/x25: Fix overflow when accumulating packets
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schiller <[email protected]>
[ Upstream commit a1822cb524e89b4cd2cf0b82e484a2335496a6d9 ]
Add a check to ensure that x25_sock.fraglen does not overflow.
The fraglen also needs to be resetted when purging fragment_queue in x25_clear_queues().
--- net/x25/x25_in.c | 4 ++++ net/x25/x25_subr.c | 1 + 2 files changed, 5 insertions(+)
net/x25/x25_in.c +4 -0
@@ -34,6 +34,10 @@ static int x25_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more)struct sk_buff *skbo, *skbn = skb;struct x25_sock *x25 =x25_sk (sk); +/* make sure we don't overflow */ +if (x25->fraglen + skb->len >USHRT_MAX ) +return 1 ; +if (more) { x25->fraglen += skb->len;skb_queue_tail (&x25->fragment_queue, skb);
net/x25/x25_subr.c +1 -0
@@ -40,6 +40,7 @@ void x25_clear_queues(struct sock *sk)skb_queue_purge (&x25->interrupt_in_queue);skb_queue_purge (&x25->interrupt_out_queue);skb_queue_purge (&x25->fragment_queue); + x25->fraglen =0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 187/312 net/sched: cls_fw: fix NULL pointer dereference on shared blocks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit faeea8bbf6e958bf3c00cb08263109661975987c ]
The old-method path in fw_classify() calls tcf_block_q() and dereferences q->handle. Shared blocks leave block->q NULL, causing a NULL deref when an empty cls_fw filter is attached to a shared block and a packet with a nonzero major skb mark is classified.
Reject the configuration in fw_change() when the old method (no TCA_OPTIONS) is used on a shared block, since fw_classify()'s old-method path needs block->q which is NULL for shared blocks.
The fixed null-ptr-deref calling stack:
KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:fw_classify (net/sched/cls_fw.c:81) Call Trace: tcf_classify (./include/net/tc_wrapper.h:197 net/sched/cls_api.c:1764 net/sched/cls_api.c:1860) tc_run (net/core/dev.c:4401) __dev_queue_xmit (net/core/dev.c:4535 net/core/dev.c:4790)
--- net/sched/cls_fw.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
net/sched/cls_fw.c +12 -2
@@ -245,8 +245,18 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,struct nlattr *tb[TCA_FW_MAX +1 ];int err; -if (!opt) -return handle ? -EINVAL :0 ;/* Succeed if it is old method. */ +if (!opt) { +if (handle) +return -EINVAL ; + +if (tcf_block_shared (tp->chain->block)) { +NL_SET_ERR_MSG (extack, +"Must specify mark when attaching fw filter to block" ); +return -EINVAL ; + } + +return 0 ;/* Succeed if it is old method. */ + } err =nla_parse_nested_deprecated (tb,TCA_FW_MAX , opt, fw_policy,NULL );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 188/312 net/sched: cls_flow: fix NULL pointer dereference on shared blocks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit 1a280dd4bd1d616a01d6ffe0de284c907b555504 ]
flow_change() calls tcf_block_q() and dereferences q->handle to derive a default baseclass. Shared blocks leave block->q NULL, causing a NULL deref when a flow filter without a fully qualified baseclass is created on a shared block.
Check tcf_block_shared() before accessing block->q and return -EINVAL for shared blocks. This avoids the null-deref shown below:
=======================================================================
KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:flow_change (net/sched/cls_flow.c:508) Call Trace: tc_new_tfilter (net/sched/cls_api.c:2432) rtnetlink_rcv_msg (net/core/rtnetlink.c:6980) [...] =======================================================================
--- net/sched/cls_flow.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
net/sched/cls_flow.c +9 -1
@@ -501,8 +501,16 @@ static int flow_change(struct net *net, struct sk_buff *in_skb, }if (TC_H_MAJ (baseclass) ==0 ) { -struct Qdisc *q =tcf_block_q (tp->chain->block); +struct tcf_block *block = tp->chain->block; +struct Qdisc *q; +if (tcf_block_shared (block)) { +NL_SET_ERR_MSG (extack, +"Must specify baseclass when attaching flow filter to block" ); + goto err2; + } + + q =tcf_block_q (block); baseclass =TC_H_MAKE (q->handle, baseclass); }if (TC_H_MIN (baseclass) ==0 )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 189/312 net: hsr: fix VLAN add unwind on slave errors
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luka Gejak <[email protected]>
[ Upstream commit 2e3514e63bfb0e972b1f19668547a455d0129e88 ]
When vlan_vid_add() fails for a secondary slave, the error path calls vlan_vid_del() on the failing port instead of the peer slave that had already succeeded. This results in asymmetric VLAN state across the HSR pair.
Fix this by switching to a centralized unwind path that removes the VID from any slave device that was already programmed.
--- net/hsr/hsr_device.c | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-)
net/hsr/hsr_device.c +17 -15
@@ -473,8 +473,8 @@ static void hsr_change_rx_flags(struct net_device *dev, int change)static int hsr_ndo_vlan_rx_add_vid (struct net_device *dev,__be16 proto,u16 vid) { -bool is_slave_a_added = false; -bool is_slave_b_added = false; +struct net_device *slave_a_dev =NULL ; +struct net_device *slave_b_dev =NULL ;struct hsr_port *port;struct hsr_priv *hsr;int ret =0 ;
@@ -490,33 +490,35 @@ static int hsr_ndo_vlan_rx_add_vid(struct net_device *dev,switch (port->type) {case HSR_PT_SLAVE_A :if (ret) { -/* clean up Slave-B */ netdev_err (dev,"add vid failed for Slave-A\n" ); -if (is_slave_b_added) -vlan_vid_del (port->dev, proto, vid); -return ret; + goto unwind; } - - is_slave_a_added = true; + slave_a_dev = port->dev;break ; -case HSR_PT_SLAVE_B :if (ret) { -/* clean up Slave-A */ netdev_err (dev,"add vid failed for Slave-B\n" ); -if (is_slave_a_added) -vlan_vid_del (port->dev, proto, vid); -return ret; + goto unwind; } - - is_slave_b_added = true; + slave_b_dev = port->dev;break ;default : +if (ret) + goto unwind;break ; } }return 0 ; + +unwind: +if (slave_a_dev) +vlan_vid_del (slave_a_dev, proto, vid); + +if (slave_b_dev) +vlan_vid_del (slave_b_dev, proto, vid); + +return ret; } static int hsr_ndo_vlan_rx_kill_vid(struct net_device *dev,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 190/312 ipv6: avoid overflows in ip6_datagram_send_ctl()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 4e453375561fc60820e6b9d8ebeb6b3ee177d42e ]
Yiming Qian reported :
<quote>
I believe I found a locally triggerable kernel bug in the IPv6 sendmsg ancillary-data path that can panic the kernel via skb_under_panic() (local DoS).
The core issue is a mismatch between:
- a 16-bit length accumulator (struct ipv6_txoptions::opt_flen, type __u16) and
- a pointer to the *last* provided destination-options header (opt->dst1opt)
when multiple IPV6_DSTOPTS control messages (cmsgs) are provided.
- include/net/ipv6.h:
- struct ipv6_txoptions::opt_flen is __u16 (wrap possible).
(lines 291-307, especially 298)
- net/ipv6/datagram.c:ip6_datagram_send_ctl():
- Accepts repeated IPV6_DSTOPTS and accumulates into opt_flen
without rejecting duplicates. (lines 909-933)
- net/ipv6/ip6_output.c:__ip6_append_data():
- Uses opt->opt_flen + opt->opt_nflen to compute header
sizes/headroom decisions. (lines 1448-1466, especially 1463-1465)
- net/ipv6/ip6_output.c:__ip6_make_skb():
- Calls ipv6_push_frag_opts() if opt->opt_flen is non-zero.
(lines 1930-1934)
- net/ipv6/exthdrs.c:ipv6_push_frag_opts() / ipv6_push_exthdr():
- Push size comes from ipv6_optlen(opt->dst1opt) (based on the
pointed-to header). (lines 1179-1185 and 1206-1211)
1. opt_flen is a 16-bit accumulator:
- include/net/ipv6.h:298 defines __u16 opt_flen; /* after fragment hdr */.
2. ip6_datagram_send_ctl() accepts *repeated* IPV6_DSTOPTS cmsgs and increments opt_flen each time:
- In net/ipv6/datagram.c:909-933, for IPV6_DSTOPTS:
- It computes len = ((hdr->hdrlen + 1) << 3);
- It checks CAP_NET_RAW using `ns_capable(net->user_ns,
CAP_NET_RAW)`. (line 922)
- Then it does:
- opt->opt_flen += len; (line 927)
- opt->dst1opt = hdr; (line 928)
There is no duplicate rejection here (unlike the legacy IPV6_2292DSTOPTS path which rejects duplicates at net/ipv6/datagram.c:901-904).
If enough large IPV6_DSTOPTS cmsgs are provided, opt_flen wraps while dst1opt still points to a large (2048-byte) destination-options header.
In the attached PoC (poc.c):
- 32 cmsgs with hdrlen=255 => len = (255+1)*8 = 2048
- 1 cmsg with hdrlen=0 => len = 8
- Total increment: 32*2048 + 8 = 65544, so (__u16)opt_flen == 8
- The last cmsg is 2048 bytes, so dst1opt points to a 2048-byte header.
3. The transmit path sizes headers using the wrapped opt_flen:
- In net/ipv6/ip6_output.c:1463-1465:
- `headersize = sizeof(struct ipv6hdr) + (opt ? opt->opt_flen +
opt->opt_nflen : 0) + ...;`
With wrapped opt_flen, headersize/headroom decisions underestimate what will be pushed later.
4. When building the final skb, the actual push length comes from dst1opt and is not limited by wrapped opt_flen:
- In net/ipv6/ip6_output.c:1930-1934:
- if (opt->opt_flen) proto = ipv6_push_frag_opts(skb, opt, proto);
- In net/ipv6/exthdrs.c:1206-1211, ipv6_push_frag_opts() pushes dst1opt via ipv6_push_exthdr().
- In net/ipv6/exthdrs.c:1179-1184, ipv6_push_exthdr() does:
- skb_push(skb, ipv6_optlen(opt));
- memcpy(h, opt, ipv6_optlen(opt));
With insufficient headroom, skb_push() underflows and triggers skb_under_panic() -> BUG():
- net/core/skbuff.c:2669-2675 (skb_push() calls skb_under_panic())
- net/core/skbuff.c:207-214 (skb_panic() ends in BUG())
- The IPV6_DSTOPTS cmsg path requires CAP_NET_RAW in the target netns user namespace (ns_capable(net->user_ns, CAP_NET_RAW)).
- Root (or any task with CAP_NET_RAW) can trigger this without user namespaces.
- An unprivileged uid=1000 user can trigger this if unprivileged user namespaces are enabled and it can create a userns+netns to obtain namespaced CAP_NET_RAW (the attached PoC does this).
- Local denial of service: kernel BUG/panic (system crash).
- Reproducible with a small userspace PoC.
</quote>
This patch does not reject duplicated options, as this might break some user applications.
Instead, it makes sure to adjust opt_flen and opt_nflen to correctly reflect the size of the current option headers, preventing the overflows and the potential for panics.
This applies to IPV6_DSTOPTS, IPV6_HOPOPTS, and IPV6_RTHDR.
Specifically:
When a new IPV6_DSTOPTS is processed, the length of the old opt->dst1opt is subtracted from opt->opt_flen before adding the new length.
When a new IPV6_HOPOPTS is processed, the length of the old opt->dst0opt is subtracted from opt->opt_nflen.
When a new Routing Header (IPV6_RTHDR or IPV6_2292RTHDR) is processed, the length of the old opt->srcrt is subtracted from opt->opt_nflen.
In the special case within IPV6_2292RTHDR handling where dst1opt is moved to dst0opt, the length of the old opt->dst0opt is subtracted from opt->opt_nflen before the new one is added.
--- net/ipv6/datagram.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
net/ipv6/datagram.c +10 -0
@@ -761,6 +761,7 @@ int ip6_datagram_send_ctl(struct net *net, struct sock *sk, {struct in6_pktinfo *src_info;struct cmsghdr *cmsg; +struct ipv6_rt_hdr *orthdr;struct ipv6_rt_hdr *rthdr;struct ipv6_opt_hdr *hdr;struct ipv6_txoptions *opt = ipc6->opt;
@@ -922,9 +923,13 @@ int ip6_datagram_send_ctl(struct net *net, struct sock *sk, goto exit_f; }if (cmsg->cmsg_type ==IPV6_DSTOPTS ) { +if (opt->dst1opt) + opt->opt_flen -=ipv6_optlen (opt->dst1opt); opt->opt_flen += len; opt->dst1opt = hdr; }else { +if (opt->dst0opt) + opt->opt_nflen -=ipv6_optlen (opt->dst0opt); opt->opt_nflen += len; opt->dst0opt = hdr; }
@@ -967,12 +972,17 @@ int ip6_datagram_send_ctl(struct net *net, struct sock *sk, goto exit_f; } + orthdr = opt->srcrt; +if (orthdr) + opt->opt_nflen -= ((orthdr->hdrlen +1 ) <<3 ); opt->opt_nflen += len; opt->srcrt = rthdr;if (cmsg->cmsg_type ==IPV6_2292RTHDR && opt->dst1opt) {int dsthdrlen = ((opt->dst1opt->hdrlen+1 )<<3 ); +if (opt->dst0opt) + opt->opt_nflen -=ipv6_optlen (opt->dst0opt); opt->opt_nflen += dsthdrlen; opt->dst0opt = opt->dst1opt; opt->dst1opt =NULL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 191/312 bpf: reject direct access to nullable PTR_TO_BUF pointers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Tang <[email protected]>
[ Upstream commit b0db1accbc7395657c2b79db59fa9fae0d6656f3 ]
check_mem_access() matches PTR_TO_BUF via base_type() which strips PTR_MAYBE_NULL, allowing direct dereference without a null check.
Map iterator ctx->key and ctx->value are PTR_TO_BUF | PTR_MAYBE_NULL. On stop callbacks these are NULL, causing a kernel NULL dereference.
Add a type_may_be_null() guard to the PTR_TO_BUF branch, matching the existing PTR_TO_BTF_ID pattern.
--- kernel/bpf/verifier.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/bpf/verifier.c +2 -1
@@ -5139,7 +5139,8 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn }else if (reg->type ==CONST_PTR_TO_MAP ) { err =check_ptr_to_map_access (env, regs, regno, off, size, t, value_regno); - }else if (base_type (reg->type) ==PTR_TO_BUF ) { + }else if (base_type (reg->type) ==PTR_TO_BUF && + !type_may_be_null (reg->type)) {bool rdonly_mem =type_is_rdonly_mem (reg->type);u32 *max_access;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 192/312 iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 773ef9f95385bae52dcb7fd129fefba3a71a04db ]
Fix an off-by-one error in the BNO055_SCAN_CH_COUNT macro. The count is derived by taking the difference of the last and first register addresses, dividing by the size of each channel (2 bytes). It needs to also add 1 to account for the fact that the count is inclusive of both the first and last channels.
Thanks to the aligned_s64 timestamp field, there was already extra padding in the buffer, so there were no runtime issues caused by this bug.
--- drivers/iio/imu/bno055/bno055.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/imu/bno055/bno055.c +1 -1
@@ -64,7 +64,7 @@#define BNO055_GRAVITY_DATA_X_LSB_REG 0x2E#define BNO055_GRAVITY_DATA_Y_LSB_REG 0x30#define BNO055_GRAVITY_DATA_Z_LSB_REG 0x32 -#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2) +#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2 + 1)#define BNO055_TEMP_REG 0x34#define BNO055_CALIB_STAT_REG 0x35#define BNO055_CALIB_STAT_MAGN_SHIFT 0
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 193/312 hwmon: (pxe1610) Check return value of page-select write in probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
[ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check the return value. If the write fails, subsequent register reads operate on an indeterminate page, leading to silent misconfiguration.
Check the return value and propagate the error using dev_err_probe(), which also handles -EPROBE_DEFER correctly without log spam.
--- drivers/hwmon/pmbus/pxe1610.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/hwmon/pmbus/pxe1610.c +4 -1
@@ -104,7 +104,10 @@ static int pxe1610_probe(struct i2c_client *client)* By default this device doesn't boot to page 0, so set page 0 * to access all pmbus registers. */ -i2c_smbus_write_byte_data (client,PMBUS_PAGE ,0 ); + ret =i2c_smbus_write_byte_data (client,PMBUS_PAGE ,0 ); +if (ret <0 ) +return dev_err_probe (&client->dev, ret, +"Failed to set page 0\n" );/* Read Manufacturer id */ ret =i2c_smbus_read_block_data (client,PMBUS_MFR_ID , buf);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 194/312 dt-bindings: gpio: fix microchip #interrupt-cells
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamie Gibbons <[email protected]>
[ Upstream commit 6b5ef8c88854b343b733b574ea8754c9dab61f41 ]
The GPIO controller on PolarFire SoC supports more than one type of interrupt and needs two interrupt cells.
--- .../devicetree/bindings/gpio/microchip,mpfs-gpio.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml +2 -2
@@ -33,7 +33,7 @@ properties: const: 2 "#interrupt-cells": - const: 1 + const: 2 ngpios: description:
@@ -84,7 +84,7 @@ examples: gpio-controller; #gpio-cells = <2>; interrupt-controller; - #interrupt-cells = <1>; + #interrupt-cells = <2>; interrupts = <53>, <53>, <53>, <53>, <53>, <53>, <53>, <53>, <53>, <53>, <53>, <53>,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 195/312 hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
[ Upstream commit ca34ee6d0307a0b4e52c870dfc1bb8a3c3eb956e ]
tps53676_identify() uses strncmp() to compare the device ID buffer against a byte sequence containing embedded non-printable bytes (\x53\x67\x60). strncmp() is semantically wrong for binary data comparison; use memcmp() instead.
Additionally, the buffer from i2c_smbus_read_block_data() is not NUL-terminated, so printing it with "%s" in the error path is undefined behavior and may read past the buffer. Use "%*ph" to hex-dump the actual bytes returned.
Per the datasheet, the expected device ID is the 6-byte sequence 54 49 53 67 60 00 ("TI\x53\x67\x60\x00"), so compare all 6 bytes including the trailing NUL.
--- drivers/hwmon/pmbus/tps53679.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/pmbus/tps53679.c +2 -2
@@ -156,8 +156,8 @@ static int tps53676_identify(struct i2c_client *client, ret =i2c_smbus_read_block_data (client,PMBUS_IC_DEVICE_ID , buf);if (ret <0 )return ret; -if (strncmp ("TI\x53\x67\x60" , buf,5 )) { -dev_err (&client->dev,"Unexpected device ID: %s\n" , buf); +if (ret !=6 ||memcmp (buf,"TI\x53\x67\x60\x00" ,6 )) { +dev_err (&client->dev,"Unexpected device ID: %*ph\n" , ret, buf);return -ENODEV ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 196/312 hwmon: (occ) Fix missing newline in occ_show_extended()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
[ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag is set, the sysfs_emit format string "%u" is missing the trailing newline that the sysfs ABI expects. The else branch correctly uses "%4phN\n", and all other show functions in this file include the trailing newline.
Add the missing "\n" for consistency and correct sysfs output.
--- drivers/hwmon/occ/common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/occ/common.c +1 -1
@@ -725,7 +725,7 @@ static ssize_t occ_show_extended(struct device *dev,switch (sattr->nr) {case 0 :if (extn->flags &EXTN_FLAG_SENSOR_ID ) { - rc =sysfs_emit (buf,"%u" , + rc =sysfs_emit (buf,"%u\n" ,get_unaligned_be32 (&extn->sensor_id)); }else { rc =sysfs_emit (buf,"%4phN\n" , extn->name);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 197/312 riscv: kgdb: fix several debug register assignment bugs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Walmsley <[email protected]>
[ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
Fix several bugs in the RISC-V kgdb implementation:
- The element of dbg_reg_def[] that is supposed to pertain to the S1 register embeds instead the struct pt_regs offset of the A1 register. Fix this to use the S1 register offset in struct pt_regs.
- The sleeping_thread_to_gdb_regs() function copies the value of the S10 register into the gdb_regs[] array element meant for the S9 register, and copies the value of the S11 register into the array element meant for the S10 register. It also neglects to copy the value of the S11 register. Fix all of these issues.
--- arch/riscv/kernel/kgdb.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
arch/riscv/kernel/kgdb.c +4 -3
@@ -194,7 +194,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = { {DBG_REG_T1, GDB_SIZEOF_REG, offsetof(struct pt_regs, t1)}, {DBG_REG_T2, GDB_SIZEOF_REG, offsetof(struct pt_regs, t2)}, {DBG_REG_FP, GDB_SIZEOF_REG, offsetof(struct pt_regs, s0)}, - {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)}, + {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, s1)}, {DBG_REG_A0, GDB_SIZEOF_REG, offsetof(struct pt_regs, a0)}, {DBG_REG_A1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)}, {DBG_REG_A2, GDB_SIZEOF_REG, offsetof(struct pt_regs, a2)},
@@ -263,8 +263,9 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task) gdb_regs[DBG_REG_S6_OFF ] = task->thread.s[6 ]; gdb_regs[DBG_REG_S7_OFF ] = task->thread.s[7 ]; gdb_regs[DBG_REG_S8_OFF ] = task->thread.s[8 ]; - gdb_regs[DBG_REG_S9_OFF ] = task->thread.s[10 ]; - gdb_regs[DBG_REG_S10_OFF ] = task->thread.s[11 ]; + gdb_regs[DBG_REG_S9_OFF ] = task->thread.s[9 ]; + gdb_regs[DBG_REG_S10_OFF ] = task->thread.s[10 ]; + gdb_regs[DBG_REG_S11_OFF ] = task->thread.s[11 ]; gdb_regs[DBG_REG_EPC_OFF ] = task->thread.ra; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 198/312 drm/ioc32: stop speculation on the drm_compat_ioctl path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit f8995c2df519f382525ca4bc90553ad2ec611067 upstream.
The drm compat ioctl path takes a user controlled pointer, and then dereferences it into a table of function pointers, the signature method of spectre problems. Fix this up by calling array_index_nospec() on the index to the function pointer list.
--- drivers/gpu/drm/drm_ioc32.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/drm_ioc32.c +2 -0
@@ -28,6 +28,7 @@* IN THE SOFTWARE. */ #include <linux/compat.h> +#include <linux/nospec.h> #include <linux/ratelimit.h> #include <linux/export.h>
@@ -982,6 +983,7 @@ long drm_compat_ioctl(struct file *filp,if (nr >=ARRAY_SIZE (drm_compat_ioctls))return drm_ioctl (filp, cmd, arg); + nr =array_index_nospec (nr,ARRAY_SIZE (drm_compat_ioctls)); fn = drm_compat_ioctls[nr].fn;if (!fn)return drm_ioctl (filp, cmd, arg);
Greg Kroah-Hartman
maintainerPATCH 199/312 wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yasuaki Torimaru <[email protected]>
commit d049e56b1739101d1c4d81deedb269c52a8dbba0 upstream.
The variable valuesize is declared as u8 but accumulates the total length of all SSIDs to scan. Each SSID contributes up to 33 bytes (IEEE80211_MAX_SSID_LEN + 1), and with WILC_MAX_NUM_PROBED_SSID (10) SSIDs the total can reach 330, which wraps around to 74 when stored in a u8.
This causes kmalloc to allocate only 75 bytes while the subsequent memcpy writes up to 331 bytes into the buffer, resulting in a 256-byte heap buffer overflow.
Widen valuesize from u8 to u32 to accommodate the full range.
--- drivers/net/wireless/microchip/wilc1000/hif.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/microchip/wilc1000/hif.c +1 -1
@@ -162,7 +162,7 @@ int wilc_scan(struct wilc_vif *vif, u8 su32 index =0 ;u32 i, scan_timeout;u8 *buffer; -u8 valuesize =0 ; +u32 valuesize =0 ;u8 *search_ssid_vals =NULL ;struct host_if_drv *hif_drv = vif->hif_drv;
Greg Kroah-Hartman
maintainerPATCH 200/312 wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Velichayshiy <[email protected]>
commit 744fabc338e87b95c4d1ff7c95bc8c0f834c6d99 upstream.
The memcpy function assumes the dynamic array notif->matches is at least as large as the number of bytes to copy. Otherwise, results->matches may contain unwanted data. To guarantee safety, extend the validation in one of the checks to ensure sufficient packet length.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/d3.c +1 -1
@@ -2678,7 +2678,7 @@ static void iwl_mvm_nd_match_info_handleif (IS_ERR_OR_NULL (vif))return ; -if (len <sizeof (struct iwl_scan_offload_match_info )) { +if (len <sizeof (struct iwl_scan_offload_match_info ) + matches_len) {IWL_ERR (mvm,"Invalid scan match info notification\n" );return ; }
Greg Kroah-Hartman
maintainerPATCH 201/312 USB: serial: option: add MeiG Smart SRM825WN
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ernestas Kulik <[email protected]>
commit e8d0ed37bd51da52da6225d278e330c2f18a6198 upstream.
Add support for the SDX62-based MeiG Smart SRM825WN module.
If#= 0: RNDIS
If#= 1: RNDIS
If#= 2: Diag
If#= 3: AT
If#= 4: AT
If#= 5: NMEA
T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 19 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2dee ProdID=4d38 Rev= 5.04 S: Manufacturer=MEIG S: Product=LTE-A Module S: SerialNumber=da47a175
C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA
A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03
I:* If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host
E: Ad=81(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/serial/option.c +3 -0
@@ -2441,6 +2441,9 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x30) }, /* MeiG Smart SRM815 and SRM825L */ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x40) }, /* MeiG Smart SRM825L */ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x60) }, /* MeiG Smart SRM825L */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d38, 0xff, 0xff, 0x30) }, /* MeiG Smart SRM825WN (Diag) */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d38, 0xff, 0xff, 0x40) }, /* MeiG Smart SRM825WN (AT) */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d38, 0xff, 0xff, 0x60) }, /* MeiG Smart SRM825WN (NMEA) */ { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */
Greg Kroah-Hartman
maintainerPATCH 202/312 ALSA: caiaq: fix stack out-of-bounds read in init_card
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Berk Cem Goksel <[email protected]>
commit 45424e871abf2a152e247a9cff78359f18dd95c0 upstream.
The loop creates a whitespace-stripped copy of the card shortname where len < sizeof(card->id) is used for the bounds check. Since sizeof(card->id) is 16 and the local id buffer is also 16 bytes, writing 16 non-space characters fills the entire buffer, overwriting the terminating nullbyte.
When this non-null-terminated string is later passed to snd_card_set_id() -> copy_valid_id_string(), the function scans forward with while (*nid && ...) and reads past the end of the stack buffer, reading the contents of the stack.
A USB device with a product name containing many non-ASCII, non-space characters (e.g. multibyte UTF-8) will reliably trigger this as follows:
BUG: KASAN: stack-out-of-bounds in copy_valid_id_string
sound/core/init.c:696 [inline]
BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c
sound/core/init.c:718The off-by-one has been present since commit bafeee5b1f8d ("ALSA:snd_usb_caiaq: give better shortname") from June 2009 (v2.6.31-rc1), which first introduced this whitespace-stripping loop. The original code never accounted for the null terminator when bounding the copy.
Fix this by changing the loop bound to sizeof(card->id) - 1, ensuring at least one byte remains as the null terminator.
--- sound/usb/caiaq/device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/caiaq/device.c +1 -1
@@ -488,7 +488,7 @@ static int init_card(struct snd_usb_caiamemset (id,0 ,sizeof (id));for (c = card->shortname, len =0 ; - *c && len <sizeof (card->id); c++) + *c && len <sizeof (card->id) -1 ; c++)if (*c !=' ' ) id[len++] = *c;
Greg Kroah-Hartman
maintainerPATCH 203/312 ALSA: ctxfi: Fix missing SPDIFI1 index handling
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit b045ab3dff97edae6d538eeff900a34c098761f8 upstream.
SPDIF1 DAIO type isn't properly handled in daio_device_index() for hw20k2, and it returned -EINVAL, which ended up with the out-of-bounds array access. Follow the hw20k1 pattern and return the proper index for this type, too.
--- sound/pci/ctxfi/ctdaio.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/ctxfi/ctdaio.c +1 -0
@@ -119,6 +119,7 @@ static unsigned int daio_device_index(enswitch (type) {case SPDIFOO :return 0 ;case SPDIFIO :return 0 ; +case SPDIFI1 :return 1 ;case LINEO1 :return 4 ;case LINEO2 :return 7 ;case LINEO3 :return 5 ;
Greg Kroah-Hartman
maintainerPATCH 204/312 Bluetooth: SMP: derive legacy responder STK authentication from MITM state
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleh Konko <[email protected]>
commit 20756fec2f0108cb88e815941f1ffff88dc286fe upstream.
The legacy responder path in smp_random() currently labels the stored STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH. That reflects what the local service requested, not what the pairing flow actually achieved.
For Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear and the resulting STK should remain unauthenticated even if the local side requested HIGH security. Use the established MITM state when storing the responder STK so the key metadata matches the pairing result.
This also keeps the legacy path aligned with the Secure Connections code, which already treats JUST_WORKS/JUST_CFM as unauthenticated.
--- net/bluetooth/smp.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
net/bluetooth/smp.c +1 -4
@@ -1017,10 +1017,7 @@ static u8 smp_random(struct smp_chan *smsmp_s1 (smp->tk, smp->prnd, smp->rrnd, stk); -if (hcon->pending_sec_level ==BT_SECURITY_HIGH ) - auth =1 ; -else - auth =0 ; + auth =test_bit (SMP_FLAG_MITM_AUTH , &smp->flags) ?1 :0 ;/* Even though there's no _RESPONDER suffix this is the * responder STK we're adding for later lookup (the initiator
Greg Kroah-Hartman
maintainerPATCH 205/312 Bluetooth: SMP: force responder MITM requirements before building the pairing response
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleh Konko <[email protected]>
commit d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7 upstream.
smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires MITM.
tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method selection inconsistent with the pairing policy the responder already enforces.
