6.12.82-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.12.82-rc1 review
This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.82-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.82-rc1
Aaron Erhardt <[email protected]>
ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
Jiayuan Chen <[email protected]>
net: skb: fix cross-cache free of KFENCE-allocated skb head
David Howells <[email protected]>
rxrpc: Fix missing error checks for rxkad encryption/decryption failure
David Howells <[email protected]>
rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
Luxiao Xu <[email protected]>
rxrpc: fix reference count leak in rxrpc_server_keyring()
Yuqi Xu <[email protected]>
rxrpc: reject undecryptable rxkad response tickets
Douya Le <[email protected]>
rxrpc: Only put the call ref if one was acquired
Anderson Nascimento <[email protected]>
rxrpc: Fix key reference count leak from call->key
David Howells <[email protected]>
rxrpc: Fix call removal to use RCU safe deletion
David Howells <[email protected]>
rxrpc: Fix anonymous key handling
David Carlier <[email protected]>
net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
David Carlier <[email protected]>
net: lan966x: fix page pool leak in error paths
David Carlier <[email protected]>
net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()
Emil Tantilov <[email protected]>
idpf: set the payload size before calling the async handler
Emil Tantilov <[email protected]>
idpf: improve locking around idpf_vc_xn_push_free()
Baolin Wang <[email protected]>
mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()
Tyllis Xu <[email protected]>
net: stmmac: fix integer underflow in chain mode
Pengpeng Hou <[email protected]>
net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure
Johan Hovold <[email protected]>
mmc: vub300: fix NULL-deref on disconnect
Jacky Bai <[email protected]>
pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled
Michael Guralnik <[email protected]>
net/mlx5: Update the list of the PCI supported devices
Jouni Högander <[email protected]>
drm/i915/psr: Do not use pipe_src as borders for SU area
Sebastian Brzezinka <[email protected]>
drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
Haoze Xie <[email protected]>
batman-adv: hold claim backbone gateways by reference
David Carlier <[email protected]>
net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
Muhammad Alifa Ramdhan <[email protected]>
net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
Borislav Petkov (AMD) <[email protected]>
EDAC/mc: Fix error path ordering in edac_mc_alloc()
Lukas Wunner <[email protected]>
X.509: Fix out-of-bounds access when parsing extensions
Ruide Cao <[email protected]>
batman-adv: reject oversized global TT response buffers
Pengpeng Hou <[email protected]>
nfc: pn533: allocate rx skb before consuming bytes
Shawn Guo <[email protected]>
arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges
Shawn Guo <[email protected]>
arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
Sebastian Krzyszkowiak <[email protected]>
arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V
Sebastian Krzyszkowiak <[email protected]>
Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"
Srinivas Pandruvada <[email protected]>
platform/x86/intel-uncore-freq: Handle autonomous UFS status bit
Thomas Fourier <[email protected]>
wifi: brcmsmac: Fix dma_free_coherent() size
Oleh Konko <[email protected]>
tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
Yasuaki Torimaru <[email protected]>
xfrm: clear trailing padding in build_polexpire()
Matthew Brost <[email protected]>
workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works
Tuan Do <[email protected]>
netfilter: nft_ct: fix use-after-free in timeout object destroy
Tiezhu Yang <[email protected]>
LoongArch: Handle percpu handler address for ORC unwinder
Tiezhu Yang <[email protected]>
LoongArch: Remove unnecessary checks for ORC unwinder
Li Xiasong <[email protected]>