When the local side requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later method selection aligned.
--- net/bluetooth/smp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/bluetooth/smp.c +5 -1
@@ -1817,7 +1817,7 @@ static u8 smp_cmd_pairing_req(struct l2cif (sec_level > conn->hcon->pending_sec_level) conn->hcon->pending_sec_level = sec_level; -/* If we need MITM check that it can be achieved */ +/* If we need MITM check that it can be achieved. */ if (conn->hcon->pending_sec_level >=BT_SECURITY_HIGH ) {u8 method;
@@ -1825,6 +1825,10 @@ static u8 smp_cmd_pairing_req(struct l2c req->io_capability);if (method ==JUST_WORKS || method ==JUST_CFM )return SMP_AUTH_REQUIREMENTS ; + +/* Force MITM bit if it isn't set by the initiator. */ + auth |=SMP_AUTH_MITM ; + rsp.auth_req |=SMP_AUTH_MITM ; } key_size =min (req->max_key_size, rsp.max_key_size);
Greg Kroah-Hartman
maintainerPATCH 206/312 MIPS: Fix the GCC version check for `__multi3 workaround
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit ec8bf18814915460d9c617b556bf024efef26613 upstream.
It was only GCC 10 that fixed a MIPS64r6 code generation issue with a `__multi3' libcall inefficiently produced to perform 64-bit widening multiplication while suitable machine instructions exist to do such a calculation. The fix went in with GCC commit 48b2123f6336 ("re PR target/82981 (unnecessary __multi3 call for mips64r6 linux kernel)").
Adjust our code accordingly, removing build failures such as:
mips64-linux-ld: lib/math/div64.o: in function `mul_u64_add_u64_div_u64':
div64.c:(.text+0x84): undefined reference to `__multi3'
with the GCC versions affected.
--- arch/mips/lib/multi3.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/mips/lib/multi3.c +3 -3
@@ -4,12 +4,12 @@#include "libgcc.h" /* -* GCC 7 & older can suboptimally generate __multi3 calls for mips64r6, so for +* GCC 9 & older can suboptimally generate __multi3 calls for mips64r6, so for * that specific case only we implement that intrinsic here. * * See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82981 */ -#if defined(CONFIG_64BIT ) && defined(CONFIG_CPU_MIPSR6 ) && (__GNUC__ <8 ) +#if defined(CONFIG_64BIT ) && defined(CONFIG_CPU_MIPSR6 ) && (__GNUC__ <10 )/* multiply 64-bit values, low 64-bits returned */ static inline long long notrace dmulu (long long a,long long b)
@@ -51,4 +51,4 @@ ti_type notrace __multi3(ti_type a, ti_t }EXPORT_SYMBOL (__multi3); -#endif /* 64BIT && CPU_MIPSR6 && GCC7 */ +#endif /* 64BIT && CPU_MIPSR6 && GCC9 */
Greg Kroah-Hartman
maintainerPATCH 207/312 hwmon: (occ) Fix division by zero in occ_show_power_1()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
commit 39e2a5bf970402a8530a319cf06122e216ba57b8 upstream.
In occ_show_power_1() case 1, the accumulator is divided by update_tag without checking for zero. If no samples have been collected yet (e.g. during early boot when the sensor block is included but hasn't been updated), update_tag is zero, causing a kernel divide-by-zero crash.
The 2019 fix in commit 211186cae14d ("hwmon: (occ) Fix division by zero issue") only addressed occ_get_powr_avg() used by occ_show_power_2() and occ_show_power_a0(). This separate code path in occ_show_power_1() was missed.
Fix this by reusing the existing occ_get_powr_avg() helper, which already handles the zero-sample case and uses mul_u64_u32_div() to multiply before dividing for better precision. Move the helper above occ_show_power_1() so it is visible at the call site.
--- drivers/hwmon/occ/common.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-)
drivers/hwmon/occ/common.c +8 -9
@@ -420,6 +420,12 @@ static ssize_t occ_show_freq_2(struct dereturn sysfs_emit (buf,"%u\n" , val); } +static u64 occ_get_powr_avg (u64 accum,u32 samples) +{ +return (samples ==0 ) ?0 : +mul_u64_u32_div (accum,1000000UL , samples); +} +static ssize_t occ_show_power_1 (struct device *dev,struct device_attribute *attr,char *buf) {
@@ -441,9 +447,8 @@ static ssize_t occ_show_power_1(struct d val =get_unaligned_be16 (&power->sensor_id);break ;case 1 : - val =get_unaligned_be32 (&power->accumulator) / -get_unaligned_be32 (&power->update_tag); - val *=1000000ULL ; + val =occ_get_powr_avg (get_unaligned_be32 (&power->accumulator), +get_unaligned_be32 (&power->update_tag));break ;case 2 : val = (u64)get_unaligned_be32(&power->update_tag) *
@@ -459,12 +464,6 @@ static ssize_t occ_show_power_1(struct dreturn sysfs_emit (buf,"%llu\n" , val); } -static u64 occ_get_powr_avg (u64 accum,u32 samples) -{ -return (samples ==0 ) ?0 : -mul_u64_u32_div (accum,1000000UL , samples); -} -static ssize_t occ_show_power_2 (struct device *dev,struct device_attribute *attr,char *buf) {
Greg Kroah-Hartman
maintainerPATCH 208/312 mips: mm: Allocate tlb_vpn array atomically
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wiehler <[email protected]>
commit 01cc50ea5167bb14117257ec084637abe9e5f691 upstream.
Found by DEBUG_ATOMIC_SLEEP:
BUG: sleeping function called from invalid context at /include/linux/sched/mm.h:306
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
no locks held by swapper/1/0.
irq event stamp: 0
hardirqs last enabled at (0): [<0000000000000000>] 0x0
hardirqs last disabled at (0): [<ffffffff801477fc>] copy_process+0x75c/0x1b68
softirqs last enabled at (0): [<ffffffff801477fc>] copy_process+0x75c/0x1b68
softirqs last disabled at (0): [<0000000000000000>] 0x0
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.6.119-d79e757675ec-fct #1
Stack : 800000000290bad8 0000000000000000 0000000000000008 800000000290bae8
800000000290bae8 800000000290bc78 0000000000000000 0000000000000000
ffffffff80c80000 0000000000000001 ffffffff80d8dee8 ffffffff810d09c0
784bb2a7ec10647d 0000000000000010 ffffffff80a6fd60 8000000001d8a9c0
0000000000000000 0000000000000000 ffffffff80d90000 0000000000000000
ffffffff80c9e0e8 0000000007ffffff 0000000000000cc0 0000000000000400
ffffffffffffffff 0000000000000001 0000000000000002 ffffffffc0149ed8
fffffffffffffffe 8000000002908000 800000000290bae0 ffffffff80a81b74
ffffffff80129fb0 0000000000000000 0000000000000000 0000000000000000
0000000000000000 0000000000000000 ffffffff80129fd0 0000000000000000
...
Call Trace:
[<ffffffff80129fd0>] show_stack+0x60/0x158
[<ffffffff80a7f894>] dump_stack_lvl+0x88/0xbc
[<ffffffff8018d3c8>] __might_resched+0x268/0x288
[<ffffffff803648b0>] __kmem_cache_alloc_node+0x2e0/0x330
[<ffffffff80302788>] __kmalloc+0x58/0xd0
[<ffffffff80a81b74>] r4k_tlb_uniquify+0x7c/0x428
[<ffffffff80143e8c>] tlb_init+0x7c/0x110
[<ffffffff8012bdb4>] per_cpu_trap_init+0x16c/0x1d0
[<ffffffff80133258>] start_secondary+0x28/0x128--- arch/mips/mm/tlb-r4k.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/mm/tlb-r4k.c +1 -1
@@ -528,7 +528,7 @@ static void __ref r4k_tlb_uniquify(void) tlb_vpn_size = tlbsize *sizeof (*tlb_vpns); tlb_vpns = (use_slab ? -kmalloc (tlb_vpn_size,GFP_KERNEL ) : +kmalloc (tlb_vpn_size,GFP_ATOMIC ) :memblock_alloc_raw (tlb_vpn_size,sizeof (*tlb_vpns)));if (WARN_ON (!tlb_vpns))return ;/* Pray local_flush_tlb_all() is good enough. */
Greg Kroah-Hartman
maintainerPATCH 209/312 iio: adc: ti-adc161s626: fix buffer read on big-endian
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
commit 24869650dff34a6fc8fd1cc91b2058a72f9abc95 upstream.
Rework ti_adc_trigger_handler() to properly handle data on big-endian architectures. The scan data format is 16-bit CPU-endian, so we can't cast it to a int * on big-endian and expect it to work. Instead, we introduce a local int variable to read the data into, and then copy it to the buffer.
Since the buffer isn't passed to any SPI functions, we don't need it to be DMA-safe. So we can drop it from the driver data struct and just use stack memory for the scan data.
Since there is only one data value (plus timestamp), we don't need an array and can just declare a struct with the correct data type instead.
Also fix alignment of iio_get_time_ns() to ( while we are touching this.
--- drivers/iio/adc/ti-adc161s626.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
drivers/iio/adc/ti-adc161s626.c +12 -9
@@ -70,8 +70,6 @@ struct ti_adc_data {u8 read_size;u8 shift; - -u8 buffer[16 ]__aligned(IIO_DMA_MINALIGN) ; }; static int ti_adc_read_measurement(struct ti_adc_data *data,
@@ -114,15 +112,20 @@ static irqreturn_t ti_adc_trigger_handlestruct iio_poll_func *pf = private;struct iio_dev *indio_dev = pf->indio_dev;struct ti_adc_data *data =iio_priv (indio_dev); -int ret; +struct { +s16 data; +aligned_s64 timestamp; + } scan = { }; +int ret, val; + + ret =ti_adc_read_measurement (data, &indio_dev->channels[0 ], &val); +if (ret) + goto exit_notify_done; - ret =ti_adc_read_measurement (data, &indio_dev->channels[0 ], - (int *) &data->buffer); -if (!ret) -iio_push_to_buffers_with_timestamp (indio_dev, - data->buffer, -iio_get_time_ns (indio_dev)); + scan.data = val; +iio_push_to_buffers_with_timestamp (indio_dev, &scan,iio_get_time_ns (indio_dev)); + exit_notify_done:iio_trigger_notify_done (indio_dev->trig);return IRQ_HANDLED ;
Greg Kroah-Hartman
maintainerPATCH 210/312 drm/ast: dp501: Fix initialization of SCU2C
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit 2f42c1a6161646cbd29b443459fd635d29eda634 upstream.
Ast's DP501 initialization reads the register SCU2C at offset 0x1202c and tries to set it to source data from VGA. But writes the update to offset 0x0, with unknown results. Write the result to SCU instead.
The bug only happens in ast_init_analog(). There's similar code in ast_init_dvo(), which works correctly.
--- drivers/gpu/drm/ast/ast_dp501.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/ast/ast_dp501.c +1 -1
@@ -426,7 +426,7 @@ static void ast_init_analog(struct drm_d/* Finally, clear bits [17:16] of SCU2c */ data =ast_read32 (ast,0x1202c ); data &=0xfffcffff ; -ast_write32 (ast,0 , data); +ast_write32 (ast,0x1202c , data);/* Disable DVO */ ast_set_index_reg_mask (ast,AST_IO_CRTC_PORT ,0xa3 ,0xcf ,0x00 );
Greg Kroah-Hartman
maintainerPATCH 211/312 USB: serial: io_edgeport: add support for Blackbox IC135A
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frej Drejhammar <[email protected]>
commit 0e01c3416eb863ee7f156a9d7e7421ec0a9f68a0 upstream.
The Blackbox 724-746-5500 USB Director USB-RS-232 HUB, part number IC135A, is a rebadged Edgeport/4 with its own USB device id.
--- drivers/usb/serial/io_edgeport.c | 3 +++ drivers/usb/serial/io_usbvend.h | 1 + 2 files changed, 4 insertions(+)
drivers/usb/serial/io_edgeport.c +3 -0
@@ -73,6 +73,7 @@ static const struct usb_device_id edgepo { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_EDGEPORT_22I) }, { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_EDGEPORT_412_4) }, { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_EDGEPORT_COMPATIBLE) }, + { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_BLACKBOX_IC135A) }, { } };
@@ -121,6 +122,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_EDGEPORT_8R) }, { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_EDGEPORT_8RR) }, { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_EDGEPORT_412_8) }, + { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_BLACKBOX_IC135A) }, { USB_DEVICE(USB_VENDOR_ID_NCR, NCR_DEVICE_ID_EPIC_0202) }, { USB_DEVICE(USB_VENDOR_ID_NCR, NCR_DEVICE_ID_EPIC_0203) }, { USB_DEVICE(USB_VENDOR_ID_NCR, NCR_DEVICE_ID_EPIC_0310) },
@@ -470,6 +472,7 @@ static void get_product_info(struct edgecase ION_DEVICE_ID_EDGEPORT_2_DIN :case ION_DEVICE_ID_EDGEPORT_4_DIN :case ION_DEVICE_ID_EDGEPORT_16_DUAL_CPU : +case ION_DEVICE_ID_BLACKBOX_IC135A : product_info->IsRS232 =1 ;break ;
drivers/usb/serial/io_usbvend.h +1 -0
@@ -211,6 +211,7 @@// // Definitions for other product IDs +#define ION_DEVICE_ID_BLACKBOX_IC135A 0x0801 // OEM device (rebranded Edgeport/4)#define ION_DEVICE_ID_MT4X56USB 0x1403 // OEM device#define ION_DEVICE_ID_E5805A 0x1A01 // OEM device (rebranded Edgeport/4)
Greg Kroah-Hartman
maintainerPATCH 212/312 USB: serial: option: add support for Rolling Wireless RW135R-GL
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wanquan Zhong <[email protected]>
commit 01e8d0f742222f1e68f48180d5480097adf7ae9f upstream.
Add VID/PID 33f8:1003 for the Rolling Wireless RW135R-GL M.2 module, which is used in laptop debug cards with MBIM interface for Linux/Chrome OS. The device supports mbim, pipe functionalities.
Here are the outputs of usb-devices:
T: Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=33f8 ProdID=1003 Rev=05.15 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling RW135R-GL Module S: SerialNumber=12345678 C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
--- drivers/usb/serial/option.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/option.c +1 -0
@@ -2464,6 +2464,7 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0302, 0xff) }, /* Rolling RW101R-GL (laptop MBIM) */ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0802, 0xff), /* Rolling RW350-GL (laptop MBIM) */ .driver_info = RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x1003, 0xff) }, /* Rolling RW135R-GL (laptop MBIM) */ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0x00, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 213/312 USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: JP Hein <[email protected]>
commit 8b7a42ecdcdeb55580d9345412f7f8fc5aca3f6c upstream.
The Razer Kiyo Pro (1532:0e05) is a USB 3.0 UVC webcam whose firmware does not handle USB Link Power Management transitions reliably. When LPM is active, the device can enter a state where it fails to respond to control transfers, producing EPIPE (-32) errors on UVC probe control SET_CUR requests. In the worst case, the stalled endpoint triggers an xHCI stop-endpoint command that times out, causing the host controller to be declared dead and every USB device on the bus to be disconnected.
This has been reported as Ubuntu Launchpad Bug #2061177. The failure mode is:
1. UVC probe control SET_CUR returns -32 (EPIPE)
2. xHCI host not responding to stop endpoint command
3. xHCI host controller not responding, assume dead
4. All USB devices on the affected xHCI controller disconnect
Disabling LPM prevents the firmware from entering the problematic low- power states that precede the stall. This is the same approach used for other webcams with similar firmware issues (e.g., Logitech HD Webcam C270).
--- drivers/usb/core/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/core/quirks.c +2 -0
@@ -490,6 +490,8 @@ static const struct usb_device_id usb_qu/* Razer - Razer Blade Keyboard */ { USB_DEVICE(0x1532, 0x0116), .driver_info = USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, + /* Razer - Razer Kiyo Pro Webcam */ + { USB_DEVICE(0x1532, 0x0e05), .driver_info = USB_QUIRK_NO_LPM }, /* Lenovo ThinkPad OneLink+ Dock twin hub controllers (VIA Labs VL812) */ { USB_DEVICE(0x17ef, 0x1018), .driver_info = USB_QUIRK_RESET_RESUME },
Greg Kroah-Hartman
maintainerPATCH 214/312 iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
commit 768461517a28d80fe81ea4d5d03a90cd184ea6ad upstream.
Add a DMA-safe buffer and use it for spi_read() instead of a stack memory. All SPI buffers must be DMA-safe.
Since we only need up to 3 bytes, we just use a u8[] instead of __be16 and __be32 and change the conversion functions appropriately.
--- drivers/iio/adc/ti-adc161s626.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-)
drivers/iio/adc/ti-adc161s626.c +8 -12
@@ -15,6 +15,7 @@#include <linux/init.h> #include <linux/err.h> #include <linux/spi/spi.h> +#include <asm/unaligned.h> #include <linux/iio/iio.h> #include <linux/iio/trigger.h> #include <linux/iio/buffer.h>
@@ -70,6 +71,7 @@ struct ti_adc_data {u8 read_size;u8 shift; +u8 buf[3 ]__aligned(IIO_DMA_MINALIGN) ; }; static int ti_adc_read_measurement(struct ti_adc_data *data,
@@ -78,26 +80,20 @@ static int ti_adc_read_measurement(strucint ret;switch (data->read_size) { -case 2 : { -__be16 buf; - - ret =spi_read (data->spi, (void *) &buf,2 ); +case 2 : + ret =spi_read (data->spi, data->buf,2 );if (ret)return ret; - *val =be16_to_cpu (buf); + *val =get_unaligned_be16 (data->buf);break ; - } -case 3 : { -__be32 buf; - - ret =spi_read (data->spi, (void *) &buf,3 ); +case 3 : + ret =spi_read (data->spi, data->buf,3 );if (ret)return ret; - *val =be32_to_cpu (buf) >>8 ; + *val =get_unaligned_be24 (data->buf);break ; - }default :return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 215/312 Input: synaptics-rmi4 - fix a locking bug in an error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 7adaaee5edd35a423ae199c41b86bd1ed60ed483 upstream.
Lock f54->data_mutex when entering the function statement since jumping to the 'error' label when checking report_size fails causes that mutex to be unlocked.
This bug has been detected by the Clang thread-safety checker.
--- drivers/input/rmi4/rmi_f54.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/input/rmi4/rmi_f54.c +2 -2
@@ -540,6 +540,8 @@ static void rmi_f54_work(struct work_strint error;int i; +mutex_lock (&f54->data_mutex); + report_size =rmi_f54_get_report_size (f54);if (report_size ==0 ) { dev_err(&fn->dev, "Bad report size, report type=%d\n",
@@ -548,8 +550,6 @@ static void rmi_f54_work(struct work_str goto error;/* retry won't help */ } -mutex_lock (&f54->data_mutex); -/* * Need to check if command has completed. * If not try again later.
Greg Kroah-Hartman
maintainerPATCH 216/312 Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoffer Sandberg <[email protected]>
commit 5839419cffc7788a356428d321e3ec18055c0286 upstream.
The device occasionally wakes up from suspend with missing input on the internal keyboard and the following suspend attempt results in an instant wake-up. The quirks fix both issues for this device.
--- drivers/input/serio/i8042-acpipnpio.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/i8042-acpipnpio.h +7 -0
@@ -1189,6 +1189,13 @@ static const struct dmi_system_id i8042_ }, { .matches = { + DMI_MATCH(DMI_BOARD_NAME, "X6KK45xU_X6SP45xU"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX |SERIO_QUIRK_RESET_ALWAYS | +SERIO_QUIRK_NOLOOP |SERIO_QUIRK_NOPNP ) + }, + { + .matches = { DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"), }, .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
Greg Kroah-Hartman
maintainerPATCH 217/312 Input: xpad - add support for Razer Wolverine V3 Pro
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zoltan Illes <[email protected]>
commit e2b0ae529db4766584e77647cefe3ec15c3d842e upstream.
Add device IDs for the Razer Wolverine V3 Pro controller in both wired (0x0a57) and wireless 2.4 GHz dongle (0x0a59) modes.
The controller uses the Xbox 360 protocol (vendor-specific class, subclass 93, protocol 1) on interface 0 with an identical 20-byte input report layout, so no additional processing is needed.
--- drivers/input/joystick/xpad.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/input/joystick/xpad.c +2 -0
@@ -289,6 +289,8 @@ static const struct xpad_device { { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE }, { 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE }, + { 0x1532, 0x0a57, "Razer Wolverine V3 Pro (Wired)", 0, XTYPE_XBOX360 }, + { 0x1532, 0x0a59, "Razer Wolverine V3 Pro (2.4 GHz Dongle)", 0, XTYPE_XBOX360 }, { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 }, { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 },
Greg Kroah-Hartman
maintainerPATCH 218/312 iio: accel: fix ADXL355 temperature signature value
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valek Andrej <[email protected]>
commit 4f51e6c0baae80e52bd013092e82a55678be31fc upstream.
Temperature was wrongly represented as 12-bit signed, confirmed by checking the datasheet. Even if the temperature is negative, the value in the register stays unsigned.
--- drivers/iio/accel/adxl355_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/accel/adxl355_core.c +1 -1
@@ -699,7 +699,7 @@ static const struct iio_chan_spec adxl35BIT (IIO_CHAN_INFO_OFFSET ), .scan_index = 3, .scan_type = { - .sign ='s' , + .sign ='u' , .realbits =12 , .storagebits =16 , .endianness =IIO_BE ,
Greg Kroah-Hartman
maintainerPATCH 219/312 iio: dac: ad5770r: fix error return in ad5770r_read_raw()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoniu Miclaus <[email protected]>
commit c354521708175d776d896f8bdae44b18711eccb6 upstream.
Return the error code from regmap_bulk_read() instead of 0 so that I/O failures are properly propagated.
--- drivers/iio/dac/ad5770r.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/dac/ad5770r.c +1 -1
@@ -323,7 +323,7 @@ static int ad5770r_read_raw(struct iio_d chan->address, st->transf_buf, 2);if (ret) -return 0 ; +return ret; buf16 = st->transf_buf[0 ] + (st->transf_buf[1 ] <<8 ); *val = buf16 >>2 ;
Greg Kroah-Hartman
maintainerPATCH 220/312 iio: light: vcnl4035: fix scan buffer on big-endian
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
commit fdc7aa54a5d44c05880a4aad7cfb41aacfd16d7b upstream.
Rework vcnl4035_trigger_consumer_handler() so that we are not passing what should be a u16 value as an int * to regmap_read(). This won't work on bit endian systems.
Instead, add a new unsigned int variable to pass to regmap_read(). Then copy that value into the buffer struct.
The buffer array is replaced with a struct since there is only one value being read. This allows us to use the correct u16 data type and has a side-effect of simplifying the alignment specification.
Also fix the endianness of the scan format from little-endian to CPU endianness. Since we are using regmap to read the value, it will be CPU-endian.
--- drivers/iio/light/vcnl4035.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/iio/light/vcnl4035.c +12 -6
@@ -105,17 +105,23 @@ static irqreturn_t vcnl4035_trigger_consstruct iio_dev *indio_dev = pf->indio_dev;struct vcnl4035_data *data =iio_priv (indio_dev);/* Ensure naturally aligned timestamp */ -u8 buffer[ALIGN (sizeof (u16),sizeof (s64)) +sizeof (s64)]__aligned(8) = { }; +struct { +u16 als_data; +aligned_s64 timestamp; + } buffer = { }; +unsigned int val;int ret; - ret =regmap_read (data->regmap,VCNL4035_ALS_DATA , (int *)buffer); + ret =regmap_read (data->regmap,VCNL4035_ALS_DATA , &val);if (ret <0 ) {dev_err (&data->client->dev,"Trigger consumer can't read from sensor.\n" ); goto fail_read; } -iio_push_to_buffers_with_timestamp (indio_dev, buffer, -iio_get_time_ns (indio_dev)); + + buffer.als_data = val; +iio_push_to_buffers_with_timestamp (indio_dev, &buffer, +iio_get_time_ns (indio_dev)); fail_read:iio_trigger_notify_done (indio_dev->trig);
@@ -378,7 +384,7 @@ static const struct iio_chan_spec vcnl40 .sign = 'u', .realbits = 16, .storagebits = 16, - .endianness = IIO_LE, + .endianness = IIO_CPU, }, }, {
@@ -392,7 +398,7 @@ static const struct iio_chan_spec vcnl40 .sign = 'u', .realbits = 16, .storagebits = 16, - .endianness = IIO_LE, + .endianness = IIO_CPU, }, }, };
Greg Kroah-Hartman
maintainerPATCH 221/312 iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
commit c05a87d9ec3bf8727a5d746ce855003c6f2f8bb4 upstream.
If 'pin' is not one of its expected values, the value of 'int_out_ctrl_shift' is undefined. With UBSAN enabled, this causes Clang to generate undefined behavior, resulting in the following warning:
drivers/iio/imu/bmi160/bmi160_core.o: warning: objtool: bmi160_setup_irq() falls through to next function __cfi_bmi160_core_runtime_resume()
Prevent the UB and improve error handling by returning an error if 'pin' has an unexpected value.
While at it, simplify the code a bit by moving the 'pin_name' assignment to the first switch statement.
--- drivers/iio/imu/bmi160/bmi160_core.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-)
drivers/iio/imu/bmi160/bmi160_core.c +5 -10
@@ -568,12 +568,16 @@ static int bmi160_config_pin(struct regm int_out_ctrl_shift =BMI160_INT1_OUT_CTRL_SHIFT ; int_latch_mask =BMI160_INT1_LATCH_MASK ; int_map_mask =BMI160_INT1_MAP_DRDY_EN ; + pin_name ="INT1" ;break ;case BMI160_PIN_INT2 : int_out_ctrl_shift =BMI160_INT2_OUT_CTRL_SHIFT ; int_latch_mask =BMI160_INT2_LATCH_MASK ; int_map_mask =BMI160_INT2_MAP_DRDY_EN ; + pin_name ="INT2" ;break ; +default : +return -EINVAL ; } int_out_ctrl_mask =BMI160_INT_OUT_CTRL_MASK << int_out_ctrl_shift;
@@ -607,17 +611,8 @@ static int bmi160_config_pin(struct regm ret =bmi160_write_conf_reg (regmap,BMI160_REG_INT_MAP , int_map_mask, int_map_mask, write_usleep); -if (ret) { -switch (pin) { -case BMI160_PIN_INT1 : - pin_name ="INT1" ; -break ; -case BMI160_PIN_INT2 : - pin_name ="INT2" ; -break ; - } +if (ret)dev_err (dev,"Failed to configure %s IRQ pin" , pin_name); - }return ret; }
Greg Kroah-Hartman
maintainerPATCH 222/312 iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <[email protected]>
commit 630748afa7030b272b7bee5df857e7bcf132ed51 upstream.
The st_lsm6dsx_set_fifo_odr() function, which is called when enabling and disabling the hardware FIFO, checks the contents of the hw->settings->batch array at index sensor->id, and then sets the current ODR value in sensor registers that depend on whether the register address is set in the above array element. This logic is valid for internal sensors only, i.e. the accelerometer and gyroscope; however, since commit c91c1c844ebd ("iio: imu:st_lsm6dsx: add i2c embedded controller support"), this function is called also when configuring the hardware FIFO for external sensors (i.e. sensors accessed through the sensor hub functionality), which can result in unrelated device registers being written.
Add a check to the beginning of st_lsm6dsx_set_fifo_odr() so that it does not touch any registers unless it is called for internal sensors.
--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c +4 -0
@@ -202,6 +202,10 @@ static int st_lsm6dsx_set_fifo_odr(strucconst struct st_lsm6dsx_reg *batch_reg;u8 data; +/* Only internal sensors have a FIFO ODR configuration register. */ +if (sensor->id >=ARRAY_SIZE (hw->settings->batch)) +return 0 ; + batch_reg = &hw->settings->batch[sensor->id];if (batch_reg->addr) {int val;
Greg Kroah-Hartman
maintainerPATCH 223/312 iio: gyro: mpu3050: Fix incorrect free_irq() variable
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Tidmore <[email protected]>
commit edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6 upstream.
The handler for the IRQ part of this driver is mpu3050->trig but, in the teardown free_irq() is called with handler mpu3050.
Use correct IRQ handler when calling free_irq().
--- drivers/iio/gyro/mpu3050-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/gyro/mpu3050-core.c +1 -1
@@ -1279,7 +1279,7 @@ void mpu3050_common_remove(struct devicepm_runtime_disable (dev);iio_triggered_buffer_cleanup (indio_dev);if (mpu3050->irq) -free_irq (mpu3050->irq, mpu3050); +free_irq (mpu3050->irq, mpu3050->trig);iio_device_unregister (indio_dev);mpu3050_power_down (mpu3050); }
Greg Kroah-Hartman
maintainerPATCH 224/312 iio: gyro: mpu3050: Fix irq resource leak
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Tidmore <[email protected]>
commit 4216db1043a3be72ef9c2b7b9f393d7fa72496e6 upstream.
The interrupt handler is setup but only a few lines down if iio_trigger_register() fails the function returns without properly releasing the handler.
Add cleanup goto to resolve resource leak.
Detected by Smatch:drivers/iio/gyro/mpu3050-core.c:1128 mpu3050_trigger_probe() warn:
'irq' from request_threaded_irq() not released on lines: 1124.