mptcp: fix soft lockup in mptcp_recvmsg()
Eric Dumazet <[email protected]>
net: annotate data-races around sk->sk_{data_ready,write_space}Matthieu Baerts (NGI0) <[email protected]>
Revert "mptcp: add needs_id for netlink appending addr"
Andrea Righi <[email protected]>
sched_ext: Fix stale direct dispatch state in ddsp_dsq_id
Xingjing Deng <[email protected]>
misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe
Geert Uytterhoeven <[email protected]>
arm64: dts: renesas: white-hawk-cpu-common: Add pin control for DSI-eDP IRQ
Jakub Kicinski <[email protected]>
nfc: nci: complete pending data exchange on device close
Chaitanya Kulkarni <[email protected]>
blktrace: fix __this_cpu_read/write in preemptible context
robbieko <[email protected]>
btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()
Filipe Manana <[email protected]>
btrfs: remove pointless out labels from extent-tree.c
Daniel Vacek <[email protected]>
btrfs: remove unused flag EXTENT_BUFFER_CORRUPT
Daniel Vacek <[email protected]>
btrfs: remove unused flag EXTENT_BUFFER_READAHEAD
David Sterba <[email protected]>
btrfs: split waiting from read_extent_buffer_pages(), drop parameter wait
David Sterba <[email protected]>
btrfs: remove unused define WAIT_PAGE_LOCK for extent io
David Sterba <[email protected]>
btrfs: make wait_on_extent_buffer_writeback() static inline
Kuninori Morimoto <[email protected]>
ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai()
Maciej W. Rozycki <[email protected]>
MIPS: mm: Rewrite TLB uniquification for the hidden bit feature
Maciej W. Rozycki <[email protected]>
MIPS: mm: Suppress TLB uniquification on EHINV hardware
Maciej W. Rozycki <[email protected]>
MIPS: Always record SEGBITS in cpu_data.vmbits
Dmitry Torokhov <[email protected]>
Input: uinput - take event lock when submitting FF request "event"
Mikhail Gavrilov <[email protected]>
Input: uinput - fix circular locking dependency with ff-core
Andrea Mayer <[email protected]>
seg6: separate dst_cache for input and output paths in seg6 lwtunnel
Jiayuan Chen <[email protected]>
mptcp: fix slab-use-after-free in __inet_lookup_established
Greg Kroah-Hartman <[email protected]>
net: rfkill: prevent unlimited numbers of rfkill events from being created
Greg Kroah-Hartman <[email protected]>
xfrm_user: fix info leak in build_report()
Johan Hovold <[email protected]>
wifi: rt2x00usb: fix devres lifetime
Nathan Rebello <[email protected]>
usb: typec: ucsi: skip connector validation before init
Eric Biggers <[email protected]>
lib/crypto: chacha: Zeroize permuted_state before it leaves scope
-------------
Diffstat:
Makefile | 4 +- .../arm64/boot/dts/freescale/imx8mq-librem5-r3.dts | 2 +- arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 24 +- .../boot/dts/hisilicon/hi3798cv200-poplar.dts | 2 +- arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi | 1 + .../boot/dts/renesas/white-hawk-cpu-common.dtsi | 8 + arch/loongarch/include/asm/setup.h | 3 + arch/loongarch/kernel/unwind_orc.c | 28 +- arch/mips/include/asm/cpu-features.h | 1 - arch/mips/include/asm/cpu-info.h | 2 - arch/mips/include/asm/mipsregs.h | 2 + arch/mips/kernel/cpu-probe.c | 13 +- arch/mips/kernel/cpu-r3k-probe.c | 2 + arch/mips/mm/tlb-r4k.c | 285 +++++++++++++++++---- crypto/asymmetric_keys/x509_cert_parser.c | 8 +- drivers/edac/edac_mc.c | 6 +- drivers/gpu/drm/i915/display/intel_psr.c | 30 ++- drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c | 26 +- drivers/input/misc/uinput.c | 35 ++- drivers/misc/fastrpc.c | 4 +- drivers/mmc/host/vub300.c | 2 +- drivers/net/ethernet/altera/altera_tse_main.c | 1 + drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 6 + drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 + .../net/ethernet/microchip/lan966x/lan966x_fdma.c | 28 +- drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 11 +- .../net/wireless/broadcom/brcm80211/brcmsmac/dma.