--- drivers/iio/gyro/mpu3050-core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/iio/gyro/mpu3050-core.c +6 -1
@@ -1139,11 +1139,16 @@ static int mpu3050_trigger_probe(struct ret =iio_trigger_register (mpu3050->trig);if (ret) -return ret; + goto err_iio_trigger; indio_dev->trig =iio_trigger_get (mpu3050->trig);return 0 ; + +err_iio_trigger: +free_irq (mpu3050->irq, mpu3050->trig); + +return ret; } int mpu3050_common_probe(struct device *dev,
Greg Kroah-Hartman
maintainerPATCH 225/312 iio: gyro: mpu3050: Move iio_device_register() to correct location
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Tidmore <[email protected]>
commit 4c05799449108fb0e0a6bd30e65fffc71e60db4d upstream.
iio_device_register() should be at the end of the probe function to prevent race conditions.
Place iio_device_register() at the end of the probe function and place iio_device_unregister() accordingly.
--- drivers/iio/gyro/mpu3050-core.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-)
drivers/iio/gyro/mpu3050-core.c +13 -8
@@ -1236,12 +1236,6 @@ int mpu3050_common_probe(struct device * goto err_power_down; } - ret =iio_device_register (indio_dev); -if (ret) { -dev_err (dev,"device register failed\n" ); - goto err_cleanup_buffer; - } -dev_set_drvdata (dev, indio_dev);/* Check if we have an assigned IRQ to use as trigger */
@@ -1264,9 +1258,20 @@ int mpu3050_common_probe(struct device *pm_runtime_use_autosuspend (dev);pm_runtime_put (dev); + ret =iio_device_register (indio_dev); +if (ret) { +dev_err (dev,"device register failed\n" ); + goto err_iio_device_register; + } +return 0 ; -err_cleanup_buffer: +err_iio_device_register: +pm_runtime_get_sync (dev); +pm_runtime_put_noidle (dev); +pm_runtime_disable (dev); +if (irq) +free_irq (mpu3050->irq, mpu3050->trig);iio_triggered_buffer_cleanup (indio_dev); err_power_down:mpu3050_power_down (mpu3050);
@@ -1279,13 +1284,13 @@ void mpu3050_common_remove(struct devicestruct iio_dev *indio_dev =dev_get_drvdata (dev);struct mpu3050 *mpu3050 =iio_priv (indio_dev); +iio_device_unregister (indio_dev);pm_runtime_get_sync (dev);pm_runtime_put_noidle (dev);pm_runtime_disable (dev);iio_triggered_buffer_cleanup (indio_dev);if (mpu3050->irq)free_irq (mpu3050->irq, mpu3050->trig); -iio_device_unregister (indio_dev);mpu3050_power_down (mpu3050); }
Greg Kroah-Hartman
maintainerPATCH 226/312 iio: gyro: mpu3050: Fix out-of-sequence free_irq()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Tidmore <[email protected]>
commit d14116f6529fa085b1a1b1f224dc9604e4d2a29c upstream.
The triggered buffer is initialized before the IRQ is requested. The removal path currently calls iio_triggered_buffer_cleanup() before free_irq(). This violates the expected LIFO.
Place free_irq() in the correct location relative to iio_triggered_buffer_cleanup().
--- drivers/iio/gyro/mpu3050-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/gyro/mpu3050-core.c +1 -1
@@ -1288,9 +1288,9 @@ void mpu3050_common_remove(struct devicepm_runtime_get_sync (dev);pm_runtime_put_noidle (dev);pm_runtime_disable (dev); -iio_triggered_buffer_cleanup (indio_dev);if (mpu3050->irq)free_irq (mpu3050->irq, mpu3050->trig); +iio_triggered_buffer_cleanup (indio_dev);mpu3050_power_down (mpu3050); }
Greg Kroah-Hartman
maintainerPATCH 227/312 usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miao Li <[email protected]>
commit dd36014ec6042f424ef51b923e607772f7502ee7 upstream.
Another Silicon Motion flash drive also randomly work incorrectly (lsusb does not list the device) on Huawei hisi platforms during 500 reboot cycles, and the DELAY_INIT quirk fixes this issue.
--- drivers/usb/core/quirks.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/core/quirks.c +1 -0
@@ -402,6 +402,7 @@ static const struct usb_device_id usb_qu/* Silicon Motion Flash Drive */ { USB_DEVICE(0x090c, 0x1000), .driver_info = USB_QUIRK_DELAY_INIT }, + { USB_DEVICE(0x090c, 0x2000), .driver_info = USB_QUIRK_DELAY_INIT }, /* Sound Devices USBPre2 */ { USB_DEVICE(0x0926, 0x0202), .driver_info =
Greg Kroah-Hartman
maintainerPATCH 228/312 usb: ulpi: fix double free in ulpi_register_interface() error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <[email protected]>
commit 01af542392b5d41fd659d487015a71f627accce3 upstream.
When device_register() fails, ulpi_register() calls put_device() on ulpi->dev.
The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free.
Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface().
--- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/usb/common/ulpi.c +2 -3
@@ -331,10 +331,9 @@ struct ulpi *ulpi_register_interface(str ulpi->ops = ops; ret =ulpi_register (dev, ulpi); -if (ret) { -kfree (ulpi); +if (ret)return ERR_PTR (ret); - } +return ulpi; }
Greg Kroah-Hartman
maintainerPATCH 229/312 usb: usbtmc: Flush anchored URBs in usbtmc_release
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heitor Alves de Siqueira <[email protected]>
commit 8a768552f7a8276fb9e01d49773d2094ace7c8f1 upstream.
When calling usbtmc_release, pending anchored URBs must be flushed or killed to prevent use-after-free errors (e.g. in the HCD giveback path). Call usbtmc_draw_down() to allow anchored URBs to be completed.
--- drivers/usb/class/usbtmc.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/class/usbtmc.c +3 -0
@@ -254,6 +254,9 @@ static int usbtmc_release(struct inode *list_del (&file_data->file_elem);spin_unlock_irq (&file_data->data->dev_lock); + +/* flush anchored URBs */ +usbtmc_draw_down (file_data);mutex_unlock (&file_data->data->io_mutex);kref_put (&file_data->data->kref, usbtmc_delete);
Greg Kroah-Hartman
maintainerPATCH 230/312 usb: ehci-brcm: fix sleep during atomic
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <[email protected]>
commit 679b771ea05ad0f8eeae83e14a91b8f4f39510c4 upstream.
echi_brcm_wait_for_sof() gets called after disabling interrupts in ehci_brcm_hub_control(). Use the atomic version of poll_timeout to fix the warning.
--- drivers/usb/host/ehci-brcm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/host/ehci-brcm.c +2 -2
@@ -31,8 +31,8 @@ static inline void ehci_brcm_wait_for_soint res;/* Wait for next microframe (every 125 usecs) */ - res =readl_relaxed_poll_timeout (&ehci->regs->frame_index, val, - val != frame_idx,1 ,130 ); + res =readl_relaxed_poll_timeout_atomic (&ehci->regs->frame_index, + val, val != frame_idx,1 ,130 );if (res)ehci_err (ehci,"Error waiting for SOF\n" );udelay (delay);
Greg Kroah-Hartman
maintainerPATCH 231/312 usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juno Choi <[email protected]>
commit 9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a upstream.
dwc2_gadget_exit_clock_gating() internally calls call_gadget() macro, which expects hsotg->lock to be held since it does spin_unlock/spin_lock around the gadget driver callback invocation.
However, dwc2_hsotg_udc_stop() calls dwc2_gadget_exit_clock_gating() without holding the lock. This leads to:
- spin_unlock on a lock that is not held (undefined behavior)
- The lock remaining held after dwc2_gadget_exit_clock_gating() returns, causing a deadlock when spin_lock_irqsave() is called later in the same function.
Fix this by acquiring hsotg->lock before calling dwc2_gadget_exit_clock_gating() and releasing it afterwards, which satisfies the locking requirement of the call_gadget() macro.
--- drivers/usb/dwc2/gadget.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/dwc2/gadget.c +2 -0
@@ -4605,7 +4605,9 @@ static int dwc2_hsotg_udc_stop(struct us/* Exit clock gating when driver is stopped. */ if (hsotg->params.power_down ==DWC2_POWER_DOWN_PARAM_NONE && hsotg->bus_suspended && !hsotg->params.no_clock_gating) { +spin_lock_irqsave (&hsotg->lock, flags);dwc2_gadget_exit_clock_gating (hsotg,0 ); +spin_unlock_irqrestore (&hsotg->lock, flags); }/* all endpoints should be shutdown */
Greg Kroah-Hartman
maintainerPATCH 232/312 usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongchao Wu <[email protected]>
commit 7f6f127b9bc34bed35f56faf7ecb1561d6b39000 upstream.
When the gadget endpoint is disabled or not yet configured, the ep->desc pointer can be NULL. This leads to a NULL pointer dereference when __cdns3_gadget_ep_queue() is called, causing a kernel crash.
Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the standard return code for unconfigured endpoints.
This prevents potential crashes when ep_queue is called on endpoints that are not ready.
--- drivers/usb/cdns3/cdns3-gadget.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/cdns3/cdns3-gadget.c +3 -0
@@ -2586,6 +2586,9 @@ static int __cdns3_gadget_ep_queue(strucstruct cdns3_request *priv_req;int ret =0 ; +if (!ep->desc) +return -ESHUTDOWN ; + request->actual =0 ; request->status = -EINPROGRESS ; priv_req =to_cdns3_request (request);
Greg Kroah-Hartman
maintainerPATCH 233/312 usb: cdns3: gadget: fix state inconsistency on gadget init failure
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongchao Wu <[email protected]>
commit c32f8748d70c8fc77676ad92ed76cede17bf2c48 upstream.
When cdns3_gadget_start() fails, the DRD hardware is left in gadget mode while software state remains INACTIVE, creating hardware/software state inconsistency.
When switching to host mode via sysfs:
echo host > /sys/class/usb_role/13180000.usb-role-switch/role
The role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error, so cdns_role_stop() skips cleanup because state is still INACTIVE. This violates the DRD controller design specification (Figure22), which requires returning to idle state before switching roles.
This leads to a synchronous external abort in xhci_gen_setup() when setting up the host controller:
[ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19
[ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget
[ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed
...
[ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP
[ 1301.382485] pc : xhci_gen_setup+0xa4/0x408
[ 1301.393391] backtrace:
...
xhci_gen_setup+0xa4/0x408 <-- CRASH
xhci_plat_setup+0x44/0x58
usb_add_hcd+0x284/0x678
...
cdns_role_set+0x9c/0xbc <-- Role switchFix by calling cdns_drd_gadget_off() in the error path to properly clean up the DRD gadget state.
--- drivers/usb/cdns3/cdns3-gadget.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/cdns3/cdns3-gadget.c +1 -0
@@ -3427,6 +3427,7 @@ static int __cdns3_gadget_init(struct cd ret =cdns3_gadget_start (cdns);if (ret) {pm_runtime_put_sync (cdns->dev); +cdns_drd_gadget_off (cdns);return ret; }
Greg Kroah-Hartman
maintainerPATCH 234/312 Revert "ext4: avoid infinite loops caused by residual data"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit 4fee3f2f4839571a6294946a2efcdb69caa61393.
--- fs/ext4/extents.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
fs/ext4/extents.c +2 -6
@@ -4424,13 +4424,9 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode, path =ext4_ext_insert_extent (handle, inode, path, &newex, flags);if (IS_ERR (path)) { err =PTR_ERR (path); -/* -* Gracefully handle out of space conditions. If the filesystem -* is inconsistent, we'll just leak allocated blocks to avoid -* causing even more damage. -*/ -if (allocated_clusters && (err == -EDQUOT || err == -ENOSPC )) { +if (allocated_clusters) {int fb_flags =0 ; +/* * free data blocks we just allocated. * not a good idea to call discard here directly,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 235/312 Revert "ext4: drop extent cache when splitting extent fails"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit de8e1b17e3876a44c4537bff0bc2dfd244efe8d9.
--- fs/ext4/extents.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
fs/ext4/extents.c +2 -6
@@ -3252,7 +3252,7 @@ static struct ext4_ext_path *ext4_split_extent_at(handle_t *handle, err =PTR_ERR (path);if (err != -ENOSPC && err != -EDQUOT && err != -ENOMEM ) - goto out_path; +return path;/* * Get a new path to try to zeroout or fix the extent length.
@@ -3266,7 +3266,7 @@ static struct ext4_ext_path *ext4_split_extent_at(handle_t *handle,if (IS_ERR (path)) {EXT4_ERROR_INODE (inode,"Failed split extent on %u, err %ld" , split,PTR_ERR (path)); - goto out_path; +return path; } depth =ext_depth (inode); ex = path[depth].p_ext;
@@ -3343,10 +3343,6 @@ static struct ext4_ext_path *ext4_split_extent_at(handle_t *handle,ext4_free_ext_path (path); path =ERR_PTR (err); } -out_path: -if (IS_ERR (path)) -/* Remove all remaining potentially stale extents. */ -ext4_es_remove_extent (inode, ee_block, ee_len);ext4_ext_show_leaf (inode, path);return path; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 236/312 Revert "ext4: drop extent cache after doing PARTIAL_VALID1 zeroout"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit 9e79460b3aae6bbf33f5ccea6c44bf2eefa45daf.
--- fs/ext4/extents.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-)
fs/ext4/extents.c +1 -9
@@ -3304,16 +3304,8 @@ static struct ext4_ext_path *ext4_split_extent_at(handle_t *handle,* extent length and ext4_split_extent() split will the * first half again. */ -if (split_flag &EXT4_EXT_DATA_PARTIAL_VALID1 ) { -/* -* Drop extent cache to prevent stale unwritten -* extents remaining after zeroing out. -*/ -ext4_es_remove_extent (inode, -le32_to_cpu (zero_ex.ee_block), -ext4_ext_get_actual_len (&zero_ex)); +if (split_flag &EXT4_EXT_DATA_PARTIAL_VALID1 ) goto fix_extent_len; - }/* update the extent length and mark as initialized */ ex->ee_len =cpu_to_le16 (ee_len);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 237/312 Revert "ext4: dont zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit ddf854e59166533b0f46ba32cd6cd9aca3197d1b.
--- fs/ext4/extents.c | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-)
fs/ext4/extents.c +1 -12
@@ -3298,15 +3298,6 @@ static struct ext4_ext_path *ext4_split_extent_at(handle_t *handle, }if (!err) { -/* -* The first half contains partially valid data, the -* splitting of this extent has not been completed, fix -* extent length and ext4_split_extent() split will the -* first half again. -*/ -if (split_flag &EXT4_EXT_DATA_PARTIAL_VALID1 ) - goto fix_extent_len; -/* update the extent length and mark as initialized */ ex->ee_len =cpu_to_le16 (ee_len);ext4_ext_try_to_merge (handle, inode, path, ex);
@@ -3382,9 +3373,7 @@ static int ext4_split_extent(handle_t *handle, split_flag1 |=EXT4_EXT_MARK_UNWRIT1 |EXT4_EXT_MARK_UNWRIT2 ;if (split_flag &EXT4_EXT_DATA_VALID2 ) - split_flag1 |= map->m_lblk > ee_block ? -EXT4_EXT_DATA_PARTIAL_VALID1 : -EXT4_EXT_DATA_ENTIRE_VALID1 ; + split_flag1 |=EXT4_EXT_DATA_ENTIRE_VALID1 ; path =ext4_split_extent_at (handle, inode, path, map->m_lblk + map->m_len, split_flag1, flags1);if (IS_ERR (path)) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 238/312 Revert "ext4: subdivide EXT4_EXT_DATA_VALID1"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit 1606176c5c6c323167dcd7d4b4f7212b2c8d3d13.
--- fs/ext4/extents.c | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-)
fs/ext4/extents.c +6 -12
@@ -43,13 +43,8 @@#define EXT4_EXT_MARK_UNWRIT1 0x2/* mark first half unwritten */ #define EXT4_EXT_MARK_UNWRIT2 0x4/* mark second half unwritten */ -/* first half contains valid data */ -#define EXT4_EXT_DATA_ENTIRE_VALID1 0x8/* has entirely valid data */ -#define EXT4_EXT_DATA_PARTIAL_VALID1 0x10/* has partially valid data */ -#define EXT4_EXT_DATA_VALID1 (EXT4_EXT_DATA_ENTIRE_VALID1 | \ - EXT4_EXT_DATA_PARTIAL_VALID1) - -#define EXT4_EXT_DATA_VALID2 0x20/* second half contains valid data */ +#define EXT4_EXT_DATA_VALID1 0x8/* first half contains valid data */ +#define EXT4_EXT_DATA_VALID2 0x10/* second half contains valid data */ static __le32 ext4_extent_block_csum (struct inode *inode,struct ext4_extent_header *eh)
@@ -3180,9 +3175,8 @@ static struct ext4_ext_path *ext4_split_extent_at(handle_t *handle,unsigned int ee_len, depth;int err =0 ; -BUG_ON ((split_flag &EXT4_EXT_DATA_VALID1 ) ==EXT4_EXT_DATA_VALID1 ); -BUG_ON ((split_flag &EXT4_EXT_DATA_VALID1 ) && - (split_flag &EXT4_EXT_DATA_VALID2 )); +BUG_ON ((split_flag & (EXT4_EXT_DATA_VALID1 |EXT4_EXT_DATA_VALID2 )) == + (EXT4_EXT_DATA_VALID1 |EXT4_EXT_DATA_VALID2 ));/* Do not cache extents that are in the process of being modified. */ flags |=EXT4_EX_NOCACHE ;
@@ -3373,7 +3367,7 @@ static int ext4_split_extent(handle_t *handle, split_flag1 |=EXT4_EXT_MARK_UNWRIT1 |EXT4_EXT_MARK_UNWRIT2 ;if (split_flag &EXT4_EXT_DATA_VALID2 ) - split_flag1 |=EXT4_EXT_DATA_ENTIRE_VALID1 ; + split_flag1 |=EXT4_EXT_DATA_VALID1 ; path =ext4_split_extent_at (handle, inode, path, map->m_lblk + map->m_len, split_flag1, flags1);if (IS_ERR (path)) {
@@ -3737,7 +3731,7 @@ static int ext4_split_convert_extents(handle_t *handle,/* Convert to unwritten */ if (flags &EXT4_GET_BLOCKS_CONVERT_UNWRITTEN ) { - split_flag |=EXT4_EXT_DATA_ENTIRE_VALID1 ; + split_flag |=EXT4_EXT_DATA_VALID1 ;/* Convert to initialized */ }else if (flags &EXT4_GET_BLOCKS_CONVERT ) { split_flag |= ee_block + ee_len <= eof_block ?
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 239/312 Revert "ext4: get rid of ppath in ext4_split_extent_at()"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit 4d03e2046f73158feb886a45d5682c3b79066872.
--- fs/ext4/extents.c | 85 +++++++++++++++++++++-------------------------- 1 file changed, 38 insertions(+), 47 deletions(-)
fs/ext4/extents.c +38 -47
@@ -84,11 +84,12 @@ static void ext4_extent_block_csum_set(struct inode *inode, et->et_checksum =ext4_extent_block_csum (inode, eh); } -static struct ext4_ext_path *ext4_split_extent_at (handle_t *handle, -struct inode *inode, -struct ext4_ext_path *path, -ext4_lblk_t split, -int split_flag,int flags); +static int ext4_split_extent_at (handle_t *handle, +struct inode *inode, +struct ext4_ext_path **ppath, +ext4_lblk_t split, +int split_flag, +int flags);static int ext4_ext_trunc_restart_fn (struct inode *inode,int *dropped) {
@@ -334,15 +335,9 @@ ext4_force_split_extent_at(handle_t *handle, struct inode *inode,if (nofail) flags |=EXT4_GET_BLOCKS_METADATA_NOFAIL |EXT4_EX_NOFAIL ; - path =ext4_split_extent_at (handle, inode, path, lblk, unwritten ? +return ext4_split_extent_at (handle, inode, ppath, lblk, unwritten ?EXT4_EXT_MARK_UNWRIT1 |EXT4_EXT_MARK_UNWRIT2 :0 , flags); -if (IS_ERR (path)) { - *ppath =NULL ; -return PTR_ERR (path); - } - *ppath = path; -return 0 ; } static int
@@ -694,7 +689,7 @@ static void ext4_ext_show_leaf(struct inode *inode, struct ext4_ext_path *path)struct ext4_extent *ex;int i; -if (IS_ERR_OR_NULL (path)) +if (!path)return ; eh = path[depth].p_hdr;
@@ -3160,14 +3155,16 @@ static int ext4_ext_zeroout(struct inode *inode, struct ext4_extent *ex)* a> the extent are splitted into two extent. * b> split is not needed, and just mark the extent. * -* Return an extent path pointer on success, or an error pointer on failure. +* return 0 on success. */ -static struct ext4_ext_path *ext4_split_extent_at (handle_t *handle, -struct inode *inode, -struct ext4_ext_path *path, -ext4_lblk_t split, -int split_flag,int flags) +static int ext4_split_extent_at (handle_t *handle, +struct inode *inode, +struct ext4_ext_path **ppath, +ext4_lblk_t split, +int split_flag, +int flags) { +struct ext4_ext_path *path = *ppath;ext4_fsblk_t newblock;ext4_lblk_t ee_block;struct ext4_extent *ex, newex, orig_ex, zero_ex;
@@ -3241,12 +3238,14 @@ static struct ext4_ext_path *ext4_split_extent_at(handle_t *handle,ext4_ext_mark_unwritten (ex2); path =ext4_ext_insert_extent (handle, inode, path, &newex, flags); -if (!IS_ERR (path)) +if (!IS_ERR (path)) { + *ppath = path; goto out; - + } + *ppath =NULL ; err =PTR_ERR (path);if (err != -ENOSPC && err != -EDQUOT && err != -ENOMEM ) -return path; +return err;/* * Get a new path to try to zeroout or fix the extent length.
@@ -3256,14 +3255,16 @@ static struct ext4_ext_path *ext4_split_extent_at(handle_t *handle,* in ext4_da_update_reserve_space() due to an incorrect * ee_len causing the i_reserved_data_blocks exception. */ - path =ext4_find_extent (inode, ee_block,NULL , flags |EXT4_EX_NOFAIL ); + path =ext4_find_extent (inode, ee_block,NULL , + flags |EXT4_EX_NOFAIL );if (IS_ERR (path)) {EXT4_ERROR_INODE (inode,"Failed split extent on %u, err %ld" , split,PTR_ERR (path)); -return path; +return PTR_ERR (path); } depth =ext_depth (inode); ex = path[depth].p_ext; + *ppath = path;if (EXT4_EXT_MAY_ZEROOUT & split_flag) {if (split_flag & (EXT4_EXT_DATA_VALID1 |EXT4_EXT_DATA_VALID2 )) {
@@ -3315,13 +3316,10 @@ static struct ext4_ext_path *ext4_split_extent_at(handle_t *handle,* and err is a non-zero error code. */ ext4_ext_dirty (handle, inode, path + path->p_depth); +return err; out: -if (err) { -ext4_free_ext_path (path); - path =ERR_PTR (err); - }ext4_ext_show_leaf (inode, path); -return path; +return err; }/*
@@ -3368,14 +3366,10 @@ static int ext4_split_extent(handle_t *handle,EXT4_EXT_MARK_UNWRIT2 ;if (split_flag &EXT4_EXT_DATA_VALID2 ) split_flag1 |=EXT4_EXT_DATA_VALID1 ; - path =ext4_split_extent_at (handle, inode, path, + err =ext4_split_extent_at (handle, inode, ppath, map->m_lblk + map->m_len, split_flag1, flags1); -if (IS_ERR (path)) { - err =PTR_ERR (path); - *ppath =NULL ; +if (err) goto out; - } - *ppath = path; }else { allocated = ee_len - (map->m_lblk - ee_block); }
@@ -3383,7 +3377,7 @@ static int ext4_split_extent(handle_t *handle,* Update path is required because previous ext4_split_extent_at() may * result in split of original leaf or extent zeroout. */ - path =ext4_find_extent (inode, map->m_lblk, path, flags); + path =ext4_find_extent (inode, map->m_lblk, *ppath, flags);if (IS_ERR (path)) { *ppath =NULL ;return PTR_ERR (path);
@@ -3405,17 +3399,13 @@ static int ext4_split_extent(handle_t *handle, split_flag1 |= split_flag & (EXT4_EXT_MAY_ZEROOUT |EXT4_EXT_MARK_UNWRIT2 ); } - path =ext4_split_extent_at (handle, inode, path, + err =ext4_split_extent_at (handle, inode, ppath, map->m_lblk, split_flag1, flags); -if (IS_ERR (path)) { - err =PTR_ERR (path); - *ppath =NULL ; +if (err) goto out; - } - *ppath = path; } -ext4_ext_show_leaf (inode, path); +ext4_ext_show_leaf (inode, *ppath); out:return err ? err : allocated; }
@@ -5611,21 +5601,22 @@ static int ext4_insert_range(struct file *file, loff_t offset, loff_t len)if (ext4_ext_is_unwritten (extent)) split_flag =EXT4_EXT_MARK_UNWRIT1 |EXT4_EXT_MARK_UNWRIT2 ; - path =ext4_split_extent_at (handle, inode, path, + ret =ext4_split_extent_at (handle, inode, &path, offset_lblk, split_flag,EXT4_EX_NOCACHE |EXT4_GET_BLOCKS_PRE_IO |EXT4_GET_BLOCKS_METADATA_NOFAIL ); } -if (IS_ERR (path)) { +ext4_free_ext_path (path); +if (ret <0 ) {up_write (&EXT4_I (inode)->i_data_sem); - ret =PTR_ERR (path); goto out_stop; } + }else { +ext4_free_ext_path (path); } -ext4_free_ext_path (path);ext4_es_remove_extent (inode, offset_lblk,EXT_MAX_BLOCKS - offset_lblk);/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 240/312 Revert "ext4: get rid of ppath in ext4_ext_insert_extent()"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit b6a01b66cdaa2da526b512fc0f9938ea5d6c7a1c.
--- fs/ext4/ext4.h | 7 ++-- fs/ext4/extents.c | 88 +++++++++++++++++++------------------------ fs/ext4/fast_commit.c | 8 ++-- fs/ext4/migrate.c | 5 +-- 4 files changed, 47 insertions(+), 61 deletions(-)
fs/ext4/ext4.h +3 -4
@@ -3719,10 +3719,9 @@ extern int ext4_map_blocks(handle_t *handle, struct inode *inode,extern int ext4_ext_calc_credits_for_single_extent (struct inode *inode,int num,struct ext4_ext_path *path); -extern struct ext4_ext_path *ext4_ext_insert_extent ( -handle_t *handle,struct inode *inode, -struct ext4_ext_path *path, -struct ext4_extent *newext,int gb_flags); +extern int ext4_ext_insert_extent (handle_t *,struct inode *, +struct ext4_ext_path **, +struct ext4_extent *,int );extern struct ext4_ext_path *ext4_find_extent (struct inode *,ext4_lblk_t ,struct ext4_ext_path *,int flags);
fs/ext4/extents.c +38 -50
196 lines not on this page · raw message
fs/ext4/fast_commit.c +4 -4
@@ -1831,12 +1831,12 @@ static int ext4_fc_replay_add_range(struct super_block *sb,if (ext4_ext_is_unwritten (ex))ext4_ext_mark_unwritten (&newex);down_write (&EXT4_I (inode)->i_data_sem); - path =ext4_ext_insert_extent (NULL , inode, - path, &newex,0 ); + ret =ext4_ext_insert_extent ( +NULL , inode, &path, &newex,0 );up_write ((&EXT4_I (inode)->i_data_sem)); -if (IS_ERR (path)) - goto out;ext4_free_ext_path (path); +if (ret) + goto out; goto next; }
fs/ext4/migrate.c +2 -3
@@ -37,6 +37,7 @@ static int finish_range(handle_t *handle, struct inode *inode, path =ext4_find_extent (inode, lb->first_block,NULL ,0 );if (IS_ERR (path)) { retval =PTR_ERR (path); + path =NULL ; goto err_out; }
@@ -52,9 +53,7 @@ static int finish_range(handle_t *handle, struct inode *inode, retval =ext4_datasem_ensure_credits (handle, inode, needed, needed,0 );if (retval <0 ) goto err_out; - path =ext4_ext_insert_extent (handle, inode, path, &newext,0 ); -if (IS_ERR (path)) - retval =PTR_ERR (path); + retval =ext4_ext_insert_extent (handle, inode, &path, &newext,0 ); err_out:up_write ((&EXT4_I (inode)->i_data_sem));ext4_free_ext_path (path);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 241/312 Revert "ext4: get rid of ppath in ext4_ext_create_new_leaf()"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit 15908fc35056e9a6fd71552eda884a353496e6c7.