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 2 +- drivers/nfc/pn533/uart.c | 11 +- .../intel/uncore-frequency/uncore-frequency-tpmi.c | 8 +- drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 8 +- drivers/usb/typec/ucsi/ucsi.c | 3 +- fs/btrfs/disk-io.c | 13 +- fs/btrfs/extent-tree.c | 30 +-- fs/btrfs/extent_io.c | 33 +-- fs/btrfs/extent_io.h | 18 +- include/net/netfilter/nf_conntrack_timeout.h | 1 + include/trace/events/rxrpc.h | 2 +- kernel/sched/ext.c | 48 +++- kernel/trace/blktrace.c | 4 +- kernel/workqueue.c | 14 +- lib/crypto/chacha.c | 4 + mm/filemap.c | 11 +- net/batman-adv/bridge_loop_avoidance.c | 27 +- net/batman-adv/translation-table.c | 9 +- net/core/skbuff.c | 5 +- net/core/skmsg.c | 14 +- net/ipv4/tcp.c | 4 +- net/ipv4/tcp_bpf.c | 2 +- net/ipv4/tcp_input.c | 14 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/udp.c | 3 +- net/ipv4/udp_bpf.c | 2 +- net/ipv6/seg6_iptunnel.c | 34 ++- net/mptcp/pm_netlink.c | 24 +- net/mptcp/protocol.c | 13 +- net/mptcp/protocol.h | 1 + net/mptcp/subflow.c | 15 +- net/netfilter/nft_ct.c | 2 +- net/nfc/nci/core.c | 9 + net/rfkill/core.c | 35 ++- net/rxrpc/af_rxrpc.c | 6 - net/rxrpc/call_object.c | 25 +- net/rxrpc/io_thread.c | 3 +- net/rxrpc/key.c | 2 +- net/rxrpc/rxkad.c | 63 +++-- net/rxrpc/sendmsg.c | 2 +- net/rxrpc/server_key.c | 3 + net/tipc/group.c | 6 +- net/tls/tls_sw.c | 10 + net/unix/af_unix.c | 8 +- net/xfrm/xfrm_user.c | 3 + sound/pci/hda/patch_hdmi.c | 1 + sound/soc/generic/simple-card-utils.c | 7 +- 75 files changed, 742 insertions(+), 361 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/70 lib/crypto: chacha: Zeroize permuted_state before it leaves scope
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit e5046823f8fa3677341b541a25af2fcb99a5b1e0 upstream.
Since the ChaCha permutation is invertible, the local variable 'permuted_state' is sufficient to compute the original 'state', and thus the key, even after the permutation has been done.
While the kernel is quite inconsistent about zeroizing secrets on the stack (and some prominent userspace crypto libraries don't bother at all since it's not guaranteed to work anyway), the kernel does try to do it as a best practice, especially in cases involving the RNG.
Thus, explicitly zeroize 'permuted_state' before it goes out of scope.
--- lib/crypto/chacha.c | 4 ++++ 1 file changed, 4 insertions(+)
lib/crypto/chacha.c +4 -0
@@ -86,6 +86,8 @@ void chacha_block_generic(u32 *state, u8put_unaligned_le32 (x[i] + state[i], &stream[i *sizeof (u32)]); state[12 ]++; + +memzero_explicit (x,sizeof (x)); }EXPORT_SYMBOL (chacha_block_generic);
@@ -110,5 +112,7 @@ void hchacha_block_generic(const u32 *stmemcpy (&stream[0 ], &x[0 ],16 );memcpy (&stream[4 ], &x[12 ],16 ); + +memzero_explicit (x,sizeof (x)); }EXPORT_SYMBOL (hchacha_block_generic);
Greg Kroah-Hartman
maintainerPATCH 2/70 usb: typec: ucsi: skip connector validation before init
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Rebello <[email protected]>
commit 5a1140404cbf7ba40137dfb1fb96893aa9a67d68 upstream.
Notifications can arrive before ucsi_init() has populated ucsi->cap.num_connectors via GET_CAPABILITY. At that point num_connectors is still 0, causing all valid connector numbers to be incorrectly rejected as bogus.
Skip the bounds check when num_connectors is 0 (not yet initialized). Pre-init notifications are already handled safely by the early-event guard in ucsi_connector_change().
--- drivers/usb/typec/ucsi/ucsi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/typec/ucsi/ucsi.c +2 -1
@@ -43,7 +43,8 @@ void ucsi_notify_common(struct ucsi *ucsreturn ;if (UCSI_CCI_CONNECTOR (cci)) { -if (UCSI_CCI_CONNECTOR (cci) <= ucsi->cap.num_connectors) +if (!ucsi->cap.num_connectors || +UCSI_CCI_CONNECTOR (cci) <= ucsi->cap.num_connectors)ucsi_connector_change (ucsi,UCSI_CCI_CONNECTOR (cci));else dev_err(ucsi->dev, "bogus connector number in CCI: %lu\n",
Greg Kroah-Hartman
maintainerPATCH 3/70 wifi: rt2x00usb: fix devres lifetime
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 25369b22223d1c56e42a0cd4ac9137349d5a898e upstream.
USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without their devices being physically disconnected (e.g. on probe deferral or configuration changes).
Fix the USB anchor lifetime so that it is released on driver unbind.
--- drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c +1 -1
@@ -830,7 +830,7 @@ int rt2x00usb_probe(struct usb_interfaceif (retval) goto exit_free_device; - rt2x00dev->anchor =devm_kmalloc (&usb_dev->dev, + rt2x00dev->anchor =devm_kmalloc (&usb_intf->dev,sizeof (struct usb_anchor ),GFP_KERNEL );if (!rt2x00dev->anchor) {
Greg Kroah-Hartman
maintainerPATCH 4/70 xfrm_user: fix info leak in build_report()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit d10119968d0e1f2b669604baf2a8b5fdb72fa6b4 upstream.
struct xfrm_user_report is a __u8 proto field followed by a struct xfrm_selector which means there is three "empty" bytes of padding, but the padding is never zeroed before copying to userspace. Fix that up by zeroing the structure before setting individual member variables.
--- net/xfrm/xfrm_user.c | 1 + 1 file changed, 1 insertion(+)
net/xfrm/xfrm_user.c +1 -0
@@ -4006,6 +4006,7 @@ static int build_report(struct sk_buff *return -EMSGSIZE ; ur =nlmsg_data (nlh); +memset (ur,0 ,sizeof (*ur)); ur->proto = proto;memcpy (&ur->sel, sel,sizeof (ur->sel));
Greg Kroah-Hartman
maintainerPATCH 5/70 net: rfkill: prevent unlimited numbers of rfkill events from being created
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit ea245d78dec594372e27d8c79616baf49e98a4a1 upstream.
Userspace can create an unlimited number of rfkill events if the system is so configured, while not consuming them from the rfkill file descriptor, causing a potential out of memory situation. Prevent this from bounding the number of pending rfkill events at a "large" number (i.e. 1000) to prevent abuses like this.
--- net/rfkill/core.c | 35 ++++++++++++++++++++++++----------- 1 file changed, 24 insertions(+), 11 deletions(-)
net/rfkill/core.c +24 -11
@@ -73,11 +73,14 @@ struct rfkill_int_event {struct rfkill_event_ext ev; }; +/* Max rfkill events that can be "in-flight" for one data source */ +#define MAX_RFKILL_EVENT 1000struct rfkill_data {struct list_head list;struct list_head events;struct mutex mtx;wait_queue_head_t read_wait; +u32 event_count;bool input_handler;u8 max_size; };
@@ -255,10 +258,12 @@ static void rfkill_global_led_trigger_un }#endif /* CONFIG_RFKILL_LEDS */ -static void rfkill_fill_event (struct rfkill_event_ext *ev, -struct rfkill *rfkill, -enum rfkill_operation op) +static int rfkill_fill_event (struct rfkill_int_event *int_ev, +struct rfkill *rfkill, +struct rfkill_data *data, +enum rfkill_operation op) { +struct rfkill_event_ext *ev = &int_ev->ev;unsigned long flags; ev->idx = rfkill->idx;
@@ -271,6 +276,15 @@ static void rfkill_fill_event(struct rfk RFKILL_BLOCK_SW_PREV)); ev->hard_block_reasons = rfkill->hard_block_reasons;spin_unlock_irqrestore (&rfkill->lock, flags); + + scoped_guard(mutex, &data->mtx) { +if (data->event_count++ >MAX_RFKILL_EVENT ) { + data->event_count--; +return -ENOSPC ; + } +list_add_tail (&int_ev->list, &data->events); + } +return 0 ; }static void rfkill_send_events (struct rfkill *rfkill,enum rfkill_operation op)
@@ -282,10 +296,10 @@ static void rfkill_send_events(struct rf ev =kzalloc (sizeof (*ev),GFP_KERNEL );if (!ev)continue ; -rfkill_fill_event (&ev->ev, rfkill, op); -mutex_lock (&data->mtx); -list_add_tail (&ev->list, &data->events); -mutex_unlock (&data->mtx); +if (rfkill_fill_event (ev, rfkill, data, op)) { +kfree (ev); +continue ; + }wake_up_interruptible (&data->read_wait); } }
@@ -1186,10 +1200,8 @@ static int rfkill_fop_open(struct inodeif (!ev) goto free;rfkill_sync (rfkill); -rfkill_fill_event (&ev->ev, rfkill,RFKILL_OP_ADD ); -mutex_lock (&data->mtx); -list_add_tail (&ev->list, &data->events); -mutex_unlock (&data->mtx); +if (rfkill_fill_event (ev, rfkill, data,RFKILL_OP_ADD )) +kfree (ev); }list_add (&data->list, &rfkill_fds);mutex_unlock (&rfkill_global_mutex);
@@ -1259,6 +1271,7 @@ static ssize_t rfkill_fop_read(struct fi ret = -EFAULT ;list_del (&ev->list); + data->event_count--;kfree (ev); out:mutex_unlock (&data->mtx);
Greg Kroah-Hartman
maintainerPATCH 6/70 mptcp: fix slab-use-after-free in __inet_lookup_established
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
commit 9b55b253907e7431210483519c5ad711a37dafa1 upstream.