--- fs/ext4/extents.c | 43 +++++++++++++++++++++---------------------- 1 file changed, 21 insertions(+), 22 deletions(-)
fs/ext4/extents.c +21 -22
@@ -1392,12 +1392,13 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode,* finds empty index and adds new leaf. * if no free index is found, then it requests in-depth growing. */ -static struct ext4_ext_path * -ext4_ext_create_new_leaf (handle_t *handle,struct inode *inode, -unsigned int mb_flags,unsigned int gb_flags, -struct ext4_ext_path *path, -struct ext4_extent *newext) +static int ext4_ext_create_new_leaf (handle_t *handle,struct inode *inode, +unsigned int mb_flags, +unsigned int gb_flags, +struct ext4_ext_path **ppath, +struct ext4_extent *newext) { +struct ext4_ext_path *path = *ppath;struct ext4_ext_path *curp;int depth, i, err =0 ;
@@ -1418,25 +1419,28 @@ ext4_ext_create_new_leaf(handle_t *handle, struct inode *inode,* entry: create all needed subtree and add new leaf */ err =ext4_ext_split (handle, inode, mb_flags, path, newext, i);if (err) - goto errout; + goto out;/* refill path */ path =ext4_find_extent (inode, (ext4_lblk_t )le32_to_cpu (newext->ee_block), path, gb_flags); -return path; +if (IS_ERR (path)) + err =PTR_ERR (path); }else {/* tree is full, time to grow in depth */ err =ext4_ext_grow_indepth (handle, inode, mb_flags);if (err) - goto errout; + goto out;/* refill path */ path =ext4_find_extent (inode, (ext4_lblk_t )le32_to_cpu (newext->ee_block), path, gb_flags); -if (IS_ERR (path)) -return path; +if (IS_ERR (path)) { + err =PTR_ERR (path); + goto out; + }/* * only first (depth 0 -> 1) produces free space;
@@ -1448,11 +1452,9 @@ ext4_ext_create_new_leaf(handle_t *handle, struct inode *inode, goto repeat; } } -return path; - -errout: -ext4_free_ext_path (path); -return ERR_PTR (err); +out: + *ppath =IS_ERR (path) ?NULL : path; +return err; }/*
@@ -2095,14 +2097,11 @@ int ext4_ext_insert_extent(handle_t *handle, struct inode *inode,*/ if (gb_flags &EXT4_GET_BLOCKS_METADATA_NOFAIL ) mb_flags |=EXT4_MB_USE_RESERVED ; - path =ext4_ext_create_new_leaf (handle, inode, mb_flags, gb_flags, - path, newext); -if (IS_ERR (path)) { - *ppath =NULL ; - err =PTR_ERR (path); + err =ext4_ext_create_new_leaf (handle, inode, mb_flags, gb_flags, + ppath, newext); +if (err) goto cleanup; - } - *ppath = path; + path = *ppath; depth =ext_depth (inode); eh = path[depth].p_hdr;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 242/312 Revert "ext4: get rid of ppath in ext4_find_extent()"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit b5a010bc7dba7e3d0966c0231335ca76b3f8780e.
--- fs/ext4/ext4.h | 2 +- fs/ext4/extents.c | 55 ++++++++++++++++++++----------------------- fs/ext4/move_extent.c | 7 +++--- 3 files changed, 30 insertions(+), 34 deletions(-)
fs/ext4/ext4.h +1 -1
@@ -3723,7 +3723,7 @@ extern int ext4_ext_insert_extent(handle_t *, struct inode *, struct ext4_ext_path **, struct ext4_extent *, int);extern struct ext4_ext_path *ext4_find_extent (struct inode *,ext4_lblk_t , -struct ext4_ext_path *, +struct ext4_ext_path **,int flags);extern void ext4_free_ext_path (struct ext4_ext_path *);extern int ext4_ext_check_inode (struct inode *inode);
fs/ext4/extents.c +26 -29
164 lines not on this page · raw message
fs/ext4/move_extent.c +3 -4
@@ -26,17 +26,16 @@ static inline int get_ext_path(struct inode *inode, ext4_lblk_t lblock, struct ext4_ext_path **ppath) { - struct ext4_ext_path *path = *ppath; + struct ext4_ext_path *path; - *ppath =NULL ; - path =ext4_find_extent (inode, lblock, path,EXT4_EX_NOCACHE ); + path =ext4_find_extent (inode, lblock, ppath,EXT4_EX_NOCACHE );if (IS_ERR (path))return PTR_ERR (path);if (path[ext_depth (inode)].p_ext ==NULL ) {ext4_free_ext_path (path); + *ppath =NULL ;return -ENODATA ; } - *ppath = path;return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 243/312 Revert "ext4: make ext4_es_remove_extent() return void"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit bfe24a48c1d56b046052014534bde1680fadb9dc.
--- fs/ext4/extents.c | 34 ++++++++++++++++++++++++++++------ fs/ext4/extents_status.c | 12 ++++++------ fs/ext4/extents_status.h | 4 ++-- fs/ext4/inline.c | 12 ++++++++++-- fs/ext4/inode.c | 8 ++++++-- 5 files changed, 52 insertions(+), 18 deletions(-)
fs/ext4/extents.c +28 -6
@@ -4463,8 +4463,15 @@ int ext4_ext_truncate(handle_t *handle, struct inode *inode) last_block = (inode->i_size + sb->s_blocksize -1 ) >>EXT4_BLOCK_SIZE_BITS (sb); -ext4_es_remove_extent (inode, last_block,EXT_MAX_BLOCKS - last_block); - +retry: + err =ext4_es_remove_extent (inode, last_block, +EXT_MAX_BLOCKS - last_block); +if (err == -ENOMEM ) { +memalloc_retry_wait (GFP_ATOMIC ); + goto retry; + } +if (err) +return err; retry_remove_space: err =ext4_ext_remove_space (inode, last_block,EXT_MAX_BLOCKS -1 );if (err == -ENOMEM ) {
@@ -5412,7 +5419,13 @@ static int ext4_collapse_range(struct file *file, loff_t offset, loff_t len)down_write (&EXT4_I (inode)->i_data_sem);ext4_discard_preallocations (inode,0 ); -ext4_es_remove_extent (inode, punch_start,EXT_MAX_BLOCKS - punch_start); + + ret =ext4_es_remove_extent (inode, punch_start, +EXT_MAX_BLOCKS - punch_start); +if (ret) { +up_write (&EXT4_I (inode)->i_data_sem); + goto out_stop; + } ret =ext4_ext_remove_space (inode, punch_start, punch_stop -1 );if (ret) {
@@ -5598,7 +5611,12 @@ static int ext4_insert_range(struct file *file, loff_t offset, loff_t len)ext4_free_ext_path (path); } -ext4_es_remove_extent (inode, offset_lblk,EXT_MAX_BLOCKS - offset_lblk); + ret =ext4_es_remove_extent (inode, offset_lblk, +EXT_MAX_BLOCKS - offset_lblk); +if (ret) { +up_write (&EXT4_I (inode)->i_data_sem); + goto out_stop; + }/* * if offset_lblk lies in a hole which is at start of file, use
@@ -5657,8 +5675,12 @@ ext4_swap_extents(handle_t *handle, struct inode *inode1,BUG_ON (!inode_is_locked (inode1));BUG_ON (!inode_is_locked (inode2)); -ext4_es_remove_extent (inode1, lblk1, count); -ext4_es_remove_extent (inode2, lblk2, count); + *erp =ext4_es_remove_extent (inode1, lblk1, count); +if (unlikely (*erp)) +return 0 ; + *erp =ext4_es_remove_extent (inode2, lblk2, count); +if (unlikely (*erp)) +return 0 ;while (count) {struct ext4_extent *ex1, *ex2, tmp_ex;
fs/ext4/extents_status.c +6 -6
@@ -1494,10 +1494,10 @@ static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,* @len - number of blocks to remove * * Reduces block/cluster reservation count and for bigalloc cancels pending -* reservations as needed. +* reservations as needed. Returns 0 on success, error code on failure. */ -void ext4_es_remove_extent (struct inode *inode,ext4_lblk_t lblk, -ext4_lblk_t len) +int ext4_es_remove_extent (struct inode *inode,ext4_lblk_t lblk, +ext4_lblk_t len) {ext4_lblk_t end;int err =0 ;
@@ -1505,14 +1505,14 @@ void ext4_es_remove_extent(struct inode *inode, ext4_lblk_t lblk,struct extent_status *es =NULL ;if (EXT4_SB (inode->i_sb)->s_mount_state &EXT4_FC_REPLAY ) -return ; +return 0 ;trace_ext4_es_remove_extent (inode, lblk, len);es_debug ("remove [%u/%u) from extent status tree of inode %lu\n" , lblk, len, inode->i_ino);if (!len) -return ; +return err; end = lblk + len -1 ;BUG_ON (end < lblk);
@@ -1539,7 +1539,7 @@ void ext4_es_remove_extent(struct inode *inode, ext4_lblk_t lblk,ext4_es_print_tree (inode);ext4_da_release_space (inode, reserved); -return ; +return 0 ; } static int __es_shrink(struct ext4_sb_info *sbi, int nr_to_scan,
fs/ext4/extents_status.h +2 -2
@@ -133,8 +133,8 @@ extern void ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,extern void ext4_es_cache_extent (struct inode *inode,ext4_lblk_t lblk,ext4_lblk_t len,ext4_fsblk_t pblk,unsigned int status); -extern void ext4_es_remove_extent (struct inode *inode,ext4_lblk_t lblk, -ext4_lblk_t len); +extern int ext4_es_remove_extent (struct inode *inode,ext4_lblk_t lblk, +ext4_lblk_t len); extern void ext4_es_find_extent_range(struct inode *inode, int (*match_fn)(struct extent_status *es), ext4_lblk_t lblk, ext4_lblk_t end,
fs/ext4/inline.c +10 -2
@@ -2004,8 +2004,16 @@ int ext4_inline_data_truncate(struct inode *inode, int *has_inline)* the extent status cache must be cleared to avoid leaving * behind stale delayed allocated extent entries */ -if (!ext4_test_inode_state (inode,EXT4_STATE_MAY_INLINE_DATA )) -ext4_es_remove_extent (inode,0 ,EXT_MAX_BLOCKS ); +if (!ext4_test_inode_state (inode,EXT4_STATE_MAY_INLINE_DATA )) { +retry: + err =ext4_es_remove_extent (inode,0 ,EXT_MAX_BLOCKS ); +if (err == -ENOMEM ) { +memalloc_retry_wait (GFP_ATOMIC ); + goto retry; + } +if (err) + goto out_error; + }/* Clear the content in the xattr space. */ if (inline_size >EXT4_MIN_INLINE_DATA_SIZE ) {
fs/ext4/inode.c +6 -2
@@ -4134,8 +4134,12 @@ int ext4_punch_hole(struct file *file, loff_t offset, loff_t length)down_write (&EXT4_I (inode)->i_data_sem);ext4_discard_preallocations (inode,0 ); -ext4_es_remove_extent (inode, first_block, - stop_block - first_block); + ret =ext4_es_remove_extent (inode, first_block, + stop_block - first_block); +if (ret) { +up_write (&EXT4_I (inode)->i_data_sem); + goto out_stop; + }if (ext4_test_inode_flag (inode,EXT4_INODE_EXTENTS )) ret = ext4_ext_remove_space(inode, first_block,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 244/312 bridge: br_nd_send: validate ND option lengths
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yang <[email protected]>
commit 850837965af15707fd3142c1cf3c5bfaf022299b upstream.
br_nd_send() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the computed option span or use a too-short source LLADDR option payload.
Validate option lengths against the remaining NS option area before advancing, and only read source LLADDR when the option is large enough for an Ethernet address.
--- net/bridge/br_arp_nd_proxy.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/bridge/br_arp_nd_proxy.c +4 -2
@@ -285,12 +285,14 @@ static void br_nd_send(struct net_bridge ns_olen = request->len - (skb_network_offset (request) +sizeof (struct ipv6hdr )) -sizeof (*ns);for (i =0 ; i < ns_olen -1 ; i += (ns->opt[i +1 ] <<3 )) { -if (!ns->opt[i +1 ]) { +if (!ns->opt[i +1 ] || i + (ns->opt[i +1 ] <<3 ) > ns_olen) {kfree_skb (reply);return ; }if (ns->opt[i] ==ND_OPT_SOURCE_LL_ADDR ) { - daddr = ns->opt + i +sizeof (struct nd_opt_hdr ); +if ((ns->opt[i +1 ] <<3 ) >= +sizeof (struct nd_opt_hdr ) +ETH_ALEN ) + daddr = ns->opt + i +sizeof (struct nd_opt_hdr );break ; } }
Greg Kroah-Hartman
maintainerPATCH 245/312 cdc-acm: new quirk for EPSON HMD
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit f97e96c303d689708f7f713d8f3afcc31f1237e9 upstream.
This device has a union descriptor that is just garbage and needs a custom descriptor.
In principle this could be done with a (conditionally activated) heuristic. That would match more devices without a need for defining a new quirk. However, this always carries the risk that the heuristics does the wrong thing and leads to more breakage. Defining the quirk and telling it exactly what to do is the safe and conservative approach.
--- drivers/usb/class/cdc-acm.c | 9 +++++++++ drivers/usb/class/cdc-acm.h | 1 + 2 files changed, 10 insertions(+)
drivers/usb/class/cdc-acm.c +9 -0
@@ -1201,6 +1201,12 @@ static int acm_probe(struct usb_interfacif (!data_interface || !control_interface)return -ENODEV ; goto skip_normal_probe; + }else if (quirks ==NO_UNION_12 ) { + data_interface =usb_ifnum_to_if (usb_dev,2 ); + control_interface =usb_ifnum_to_if (usb_dev,1 ); +if (!data_interface || !control_interface) +return -ENODEV ; + goto skip_normal_probe; }/* normal probing*/
@@ -1724,6 +1730,9 @@ static const struct usb_device_id acm_id { USB_DEVICE(0x045b, 0x024D), /* Renesas R-Car E3 USB Download mode */ .driver_info =DISABLE_ECHO ,/* Don't echo banner */ }, + { USB_DEVICE(0x04b8, 0x0d12), /* EPSON HMD Com&Sens */ + .driver_info = NO_UNION_12, /* union descriptor is garbage */ + }, { USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; [email protected] */ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ },
drivers/usb/class/cdc-acm.h +1 -0
@@ -114,3 +114,4 @@ struct acm {#define SEND_ZERO_PACKET BIT(6)#define DISABLE_ECHO BIT(7)#define MISSING_CAP_BRK BIT(8) +#define NO_UNION_12 BIT(9)
Greg Kroah-Hartman
maintainerPATCH 246/312 comedi: dt2815: add hardware detection to prevent crash
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
commit 93853512f565e625df2397f0d8050d6aafd7c3ad upstream.
The dt2815 driver crashes when attached to I/O ports without actual hardware present. This occurs because syzkaller or users can attach the driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl.
When no hardware exists at the specified port, inb() operations return 0xff (floating bus), but outb() operations can trigger page faults due to undefined behavior, especially under race conditions:
BUG: unable to handle page fault for address: 000000007fffff90 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page RIP: 0010:dt2815_attach+0x6e0/0x1110
Add hardware detection by reading the status register before attempting any write operations. If the read returns 0xff, assume no hardware is present and fail the attach with -ENODEV. This prevents crashes from outb() operations on non-existent hardware.
--- drivers/comedi/drivers/dt2815.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/comedi/drivers/dt2815.c +12 -0
@@ -175,6 +175,18 @@ static int dt2815_attach(struct comedi_d ? current_range_type : voltage_range_type; } +/* +* Check if hardware is present before attempting any I/O operations. +* Reading 0xff from status register typically indicates no hardware +* on the bus (floating bus reads as all 1s). +*/ +if (inb (dev->iobase +DT2815_STATUS ) ==0xff ) { +dev_err (dev->class_dev, +"No hardware detected at I/O base 0x%lx\n" , + dev->iobase); +return -ENODEV ; + } +/* Init the 2815 */ outb (0x00 , dev->iobase +DT2815_STATUS );for (i =0 ; i <100 ; i++) {
Greg Kroah-Hartman
maintainerPATCH 247/312 comedi: Reinit dev->spinlock between attachments to low-level drivers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit 4b9a9a6d71e3e252032f959fb3895a33acb5865c upstream.
struct comedi_device is the main controlling structure for a COMEDI device created by the COMEDI subsystem. It contains a member spinlock containing a spin-lock that is initialized by the COMEDI subsystem, but is reserved for use by a low-level driver attached to the COMEDI device (at least since commit 25436dc9d84f ("Staging: comedi: remove RT code")).
Some COMEDI devices (those created on initialization of the COMEDI subsystem when the "comedi.comedi_num_legacy_minors" parameter is non-zero) can be attached to different low-level drivers over their lifetime using the COMEDI_DEVCONFIG ioctl command. This can result in inconsistent lock states being reported when there is a mismatch in the spin-lock locking levels used by each low-level driver to which the COMEDI device has been attached. Fix it by reinitializing dev->spinlock before calling the low-level driver's attach function pointer if CONFIG_LOCKDEP is enabled.
--- drivers/comedi/drivers.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/comedi/drivers.c +8 -0
@@ -1000,6 +1000,14 @@ int comedi_device_attach(struct comedi_d ret = -EIO ; goto out; } +if (IS_ENABLED (CONFIG_LOCKDEP )) { +/* +* dev->spinlock is for private use by the attached low-level +* driver. Reinitialize it to stop lock-dependency tracking +* between attachments to different low-level drivers. +*/ +spin_lock_init (&dev->spinlock); + } dev->driver = driv; dev->board_name = dev->board_ptr ? *(const char **)dev->board_ptr : dev->driver->driver_name;
Greg Kroah-Hartman
maintainerPATCH 248/312 comedi: ni_atmio16d: Fix invalid clean-up after failed attach
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit 101ab946b79ad83b36d5cfd47de587492a80acf0 upstream.
If the driver's COMEDI "attach" handler function (atmio16d_attach()) returns an error, the COMEDI core will call the driver's "detach" handler function (atmio16d_detach()) to clean up. This calls reset_atmio16d() unconditionally, but depending on where the error occurred in the attach handler, the device may not have been sufficiently initialized to call reset_atmio16d(). It uses dev->iobase as the I/O port base address and dev->private as the pointer to the COMEDI device's private data structure. dev->iobase may still be set to its initial value of 0, which would result in undesired writes to low I/O port addresses. dev->private may still be NULL, which would result in null pointer dereferences.
Fix atmio16d_detach() by checking that dev->private is valid (non-null) before calling reset_atmio16d(). This implies that dev->iobase was set correctly since that is set up before dev->private.
--- drivers/comedi/drivers/ni_atmio16d.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/comedi/drivers/ni_atmio16d.c +2 -1
@@ -698,7 +698,8 @@ static int atmio16d_attach(struct comedistatic void atmio16d_detach (struct comedi_device *dev) { -reset_atmio16d (dev); +if (dev->private) +reset_atmio16d (dev);comedi_legacy_detach (dev); }
Greg Kroah-Hartman
maintainerPATCH 249/312 comedi: me_daq: Fix potential overrun of firmware buffer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit cc797d4821c754c701d9714b58bea947e31dbbe0 upstream.
me2600_xilinx_download() loads the firmware that was requested by request_firmware(). It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable file_length and reads the data stream contents of length file_length from offset 16 onwards. Although it checks that the supplied firmware is at least 16 bytes long, it does not check that it is long enough to contain the data stream.
Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return -EINVAL.
--- drivers/comedi/drivers/me_daq.c | 35 +++++++++++++++++++---------------- 1 file changed, 19 insertions(+), 16 deletions(-)
drivers/comedi/drivers/me_daq.c +19 -16
@@ -344,6 +344,25 @@ static int me2600_xilinx_download(structunsigned int file_length;unsigned int i; +/* +* Format of the firmware +* Build longs from the byte-wise coded header +* Byte 1-3: length of the array +* Byte 4-7: version +* Byte 8-11: date +* Byte 12-15: reserved +*/ +if (size >=4 ) { + file_length = (((unsigned int )data[0 ] &0xff ) <<24 ) + + (((unsigned int )data[1 ] &0xff ) <<16 ) + + (((unsigned int )data[2 ] &0xff ) <<8 ) + + ((unsigned int )data[3 ] &0xff ); + } +if (size <16 || file_length > size -16 ) { +dev_err (dev->class_dev,"Firmware length inconsistency\n" ); +return -EINVAL ; + } +/* disable irq's on PLX */ writel (0x00 , devpriv->plx_regbase +PLX9052_INTCSR );
@@ -358,22 +377,6 @@ static int me2600_xilinx_download(structsleep (1 );/* -* Format of the firmware -* Build longs from the byte-wise coded header -* Byte 1-3: length of the array -* Byte 4-7: version -* Byte 8-11: date -* Byte 12-15: reserved -*/ -if (size <16 ) -return -EINVAL ; - - file_length = (((unsigned int )data[0 ] &0xff ) <<24 ) + - (((unsigned int )data[1 ] &0xff ) <<16 ) + - (((unsigned int )data[2 ] &0xff ) <<8 ) + - ((unsigned int )data[3 ] &0xff ); - -/* * Loop for writing firmware byte by byte to xilinx * Firmware data start at offset 16 */
Greg Kroah-Hartman
maintainerPATCH 250/312 comedi: me4000: Fix potential overrun of firmware buffer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit 3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7 upstream.
me4000_xilinx_download() loads the firmware that was requested by request_firmware(). It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable file_length and reads the data stream contents of length file_length from offset 16 onwards.
Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return -EINVAL.
Note: The firmware loading was totally broken before commit ac584af59945 ("staging: comedi: me4000: fix firmware downloading"), but that is the most sensible target for this fix.
--- drivers/comedi/drivers/me4000.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/comedi/drivers/me4000.c +12 -4
@@ -315,6 +315,18 @@ static int me4000_xilinx_download(structunsigned int val;unsigned int i; +/* Get data stream length from header. */ +if (size >=4 ) { + file_length = (((unsigned int )data[0 ] &0xff ) <<24 ) + + (((unsigned int )data[1 ] &0xff ) <<16 ) + + (((unsigned int )data[2 ] &0xff ) <<8 ) + + ((unsigned int )data[3 ] &0xff ); + } +if (size <16 || file_length > size -16 ) { +dev_err (dev->class_dev,"Firmware length inconsistency\n" ); +return -EINVAL ; + } +if (!xilinx_iobase)return -ENODEV ;
@@ -346,10 +358,6 @@ static int me4000_xilinx_download(structoutl (val, devpriv->plx_regbase +PLX9052_CNTRL );/* Download Xilinx firmware */ - file_length = (((unsigned int )data[0 ] &0xff ) <<24 ) + - (((unsigned int )data[1 ] &0xff ) <<16 ) + - (((unsigned int )data[2 ] &0xff ) <<8 ) + - ((unsigned int )data[3 ] &0xff );usleep_range (10 ,1000 );for (i =0 ; i < file_length; i++) {
Greg Kroah-Hartman
maintainerPATCH 251/312 netfilter: ipset: drop logically empty buckets in mtype_del
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yifan Wu <[email protected]>
commit 9862ef9ab0a116c6dca98842aab7de13a252ae02 upstream.
mtype_del() counts empty slots below n->pos in k, but it only drops the bucket when both n->pos and k are zero. This misses buckets whose live entries have all been removed while n->pos still points past deleted slots.
Treat a bucket as empty when all positions below n->pos are unused and release it directly instead of shrinking it further.
--- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/ipset/ip_set_hash_gen.h +1 -1
@@ -1086,7 +1086,7 @@ mtype_del(struct ip_set *set, void *valuif (!test_bit (i, n->used)) k++; } -if (n->pos ==0 && k ==0 ) { +if (k == n->pos) { t->hregion[r].ext_size -=ext_size (n->size, dsize);rcu_assign_pointer (hbucket (t, key),NULL );kfree_rcu (n, rcu);
Greg Kroah-Hartman
maintainerPATCH 252/312 vxlan: validate ND option lengths in vxlan_na_create
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yang <[email protected]>
commit afa9a05e6c4971bd5586f1b304e14d61fb3d9385 upstream.
vxlan_na_create() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the computed option span or use a too-short source LLADDR option payload.
Validate option lengths against the remaining NS option area before advancing, and only read source LLADDR when the option is large enough for an Ethernet address.
--- drivers/net/vxlan/vxlan_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/vxlan/vxlan_core.c +4 -2
@@ -2009,12 +2009,14 @@ static struct sk_buff *vxlan_na_create(s ns_olen = request->len -skb_network_offset (request) -sizeof (struct ipv6hdr ) -sizeof (*ns);for (i =0 ; i < ns_olen-1 ; i += (ns->opt[i+1 ]<<3 )) { -if (!ns->opt[i +1 ]) { +if (!ns->opt[i +1 ] || i + (ns->opt[i +1 ] <<3 ) > ns_olen) {kfree_skb (reply);return NULL ; }if (ns->opt[i] ==ND_OPT_SOURCE_LL_ADDR ) { - daddr = ns->opt + i +sizeof (struct nd_opt_hdr ); +if ((ns->opt[i +1 ] <<3 ) >= +sizeof (struct nd_opt_hdr ) +ETH_ALEN ) + daddr = ns->opt + i +sizeof (struct nd_opt_hdr );break ; } }
Greg Kroah-Hartman
maintainerPATCH 253/312 net: ftgmac100: fix ring allocation unwind on open failure
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yufan Chen <[email protected]>
commit c0fd0fe745f5e8c568d898cd1513d0083e46204a upstream.
ftgmac100_alloc_rings() allocates rx_skbs, tx_skbs, rxdes, txdes, and rx_scratch in stages. On intermediate failures it returned -ENOMEM directly, leaking resources allocated earlier in the function.
Rework the failure path to use staged local unwind labels and free allocated resources in reverse order before returning -ENOMEM. This matches common netdev allocation cleanup style.
--- drivers/net/ethernet/faraday/ftgmac100.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-)
drivers/net/ethernet/faraday/ftgmac100.c +24 -4
@@ -928,19 +928,19 @@ static int ftgmac100_alloc_rings(struct priv->tx_skbs =kcalloc (MAX_TX_QUEUE_ENTRIES ,sizeof (void *),GFP_KERNEL );if (!priv->tx_skbs) -return -ENOMEM ; + goto err_free_rx_skbs;/* Allocate descriptors */ priv->rxdes =dma_alloc_coherent (priv->dev,MAX_RX_QUEUE_ENTRIES *sizeof (struct ftgmac100_rxdes ), &priv->rxdes_dma,GFP_KERNEL );if (!priv->rxdes) -return -ENOMEM ; + goto err_free_tx_skbs; priv->txdes =dma_alloc_coherent (priv->dev,MAX_TX_QUEUE_ENTRIES *sizeof (struct ftgmac100_txdes ), &priv->txdes_dma,GFP_KERNEL );if (!priv->txdes) -return -ENOMEM ; + goto err_free_rxdes;/* Allocate scratch packet buffer */ priv->rx_scratch = dma_alloc_coherent(priv->dev,
@@ -948,9 +948,29 @@ static int ftgmac100_alloc_rings(struct &priv->rx_scratch_dma, GFP_KERNEL);if (!priv->rx_scratch) -return -ENOMEM ; + goto err_free_txdes;return 0 ; + +err_free_txdes: +dma_free_coherent (priv->dev, +MAX_TX_QUEUE_ENTRIES * +sizeof (struct ftgmac100_txdes ), + priv->txdes, priv->txdes_dma); + priv->txdes =NULL ; +err_free_rxdes: +dma_free_coherent (priv->dev, +MAX_RX_QUEUE_ENTRIES * +sizeof (struct ftgmac100_rxdes ), + priv->rxdes, priv->rxdes_dma); + priv->rxdes =NULL ; +err_free_tx_skbs: +kfree (priv->tx_skbs); + priv->tx_skbs =NULL ; +err_free_rx_skbs: +kfree (priv->rx_skbs); + priv->rx_skbs =NULL ; +return -ENOMEM ; }static void ftgmac100_init_rings (struct ftgmac100 *priv)
Greg Kroah-Hartman
maintainerPATCH 254/312 thunderbolt: Fix property read in nhi_wake_supported()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
commit 73a505dc48144ec72e25874e2b2a72487b02d3bc upstream.
device_property_read_foo() returns 0 on success and only then modifies 'val'. Currently, val is left uninitialized if the aforementioned function returns non-zero, making nhi_wake_supported() return true almost always (random != 0) if the property is not present in device firmware.
Invert the check to make it make sense.
--- drivers/thunderbolt/nhi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thunderbolt/nhi.c +1 -1
@@ -1005,7 +1005,7 @@ static bool nhi_wake_supported(struct pc* If power rails are sustainable for wakeup from S4 this * property is set by the BIOS. */ -if (device_property_read_u8 (&pdev->dev,"WAKE_SUPPORTED" , &val)) +if (!device_property_read_u8 (&pdev->dev,"WAKE_SUPPORTED" , &val))return !!val;return true;
Greg Kroah-Hartman
maintainerPATCH 255/312 USB: dummy-hcd: Fix locking/synchronization error
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 616a63ff495df12863692ab3f9f7b84e3fa7a66d upstream.
Syzbot testing was able to provoke an addressing exception and crash in the usb_gadget_udc_reset() routine in drivers/usb/gadgets/udc/core.c, resulting from the fact that the routine was called with a second ("driver") argument of NULL. The bad caller was set_link_state() in dummy_hcd.c, and the problem arose because of a race between a USB reset and driver unbind.
These sorts of races were not supposed to be possible; commit 7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous synchronization change"), along with a few followup commits, was written specifically to prevent them. As it turns out, there are (at least) two errors remaining in the code. Another patch will address the second error; this one is concerned with the first.
The error responsible for the syzbot crash occurred because the stop_activity() routine will sometimes drop and then re-acquire the dum->lock spinlock. A call to stop_activity() occurs in set_link_state() when handling an emulated USB reset, after the test of dum->ints_enabled and before the increment of dum->callback_usage. This allowed another thread (doing a driver unbind) to sneak in and grab the spinlock, and then clear dum->ints_enabled and dum->driver. Normally this other thread would have to wait for dum->callback_usage to go down to 0 before it would clear dum->driver, but in this case it didn't have to wait since dum->callback_usage had not yet been incremented.
The fix is to increment dum->callback_usage _before_ calling stop_activity() instead of after. Then the thread doing the unbind will not clear dum->driver until after the call to usb_gadget_udc_reset() safely returns and dum->callback_usage has been decremented again.
--- drivers/usb/gadget/udc/dummy_hcd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/usb/gadget/udc/dummy_hcd.c +6 -1
@@ -461,8 +461,13 @@ static void set_link_state(struct dummy_/* Report reset and disconnect events to the driver */ if (dum->ints_enabled && (disconnect || reset)) { -stop_activity (dum); ++dum->callback_usage; +/* +* stop_activity() can drop dum->lock, so it must +* not come between the dum->ints_enabled test +* and the ++dum->callback_usage. +*/ +stop_activity (dum);spin_unlock (&dum->lock);if (reset)usb_gadget_udc_reset (&dum->gadget, dum->driver);
Greg Kroah-Hartman
maintainerPATCH 256/312 USB: dummy-hcd: Fix interrupt synchronization error
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 2ca9e46f8f1f5a297eb0ac83f79d35d5b3a02541 upstream.
This fixes an error in synchronization in the dummy-hcd driver. The error has a somewhat involved history. The synchronization mechanism was introduced by commit 7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous synchronization change"), which added an emulated "interrupts enabled" flag together with code emulating synchronize_irq() (it waits until all current handler callbacks have returned).
But the emulated interrupt-disable occurred too late, after the driver containing the handler callback routines had been told that it was unbound and no more callbacks would occur. Commit 4a5d797a9f9c ("usb:
gadget: dummy_hcd: fix gpf in gadget_setup") tried to fix this by moving the synchronize_irq() emulation code from dummy_stop() to dummy_pullup(), which runs before the unbind callback.
There still were races, though, because the emulated interrupt-disable still occurred too late. It couldn't be moved to dummy_pullup(), because that routine can be called for reasons other than an impending unbind. Therefore commits 7dc0c55e9f30 ("USB: UDC core: Add udc_async_callbacks gadget op") and 04145a03db9d ("USB: UDC: Implement udc_async_callbacks in dummy-hcd") added an API allowing the UDC core to tell dummy-hcd exactly when emulated interrupts and their callbacks should be disabled.
That brings us to the current state of things, which is still wrong because the emulated synchronize_irq() occurs before the emulated interrupt-disable! That's no good, beause it means that more emulated interrupts can occur after the synchronize_irq() emulation has run, leading to the possibility that a callback handler may be running when the gadget driver is unbound.
To fix this, we have to move the synchronize_irq() emulation code yet again, to the dummy_udc_async_callbacks() routine, which takes care of enabling and disabling emulated interrupt requests. The synchronization will now run immediately after emulated interrupts are disabled, which is where it belongs.
--- drivers/usb/gadget/udc/dummy_hcd.c | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-)
drivers/usb/gadget/udc/dummy_hcd.c +14 -15
@@ -912,21 +912,6 @@ static int dummy_pullup(struct usb_gadgespin_lock_irqsave (&dum->lock, flags); dum->pullup = (value !=0 );set_link_state (dum_hcd); -if (value ==0 ) { -/* -* Emulate synchronize_irq(): wait for callbacks to finish. -* This seems to be the best place to emulate the call to -* synchronize_irq() that's in usb_gadget_remove_driver(). -* Doing it in dummy_udc_stop() would be too late since it -* is called after the unbind callback and unbind shouldn't -* be invoked until all the other callbacks are finished. -*/ -while (dum->callback_usage >0 ) { -spin_unlock_irqrestore (&dum->lock, flags); -usleep_range (1000 ,2000 ); -spin_lock_irqsave (&dum->lock, flags); - } - }spin_unlock_irqrestore (&dum->lock, flags);usb_hcd_poll_rh_status (dummy_hcd_to_hcd (dum_hcd));
@@ -949,6 +934,20 @@ static void dummy_udc_async_callbacks(stspin_lock_irq (&dum->lock); dum->ints_enabled = enable; +if (!enable) { +/* +* Emulate synchronize_irq(): wait for callbacks to finish. +* This has to happen after emulated interrupts are disabled +* (dum->ints_enabled is clear) and before the unbind callback, +* just like the call to synchronize_irq() in +* gadget/udc/core:gadget_unbind_driver(). +*/ +while (dum->callback_usage >0 ) { +spin_unlock_irq (&dum->lock); +usleep_range (1000 ,2000 ); +spin_lock_irq (&dum->lock); + } + }spin_unlock_irq (&dum->lock); }
Greg Kroah-Hartman
maintainerPATCH 257/312 usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Urban <[email protected]>
commit f50200dd44125e445a6164e88c217472fa79cdbc upstream.
When a gadget request is only partially transferred in transfer() because the per-frame bandwidth budget is exhausted, the loop advances to the next queued request. If that next request is a zero-length packet (ZLP), len evaluates to zero and the code takes the unlikely(len == 0) path, which sets is_short = 1. This bypasses the bandwidth guard ("limit < ep->ep.maxpacket && limit < len") that lives in the else branch and would otherwise break out of the loop for non-zero requests. The is_short path then completes the URB before all data from the first request has been transferred.
Reproducer (bulk IN, high speed):
Device side (FunctionFS with Linux AIO):
1. Queue a 65024-byte write via io_submit (127 * 512, i.e. a multiple of the HS bulk max packet size).
2. Immediately queue a zero-length write (ZLP) via io_submit.
Host side:
3. Submit a 65536-byte bulk IN URB.
Expected: URB completes with actual_length = 65024.
Actual: URB completes with actual_length = 53248, losing 11776
bytes that leak into subsequent URBs.
At high speed the per-frame budget is 53248 bytes (512 * 13 * 8). The 65024-byte request exhausts this budget after 53248 bytes, leaving the request incomplete (req->req.actual < req->req.length). Neither the request nor the URB is finished, and rescan is 0, so the loop advances to the ZLP. For the ZLP, dev_len = 0, so len = min(12288, 0) = 0, taking the unlikely(len == 0) path and setting is_short = 1. The is_short handler then sets *status = 0, completing the URB with only 53248 of the expected 65024 bytes.
Fix this by breaking out of the loop when the current request has remaining data (req->req.actual < req->req.length). The request resumes on the next timer tick, preserving correct data ordering.
--- drivers/usb/gadget/udc/dummy_hcd.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/gadget/udc/dummy_hcd.c +6 -0
@@ -1538,6 +1538,12 @@ top:/* rescan to continue with any other queued i/o */ if (rescan) goto top; + +/* request not fully transferred; stop iterating to +* preserve data ordering across queued requests. +*/ +if (req->req.actual < req->req.length) +break ; }return sent; }
Greg Kroah-Hartman
maintainerPATCH 258/312 btrfs: fix the qgroup data free range for inline data extents
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 0bb067ca64e35536f1f5d9ef6aaafc40f4833623 ]
Inside function __cow_file_range_inline() since the inlined data no longer take any data space, we need to free up the reserved space.
However the code is still using the old page size == sector size assumption, and will not handle subpage case well.
Thankfully it is not going to cause any problems because we have two extra safe nets:
- Inline data extents creation is disabled for sector size < page size cases for now
But it won't stay that for long.
- btrfs_qgroup_free_data() will only clear ranges which have been already reserved
So even if we pass a range larger than what we need, it should still be fine, especially there is only reserved space for a single block at file offset 0 of an inline data extent.
But just for the sake of consistency, fix the call site to use sectorsize instead of page size.
Stable-dep-of: f8da41de0bff ("btrfs: do not free data reservation in fallback from inline due to -ENOSPC")
--- fs/btrfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/inode.c +1 -1
@@ -469,7 +469,7 @@ static noinline int cow_file_range_inline(struct btrfs_inode *inode, u64 size,* And at reserve time, it's always aligned to page size, so * just free one page here. */ -btrfs_qgroup_free_data (inode,NULL ,0 ,PAGE_SIZE ,NULL ); +btrfs_qgroup_free_data (inode,NULL ,0 , fs_info->sectorsize,NULL );btrfs_free_path (path);if (trans)btrfs_end_transaction (trans);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 259/312 btrfs: do not free data reservation in fallback from inline due to -ENOSPC
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit f8da41de0bff9eb1d774a7253da0c9f637c4470a ]
If we fail to create an inline extent due to -ENOSPC, we will attempt to go through the normal COW path, reserve an extent, create an ordered extent, etc. However we were always freeing the reserved qgroup data, which is wrong since we will use data. Fix this by freeing the reserved qgroup data in __cow_file_range_inline() only if we are not doing the fallback (ret is <= 0).
--- fs/btrfs/inode.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/btrfs/inode.c +5 -1
@@ -468,8 +468,12 @@ static noinline int cow_file_range_inline(struct btrfs_inode *inode, u64 size,* it won't count as data extent, free them directly here. * And at reserve time, it's always aligned to page size, so * just free one page here. +* +* If we fallback to non-inline (ret == 1) due to -ENOSPC, then we need +* to keep the data reservation. */ -btrfs_qgroup_free_data (inode,NULL ,0 , fs_info->sectorsize,NULL ); +if (ret <=0 ) +btrfs_qgroup_free_data (inode,NULL ,0 , fs_info->sectorsize,NULL );btrfs_free_path (path);if (trans)btrfs_end_transaction (trans);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 260/312 Revert "nvme: fix admin request_queue lifetime"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heyne, Maximilian <[email protected]>
This reverts commit ff037b5f47eeccc1636c03f84cd47db094eb73c9.
The backport of upstream commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime") to 6.1 is broken in 2 ways. First of all it doesn't actually fix the issue because blk_put_queue will still be called as part of blk_mq_destroy_queue in nvme_remove_admin_tag_set leading to the UAF.
Second, the backport leads to a refcount underflow when unbinding a pci nvme device:
refcount_t: underflow; use-after-free.
WARNING: CPU: 2 PID: 1486 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 Modules linked in: bochs drm_vram_helper simpledrm skx_edac_common drm_shmem_helper drm_kms_helper kvm_intel cfbfillrect syscopyarea cfbimgblt sysfillrect sysimgblt fb_sys_fops cfbcopyarea drm_ttm_helper fb ttm kvm fbdev drm mousedev nls_ascii psmouse irqbypass nls_cp437 atkbd crc32_pclmul crc32c_intel libps2 vfat fat sunrpc virtio_net ata_piix vivaldi_fmap drm_panel_orientation_quirks libata backlight i2c_piix4 net_failover i8042 ghash_clmulni_intel failover serio i2c_core button sch_fq_codel CPU: 2 PID: 1486 Comm: bash Not tainted 6.1.167 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20240813-306.amzn2 08/13/2024 RIP: 0010:refcount_warn_saturate+0xba/0x110 Code: 01 01 e8 89 79 ad ff 0f 0b e9 82 f4 7e 00 80 3d 73 03 cc 01 00 75 85 48 c7 c7 e0 5d 3b 8e c6 05 63 03 cc 01 01 e8 66 79 ad ff <0f> 0b c3 cc cc cc cc 80 3d 4e 03 cc 01 00 0f 85 5e ff ff ff 48 c7 RSP: 0018:ffffd0cc011bfd18 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8ada07b33210 RCX: 0000000000000027 RDX: ffff8adb37d1f728 RSI: 0000000000000001 RDI: ffff8adb37d1f720 RBP: ffff8ada07b33000 R08: 0000000000000000 R09: 00000000fffeffff R10: ffffd0cc011bfba8 R11: ffffffff8f1781a8 R12: ffffd0cc011bfd38 R13: ffff8ada03080800 R14: ffff8ada07b33210 R15: ffff8ada07b33b10 FS: 00007f50f6964740(0000) GS:ffff8adb37d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055cdb54e6ae0 CR3: 000000010224e001 CR4: 0000000000770ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> nvme_pci_free_ctrl+0x45/0x80 nvme_free_ctrl+0x1aa/0x2b0 device_release+0x34/0x90 kobject_cleanup+0x3a/0x130 pci_device_remove+0x3e/0xb0 device_release_driver_internal+0x1aa/0x230 unbind_store+0x11f/0x130 kernfs_fop_write_iter+0x13a/0x1d0 vfs_write+0x2a6/0x3b0 ksys_write+0x5f/0xe0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 RIP: 0033:0x7f50f66ff897 Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 RSP: 002b:00007fffaef903d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f50f67fd780 RCX: 00007f50f66ff897 RDX: 000000000000000d RSI: 0000557f72ef6b90 RDI: 0000000000000001 RBP: 000000000000000d R08: 0000000000000000 R09: 00007f50f67b2d20 R10: 00007f50f67b2c20 R11: 0000000000000246 R12: 000000000000000d R13: 0000557f72ef6b90 R14: 000000000000000d R15: 00007f50f67f89c0 </TASK>
The reason for this is that nvme_free_ctrl calls ->free_ctrl which resolves to nvme_pci_free_ctrl in aforementioned case which also has a blk_put_queue, so the admin queue is put twice. This is because on 6.1 we're missing the commit 96ef1be53663 ("nvme-pci: put the admin queue in nvme_dev_remove_admin").
--- drivers/nvme/host/core.c | 2 -- 1 file changed, 2 deletions(-)
drivers/nvme/host/core.c +0 -2
@@ -5180,8 +5180,6 @@ static void nvme_free_ctrl(struct device *dev) container_of(dev, struct nvme_ctrl, ctrl_device);struct nvme_subsystem *subsys = ctrl->subsys; -if (ctrl->admin_q) -blk_put_queue (ctrl->admin_q);if (!subsys || ctrl->instance != subsys->instance)ida_free (&nvme_instance_ida, ctrl->instance);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 261/312 blk-mq: move the call to blk_put_queue out of blk_mq_destroy_queue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 2b3f056f72e56fa07df69b4705e0b46a6c08e77c ]
The fact that blk_mq_destroy_queue also drops a queue reference leads to various places having to grab an extra reference. Move the call to blk_put_queue into the callers to allow removing the extra references.
Stable-dep-of: 03b3bcd319b3 ("nvme: fix admin request_queue lifetime")
--- block/blk-mq.c | 4 +--- block/bsg-lib.c | 2 ++ drivers/nvme/host/apple.c | 1 + drivers/nvme/host/core.c | 10 ++++++++-- drivers/nvme/host/pci.c | 1 + drivers/scsi/scsi_sysfs.c | 1 + drivers/ufs/core/ufshcd.c | 2 ++ 7 files changed, 16 insertions(+), 5 deletions(-)
block/blk-mq.c +1 -3
@@ -4194,9 +4194,6 @@ void blk_mq_destroy_queue(struct request_queue *q)blk_sync_queue (q);blk_mq_cancel_work_sync (q);blk_mq_exit_queue (q); - -/* @q is and will stay empty, shutdown and put */ -blk_put_queue (q); }EXPORT_SYMBOL (blk_mq_destroy_queue);
@@ -4213,6 +4210,7 @@ struct gendisk *__blk_mq_alloc_disk(struct blk_mq_tag_set *set, void *queuedata, disk =__alloc_disk_node (q, set->numa_node, lkclass);if (!disk) {blk_mq_destroy_queue (q); +blk_put_queue (q);return ERR_PTR (-ENOMEM ); }set_bit (GD_OWNS_QUEUE , &disk->state);
block/bsg-lib.c +2 -0
@@ -325,6 +325,7 @@ void bsg_remove_queue(struct request_queue *q)bsg_unregister_queue (bset->bd);blk_mq_destroy_queue (q); +blk_put_queue (q);blk_mq_free_tag_set (&bset->tag_set);kfree (bset); }
@@ -400,6 +401,7 @@ struct request_queue *bsg_setup_queue(struct device *dev, const char *name,return q; out_cleanup_queue:blk_mq_destroy_queue (q); +blk_put_queue (q); out_queue:blk_mq_free_tag_set (set); out_tag_set:
drivers/nvme/host/apple.c +1 -0
@@ -1510,6 +1510,7 @@ static int apple_nvme_probe(struct platform_device *pdev)if (!blk_get_queue (anv->ctrl.admin_q)) {nvme_start_admin_queue (&anv->ctrl);blk_mq_destroy_queue (anv->ctrl.admin_q); +blk_put_queue (anv->ctrl.admin_q); anv->ctrl.admin_q =NULL ; ret = -ENODEV ; goto put_dev;
drivers/nvme/host/core.c +8 -2
@@ -5031,6 +5031,7 @@ int nvme_alloc_admin_tag_set(struct nvme_ctrl *ctrl, struct blk_mq_tag_set *set, out_cleanup_admin_q:blk_mq_destroy_queue (ctrl->admin_q); +blk_put_queue (ctrl->admin_q); out_free_tagset:blk_mq_free_tag_set (set); ctrl->admin_q =NULL ;
@@ -5042,8 +5043,11 @@ EXPORT_SYMBOL_GPL(nvme_alloc_admin_tag_set);void nvme_remove_admin_tag_set (struct nvme_ctrl *ctrl) {blk_mq_destroy_queue (ctrl->admin_q); -if (ctrl->ops->flags &NVME_F_FABRICS ) +blk_put_queue (ctrl->admin_q); +if (ctrl->ops->flags &NVME_F_FABRICS ) {blk_mq_destroy_queue (ctrl->fabrics_q); +blk_put_queue (ctrl->fabrics_q); + }blk_mq_free_tag_set (ctrl->admin_tagset); }EXPORT_SYMBOL_GPL (nvme_remove_admin_tag_set);
@@ -5099,8 +5103,10 @@ EXPORT_SYMBOL_GPL(nvme_alloc_io_tag_set);void nvme_remove_io_tag_set (struct nvme_ctrl *ctrl) { -if (ctrl->ops->flags &NVME_F_FABRICS ) +if (ctrl->ops->flags &NVME_F_FABRICS ) {blk_mq_destroy_queue (ctrl->connect_q); +blk_put_queue (ctrl->connect_q); + }blk_mq_free_tag_set (ctrl->tagset); }EXPORT_SYMBOL_GPL (nvme_remove_io_tag_set);
drivers/nvme/host/pci.c +1 -0
@@ -1783,6 +1783,7 @@ static void nvme_dev_remove_admin(struct nvme_dev *dev)*/ nvme_start_admin_queue (&dev->ctrl);blk_mq_destroy_queue (dev->ctrl.admin_q); +blk_put_queue (dev->ctrl.admin_q);blk_mq_free_tag_set (&dev->admin_tagset); } }
drivers/scsi/scsi_sysfs.c +1 -0
@@ -1486,6 +1486,7 @@ void __scsi_remove_device(struct scsi_device *sdev)mutex_unlock (&sdev->state_mutex);blk_mq_destroy_queue (sdev->request_queue); +blk_put_queue (sdev->request_queue);kref_put (&sdev->host->tagset_refcnt, scsi_mq_free_tags);cancel_work_sync (&sdev->requeue_work);
drivers/ufs/core/ufshcd.c +2 -0
@@ -9651,6 +9651,7 @@ void ufshcd_remove(struct ufs_hba *hba)ufshpb_remove (hba);ufs_sysfs_remove_nodes (hba->dev);blk_mq_destroy_queue (hba->tmf_queue); +blk_put_queue (hba->tmf_queue);blk_mq_free_tag_set (&hba->tmf_tag_set);scsi_remove_host (hba->host);/* disable interrupts */
@@ -9953,6 +9954,7 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) free_tmf_queue:blk_mq_destroy_queue (hba->tmf_queue); +blk_put_queue (hba->tmf_queue); free_tmf_tag_set:blk_mq_free_tag_set (&hba->tmf_tag_set); out_remove_scsi_host:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 262/312 nvme-pci: remove an extra queue reference
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 7dcebef90d35de13a326f765dd787538880566f9 ]
Now that blk_mq_destroy_queue does not release the queue reference, there is no need for a second admin queue reference to be held by the nvme_dev.
Stable-dep-of: 03b3bcd319b3 ("nvme: fix admin request_queue lifetime")
--- drivers/nvme/host/pci.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/nvme/host/pci.c +0 -6
@@ -1783,7 +1783,6 @@ static void nvme_dev_remove_admin(struct nvme_dev *dev)*/ nvme_start_admin_queue (&dev->ctrl);blk_mq_destroy_queue (dev->ctrl.admin_q); -blk_put_queue (dev->ctrl.admin_q);blk_mq_free_tag_set (&dev->admin_tagset); } }
@@ -1812,11 +1811,6 @@ static int nvme_pci_alloc_admin_tag_set(struct nvme_dev *dev) dev->ctrl.admin_q =NULL ;return -ENOMEM ; } -if (!blk_get_queue (dev->ctrl.admin_q)) { -nvme_dev_remove_admin (dev); - dev->ctrl.admin_q =NULL ; -return -ENODEV ; - }return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 263/312 nvme-pci: put the admin queue in nvme_dev_remove_admin
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 96ef1be53663a9343dffcf106e2f1b59da4b8799 ]
Once the controller is shutdown no one can access the admin queue. Tear it down in nvme_dev_remove_admin, which matches the flow in the other drivers.
Tested-by Gerd Bayer <[email protected]>
[ Context change due to missing commit 94cc781f69f4 ("nvme: move OPAL
setup from PCIe to core")]
Stable-dep-of: 03b3bcd319b3 ("nvme: fix admin request_queue lifetime")
--- drivers/nvme/host/pci.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/nvme/host/pci.c +1 -2
@@ -1783,6 +1783,7 @@ static void nvme_dev_remove_admin(struct nvme_dev *dev)*/ nvme_start_admin_queue (&dev->ctrl);blk_mq_destroy_queue (dev->ctrl.admin_q); +blk_put_queue (dev->ctrl.admin_q);blk_mq_free_tag_set (&dev->admin_tagset); } }
@@ -2838,8 +2839,6 @@ static void nvme_pci_free_ctrl(struct nvme_ctrl *ctrl)nvme_dbbuf_dma_free (dev);nvme_free_tagset (dev); -if (dev->ctrl.admin_q) -blk_put_queue (dev->ctrl.admin_q);free_opal_dev (dev->ctrl.opal_dev);mempool_destroy (dev->iod_mempool);put_device (dev->dev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 264/312 nvme: fix admin request_queue lifetime
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit 03b3bcd319b3ab5182bc9aaa0421351572c78ac0]
The namespaces can access the controller's admin request_queue, and stale references on the namespaces may exist after tearing down the controller. Ensure the admin request_queue is active by moving the controller's 'put' to after all controller references have been released to ensure no one is can access the request_queue. This fixes a reported use-after-free bug:
BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0 Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287 CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15 Tainted: [E]=UNSIGNED_MODULE Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025 Call Trace: <TASK> dump_stack_lvl+0x4f/0x60 print_report+0xc4/0x620 ? _raw_spin_lock_irqsave+0x70/0xb0 ? _raw_read_unlock_irqrestore+0x30/0x30 ? blk_queue_enter+0x41c/0x4a0 kasan_report+0xab/0xe0 ? blk_queue_enter+0x41c/0x4a0 blk_queue_enter+0x41c/0x4a0 ? __irq_work_queue_local+0x75/0x1d0 ? blk_queue_start_drain+0x70/0x70 ? irq_work_queue+0x18/0x20 ? vprintk_emit.part.0+0x1cc/0x350 ? wake_up_klogd_work_func+0x60/0x60 blk_mq_alloc_request+0x2b7/0x6b0 ? __blk_mq_alloc_requests+0x1060/0x1060 ? __switch_to+0x5b7/0x1060 nvme_submit_user_cmd+0xa9/0x330 nvme_user_cmd.isra.0+0x240/0x3f0 ? force_sigsegv+0xe0/0xe0 ? nvme_user_cmd64+0x400/0x400 ? vfs_fileattr_set+0x9b0/0x9b0 ? cgroup_update_frozen_flag+0x24/0x1c0 ? cgroup_leave_frozen+0x204/0x330 ? nvme_ioctl+0x7c/0x2c0 blkdev_ioctl+0x1a8/0x4d0 ? blkdev_common_ioctl+0x1930/0x1930 ? fdget+0x54/0x380 __x64_sys_ioctl+0x129/0x190 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f765f703b0b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000 R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003 R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60 </TASK>
[ Because we're missing commit 0da7feaa5913 ("nvme-pci: use the tagset
alloc/free helpers") we need to additionally remove the blk_put_queue from nvme_dev_remove_admin in pci.c to properly fix the UAF ]
--- drivers/nvme/host/core.c | 3 ++- drivers/nvme/host/pci.c | 1 - 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/nvme/host/core.c +2 -1
@@ -5043,7 +5043,6 @@ EXPORT_SYMBOL_GPL(nvme_alloc_admin_tag_set);void nvme_remove_admin_tag_set (struct nvme_ctrl *ctrl) {blk_mq_destroy_queue (ctrl->admin_q); -blk_put_queue (ctrl->admin_q);if (ctrl->ops->flags &NVME_F_FABRICS ) {blk_mq_destroy_queue (ctrl->fabrics_q);blk_put_queue (ctrl->fabrics_q);
@@ -5186,6 +5185,8 @@ static void nvme_free_ctrl(struct device *dev) container_of(dev, struct nvme_ctrl, ctrl_device);struct nvme_subsystem *subsys = ctrl->subsys; +if (ctrl->admin_q) +blk_put_queue (ctrl->admin_q);if (!subsys || ctrl->instance != subsys->instance)ida_free (&nvme_instance_ida, ctrl->instance);
drivers/nvme/host/pci.c +0 -1
@@ -1783,7 +1783,6 @@ static void nvme_dev_remove_admin(struct nvme_dev *dev)*/ nvme_start_admin_queue (&dev->ctrl);blk_mq_destroy_queue (dev->ctrl.admin_q); -blk_put_queue (dev->ctrl.admin_q);blk_mq_free_tag_set (&dev->admin_tagset); } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 265/312 nvme: fix admin queue leak on controller reset
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
[ Upstream commit b84bb7bd913d8ca2f976ee6faf4a174f91c02b8d ]
When nvme_alloc_admin_tag_set() is called during a controller reset, a previous admin queue may still exist. Release it properly before allocating a new one to avoid orphaning the old queue.
This fixes a regression introduced by commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime").
[ Have to do analogous work in nvme_pci_alloc_admin_tag_set in pci.c due
to missing upstream commit 0da7feaa5913 ("nvme-pci: use the tagset alloc/free helpers") ]
--- drivers/nvme/host/core.c | 7 +++++++ drivers/nvme/host/pci.c | 7 +++++++ 2 files changed, 14 insertions(+)
drivers/nvme/host/core.c +7 -0
@@ -5012,6 +5012,13 @@ int nvme_alloc_admin_tag_set(struct nvme_ctrl *ctrl, struct blk_mq_tag_set *set,if (ret)return ret; +/* +* If a previous admin queue exists (e.g., from before a reset), +* put it now before allocating a new one to avoid orphaning it. +*/ +if (ctrl->admin_q) +blk_put_queue (ctrl->admin_q); + ctrl->admin_q =blk_mq_init_queue (set);if (IS_ERR (ctrl->admin_q)) { ret =PTR_ERR (ctrl->admin_q);
drivers/nvme/host/pci.c +7 -0
@@ -1805,6 +1805,13 @@ static int nvme_pci_alloc_admin_tag_set(struct nvme_dev *dev)return -ENOMEM ; dev->ctrl.admin_tagset = set; +/* +* If a previous admin queue exists (e.g., from before a reset), +* put it now before allocating a new one to avoid orphaning it. +*/ +if (dev->ctrl.admin_q) +blk_put_queue (dev->ctrl.admin_q); + dev->ctrl.admin_q =blk_mq_init_queue (set);if (IS_ERR (dev->ctrl.admin_q)) {blk_mq_free_tag_set (set);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 266/312 mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Law <[email protected]>
Multiple sysfs command paths dereference contexts_arr[0] without first verifying that kdamond->contexts->nr == 1. A user can set nr_contexts to 0 via sysfs while DAMON is running, causing NULL pointer dereferences.
In more detail, the issue can be triggered by privileged users like below.
First, start DAMON and make contexts directory empty (kdamond->contexts->nr == 0).
# damo start
# cd /sys/kernel/mm/damon/admin/kdamonds/0
# echo 0 > contexts/nr_contextsThen, each of below commands will cause the NULL pointer dereference.
# echo update_schemes_stats > state
# echo update_schemes_tried_regions > state
# echo update_schemes_tried_bytes > state
# echo update_schemes_effective_quotas > state
# echo update_tuned_intervals > stateGuard all commands (except OFF) at the entry point of damon_sysfs_handle_cmd().
(cherry picked from commit 1bfe9fb5ed2667fb075682408b776b5273162615)
--- mm/damon/sysfs.c | 3 +++ 1 file changed, 3 insertions(+)
mm/damon/sysfs.c +3 -0
@@ -2576,6 +2576,9 @@ static int damon_sysfs_handle_cmd(enum damon_sysfs_cmd cmd, {bool need_wait = true; +if (cmd !=DAMON_SYSFS_CMD_OFF && kdamond->contexts->nr !=1 ) +return -EINVAL ; +/* Handle commands that doesn't access DAMON context-internal data */ switch (cmd) {case DAMON_SYSFS_CMD_ON :
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 267/312 net: enetc: fix PF !of_device_is_available() teardown path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
Upstream commit e15c5506dd39 ("net: enetc: allocate vf_state during PF probes") was backported incorrectly to kernels where enetc_pf_probe() still has to manually check whether the OF node of the PCI device is enabled.
In kernels which contain commit bfce089ddd0e ("net: enetc: remove of_device_is_available() handling") and its dependent change, commit 6fffbc7ae137 ("PCI: Honor firmware's device disabled status"), the "err_device_disabled" label has disappeared. Yet, linux-6.1.y and earlier still contains it.
The trouble is that upstream commit e15c5506dd39 ("net: enetc: allocate vf_state during PF probes"), backported as 35668e29e979 in linux-6.1.y, introduces new code for the err_setup_mac_addresses and err_alloc_netdev labels which calls kfree(pf->vf_state). This code must not execute for the err_device_disabled label, because at that stage, the pf structure has not yet been allocated, and is an uninitialized pointer.
By moving the err_device_disabled label to undo just the previous operation, i.e. a successful enetc_psi_create() call with enetc_psi_destroy(), the dereference of uninitialized pf->vf_state is avoided.
--- drivers/net/ethernet/freescale/enetc/enetc_pf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/freescale/enetc/enetc_pf.c +1 -1
@@ -1393,10 +1393,10 @@ static int enetc_pf_probe(struct pci_dev *pdev, si->ndev =NULL ;free_netdev (ndev); err_alloc_netdev: -err_device_disabled: err_setup_mac_addresses:kfree (pf->vf_state); err_alloc_vf_state: +err_device_disabled:enetc_psi_destroy (pdev); err_psi_create:return err;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 268/312 usb: gadget: uvc: fix NULL pointer dereference during unbind race
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jimmy Hu <[email protected]>
commit eba2936bbe6b752a31725a9eb5c674ecbf21ee7d upstream.