The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side critical sections. Both tcp_prot and tcpv6_prot have their slab caches created with this flag via proto_register().
However, MPTCP's mptcp_subflow_init() copies tcpv6_prot into tcpv6_prot_override during inet_init() (fs_initcall, level 5), before inet6_init() (module_init/device_initcall, level 6) has called proto_register(&tcpv6_prot). At that point, tcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab remains NULL permanently.
This causes MPTCP v6 subflow child sockets to be allocated via kmalloc (falling into kmalloc-4k) instead of the TCPv6 slab cache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so when these sockets are freed without SOCK_RCU_FREE (which is cleared for child sockets by design), the memory can be immediately reused. Concurrent ehash lookups under rcu_read_lock can then access freed memory, triggering a slab-use-after-free in __inet_lookup_established.
Fix this by splitting the IPv6-specific initialization out of mptcp_subflow_init() into a new mptcp_subflow_v6_init(), called from mptcp_proto_v6_init() before protocol registration. This ensures tcpv6_prot_override.slab correctly inherits the SLAB_TYPESAFE_BY_RCU slab cache.
--- net/mptcp/protocol.c | 2 ++ net/mptcp/protocol.h | 1 + net/mptcp/subflow.c | 15 +++++++++------ 3 files changed, 12 insertions(+), 6 deletions(-)
net/mptcp/protocol.c +2 -0
@@ -4338,6 +4338,8 @@ int __init mptcp_proto_v6_init(void) {int err; +mptcp_subflow_v6_init (); + mptcp_v6_prot = mptcp_prot;strscpy (mptcp_v6_prot.name,"MPTCPv6" ,sizeof (mptcp_v6_prot.name)); mptcp_v6_prot.slab =NULL ;
net/mptcp/protocol.h +1 -0
@@ -821,6 +821,7 @@ static inline void mptcp_subflow_tcp_falvoid __init mptcp_proto_init (void );#if IS_ENABLED (CONFIG_MPTCP_IPV6 )int __init mptcp_proto_v6_init (void ); +void __init mptcp_subflow_v6_init (void );#endif struct sock *mptcp_sk_clone_init(const struct sock *sk,
net/mptcp/subflow.c +9 -6
@@ -2147,7 +2147,15 @@ void __init mptcp_subflow_init(void) tcp_prot_override.psock_update_sk_prot =NULL ;#endif +mptcp_diag_subflow_init (&subflow_ulp_ops); + +if (tcp_register_ulp (&subflow_ulp_ops) !=0 ) +panic ("MPTCP: failed to register subflows to ULP\n" ); +} +#if IS_ENABLED (CONFIG_MPTCP_IPV6 ) +void __init mptcp_subflow_v6_init (void ) +{/* In struct mptcp_subflow_request_sock, we assume the TCP request sock * structures for v4 and v6 have the same size. It should not changed in * the future but better to make sure to be warned if it is no longer
@@ -2186,10 +2194,5 @@ void __init mptcp_subflow_init(void)/* Disable sockmap processing for subflows */ tcpv6_prot_override.psock_update_sk_prot =NULL ; #endif -#endif - -mptcp_diag_subflow_init (&subflow_ulp_ops); - -if (tcp_register_ulp (&subflow_ulp_ops) !=0 ) -panic ("MPTCP: failed to register subflows to ULP\n" ); } +#endif
Greg Kroah-Hartman
maintainerPATCH 7/70 seg6: separate dst_cache for input and output paths in seg6 lwtunnel
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Mayer <[email protected]>
commit c3812651b522fe8437ebb7063b75ddb95b571643 upstream.