Commit b81ac4395bbe ("usb: gadget: uvc: allow for application to cleanly shutdown") introduced two stages of synchronization waits totaling 1500ms in uvc_function_unbind() to prevent several types of kernel panics. However, this timing-based approach is insufficient during power management (PM) transitions.
When the PM subsystem starts freezing user space processes, the wait_event_interruptible_timeout() is aborted early, which allows the unbind thread to proceed and nullify the gadget pointer (cdev->gadget = NULL):
[ 814.123447][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind() [ 814.178583][ T3173] PM: suspend entry (deep) [ 814.192487][ T3173] Freezing user space processes [ 814.197668][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind no clean disconnect, wait for release
When the PM subsystem resumes or aborts the suspend and tasks are restarted, the V4L2 release path is executed and attempts to access the already nullified gadget pointer, triggering a kernel panic:
[ 814.292597][ C0] PM: pm_system_irq_wakeup: 479 triggered dhdpcie_host_wake [ 814.386727][ T3173] Restarting tasks ... [ 814.403522][ T4558] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030 [ 814.404021][ T4558] pc : usb_gadget_deactivate+0x14/0xf4 [ 814.404031][ T4558] lr : usb_function_deactivate+0x54/0x94 [ 814.404078][ T4558] Call trace: [ 814.404080][ T4558] usb_gadget_deactivate+0x14/0xf4 [ 814.404083][ T4558] usb_function_deactivate+0x54/0x94 [ 814.404087][ T4558] uvc_function_disconnect+0x1c/0x5c [ 814.404092][ T4558] uvc_v4l2_release+0x44/0xac [ 814.404095][ T4558] v4l2_release+0xcc/0x130
Address the race condition and NULL pointer dereference by:
1. State Synchronization (flag + mutex)
Introduce a 'func_unbound' flag in struct uvc_device. This allows uvc_function_disconnect() to safely skip accessing the nullified cdev->gadget pointer. As suggested by Alan Stern, this flag is protected by a new mutex (uvc->lock) to ensure proper memory ordering and prevent instruction reordering or speculative loads. This mutex is also used to protect 'func_connected' for consistent state management.
2. Explicit Synchronization (completion)
Use a completion to synchronize uvc_function_unbind() with the uvc_vdev_release() callback. This prevents Use-After-Free (UAF) by ensuring struct uvc_device is freed after all video device resources are released.
--- drivers/usb/gadget/function/f_uvc.c | 39 ++++++++++++++++++++++++++++++--- drivers/usb/gadget/function/uvc.h | 3 ++ drivers/usb/gadget/function/uvc_v4l2.c | 5 +++- 3 files changed, 43 insertions(+), 4 deletions(-)
drivers/usb/gadget/function/f_uvc.c +36 -3
@@ -397,6 +397,12 @@ uvc_function_disconnect(struct uvc_devic {int ret; +guard (mutex)(&uvc->lock); +if (uvc->func_unbound) { +dev_dbg (&uvc->vdev.dev,"skipping function deactivate (unbound)\n" ); +return ; + } +if ((ret =usb_function_deactivate (&uvc->func)) <0 )uvcg_info (&uvc->func,"UVC disconnect failed with %d\n" , ret); }
@@ -415,6 +421,15 @@ static ssize_t function_name_show(structstatic DEVICE_ATTR_RO (function_name); +static void uvc_vdev_release (struct video_device *vdev) +{ +struct uvc_device *uvc =video_get_drvdata (vdev); + +/* Signal uvc_function_unbind() that the video device has been released */ +if (uvc->vdev_release_done) +complete (uvc->vdev_release_done); +} +static int uvc_register_video (struct uvc_device *uvc) {
@@ -427,7 +442,7 @@ uvc_register_video(struct uvc_device *uv uvc->vdev.v4l2_dev->dev = &cdev->gadget->dev; uvc->vdev.fops = &uvc_v4l2_fops; uvc->vdev.ioctl_ops = &uvc_v4l2_ioctl_ops; - uvc->vdev.release = video_device_release_empty; + uvc->vdev.release = uvc_vdev_release; uvc->vdev.vfl_dir =VFL_DIR_TX ; uvc->vdev.lock = &uvc->video.mutex; uvc->vdev.device_caps =V4L2_CAP_VIDEO_OUTPUT |V4L2_CAP_STREAMING ;
@@ -602,6 +617,8 @@ uvc_function_bind(struct usb_configuratiint ret = -EINVAL ;uvcg_info (f,"%s()\n" , __func__); +scoped_guard (mutex, &uvc->lock) + uvc->func_unbound = false; opts =fi_to_f_uvc_opts (f->fi);/* Sanity check the streaming endpoint module parameters. */
@@ -897,12 +914,19 @@ static void uvc_free(struct usb_functionstatic void uvc_function_unbind (struct usb_configuration *c,struct usb_function *f) { +DECLARE_COMPLETION_ONSTACK (vdev_release_done);struct usb_composite_dev *cdev = c->cdev;struct uvc_device *uvc =to_uvc (f);struct uvc_video *video = &uvc->video;long wait_ret =1 ; +bool connected;uvcg_info (f,"%s()\n" , __func__); + scoped_guard(mutex, &uvc->lock) { + uvc->func_unbound = true; + uvc->vdev_release_done = &vdev_release_done; + connected = uvc->func_connected; + }if (video->async_wq)destroy_workqueue (video->async_wq);
@@ -913,7 +937,7 @@ static void uvc_function_unbind(struct u* though the video device removal uevent. Allow some time for the * application to close out before things get deleted. */ -if (uvc->func_connected) { +if (connected) {uvcg_dbg (f,"waiting for clean disconnect\n" ); wait_ret =wait_event_interruptible_timeout (uvc->func_connected_queue, uvc->func_connected == false,msecs_to_jiffies (500 ));
@@ -924,7 +948,10 @@ static void uvc_function_unbind(struct uvideo_unregister_device (&uvc->vdev);v4l2_device_unregister (&uvc->v4l2_dev); -if (uvc->func_connected) { +scoped_guard (mutex, &uvc->lock) + connected = uvc->func_connected; + +if (connected) {/* * Wait for the release to occur to ensure there are no longer any * pending operations that may cause panics when resources are cleaned
@@ -936,6 +963,10 @@ static void uvc_function_unbind(struct uuvcg_dbg (f,"done waiting for release with ret: %ld\n" , wait_ret); } +/* Wait for the video device to be released */ +wait_for_completion (&vdev_release_done); + uvc->vdev_release_done =NULL ; +usb_ep_free_request (cdev->gadget->ep0, uvc->control_req);kfree (uvc->control_buf);
@@ -954,6 +985,8 @@ static struct usb_function *uvc_alloc(streturn ERR_PTR (-ENOMEM );mutex_init (&uvc->video.mutex); +mutex_init (&uvc->lock); + uvc->func_unbound = true; uvc->state =UVC_STATE_DISCONNECTED ;init_waitqueue_head (&uvc->func_connected_queue); opts =fi_to_f_uvc_opts (fi);
drivers/usb/gadget/function/uvc.h +3 -0
@@ -131,6 +131,9 @@ struct uvc_device {enum uvc_state state;struct usb_function func;struct uvc_video video; +struct completion *vdev_release_done; +struct mutex lock;/* protects func_unbound and func_connected */ +bool func_unbound;bool func_connected;wait_queue_head_t func_connected_queue;
drivers/usb/gadget/function/uvc_v4l2.c +4 -1
@@ -497,6 +497,8 @@ uvc_v4l2_subscribe_event(struct v4l2_fhif (sub->type <UVC_EVENT_FIRST || sub->type >UVC_EVENT_LAST )return -EINVAL ; +guard (mutex)(&uvc->lock); +if (sub->type ==UVC_EVENT_SETUP && uvc->func_connected)return -EBUSY ;
@@ -518,7 +520,8 @@ static void uvc_v4l2_disable(struct uvc_uvc_function_disconnect (uvc);uvcg_video_enable (&uvc->video,0 );uvcg_free_buffers (&uvc->video.queue); - uvc->func_connected = false; +scoped_guard (mutex, &uvc->lock) + uvc->func_connected = false;wake_up_interruptible (&uvc->func_connected_queue); }
Greg Kroah-Hartman
maintainerPATCH 269/312 usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <[email protected]>
commit caa27923aacd8a5869207842f2ab1657c6c0c7bc upstream.
geth_alloc() increments the reference count, but geth_free() fails to decrement it. This prevents the configuration of attributes via configfs after unlinking the function.
Decrement the reference count in geth_free() to ensure proper cleanup.
--- drivers/usb/gadget/function/f_subset.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/gadget/function/f_subset.c +6 -0
@@ -6,6 +6,7 @@* Copyright (C) 2008 Nokia Corporation */ +#include <linux/cleanup.h> #include <linux/slab.h> #include <linux/kernel.h> #include <linux/module.h>
@@ -451,8 +452,13 @@ static struct usb_function_instance *getstatic void geth_free (struct usb_function *f) {struct f_gether *eth; +struct f_gether_opts *opts; + + opts = container_of(f->fi, struct f_gether_opts, func_inst); eth =func_to_geth (f); +scoped_guard (mutex, &opts->lock) + opts->refcnt--;kfree (eth); }
Greg Kroah-Hartman
maintainerPATCH 270/312 usb: gadget: f_rndis: Protect RNDIS options with mutex
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <[email protected]>
commit 8d8c68b1fc06ece60cf43e1306ff0f4ac121547e upstream.
The class/subclass/protocol options are suspectible to race conditions as they can be accessed concurrently through configfs.
Use existing mutex to protect these options. This issue was identified during code inspection.
--- drivers/usb/gadget/function/f_rndis.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/usb/gadget/function/f_rndis.c +6 -3
@@ -11,6 +11,7 @@/* #define VERBOSE_DEBUG */ +#include <linux/cleanup.h> #include <linux/slab.h> #include <linux/kernel.h> #include <linux/module.h>
@@ -691,9 +692,11 @@ rndis_bind(struct usb_configuration *c,return -ENOMEM ; } - rndis_iad_descriptor.bFunctionClass = rndis_opts->class; - rndis_iad_descriptor.bFunctionSubClass = rndis_opts->subclass; - rndis_iad_descriptor.bFunctionProtocol = rndis_opts->protocol; + scoped_guard(mutex, &rndis_opts->lock) { + rndis_iad_descriptor.bFunctionClass = rndis_opts->class; + rndis_iad_descriptor.bFunctionSubClass = rndis_opts->subclass; + rndis_iad_descriptor.bFunctionProtocol = rndis_opts->protocol; + }/* * in drivers/usb/gadget/configfs.c:configfs_composite_bind()
Greg Kroah-Hartman
maintainerPATCH 271/312 usb: gadget: f_uac1_legacy: validate control request size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taegu Ha <[email protected]>
commit 6e0e34d85cd46ceb37d16054e97a373a32770f6c upstream.
f_audio_complete() copies req->length bytes into a 4-byte stack variable:
u32 data = 0; memcpy(&data, req->buf, req->length);
req->length is derived from the host-controlled USB request path, which can lead to a stack out-of-bounds write.
Validate req->actual against the expected payload size for the supported control selectors and decode only the expected amount of data.
This avoids copying a host-influenced length into a fixed-size stack object.
--- drivers/usb/gadget/function/f_uac1_legacy.c | 47 ++++++++++++++++++++++------ 1 file changed, 37 insertions(+), 10 deletions(-)
drivers/usb/gadget/function/f_uac1_legacy.c +37 -10
@@ -360,19 +360,46 @@ static int f_audio_out_ep_complete(strucstatic void f_audio_complete (struct usb_ep *ep,struct usb_request *req) {struct f_audio *audio = req->context; -int status = req->status; -u32 data =0 ;struct usb_ep *out_ep = audio->out_ep; -switch (status) { - -case 0 :/* normal completion? */ -if (ep == out_ep) +switch (req->status) { +case 0 : +if (ep == out_ep) {f_audio_out_ep_complete (ep, req); -else if (audio->set_con) { -memcpy (&data, req->buf, req->length); - audio->set_con->set (audio->set_con, audio->set_cmd, -le16_to_cpu (data)); + }else if (audio->set_con) { +struct usb_audio_control *con = audio->set_con; +u8 type = con->type; +u32 data; +bool valid_request = false; + +switch (type) { +case UAC_FU_MUTE : { +u8 value; + +if (req->actual ==sizeof (value)) { +memcpy (&value, req->buf,sizeof (value)); + data = value; + valid_request = true; + } +break ; + } +case UAC_FU_VOLUME : { +__le16 value; + +if (req->actual ==sizeof (value)) { +memcpy (&value, req->buf,sizeof (value)); + data =le16_to_cpu (value); + valid_request = true; + } +break ; + } + } + +if (valid_request) + con->set (con, audio->set_cmd, data); +else +usb_ep_set_halt (ep); + audio->set_con =NULL ; }break ;
Greg Kroah-Hartman
maintainerPATCH 272/312 wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Popov <[email protected]>
commit 789b06f9f39cdc7e895bdab2c034e39c41c8f8d6 upstream.
Currently we execute SET_NETDEV_DEV(dev, &priv->lowerdev->dev) for the virt_wifi net devices. However, unregistering a virt_wifi device in netdev_run_todo() can happen together with the device referenced by SET_NETDEV_DEV().
It can result in use-after-free during the ethtool operations performed on a virt_wifi device that is currently being unregistered. Such a net device can have the dev.parent field pointing to the freed memory, but ethnl_ops_begin() calls pm_runtime_get_sync(dev->dev.parent).
Let's remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this:
==================================================================
BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0xe2/0xf0 Read of size 2 at addr ffff88810cfc46f8 by task pm/606 Call Trace: <TASK> dump_stack_lvl+0x4d/0x70 print_report+0x170/0x4f3 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 kasan_report+0xda/0x110 ? __pm_runtime_resume+0xe2/0xf0 ? __pm_runtime_resume+0xe2/0xf0 __pm_runtime_resume+0xe2/0xf0 ethnl_ops_begin+0x49/0x270 ethnl_set_features+0x23c/0xab0 ? __pfx_ethnl_set_features+0x10/0x10 ? kvm_sched_clock_read+0x11/0x20 ? local_clock_noinstr+0xf/0xf0 ? local_clock+0x10/0x30 ? kasan_save_track+0x25/0x60 ? __kasan_kmalloc+0x7f/0x90 ? genl_family_rcv_msg_attrs_parse.isra.0+0x150/0x2c0 genl_family_rcv_msg_doit+0x1e7/0x2c0 ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 ? __pfx_cred_has_capability.isra.0+0x10/0x10 ? stack_trace_save+0x8e/0xc0 genl_rcv_msg+0x411/0x660 ? __pfx_genl_rcv_msg+0x10/0x10 ? __pfx_ethnl_set_features+0x10/0x10 netlink_rcv_skb+0x121/0x380 ? __pfx_genl_rcv_msg+0x10/0x10 ? __pfx_netlink_rcv_skb+0x10/0x10 ? __pfx_down_read+0x10/0x10 genl_rcv+0x23/0x30 netlink_unicast+0x60f/0x830 ? __pfx_netlink_unicast+0x10/0x10 ? __pfx___alloc_skb+0x10/0x10 netlink_sendmsg+0x6ea/0xbc0 ? __pfx_netlink_sendmsg+0x10/0x10 ? __futex_queue+0x10b/0x1f0 ____sys_sendmsg+0x7a2/0x950 ? copy_msghdr_from_user+0x26b/0x430 ? __pfx_____sys_sendmsg+0x10/0x10 ? __pfx_copy_msghdr_from_user+0x10/0x10 ___sys_sendmsg+0xf8/0x180 ? __pfx____sys_sendmsg+0x10/0x10 ? __pfx_futex_wait+0x10/0x10 ? fdget+0x2e4/0x4a0 __sys_sendmsg+0x11f/0x1c0 ? __pfx___sys_sendmsg+0x10/0x10 do_syscall_64+0xe2/0x570 ? exc_page_fault+0x66/0xb0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>
This fix may be combined with another one in the ethtool subsystem:
https://lore.kernel.org/all/[email protected]/T/#u
--- drivers/net/wireless/virt_wifi.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/wireless/virt_wifi.c +0 -1
@@ -553,7 +553,6 @@ static int virt_wifi_newlink(struct neteth_hw_addr_inherit (dev, priv->lowerdev);netif_stacked_transfer_operstate (priv->lowerdev, dev); -SET_NETDEV_DEV (dev, &priv->lowerdev->dev); dev->ieee80211_ptr =kzalloc (sizeof (*dev->ieee80211_ptr),GFP_KERNEL );if (!dev->ieee80211_ptr) {
Greg Kroah-Hartman
maintainerPATCH 273/312 ext4: fix use-after-free in update_super_work when racing with umount
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit d15e4b0a418537aafa56b2cb80d44add83e83697 ]
Commit b98535d09179 ("ext4: fix bug_on in start_this_handle during umount filesystem") moved ext4_unregister_sysfs() before flushing s_sb_upd_work to prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups reads during unmount. However, this introduced a use-after-free because update_super_work calls ext4_notify_error_sysfs() -> sysfs_notify() which accesses the kobject's kernfs_node after it has been freed by kobject_del() in ext4_unregister_sysfs():
update_super_work ext4_put_super
----------------- --------------
ext4_unregister_sysfs(sb)
kobject_del(&sbi->s_kobj)
__kobject_del()
sysfs_remove_dir()
kobj->sd = NULL
sysfs_put(sd)
kernfs_put() // RCU free
ext4_notify_error_sysfs(sbi)
sysfs_notify(&sbi->s_kobj)
kn = kobj->sd // stale pointer
kernfs_get(kn) // UAF on freed kernfs_node
ext4_journal_destroy()
flush_work(&sbi->s_sb_upd_work)Instead of reordering the teardown sequence, fix this by making ext4_notify_error_sysfs() detect that sysfs has already been torn down by checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call in that case. A dedicated mutex (s_error_notify_mutex) serializes ext4_notify_error_sysfs() against kobject_del() in ext4_unregister_sysfs() to prevent TOCTOU races where the kobject could be deleted between the state_in_sysfs check and the sysfs_notify() call.
--- fs/ext4/ext4.h | 1 + fs/ext4/super.c | 1 + fs/ext4/sysfs.c | 10 +++++++++- 3 files changed, 11 insertions(+), 1 deletion(-)
fs/ext4/ext4.h +1 -0
@@ -1557,6 +1557,7 @@ struct ext4_sb_info {struct proc_dir_entry *s_proc;struct kobject s_kobj;struct completion s_kobj_unregister; +struct mutex s_error_notify_mutex;/* protects sysfs_notify vs kobject_del */ struct super_block *s_sb;struct buffer_head *s_mmp_bh;
fs/ext4/super.c +1 -0
@@ -5263,6 +5263,7 @@ static int __ext4_fill_super(struct fs_ctimer_setup (&sbi->s_err_report, print_daily_error_info,0 );spin_lock_init (&sbi->s_error_lock); +mutex_init (&sbi->s_error_notify_mutex);INIT_WORK (&sbi->s_error_work, flush_stashed_error_work);/* Register extent status tree shrinker */
fs/ext4/sysfs.c +9 -1
@@ -515,7 +515,10 @@ static struct kobj_type ext4_feat_ktypevoid ext4_notify_error_sysfs (struct ext4_sb_info *sbi) { -sysfs_notify (&sbi->s_kobj,NULL ,"errors_count" ); +mutex_lock (&sbi->s_error_notify_mutex); +if (sbi->s_kobj.state_in_sysfs) +sysfs_notify (&sbi->s_kobj,NULL ,"errors_count" ); +mutex_unlock (&sbi->s_error_notify_mutex); }static struct kobject *ext4_root;
@@ -528,8 +531,10 @@ int ext4_register_sysfs(struct super_bloint err;init_completion (&sbi->s_kobj_unregister); +mutex_lock (&sbi->s_error_notify_mutex); err =kobject_init_and_add (&sbi->s_kobj, &ext4_sb_ktype, ext4_root,"%s" , sb->s_id); +mutex_unlock (&sbi->s_error_notify_mutex);if (err) {kobject_put (&sbi->s_kobj);wait_for_completion (&sbi->s_kobj_unregister);
@@ -562,7 +567,10 @@ void ext4_unregister_sysfs(struct super_if (sbi->s_proc)remove_proc_subtree (sb->s_id, ext4_proc_root); + +mutex_lock (&sbi->s_error_notify_mutex);kobject_del (&sbi->s_kobj); +mutex_unlock (&sbi->s_error_notify_mutex); }int __init ext4_init_sysfs (void )
Greg Kroah-Hartman
maintainerPATCH 274/312 block: fix resource leak in blk_register_queue() error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <[email protected]>
[ Upstream commit 40f2eb9b531475dd01b683fdaf61ca3cfd03a51e ]
When registering a queue fails after blk_mq_sysfs_register() is successful but the function later encounters an error, we need to clean up the blk_mq_sysfs resources.
Add the missing blk_mq_sysfs_unregister() call in the error path to properly clean up these resources and prevent a memory leak.
--- block/blk-sysfs.c | 2 ++ 1 file changed, 2 insertions(+)
block/blk-sysfs.c +2 -0
@@ -867,6 +867,8 @@ put_dev:elv_unregister_queue (q);disk_unregister_independent_access_ranges (disk);mutex_unlock (&q->sysfs_lock); +if (queue_is_mq (q)) +blk_mq_sysfs_unregister (disk);mutex_unlock (&q->sysfs_dir_lock);kobject_del (&q->kobj);
Greg Kroah-Hartman
maintainerPATCH 275/312 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit aad885e774966e97b675dfe928da164214a71605 ]
When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM.
E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE.
------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]---
--- arch/x86/kvm/mmu/mmu.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
arch/x86/kvm/mmu/mmu.c +9 -6
@@ -2814,12 +2814,6 @@ static int mmu_set_spte(struct kvm_vcpupgprintk ("%s: spte %llx write_fault %d gfn %llx\n" , __func__, *sptep, write_fault, gfn); -if (unlikely (is_noslot_pfn (pfn))) { - vcpu->stat.pf_mmio_spte_created++; -mark_mmio_spte (vcpu, sptep, gfn, pte_access); -return RET_PF_EMULATE ; - } -if (is_shadow_present_pte (*sptep)) {/* * If we overwrite a PTE page pointer with a 2MB PMD, unlink
@@ -2841,6 +2835,15 @@ static int mmu_set_spte(struct kvm_vcpu was_rmapped =1 ; } +if (unlikely (is_noslot_pfn (pfn))) { + vcpu->stat.pf_mmio_spte_created++; +mark_mmio_spte (vcpu, sptep, gfn, pte_access); +if (flush) +kvm_flush_remote_tlbs_with_address (vcpu->kvm, gfn, +KVM_PAGES_PER_HPAGE (level)); +return RET_PF_EMULATE ; + } + wrprot =make_spte (vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch, true, host_writable, &spte);
Greg Kroah-Hartman
maintainerPATCH 276/312 net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
[ Upstream commit c4336a07eb6b2526dc2b62928b5104b41a7f81f5 ]
NETIF_F_IPV6_CSUM only advertises support for checksum offload of packets without IPv6 extension headers. Packets with extension headers must fall back onto software checksumming. Since TSO depends on checksum offload, those must revert to GSO.
The below commit introduces that fallback. It always checks network header length. For tunneled packets, the inner header length must be checked instead. Extend the check accordingly.
A special case is tunneled packets without inner IP protocol. Such as RFC 6951 SCTP in UDP. Those are not standard IPv6 followed by transport header either, so also must revert to the software GSO path.
--- net/core/dev.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
net/core/dev.c +17 -5
@@ -3586,6 +3586,22 @@ static netdev_features_t dflt_features_creturn vlan_features_check (skb, features); } +static bool skb_gso_has_extension_hdr (const struct sk_buff *skb) +{ +if (!skb->encapsulation) +return ((skb_shinfo (skb)->gso_type &SKB_GSO_TCPV6 || + (skb_shinfo (skb)->gso_type &SKB_GSO_UDP_L4 && +vlan_get_protocol (skb) ==htons (ETH_P_IPV6 ))) && +skb_transport_header_was_set (skb) && +skb_network_header_len (skb) !=sizeof (struct ipv6hdr )); +else +return (!skb_inner_network_header_was_set (skb) || + ((skb_shinfo (skb)->gso_type &SKB_GSO_TCPV6 || + (skb_shinfo (skb)->gso_type &SKB_GSO_UDP_L4 && +inner_ip_hdr (skb)->version ==6 )) && +skb_inner_network_header_len (skb) !=sizeof (struct ipv6hdr ))); +} +static netdev_features_t gso_features_check (const struct sk_buff *skb,struct net_device *dev,netdev_features_t features)
@@ -3627,11 +3643,7 @@ static netdev_features_t gso_features_ch* so neither does TSO that depends on it. */ if (features &NETIF_F_IPV6_CSUM && - (skb_shinfo (skb)->gso_type &SKB_GSO_TCPV6 || - (skb_shinfo (skb)->gso_type &SKB_GSO_UDP_L4 && -vlan_get_protocol (skb) ==htons (ETH_P_IPV6 ))) && -skb_transport_header_was_set (skb) && -skb_network_header_len (skb) !=sizeof (struct ipv6hdr ) && +skb_gso_has_extension_hdr (skb) && !ipv6_has_hopopt_jumbo (skb)) features &= ~(NETIF_F_IPV6_CSUM |NETIF_F_TSO6 |NETIF_F_GSO_UDP_L4 );
Greg Kroah-Hartman
maintainerPATCH 277/312 net: macb: Move devm_{free,request}_irq() out of spin lock area
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Hao <[email protected]>
[ Upstream commit 317e49358ebbf6390fa439ef3c142f9239dd25fb ]
The devm_free_irq() and devm_request_irq() functions should not be executed in an atomic context.
During device suspend, all userspace processes and most kernel threads are frozen. Additionally, we flush all tx/rx status, disable all macb interrupts, and halt rx operations. Therefore, it is safe to split the region protected by bp->lock into two independent sections, allowing devm_free_irq() and devm_request_irq() to run in a non-atomic context. This modification resolves the following lockdep warning:
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 501, name: rtcwake
preempt_count: 1, expected: 0
RCU nest depth: 1, expected: 0
7 locks held by rtcwake/501:
#0: ffff0008038c3408 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0xf8/0x368
#1: ffff0008049a5e88 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_fop_write_iter+0xbc/0x1c8
#2: ffff00080098d588 (kn->active#70){.+.+}-{0:0}, at: kernfs_fop_write_iter+0xcc/0x1c8
#3: ffff800081c84888 (system_transition_mutex){+.+.}-{4:4}, at: pm_suspend+0x1ec/0x290
#4: ffff0008009ba0f8 (&dev->mutex){....}-{4:4}, at: device_suspend+0x118/0x4f0
#5: ffff800081d00458 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire+0x4/0x48
#6: ffff0008031fb9e0 (&bp->lock){-.-.}-{3:3}, at: macb_suspend+0x144/0x558
irq event stamp: 8682
hardirqs last enabled at (8681): [<ffff8000813c7d7c>] _raw_spin_unlock_irqrestore+0x44/0x88
hardirqs last disabled at (8682): [<ffff8000813c7b58>] _raw_spin_lock_irqsave+0x38/0x98
softirqs last enabled at (7322): [<ffff8000800f1b4c>] handle_softirqs+0x52c/0x588
softirqs last disabled at (7317): [<ffff800080010310>] __do_softirq+0x20/0x2c
CPU: 1 UID: 0 PID: 501 Comm: rtcwake Not tainted 7.0.0-rc3-next-20260310-yocto-standard+ #125 PREEMPT
Hardware name: ZynqMP ZCU102 Rev1.1 (DT)
Call trace:
show_stack+0x24/0x38 (C)
__dump_stack+0x28/0x38
dump_stack_lvl+0x64/0x88
dump_stack+0x18/0x24
__might_resched+0x200/0x218
__might_sleep+0x38/0x98
__mutex_lock_common+0x7c/0x1378
mutex_lock_nested+0x38/0x50
free_irq+0x68/0x2b0
devm_irq_release+0x24/0x38
devres_release+0x40/0x80
devm_free_irq+0x48/0x88
macb_suspend+0x298/0x558
device_suspend+0x218/0x4f0
dpm_suspend+0x244/0x3a0
dpm_suspend_start+0x50/0x78
suspend_devices_and_enter+0xec/0x560
pm_suspend+0x194/0x290
state_store+0x110/0x158
kobj_attr_store+0x1c/0x30
sysfs_kf_write+0xa8/0xd0
kernfs_fop_write_iter+0x11c/0x1c8
vfs_write+0x248/0x368
ksys_write+0x7c/0xf8
__arm64_sys_write+0x28/0x40
invoke_syscall+0x4c/0xe8
el0_svc_common+0x98/0xf0
do_el0_svc+0x28/0x40
el0_svc+0x54/0x1e0
el0t_64_sync_handler+0x84/0x130
el0t_64_sync+0x198/0x1a0--- drivers/net/ethernet/cadence/macb_main.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/net/ethernet/cadence/macb_main.c +8 -5
@@ -5270,6 +5270,8 @@ static int __maybe_unused macb_suspend(smacb_writel (bp,TSR ,-1 );macb_writel (bp,RSR ,-1 ); +spin_unlock_irqrestore (&bp->lock, flags); +/* Change interrupt handler and * Enable WoL IRQ on queue 0 */
@@ -5281,11 +5283,12 @@ static int __maybe_unused macb_suspend(sdev_err (dev,"Unable to request IRQ %d (error %d)\n" , bp->queues[0 ].irq, err); -spin_unlock_irqrestore (&bp->lock, flags);return err; } +spin_lock_irqsave (&bp->lock, flags);queue_writel (bp->queues,IER ,GEM_BIT (WOL ));gem_writel (bp,WOL ,MACB_BIT (MAG )); +spin_unlock_irqrestore (&bp->lock, flags); }else { err =devm_request_irq (dev, bp->queues[0 ].irq, macb_wol_interrupt,IRQF_SHARED , netdev->name, bp->queues);
@@ -5293,13 +5296,13 @@ static int __maybe_unused macb_suspend(sdev_err (dev,"Unable to request IRQ %d (error %d)\n" , bp->queues[0 ].irq, err); -spin_unlock_irqrestore (&bp->lock, flags);return err; } +spin_lock_irqsave (&bp->lock, flags);queue_writel (bp->queues,IER ,MACB_BIT (WOL ));macb_writel (bp,WOL ,MACB_BIT (MAG )); +spin_unlock_irqrestore (&bp->lock, flags); } -spin_unlock_irqrestore (&bp->lock, flags);enable_irq_wake (bp->queues[0 ].irq); }
@@ -5366,6 +5369,8 @@ static int __maybe_unused macb_resume(stqueue_readl (bp->queues,ISR );if (bp->caps &MACB_CAPS_ISR_CLEAR_ON_WRITE )queue_writel (bp->queues,ISR ,-1 ); +spin_unlock_irqrestore (&bp->lock, flags); +/* Replace interrupt handler on queue 0 */ devm_free_irq (dev, bp->queues[0 ].irq, bp->queues); err = devm_request_irq(dev, bp->queues[0].irq, macb_interrupt,
@@ -5374,10 +5379,8 @@ static int __maybe_unused macb_resume(stdev_err (dev,"Unable to request IRQ %d (error %d)\n" , bp->queues[0 ].irq, err); -spin_unlock_irqrestore (&bp->lock, flags);return err; } -spin_unlock_irqrestore (&bp->lock, flags);disable_irq_wake (bp->queues[0 ].irq);
Greg Kroah-Hartman
maintainerPATCH 278/312 scsi: target: tcm_loop: Drain commands in target_reset handler
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit 1333eee56cdf3f0cf67c6ab4114c2c9e0a952026 ]
tcm_loop_target_reset() violates the SCSI EH contract: it returns SUCCESS without draining any in-flight commands. The SCSI EH documentation (scsi_eh.rst) requires that when a reset handler returns SUCCESS the driver has made lower layers "forget about timed out scmds" and is ready for new commands. Every other SCSI LLD (virtio_scsi, mpt3sas, ipr, scsi_debug, mpi3mr) enforces this by draining or completing outstanding commands before returning SUCCESS.
Because tcm_loop_target_reset() doesn't drain, the SCSI EH reuses in-flight scsi_cmnd structures for recovery commands (e.g. TUR) while the target core still has async completion work queued for the old se_cmd. The memset in queuecommand zeroes se_lun and lun_ref_active, causing transport_lun_remove_cmd() to skip its percpu_ref_put(). The leaked LUN reference prevents transport_clear_lun_ref() from completing, hanging configfs LUN unlink forever in D-state:
INFO: task rm:264 blocked for more than 122 seconds. rm D 0 264 258 0x00004000 Call Trace: __schedule+0x3d0/0x8e0 schedule+0x36/0xf0 transport_clear_lun_ref+0x78/0x90 [target_core_mod] core_tpg_remove_lun+0x28/0xb0 [target_core_mod] target_fabric_port_unlink+0x50/0x60 [target_core_mod] configfs_unlink+0x156/0x1f0 [configfs] vfs_unlink+0x109/0x290 do_unlinkat+0x1d5/0x2d0
Fix this by making tcm_loop_target_reset() actually drain commands:
1. Issue TMR_LUN_RESET via tcm_loop_issue_tmr() to drain all commands that the target core knows about (those not yet CMD_T_COMPLETE).
2. Use blk_mq_tagset_busy_iter() to iterate all started requests and flush_work() on each se_cmd — this drains any deferred completion work for commands that already had CMD_T_COMPLETE set before the TMR (which the TMR skips via __target_check_io_state()). This is the same pattern used by mpi3mr, scsi_debug, and libsas to drain outstanding commands during reset.
--- drivers/target/loopback/tcm_loop.c | 52 ++++++++++++++++++++++++++++++++----- 1 file changed, 46 insertions(+), 6 deletions(-)
drivers/target/loopback/tcm_loop.c +46 -6
@@ -26,6 +26,7 @@#include <linux/slab.h> #include <linux/types.h> #include <linux/configfs.h> +#include <linux/blk-mq.h> #include <scsi/scsi.h> #include <scsi/scsi_tcq.h> #include <scsi/scsi_host.h>
@@ -274,15 +275,27 @@ static int tcm_loop_device_reset(structreturn (ret ==TMR_FUNCTION_COMPLETE ) ?SUCCESS :FAILED ; } +static bool tcm_loop_flush_work_iter (struct request *rq,void *data) +{ +struct scsi_cmnd *sc =blk_mq_rq_to_pdu (rq); +struct tcm_loop_cmd *tl_cmd =scsi_cmd_priv (sc); +struct se_cmd *se_cmd = &tl_cmd->tl_se_cmd; + +flush_work (&se_cmd->work); +return true; +} +static int tcm_loop_target_reset (struct scsi_cmnd *sc) {struct tcm_loop_hba *tl_hba;struct tcm_loop_tpg *tl_tpg; +struct Scsi_Host *sh = sc->device->host; +int ret;/* * Locate the tcm_loop_hba_t pointer */ - tl_hba = *(struct tcm_loop_hba **)shost_priv (sc->device->host); + tl_hba = *(struct tcm_loop_hba **)shost_priv (sh);if (!tl_hba) {pr_err ("Unable to perform device reset without active I_T Nexus\n" );return FAILED ;
@@ -291,11 +304,38 @@ static int tcm_loop_target_reset(struct* Locate the tl_tpg pointer from TargetID in sc->device->id */ tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id]; -if (tl_tpg) { - tl_tpg->tl_transport_status =TCM_TRANSPORT_ONLINE ; -return SUCCESS ; - } -return FAILED ; +if (!tl_tpg) +return FAILED ; + +/* +* Issue a LUN_RESET to drain all commands that the target core +* knows about. This handles commands not yet marked CMD_T_COMPLETE. +*/ + ret =tcm_loop_issue_tmr (tl_tpg, sc->device->lun,0 ,TMR_LUN_RESET ); +if (ret !=TMR_FUNCTION_COMPLETE ) +return FAILED ; + +/* +* Flush any deferred target core completion work that may still be +* queued. Commands that already had CMD_T_COMPLETE set before the TMR +* are skipped by the TMR drain, but their async completion work +* (transport_lun_remove_cmd → percpu_ref_put, release_cmd → scsi_done) +* may still be pending in target_completion_wq. +* +* The SCSI EH will reuse in-flight scsi_cmnd structures for recovery +* commands (e.g. TUR) immediately after this handler returns SUCCESS — +* if deferred work is still pending, the memset in queuecommand would +* zero the se_cmd while the work accesses it, leaking the LUN +* percpu_ref and hanging configfs unlink forever. +* +* Use blk_mq_tagset_busy_iter() to find all started requests and +* flush_work() on each — the same pattern used by mpi3mr, scsi_debug, +* and other SCSI drivers to drain outstanding commands during reset. +*/ +blk_mq_tagset_busy_iter (&sh->tag_set, tcm_loop_flush_work_iter,NULL ); + + tl_tpg->tl_transport_status =TCM_TRANSPORT_ONLINE ; +return SUCCESS ; }static struct scsi_host_template tcm_loop_driver_template = {
Greg Kroah-Hartman
maintainerPATCH 279/312 mm/huge_memory: fix folio isnt locked in softleaf_to_folio()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjiang Tu <[email protected]>
[ Upstream commit 4c5e7f0fcd592801c9cc18f29f80fbee84eb8669 ]
On arm64 server, we found folio that get from migration entry isn't locked in softleaf_to_folio(). This issue triggers when mTHP splitting and zap_nonpresent_ptes() races, and the root cause is lack of memory barrier in softleaf_to_folio(). The race is as follows:
CPU0 CPU1
deferred_split_scan() zap_nonpresent_ptes()
lock folio
split_folio()
unmap_folio()
change ptes to migration entries
__split_folio_to_order() softleaf_to_folio()
set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry))
smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio))
prep_compound_page() for tail pages
In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages are visible before the tail page becomes non-compound. smp_wmb() should be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a result, if zap_nonpresent_ptes() accesses migration entry that stores tail pfn, softleaf_to_folio() may see the updated compound_head of tail page before page->flags.
This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio() because of the race between folio split and zap_nonpresent_ptes() leading to a folio incorrectly undergoing modification without a folio lock being held.
This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further swapops predicates"), which in merged in v6.19-rc1.
To fix it, add missing smp_rmb() if the softleaf entry is migration entry in softleaf_to_folio() and softleaf_to_page().
--- include/linux/swapops.h | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
include/linux/swapops.h +15 -5
@@ -541,11 +541,21 @@ static inline struct page *pfn_swap_entr {struct page *p =pfn_to_page (swp_offset_pfn (entry)); -/* -* Any use of migration entries may only occur while the -* corresponding page is locked -*/ -BUG_ON (is_migration_entry (entry) && !PageLocked (p)); +if (is_migration_entry (entry)) { +/* +* Ensure we do not race with split, which might alter tail +* pages into new folios and thus result in observing an +* unlocked folio. +* This matches the write barrier in __split_folio_to_order(). +*/ +smp_rmb (); + +/* +* Any use of migration entries may only occur while the +* corresponding page is locked +*/ +BUG_ON (!PageLocked (p)); + }return p; }
Greg Kroah-Hartman
maintainerPATCH 280/312 x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikunj A Dadhania <[email protected]>
[ Upstream commit 05243d490bb7852a8acca7b5b5658019c7797a52 ]
Move FSGSBASE enablement from identify_cpu() to cpu_init_exception_handling() to ensure it is enabled before any exceptions can occur on both boot and secondary CPUs.
== Background ==
Exception entry code (paranoid_entry()) uses ALTERNATIVE patching based on X86_FEATURE_FSGSBASE to decide whether to use RDGSBASE/WRGSBASE instructions or the slower RDMSR/SWAPGS sequence for saving/restoring GSBASE.
On boot CPU, ALTERNATIVE patching happens after enabling FSGSBASE in CR4. When the feature is available, the code is permanently patched to use RDGSBASE/WRGSBASE, which require CR4.FSGSBASE=1 to execute without triggering
== Boot Sequence ==
Boot CPU (with CR pinning enabled):
trap_init()
cpu_init() <- Uses unpatched code (RDMSR/SWAPGS)
x2apic_setup()
...
arch_cpu_finalize_init()
identify_boot_cpu()
identify_cpu()
cr4_set_bits(X86_CR4_FSGSBASE) # Enables the feature # This becomes part of cr4_pinned_bits
...
alternative_instructions() <- Patches code to use RDGSBASE/WRGSBASE
Secondary CPUs (with CR pinning enabled):
start_secondary()
cr4_init() <- Code already patched, CR4.FSGSBASE=1
set implicitly via cr4_pinned_bits
cpu_init() <- exceptions work because FSGSBASE is
already enabled
Secondary CPU (with CR pinning disabled):
start_secondary()
cr4_init() <- Code already patched, CR4.FSGSBASE=0
cpu_init()
x2apic_setup()
rdmsrq(MSR_IA32_APICBASE) <- Triggers #VC in SNP guests
exc_vmm_communication()
paranoid_entry() <- Uses RDGSBASE with CR4.FSGSBASE=0
(patched code)
...
ap_starting()
identify_secondary_cpu()
identify_cpu()
cr4_set_bits(X86_CR4_FSGSBASE) <- Enables the feature, which is
too late
== CR Pinning ==
Currently, for secondary CPUs, CR4.FSGSBASE is set implicitly through
CR-pinning: the boot CPU sets it during identify_cpu(), it becomes part of cr4_pinned_bits, and cr4_init() applies those pinned bits to secondary CPUs. This works but creates an undocumented dependency between cr4_init() and the pinning mechanism.
== Problem ==
Secondary CPUs boot after alternatives have been applied globally. They execute already-patched paranoid_entry() code that uses RDGSBASE/WRGSBASE instructions, which require CR4.FSGSBASE=1. Upcoming changes to CR pinning behavior will break the implicit dependency, causing secondary CPUs to generate #UD.
This issue manifests itself on AMD SEV-SNP guests, where the rdmsrq() in x2apic_setup() triggers a #VC exception early during cpu_init(). The #VC handler (exc_vmm_communication()) executes the patched paranoid_entry() path. Without CR4.FSGSBASE enabled, RDGSBASE instructions trigger #UD.
== Fix ==
Enable FSGSBASE explicitly in cpu_init_exception_handling() before loading exception handlers. This makes the dependency explicit and ensures both boot and secondary CPUs have FSGSBASE enabled before paranoid_entry() executes.
--- arch/x86/kernel/cpu/common.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
arch/x86/kernel/cpu/common.c +12 -6
@@ -1992,12 +1992,6 @@ static void identify_cpu(struct cpuinfo_setup_smap (c);setup_umip (c); -/* Enable FSGSBASE instructions if available. */ -if (cpu_has (c,X86_FEATURE_FSGSBASE )) { -cr4_set_bits (X86_CR4_FSGSBASE ); - elf_hwcap2 |=HWCAP2_FSGSBASE ; - } -/* * The vendor-specific functions might have changed features. * Now we do "generic changes."
@@ -2384,6 +2378,18 @@ void cpu_init_exception_handling(void)/* GHCB needs to be setup to handle #VC. */ setup_ghcb (); +/* +* On CPUs with FSGSBASE support, paranoid_entry() uses +* ALTERNATIVE-patched RDGSBASE/WRGSBASE instructions. Secondary CPUs +* boot after alternatives are patched globally, so early exceptions +* execute patched code that depends on FSGSBASE. Enable the feature +* before any exceptions occur. +*/ +if (cpu_feature_enabled (X86_FEATURE_FSGSBASE )) { +cr4_set_bits (X86_CR4_FSGSBASE ); + elf_hwcap2 |=HWCAP2_FSGSBASE ; + } +/* Finally load the IDT */ load_current_idt (); }
Greg Kroah-Hartman
maintainerPATCH 281/312 ksmbd: fix memory leaks and NULL deref in smb2_lock()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Kasselman <[email protected]>
[ Upstream commit 309b44ed684496ed3f9c5715d10b899338623512 ]
smb2_lock() has three error handling issues after list_del() detaches smb_lock from lock_list at no_check_cl:
1) If vfs_lock_file() returns an unexpected error in the non-UNLOCK path, goto out leaks smb_lock and its flock because the out:
handler only iterates lock_list and rollback_list, neither of which contains the detached smb_lock.
2) If vfs_lock_file() returns -ENOENT in the UNLOCK path, goto out leaks smb_lock and flock for the same reason. The error code returned to the dispatcher is also stale.
3) In the rollback path, smb_flock_init() can return NULL on allocation failure. The result is dereferenced unconditionally, causing a kernel NULL pointer dereference. Add a NULL check to prevent the crash and clean up the bookkeeping; the VFS lock itself cannot be rolled back without the allocation and will be released at file or connection teardown.
Fix cases 1 and 2 by hoisting the locks_free_lock()/kfree() to before the if(!rc) check in the UNLOCK branch so all exit paths share one free site, and by freeing smb_lock and flock before goto out in the non-UNLOCK branch. Propagate the correct error code in both cases. Fix case 3 by wrapping the VFS unlock in an if(rlock) guard and adding a NULL check for locks_free_lock(rlock) in the shared cleanup.
Found via call-graph analysis using sqry.
--- fs/smb/server/smb2pdu.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-)
fs/smb/server/smb2pdu.c +19 -10
@@ -7145,14 +7145,15 @@ retry: rc =vfs_lock_file (filp, smb_lock->cmd, flock,NULL ); skip:if (smb_lock->flags &SMB2_LOCKFLAG_UNLOCK ) { +locks_free_lock (flock); +kfree (smb_lock);if (!rc) {ksmbd_debug (SMB ,"File unlocked\n" ); }else if (rc == -ENOENT ) { rsp->hdr.Status =STATUS_NOT_LOCKED ; + err = rc; goto out; } -locks_free_lock (flock); -kfree (smb_lock); }else {if (rc ==FILE_LOCK_DEFERRED ) {void **argv;
@@ -7221,6 +7222,9 @@ skip:spin_unlock (&work->conn->llist_lock);ksmbd_debug (SMB ,"successful in taking lock\n" ); }else { +locks_free_lock (flock); +kfree (smb_lock); + err = rc; goto out; } }
@@ -7251,13 +7255,17 @@ out:struct file_lock *rlock =NULL ; rlock =smb_flock_init (filp); - rlock->fl_type =F_UNLCK ; - rlock->fl_start = smb_lock->start; - rlock->fl_end = smb_lock->end; - - rc =vfs_lock_file (filp,F_SETLK , rlock,NULL ); -if (rc) -pr_err ("rollback unlock fail : %d\n" , rc); +if (rlock) { + rlock->fl_type =F_UNLCK ; + rlock->fl_start = smb_lock->start; + rlock->fl_end = smb_lock->end; + + rc =vfs_lock_file (filp,F_SETLK , rlock,NULL ); +if (rc) +pr_err ("rollback unlock fail : %d\n" , rc); + }else { +pr_err ("rollback unlock alloc failed\n" ); + }list_del (&smb_lock->llist);spin_lock (&work->conn->llist_lock);
@@ -7267,7 +7275,8 @@ out:spin_unlock (&work->conn->llist_lock);locks_free_lock (smb_lock->fl); -locks_free_lock (rlock); +if (rlock) +locks_free_lock (rlock);kfree (smb_lock); } out2:
Greg Kroah-Hartman
maintainerPATCH 282/312 ksmbd: fix potencial OOB in get_file_all_info() for compound requests
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit beef2634f81f1c086208191f7228bce1d366493d ]
When a compound request consists of QUERY_DIRECTORY + QUERY_INFO (FILE_ALL_INFORMATION) and the first command consumes nearly the entire max_trans_size, get_file_all_info() would blindly call smbConvertToUTF16() with PATH_MAX, causing out-of-bounds write beyond the response buffer. In get_file_all_info(), there was a missing validation check for the client-provided OutputBufferLength before copying the filename into FileName field of the smb2_file_all_info structure.
If the filename length exceeds the available buffer space, it could lead to potential buffer overflows or memory corruption during smbConvertToUTF16 conversion. This calculating the actual free buffer size using smb2_calc_max_out_buf_len() and returning -EINVAL if the buffer is insufficient and updating smbConvertToUTF16 to use the actual filename length (clamped by PATH_MAX) to ensure a safe copy operation.
--- fs/smb/server/smb2pdu.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
fs/smb/server/smb2pdu.c +14 -1
@@ -4606,6 +4606,8 @@ static int get_file_all_info(struct ksmbint conv_len;char *filename;u64 time; +int buf_free_len, filename_len; +struct smb2_query_info_req *req =ksmbd_req_buf_next (work);if (!(fp->daccess &FILE_READ_ATTRIBUTES_LE )) { ksmbd_debug(SMB, "no right to read the attributes : 0x%x\n",
@@ -4617,6 +4619,16 @@ static int get_file_all_info(struct ksmbif (IS_ERR (filename))return PTR_ERR (filename); + filename_len =strlen (filename); + buf_free_len =smb2_calc_max_out_buf_len (work, + offsetof(struct smb2_query_info_rsp , Buffer) + + offsetof(struct smb2_file_all_info , FileName), +le32_to_cpu (req->OutputBufferLength)); +if (buf_free_len < (filename_len +1 ) *2 ) { +kfree (filename); +return -EINVAL ; + } + inode =file_inode (fp->filp);generic_fillattr (file_mnt_user_ns (fp->filp), inode, &stat);
@@ -4648,7 +4660,8 @@ static int get_file_all_info(struct ksmb file_info->Mode = fp->coption; file_info->AlignmentRequirement =0 ; conv_len =smbConvertToUTF16 ((__le16 *)file_info->FileName, filename, -PATH_MAX , conn->local_nls,0 ); +min (filename_len,PATH_MAX ), + conn->local_nls,0 ); conv_len *=2 ; file_info->FileNameLength =cpu_to_le32 (conv_len); rsp->OutputBufferLength =
Greg Kroah-Hartman
maintainerPATCH 283/312 tracing: Fix potential deadlock in cpu hotplug with osnoise
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Haiyang <[email protected]>
[ Upstream commit 1f9885732248d22f788e4992c739a98c88ab8a55 ]
The following sequence may leads deadlock in cpu hotplug:
task1 task2 task3
----- ----- ----- mutex_lock(&interface_lock)
[CPU GOING OFFLINE]
cpus_write_lock();
osnoise_cpu_die();
kthread_stop(task3);
wait_for_completion();
osnoise_sleep();
mutex_lock(&interface_lock); cpus_read_lock();
[DEAD LOCK]
Fix by swap the order of cpus_read_lock() and mutex_lock(&interface_lock).
--- kernel/trace/trace_osnoise.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
kernel/trace/trace_osnoise.c +4 -4
@@ -1809,8 +1809,8 @@ static void osnoise_hotplug_workfn(strucif (!osnoise_has_registered_instances ()) goto out_unlock_trace; -mutex_lock (&interface_lock);cpus_read_lock (); +mutex_lock (&interface_lock);if (!cpu_online (cpu)) goto out_unlock;
@@ -1820,8 +1820,8 @@ static void osnoise_hotplug_workfn(strucstart_kthread (cpu); out_unlock: -cpus_read_unlock ();mutex_unlock (&interface_lock); +cpus_read_unlock (); out_unlock_trace:mutex_unlock (&trace_types_lock); }
@@ -1950,16 +1950,16 @@ osnoise_cpus_write(struct file *filp, coif (running)stop_per_cpu_kthreads (); -mutex_lock (&interface_lock);/* * osnoise_cpumask is read by CPU hotplug operations. */ cpus_read_lock (); +mutex_lock (&interface_lock);cpumask_copy (&osnoise_cpumask, osnoise_cpumask_new); -cpus_read_unlock ();mutex_unlock (&interface_lock); +cpus_read_unlock ();if (running)start_per_cpu_kthreads ();
Greg Kroah-Hartman
maintainerPATCH 284/312 hwmon: (pmbus/core) Add lock and unlock functions
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eddie James <[email protected]>
[ Upstream commit a7ac37183ac2a0cc46d857997b2dd24997ca2754 ]
Debugfs operations may set the page number, which must be done atomically with the subsequent i2c operation. Lock the update_lock in the debugfs functions and provide a function for pmbus drivers to lock and unlock the update_lock.
Stable-dep-of: 3075a3951f77 ("hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes")
--- drivers/hwmon/pmbus/pmbus.h | 2 ++ drivers/hwmon/pmbus/pmbus_core.c | 30 ++++++++++++++++++++++++++++++ 2 files changed, 32 insertions(+)
drivers/hwmon/pmbus/pmbus.h +2 -0
@@ -510,6 +510,8 @@ int pmbus_get_fan_rate_device(struct i2c enum pmbus_fan_mode mode);int pmbus_get_fan_rate_cached (struct i2c_client *client,int page,int id,enum pmbus_fan_mode mode); +int pmbus_lock_interruptible (struct i2c_client *client); +void pmbus_unlock (struct i2c_client *client);int pmbus_update_fan (struct i2c_client *client,int page,int id,u8 config,u8 mask,u16 command);struct dentry *pmbus_get_debugfs_dir (struct i2c_client *client);
drivers/hwmon/pmbus/pmbus_core.c +30 -0
@@ -3049,8 +3049,13 @@ static int pmbus_debugfs_get(void *data, {int rc;struct pmbus_debugfs_entry *entry = data; +struct pmbus_data *pdata =i2c_get_clientdata (entry->client); + rc =mutex_lock_interruptible (&pdata->update_lock); +if (rc) +return rc; rc =_pmbus_read_byte_data (entry->client, entry->page, entry->reg); +mutex_unlock (&pdata->update_lock);if (rc <0 )return rc;
@@ -3067,7 +3072,11 @@ static int pmbus_debugfs_get_status(voidstruct pmbus_debugfs_entry *entry = data;struct pmbus_data *pdata =i2c_get_clientdata (entry->client); + rc =mutex_lock_interruptible (&pdata->update_lock); +if (rc) +return rc; rc = pdata->read_status (entry->client, entry->page); +mutex_unlock (&pdata->update_lock);if (rc <0 )return rc;
@@ -3083,10 +3092,15 @@ static ssize_t pmbus_debugfs_mfr_read(st {int rc;struct pmbus_debugfs_entry *entry = file->private_data; +struct pmbus_data *pdata =i2c_get_clientdata (entry->client);char data[I2C_SMBUS_BLOCK_MAX +2 ] = {0 }; + rc =mutex_lock_interruptible (&pdata->update_lock); +if (rc) +return rc; rc =pmbus_read_block_data (entry->client, entry->page, entry->reg, data); +mutex_unlock (&pdata->update_lock);if (rc <0 )return rc;
@@ -3420,6 +3434,22 @@ struct dentry *pmbus_get_debugfs_dir(str }EXPORT_SYMBOL_NS_GPL (pmbus_get_debugfs_dir,PMBUS ); +int pmbus_lock_interruptible (struct i2c_client *client) +{ +struct pmbus_data *data =i2c_get_clientdata (client); + +return mutex_lock_interruptible (&data->update_lock); +} +EXPORT_SYMBOL_NS_GPL (pmbus_lock_interruptible,PMBUS ); + +void pmbus_unlock (struct i2c_client *client) +{ +struct pmbus_data *data =i2c_get_clientdata (client); + +mutex_unlock (&data->update_lock); +} +EXPORT_SYMBOL_NS_GPL (pmbus_unlock,PMBUS ); +static int __init pmbus_core_init (void ) { pmbus_debugfs_dir =debugfs_create_dir ("pmbus" ,NULL );
Greg Kroah-Hartman
maintainerPATCH 285/312 hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
[ Upstream commit 3075a3951f7708da5a8ab47b0b7d068a32f69e58 ]
The custom avs0_enable and avs1_enable sysfs attributes access PMBus registers through the exported API helpers (pmbus_read_byte_data, pmbus_read_word_data, pmbus_write_word_data, pmbus_update_byte_data) without holding the PMBus update_lock mutex. These exported helpers do not acquire the mutex internally, unlike the core's internal callers which hold the lock before invoking them.
The store callback is especially vulnerable: it performs a multi-step read-modify-write sequence (read VOUT_COMMAND, write VOUT_COMMAND, then update OPERATION) where concurrent access from another thread could interleave and corrupt the register state.
Add pmbus_lock_interruptible()/pmbus_unlock() around both the show and store callbacks to serialize PMBus register access with the rest of the driver.
--- drivers/hwmon/pmbus/isl68137.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
drivers/hwmon/pmbus/isl68137.c +18 -3
@@ -78,7 +78,15 @@ static ssize_t isl68137_avs_enable_show_int page, char *buf) { - int val = pmbus_read_byte_data(client, page, PMBUS_OPERATION); + int val; + + val =pmbus_lock_interruptible (client); +if (val) +return val; + + val =pmbus_read_byte_data (client, page,PMBUS_OPERATION ); + +pmbus_unlock (client);if (val <0 )return val;
@@ -100,6 +108,10 @@ static ssize_t isl68137_avs_enable_store op_val = result ?ISL68137_VOUT_AVS :0 ; + rc =pmbus_lock_interruptible (client); +if (rc) +return rc; +/* * Writes to VOUT setpoint over AVSBus will persist after the VRM is * switched to PMBus control. Switching back to AVSBus control
@@ -111,17 +123,20 @@ static ssize_t isl68137_avs_enable_store rc =pmbus_read_word_data (client, page,0xff ,PMBUS_VOUT_COMMAND );if (rc <0 ) -return rc; + goto unlock; rc =pmbus_write_word_data (client, page,PMBUS_VOUT_COMMAND , rc);if (rc <0 ) -return rc; + goto unlock; } rc =pmbus_update_byte_data (client, page,PMBUS_OPERATION ,ISL68137_VOUT_AVS , op_val); +unlock: +pmbus_unlock (client); +return (rc <0 ) ? rc : count; }
Greg Kroah-Hartman
maintainerPATCH 286/312 ext4: factor out ext4_percpu_param_init() and ext4_percpu_param_destroy()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Yan <[email protected]>
[ Upstream commit 1f79467c8a6be64940a699de1bd43338a6dd9fdd ]
Factor out ext4_percpu_param_init() and ext4_percpu_param_destroy(). And also use ext4_percpu_param_destroy() in ext4_put_super() to avoid duplicated code. No functional change.
Stable-dep-of: 496bb99b7e66 ("ext4: fix the might_sleep() warnings in kvfree()")
--- fs/ext4/super.c | 85 ++++++++++++++++++++++++++++++-------------------------- 1 file changed, 46 insertions(+), 39 deletions(-)
fs/ext4/super.c +46 -39
@@ -1193,6 +1193,49 @@ static inline void ext4_quota_off_umount }#endif +static int ext4_percpu_param_init (struct ext4_sb_info *sbi) +{ +ext4_fsblk_t block; +int err; + + block =ext4_count_free_clusters (sbi->s_sb); +ext4_free_blocks_count_set (sbi->s_es,EXT4_C2B (sbi, block)); + err =percpu_counter_init (&sbi->s_freeclusters_counter, block, +GFP_KERNEL ); +if (!err) { +unsigned long freei =ext4_count_free_inodes (sbi->s_sb); + sbi->s_es->s_free_inodes_count =cpu_to_le32 (freei); + err =percpu_counter_init (&sbi->s_freeinodes_counter, freei, +GFP_KERNEL ); + } +if (!err) + err =percpu_counter_init (&sbi->s_dirs_counter, +ext4_count_dirs (sbi->s_sb),GFP_KERNEL ); +if (!err) + err =percpu_counter_init (&sbi->s_dirtyclusters_counter,0 , +GFP_KERNEL ); +if (!err) + err =percpu_counter_init (&sbi->s_sra_exceeded_retry_limit,0 , +GFP_KERNEL ); +if (!err) + err =percpu_init_rwsem (&sbi->s_writepages_rwsem); + +if (err) +ext4_msg (sbi->s_sb,KERN_ERR ,"insufficient memory" ); + +return err; +} + +static void ext4_percpu_param_destroy (struct ext4_sb_info *sbi) +{ +percpu_counter_destroy (&sbi->s_freeclusters_counter); +percpu_counter_destroy (&sbi->s_freeinodes_counter); +percpu_counter_destroy (&sbi->s_dirs_counter); +percpu_counter_destroy (&sbi->s_dirtyclusters_counter); +percpu_counter_destroy (&sbi->s_sra_exceeded_retry_limit); +percpu_free_rwsem (&sbi->s_writepages_rwsem); +} +static void ext4_put_super (struct super_block *sb) {struct ext4_sb_info *sbi =EXT4_SB (sb);
@@ -1259,12 +1302,7 @@ static void ext4_put_super(struct super_kvfree (flex_groups); }rcu_read_unlock (); -percpu_counter_destroy (&sbi->s_freeclusters_counter); -percpu_counter_destroy (&sbi->s_freeinodes_counter); -percpu_counter_destroy (&sbi->s_dirs_counter); -percpu_counter_destroy (&sbi->s_dirtyclusters_counter); -percpu_counter_destroy (&sbi->s_sra_exceeded_retry_limit); -percpu_free_rwsem (&sbi->s_writepages_rwsem); +ext4_percpu_param_destroy (sbi);#ifdef CONFIG_QUOTA for (i =0 ; i <EXT4_MAXQUOTAS ; i++)kfree (get_qf_name (sb, sbi, i));
@@ -5088,7 +5126,6 @@ static int __ext4_fill_super(struct fs_cstruct ext4_super_block *es =NULL ;struct ext4_sb_info *sbi =EXT4_SB (sb);struct flex_groups **flex_groups; -ext4_fsblk_t block;ext4_fsblk_t logical_sb_block;struct inode *root;int ret = -ENOMEM ;
@@ -5496,33 +5533,8 @@ static int __ext4_fill_super(struct fs_c sbi->s_journal->j_commit_callback = ext4_journal_commit_callback; - block =ext4_count_free_clusters (sb); -ext4_free_blocks_count_set (sbi->s_es, -EXT4_C2B (sbi, block)); - err =percpu_counter_init (&sbi->s_freeclusters_counter, block, -GFP_KERNEL ); -if (!err) { -unsigned long freei =ext4_count_free_inodes (sb); - sbi->s_es->s_free_inodes_count =cpu_to_le32 (freei); - err =percpu_counter_init (&sbi->s_freeinodes_counter, freei, -GFP_KERNEL ); - } -if (!err) - err =percpu_counter_init (&sbi->s_dirs_counter, -ext4_count_dirs (sb),GFP_KERNEL ); -if (!err) - err =percpu_counter_init (&sbi->s_dirtyclusters_counter,0 , -GFP_KERNEL ); -if (!err) - err =percpu_counter_init (&sbi->s_sra_exceeded_retry_limit,0 , -GFP_KERNEL ); -if (!err) - err =percpu_init_rwsem (&sbi->s_writepages_rwsem); - -if (err) { -ext4_msg (sb,KERN_ERR ,"insufficient memory" ); +if (ext4_percpu_param_init (sbi)) goto failed_mount6; - }if (ext4_has_feature_flex_bg (sb))if (!ext4_fill_flex_info (sb)) {
@@ -5613,12 +5625,7 @@ failed_mount6:kvfree (flex_groups); }rcu_read_unlock (); -percpu_counter_destroy (&sbi->s_freeclusters_counter); -percpu_counter_destroy (&sbi->s_freeinodes_counter); -percpu_counter_destroy (&sbi->s_dirs_counter); -percpu_counter_destroy (&sbi->s_dirtyclusters_counter); -percpu_counter_destroy (&sbi->s_sra_exceeded_retry_limit); -percpu_free_rwsem (&sbi->s_writepages_rwsem); +ext4_percpu_param_destroy (sbi); failed_mount5:ext4_ext_release (sb);ext4_release_system_zone (sb);
Greg Kroah-Hartman
maintainerPATCH 287/312 ext4: use ext4_group_desc_free() in ext4_put_super() to save some duplicated code
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Yan <[email protected]>
[ Upstream commit 6ef684988816fdfa29ceff260c97d725a489a942 ]
The only difference here is that ->s_group_desc and ->s_flex_groups share the same rcu read lock here but it is not necessary. In other places they do not share the lock at all.
Stable-dep-of: 496bb99b7e66 ("ext4: fix the might_sleep() warnings in kvfree()")
--- fs/ext4/super.c | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-)
fs/ext4/super.c +14 -18
@@ -1236,11 +1236,23 @@ static void ext4_percpu_param_destroy(stpercpu_free_rwsem (&sbi->s_writepages_rwsem); } +static void ext4_group_desc_free (struct ext4_sb_info *sbi) +{ +struct buffer_head **group_desc; +int i; + +rcu_read_lock (); + group_desc =rcu_dereference (sbi->s_group_desc); +for (i =0 ; i < sbi->s_gdb_count; i++) +brelse (group_desc[i]); +kvfree (group_desc); +rcu_read_unlock (); +} +static void ext4_put_super (struct super_block *sb) {struct ext4_sb_info *sbi =EXT4_SB (sb);struct ext4_super_block *es = sbi->s_es; -struct buffer_head **group_desc;struct flex_groups **flex_groups;int aborted =0 ;int i, err;
@@ -1290,11 +1302,8 @@ static void ext4_put_super(struct super_if (!sb_rdonly (sb))ext4_commit_super (sb); +ext4_group_desc_free (sbi);rcu_read_lock (); - group_desc =rcu_dereference (sbi->s_group_desc); -for (i =0 ; i < sbi->s_gdb_count; i++) -brelse (group_desc[i]); -kvfree (group_desc); flex_groups =rcu_dereference (sbi->s_flex_groups);if (flex_groups) {for (i =0 ; i < sbi->s_flex_groups_allocated; i++)
@@ -4770,19 +4779,6 @@ static int ext4_geometry_check(struct sureturn 0 ; } -static void ext4_group_desc_free (struct ext4_sb_info *sbi) -{ -struct buffer_head **group_desc; -int i; - -rcu_read_lock (); - group_desc =rcu_dereference (sbi->s_group_desc); -for (i =0 ; i < sbi->s_gdb_count; i++) -brelse (group_desc[i]); -kvfree (group_desc); -rcu_read_unlock (); -} - static int ext4_group_desc_init(struct super_block *sb, struct ext4_super_block *es, ext4_fsblk_t logical_sb_block,
Greg Kroah-Hartman
maintainerPATCH 288/312 ext4: factor out ext4_flex_groups_free()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Yan <[email protected]>
[ Upstream commit dcbf87589d90e3bd5a5a4cf832517f22f3c55efb ]
Factor out ext4_flex_groups_free() and it can be used both in __ext4_fill_super() and ext4_put_super().
Stable-dep-of: 496bb99b7e66 ("ext4: fix the might_sleep() warnings in kvfree()")
--- fs/ext4/super.c | 35 +++++++++++++++++------------------ 1 file changed, 17 insertions(+), 18 deletions(-)
fs/ext4/super.c +17 -18
@@ -1249,11 +1249,25 @@ static void ext4_group_desc_free(structrcu_read_unlock (); } +static void ext4_flex_groups_free (struct ext4_sb_info *sbi) +{ +struct flex_groups **flex_groups; +int i; + +rcu_read_lock (); + flex_groups =rcu_dereference (sbi->s_flex_groups); +if (flex_groups) { +for (i =0 ; i < sbi->s_flex_groups_allocated; i++) +kvfree (flex_groups[i]); +kvfree (flex_groups); + } +rcu_read_unlock (); +} +static void ext4_put_super (struct super_block *sb) {struct ext4_sb_info *sbi =EXT4_SB (sb);struct ext4_super_block *es = sbi->s_es; -struct flex_groups **flex_groups;int aborted =0 ;int i, err;
@@ -1303,14 +1317,7 @@ static void ext4_put_super(struct super_ext4_commit_super (sb);ext4_group_desc_free (sbi); -rcu_read_lock (); - flex_groups =rcu_dereference (sbi->s_flex_groups); -if (flex_groups) { -for (i =0 ; i < sbi->s_flex_groups_allocated; i++) -kvfree (flex_groups[i]); -kvfree (flex_groups); - } -rcu_read_unlock (); +ext4_flex_groups_free (sbi);ext4_percpu_param_destroy (sbi);#ifdef CONFIG_QUOTA for (i =0 ; i <EXT4_MAXQUOTAS ; i++)
@@ -5121,7 +5128,6 @@ static int __ext4_fill_super(struct fs_c {struct ext4_super_block *es =NULL ;struct ext4_sb_info *sbi =EXT4_SB (sb); -struct flex_groups **flex_groups;ext4_fsblk_t logical_sb_block;struct inode *root;int ret = -ENOMEM ;
@@ -5613,14 +5619,7 @@ failed_mount7:ext4_unregister_li_request (sb); failed_mount6:ext4_mb_release (sb); -rcu_read_lock (); - flex_groups =rcu_dereference (sbi->s_flex_groups); -if (flex_groups) { -for (i =0 ; i < sbi->s_flex_groups_allocated; i++) -kvfree (flex_groups[i]); -kvfree (flex_groups); - } -rcu_read_unlock (); +ext4_flex_groups_free (sbi);ext4_percpu_param_destroy (sbi); failed_mount5:ext4_ext_release (sb);
Greg Kroah-Hartman
maintainerPATCH 289/312 ext4: fix the might_sleep() warnings in kvfree()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <[email protected]>
[ Upstream commit 496bb99b7e66f48b178126626f47e9ba79e2d0fa ]
Use the kvfree() in the RCU read critical section can trigger the following warnings:
EXT4-fs (vdb): unmounting filesystem cd983e5b-3c83-4f5a-a136-17b00eb9d018.
WARNING: suspicious RCU usage
./include/linux/rcupdate.h:409 Illegal context switch in RCU read-side critical section!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
Call Trace: <TASK> dump_stack_lvl+0xbb/0xd0 dump_stack+0x14/0x20 lockdep_rcu_suspicious+0x15a/0x1b0 __might_resched+0x375/0x4d0 ? put_object.part.0+0x2c/0x50 __might_sleep+0x108/0x160 vfree+0x58/0x910 ? ext4_group_desc_free+0x27/0x270 kvfree+0x23/0x40 ext4_group_desc_free+0x111/0x270 ext4_put_super+0x3c8/0xd40 generic_shutdown_super+0x14c/0x4a0 ? __pfx_shrinker_free+0x10/0x10 kill_block_super+0x40/0x90 ext4_kill_sb+0x6d/0xb0 deactivate_locked_super+0xb4/0x180 deactivate_super+0x7e/0xa0 cleanup_mnt+0x296/0x3e0 __cleanup_mnt+0x16/0x20 task_work_run+0x157/0x250 ? __pfx_task_work_run+0x10/0x10 ? exit_to_user_mode_loop+0x6a/0x550 exit_to_user_mode_loop+0x102/0x550 do_syscall_64+0x44a/0x500 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> BUG: sleeping function called from invalid context at mm/vmalloc.c:3441 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 556, name: umount preempt_count: 1, expected: 0 CPU: 3 UID: 0 PID: 556 Comm: umount Call Trace: <TASK> dump_stack_lvl+0xbb/0xd0 dump_stack+0x14/0x20 __might_resched+0x275/0x4d0 ? put_object.part.0+0x2c/0x50 __might_sleep+0x108/0x160 vfree+0x58/0x910 ? ext4_group_desc_free+0x27/0x270 kvfree+0x23/0x40 ext4_group_desc_free+0x111/0x270 ext4_put_super+0x3c8/0xd40 generic_shutdown_super+0x14c/0x4a0 ? __pfx_shrinker_free+0x10/0x10 kill_block_super+0x40/0x90 ext4_kill_sb+0x6d/0xb0 deactivate_locked_super+0xb4/0x180 deactivate_super+0x7e/0xa0 cleanup_mnt+0x296/0x3e0 __cleanup_mnt+0x16/0x20 task_work_run+0x157/0x250 ? __pfx_task_work_run+0x10/0x10 ? exit_to_user_mode_loop+0x6a/0x550 exit_to_user_mode_loop+0x102/0x550 do_syscall_64+0x44a/0x500 entry_SYSCALL_64_after_hwframe+0x77/0x7f
The above scenarios occur in initialization failures and teardown paths, there are no parallel operations on the resources released by kvfree(), this commit therefore remove rcu_read_lock/unlock() and use rcu_access_pointer() instead of rcu_dereference() operations.
--- fs/ext4/mballoc.c | 10 +++------- fs/ext4/super.c | 8 ++------ 2 files changed, 5 insertions(+), 13 deletions(-)
fs/ext4/mballoc.c +3 -7
@@ -3298,9 +3298,7 @@ err_freebuddy:rcu_read_unlock ();iput (sbi->s_buddy_cache); err_freesgi: -rcu_read_lock (); -kvfree (rcu_dereference (sbi->s_group_info)); -rcu_read_unlock (); +kvfree (rcu_access_pointer (sbi->s_group_info));return -ENOMEM ; }
@@ -3597,7 +3595,8 @@ int ext4_mb_release(struct super_block *flush_work (&sbi->s_discard_work);WARN_ON_ONCE (!list_empty (&sbi->s_discard_list)); -if (sbi->s_group_info) { + group_info =rcu_access_pointer (sbi->s_group_info); +if (group_info) {for (i =0 ; i < ngroups; i++) {cond_resched (); grinfo =ext4_get_group_info (sb, i);
@@ -3615,12 +3614,9 @@ int ext4_mb_release(struct super_block * num_meta_group_infos = (ngroups +EXT4_DESC_PER_BLOCK (sb) -1 ) >>EXT4_DESC_PER_BLOCK_BITS (sb); -rcu_read_lock (); - group_info =rcu_dereference (sbi->s_group_info);for (i =0 ; i < num_meta_group_infos; i++)kfree (group_info[i]);kvfree (group_info); -rcu_read_unlock (); }kfree (sbi->s_mb_avg_fragment_size);kfree (sbi->s_mb_avg_fragment_size_locks);
fs/ext4/super.c +2 -6
@@ -1241,12 +1241,10 @@ static void ext4_group_desc_free(structstruct buffer_head **group_desc;int i; -rcu_read_lock (); - group_desc =rcu_dereference (sbi->s_group_desc); + group_desc =rcu_access_pointer (sbi->s_group_desc);for (i =0 ; i < sbi->s_gdb_count; i++)brelse (group_desc[i]);kvfree (group_desc); -rcu_read_unlock (); }static void ext4_flex_groups_free (struct ext4_sb_info *sbi)
@@ -1254,14 +1252,12 @@ static void ext4_flex_groups_free(structstruct flex_groups **flex_groups;int i; -rcu_read_lock (); - flex_groups =rcu_dereference (sbi->s_flex_groups); + flex_groups =rcu_access_pointer (sbi->s_flex_groups);if (flex_groups) {for (i =0 ; i < sbi->s_flex_groups_allocated; i++)kvfree (flex_groups[i]);kvfree (flex_groups); } -rcu_read_unlock (); }static void ext4_put_super (struct super_block *sb)
Greg Kroah-Hartman
maintainerPATCH 290/312 ext4: publish jinode after initialization
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Chen <[email protected]>
[ Upstream commit 1aec30021edd410b986c156f195f3d23959a9d11 ]
ext4_inode_attach_jinode() publishes ei->jinode to concurrent users. It used to set ei->jinode before jbd2_journal_init_jbd_inode(), allowing a reader to observe a non-NULL jinode with i_vfs_inode still unset.
The fast commit flush path can then pass this jinode to jbd2_wait_inode_data(), which dereferences i_vfs_inode->i_mapping and may crash.
Below is the crash I observe:
``` BUG: unable to handle page fault for address: 000000010beb47f4 PGD 110e51067 P4D 110e51067 PUD 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014 RIP: 0010:xas_find_marked+0x3d/0x2e0 Code: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f <49> 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02 RSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246 RAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003 RDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10 RBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec R10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000 R13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88 FS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> filemap_get_folios_tag+0x87/0x2a0 __filemap_fdatawait_range+0x5f/0xd0 ? srso_alias_return_thunk+0x5/0xfbef5 ? __schedule+0x3e7/0x10c0 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? preempt_count_sub+0x5f/0x80 ? srso_alias_return_thunk+0x5/0xfbef5 ? cap_safe_nice+0x37/0x70 ? srso_alias_return_thunk+0x5/0xfbef5 ? preempt_count_sub+0x5f/0x80 ? srso_alias_return_thunk+0x5/0xfbef5 filemap_fdatawait_range_keep_errors+0x12/0x40 ext4_fc_commit+0x697/0x8b0 ? ext4_file_write_iter+0x64b/0x950 ? srso_alias_return_thunk+0x5/0xfbef5 ? preempt_count_sub+0x5f/0x80 ? srso_alias_return_thunk+0x5/0xfbef5 ? vfs_write+0x356/0x480 ? srso_alias_return_thunk+0x5/0xfbef5 ? preempt_count_sub+0x5f/0x80 ext4_sync_file+0xf7/0x370 do_fsync+0x3b/0x80 ? syscall_trace_enter+0x108/0x1d0 __x64_sys_fdatasync+0x16/0x20 do_syscall_64+0x62/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ... ```
Fix this by initializing the jbd2_inode first.
Use smp_wmb() and WRITE_ONCE() to publish ei->jinode after initialization. Readers use READ_ONCE() to fetch the pointer.
--- fs/ext4/fast_commit.c | 4 ++-- fs/ext4/inode.c | 15 +++++++++++---- 2 files changed, 13 insertions(+), 6 deletions(-)
fs/ext4/fast_commit.c +2 -2
@@ -1019,7 +1019,7 @@ static int ext4_fc_submit_inode_data_allfinish_wait (&ei->i_fc_wait, &wait); }spin_unlock (&sbi->s_fc_lock); - ret =jbd2_submit_inode_data (ei->jinode); + ret =jbd2_submit_inode_data (READ_ONCE (ei->jinode));if (ret)return ret;spin_lock (&sbi->s_fc_lock);
@@ -1044,7 +1044,7 @@ static int ext4_fc_wait_inode_data_all(jcontinue ;spin_unlock (&sbi->s_fc_lock); - ret =jbd2_wait_inode_data (journal, pos->jinode); + ret =jbd2_wait_inode_data (journal,READ_ONCE (pos->jinode));if (ret)return ret;spin_lock (&sbi->s_fc_lock);
fs/ext4/inode.c +11 -4
@@ -122,6 +122,8 @@ void ext4_inode_csum_set(struct inode *istatic inline int ext4_begin_ordered_truncate (struct inode *inode,loff_t new_size) { +struct jbd2_inode *jinode =READ_ONCE (EXT4_I (inode)->jinode); +trace_ext4_begin_ordered_truncate (inode, new_size);/* * If jinode is zero, then we never opened the file for
@@ -129,10 +131,10 @@ static inline int ext4_begin_ordered_tru* jbd2_journal_begin_ordered_truncate() since there's no * outstanding writes we need to flush. */ -if (!EXT4_I (inode)->jinode) +if (!jinode)return 0 ;return jbd2_journal_begin_ordered_truncate (EXT4_JOURNAL (inode), -EXT4_I (inode)->jinode, + jinode, new_size); }
@@ -4184,8 +4186,13 @@ int ext4_inode_attach_jinode(struct inodspin_unlock (&inode->i_lock);return -ENOMEM ; } - ei->jinode = jinode; -jbd2_journal_init_jbd_inode (ei->jinode, inode); +jbd2_journal_init_jbd_inode (jinode, inode); +/* +* Publish ->jinode only after it is fully initialized so that +* readers never observe a partially initialized jbd2_inode. +*/ +smp_wmb (); +WRITE_ONCE (ei->jinode, jinode); jinode =NULL ; }spin_unlock (&inode->i_lock);
Greg Kroah-Hartman
maintainerPATCH 291/312 MPTCP: fix lock class name family in pm_nl_create_listen_socket
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Xiasong <[email protected]>
commit 7ab4a7c5d969642782b8a5b608da0dd02aa9f229 upstream.
In mptcp_pm_nl_create_listen_socket(), use entry->addr.family instead of sk->sk_family for lock class setup. The 'sk' parameter is a netlink socket, not the MPTCP subflow socket being created.
[ Conflict in pm_kernel.c, because commit 8617e85e04bd ("mptcp: pm:
split in-kernel PM specific code") is not in this version, and moves code from pm_netlink.c to pm_kernel.c. ]
--- net/mptcp/pm_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mptcp/pm_netlink.c +1 -1
@@ -1184,7 +1184,7 @@ static struct lock_class_key mptcp_keys[static int mptcp_pm_nl_create_listen_socket (struct sock *sk,struct mptcp_pm_addr_entry *entry) { -bool is_ipv6 = sk->sk_family ==AF_INET6 ; +bool is_ipv6 = entry->addr.family ==AF_INET6 ;int addrlen =sizeof (struct sockaddr_in );struct sockaddr_storage addr;struct socket *ssock;
Greg Kroah-Hartman
maintainerPATCH 292/312 ext4: handle wraparound when searching for blocks for indirect mapped blocks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
[ Upstream commit bb81702370fad22c06ca12b6e1648754dbc37e0f ]
Commit 4865c768b563 ("ext4: always allocate blocks only from groups inode can use") restricts what blocks will be allocated for indirect block based files to block numbers that fit within 32-bit block numbers.
However, when using a review bot running on the latest Gemini LLM to check this commit when backporting into an LTS based kernel, it raised this concern:
If ac->ac_g_ex.fe_group is >= ngroups (for instance, if the goal group was populated via stream allocation from s_mb_last_groups), then start will be >= ngroups.
Does this allow allocating blocks beyond the 32-bit limit for indirect block mapped files? The commit message mentions that ext4_mb_scan_groups_linear() takes care to not select unsupported groups. However, its loop uses group = *start, and the very first iteration will call ext4_mb_scan_group() with this unsupported group because next_linear_group() is only called at the end of the iteration.
After reviewing the code paths involved and considering the LLM review, I determined that this can happen when there is a file system where some files/directories are extent-mapped and others are indirect-block mapped. To address this, add a safety clamp in ext4_mb_scan_groups().
--- fs/ext4/mballoc.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ext4/mballoc.c +2 -0
@@ -2733,6 +2733,8 @@ repeat:* from the goal value specified */ group = ac->ac_g_ex.fe_group; +if (group >= ngroups) + group =0 ; ac->ac_groups_linear_remaining = sbi->s_mb_max_linear_groups; prefetch_grp = group;
Greg Kroah-Hartman
maintainerPATCH 293/312 cpufreq: governor: Free dbs_data directly when gov->init() fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chang <[email protected]>
[ Upstream commit 916f13884042f615cfbfc0b42cc68dadee826f2a ]
Due to the kobject embedded in the dbs_data doest not has a release() method yet, it needs to use kfree() to free dbs_data directly when governor fails to allocate the tunner field of dbs_data.
Stable-dep-of: 6dcf9d0064ce ("cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path")
--- drivers/cpufreq/cpufreq_governor.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/cpufreq/cpufreq_governor.c +3 -1
@@ -440,7 +440,7 @@ int cpufreq_dbs_governor_init(struct cpu ret = gov->init (dbs_data);if (ret) - goto free_policy_dbs_info; + goto free_dbs_data;/* * The sampling interval should not be less than the transition latency
@@ -475,6 +475,8 @@ int cpufreq_dbs_governor_init(struct cpuif (!have_governor_per_policy ()) gov->gdbs_data =NULL ; gov->exit (dbs_data); + +free_dbs_data:kfree (dbs_data); free_policy_dbs_info:
Greg Kroah-Hartman
maintainerPATCH 294/312 cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <[email protected]>
[ Upstream commit 6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e ]
When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls kobject_put(&dbs_data->attr_set.kobj).
The kobject release callback cpufreq_dbs_data_release() calls gov->exit(dbs_data) and kfree(dbs_data), but the current error path then calls gov->exit(dbs_data) and kfree(dbs_data) again, causing a double free.
Keep the direct kfree(dbs_data) for the gov->init() failure path, but after kobject_init_and_add() has been called, let kobject_put() handle the cleanup through cpufreq_dbs_data_release().
--- drivers/cpufreq/cpufreq_governor.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/cpufreq/cpufreq_governor.c +3 -3
@@ -468,13 +468,13 @@ int cpufreq_dbs_governor_init(struct cpu/* Failure, so roll back. */ pr_err ("initialization failed (dbs_data kobject init error %d)\n" , ret); -kobject_put (&dbs_data->attr_set.kobj); - policy->governor_data =NULL ;if (!have_governor_per_policy ()) gov->gdbs_data =NULL ; - gov->exit (dbs_data); + +kobject_put (&dbs_data->attr_set.kobj); + goto free_policy_dbs_info; free_dbs_data:kfree (dbs_data);
Greg Kroah-Hartman
maintainerPATCH 295/312 mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pratyush Yadav <[email protected]>
[ Upstream commit f156b23df6a84efb2f6686156be94d4988568954 ]
On Octal DTR capable flashes like Micron Xcella reads cannot start or end at an odd address in Octal DTR mode. Extra bytes need to be read at the start or end to make sure both the start address and length remain even.
To avoid allocating too much extra memory, thereby putting unnecessary memory pressure on the system, the temporary buffer containing the extra padding bytes is capped at PAGE_SIZE bytes. The rest of the 2-byte aligned part should be read directly in the main buffer.
[ Resolve conflict in drivers/mtd/spi-nor/core.c.
In spi_nor_read(), 6.1.y contains a spi_nor_convert_addr() call before spi_nor_read_data(), introduced by 364995962803 ("mtd:
spi-nor: Add a ->convert_addr() method"), which does not exist in mainline. This call is specific to Xilinx S3AN flashes, which use a non-standard address format. In mainline, S3AN flash support was removed entirely, and the corresponding spi_nor_convert_addr() call was dropped by 9539d12d9f52 ("mtd: spi-nor: get rid of non-power-of-2 page size handling"). Keep the existing spi_nor_convert_addr() call and insert the new spi_nor_octal_dtr_read() branch after it. ]
--- drivers/mtd/spi-nor/core.c | 76 ++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 75 insertions(+), 1 deletion(-)
drivers/mtd/spi-nor/core.c +75 -1
@@ -1677,6 +1677,76 @@ static const struct flash_info *spi_nor_return info; } +/* +* On Octal DTR capable flashes, reads cannot start or end at an odd +* address in Octal DTR mode. Extra bytes need to be read at the start +* or end to make sure both the start address and length remain even. +*/ +static int spi_nor_octal_dtr_read (struct spi_nor *nor,loff_t from,size_t len, +u_char *buf) +{ +u_char *tmp_buf; +size_t tmp_len; +loff_t start, end; +int ret, bytes_read; + +if (IS_ALIGNED (from,2 ) &&IS_ALIGNED (len,2 )) +return spi_nor_read_data (nor, from, len, buf); +else if (IS_ALIGNED (from,2 ) && len >PAGE_SIZE ) +return spi_nor_read_data (nor, from,round_down (len,PAGE_SIZE ), + buf); + + tmp_buf =kmalloc (PAGE_SIZE ,GFP_KERNEL ); +if (!tmp_buf) +return -ENOMEM ; + + start =round_down (from,2 ); + end =round_up (from + len,2 ); + +/* +* Avoid allocating too much memory. The requested read length might be +* quite large. Allocating a buffer just as large (slightly bigger, in +* fact) would put unnecessary memory pressure on the system. +* +* For example if the read is from 3 to 1M, then this will read from 2 +* to 4098. The reads from 4098 to 1M will then not need a temporary +* buffer so they can proceed as normal. +*/ + tmp_len =min_t (size_t, end - start,PAGE_SIZE ); + + ret =spi_nor_read_data (nor, start, tmp_len, tmp_buf); +if (ret ==0 ) { + ret = -EIO ; + goto out; + } +if (ret <0 ) + goto out; + +/* +* More bytes are read than actually requested, but that number can't be +* reported to the calling function or it will confuse its calculations. +* Calculate how many of the _requested_ bytes were read. +*/ + bytes_read = ret; + +if (from != start) + ret -= from - start; + +/* +* Only account for extra bytes at the end if they were actually read. +* For example, if the total length was truncated because of temporary +* buffer size limit then the adjustment for the extra bytes at the end +* is not needed. +*/ +if (start + bytes_read == end) + ret -= end - (from + len); + +memcpy (buf, tmp_buf + (from - start), ret); +out: +kfree (tmp_buf); +return ret; +} +static int spi_nor_read (struct mtd_info *mtd,loff_t from,size_t len,size_t *retlen,u_char *buf) {
@@ -1694,7 +1764,11 @@ static int spi_nor_read(struct mtd_info addr =spi_nor_convert_addr (nor, addr); - ret =spi_nor_read_data (nor, addr, len, buf); +if (nor->read_proto ==SNOR_PROTO_8_8_8_DTR ) + ret =spi_nor_octal_dtr_read (nor, addr, len, buf); +else + ret =spi_nor_read_data (nor, addr, len, buf); +if (ret ==0 ) {/* We shouldn't see 0-length reads */ ret = -EIO ;