The seg6 lwtunnel uses a single dst_cache per encap route, shared between seg6_input_core() and seg6_output_core(). These two paths can perform the post-encap SID lookup in different routing contexts (e.g., ip rules matching on the ingress interface, or VRF table separation). Whichever path runs first populates the cache, and the other reuses it blindly, bypassing its own lookup.
Fix this by splitting the cache into cache_input and cache_output, so each path maintains its own cached dst independently.
--- net/ipv6/seg6_iptunnel.c | 34 +++++++++++++++++++++++----------- 1 file changed, 23 insertions(+), 11 deletions(-)
net/ipv6/seg6_iptunnel.c +23 -11
@@ -48,7 +48,8 @@ static size_t seg6_lwt_headroom(struct s }struct seg6_lwt { -struct dst_cache cache; +struct dst_cache cache_input; +struct dst_cache cache_output;struct seg6_iptunnel_encap tuninfo[]; };
@@ -488,7 +489,7 @@ static int seg6_input_core(struct net *n slwt =seg6_lwt_lwtunnel (lwtst);local_bh_disable (); - dst =dst_cache_get (&slwt->cache); + dst =dst_cache_get (&slwt->cache_input);local_bh_enable (); err =seg6_do_srh (skb, dst);
@@ -504,7 +505,7 @@ static int seg6_input_core(struct net *n/* cache only if we don't create a dst reference loop */ if (!dst->error && lwtst != dst->lwtstate) {local_bh_disable (); -dst_cache_set_ip6 (&slwt->cache, dst, +dst_cache_set_ip6 (&slwt->cache_input, dst, &ipv6_hdr (skb)->saddr);local_bh_enable (); }
@@ -564,7 +565,7 @@ static int seg6_output_core(struct net * slwt =seg6_lwt_lwtunnel (orig_dst->lwtstate);local_bh_disable (); - dst =dst_cache_get (&slwt->cache); + dst =dst_cache_get (&slwt->cache_output);local_bh_enable (); err =seg6_do_srh (skb, dst);
@@ -591,7 +592,7 @@ static int seg6_output_core(struct net */* cache only if we don't create a dst reference loop */ if (orig_dst->lwtstate != dst->lwtstate) {local_bh_disable (); -dst_cache_set_ip6 (&slwt->cache, dst, &fl6.saddr); +dst_cache_set_ip6 (&slwt->cache_output, dst, &fl6.saddr);local_bh_enable (); }
@@ -701,11 +702,13 @@ static int seg6_build_state(struct net * slwt =seg6_lwt_lwtunnel (newts); - err =dst_cache_init (&slwt->cache,GFP_ATOMIC ); -if (err) { -kfree (newts); -return err; - } + err =dst_cache_init (&slwt->cache_input,GFP_ATOMIC ); +if (err) + goto err_free_newts; + + err =dst_cache_init (&slwt->cache_output,GFP_ATOMIC ); +if (err) + goto err_destroy_input;memcpy (&slwt->tuninfo, tuninfo, tuninfo_len);
@@ -720,11 +723,20 @@ static int seg6_build_state(struct net * *ts = newts;return 0 ; + +err_destroy_input: +dst_cache_destroy (&slwt->cache_input); +err_free_newts: +kfree (newts); +return err; }static void seg6_destroy_state (struct lwtunnel_state *lwt) { -dst_cache_destroy (&seg6_lwt_lwtunnel (lwt)->cache); +struct seg6_lwt *slwt =seg6_lwt_lwtunnel (lwt); + +dst_cache_destroy (&slwt->cache_input); +dst_cache_destroy (&slwt->cache_output); } static int seg6_fill_encap_info(struct sk_buff *skb,
Greg Kroah-Hartman
maintainerPATCH 8/70 Input: uinput - fix circular locking dependency with ff-core
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Gavrilov <[email protected]>
commit 4cda78d6f8bf2b700529f2fbccb994c3e826d7c2 upstream.
A lockdep circular locking dependency warning can be triggered reproducibly when using a force-feedback gamepad with uinput (for example, playing ELDEN RING under Wine with a Flydigi Vader 5 controller):
ff->mutex -> udev->mutex -> input_mutex -> dev->mutex -> ff->mutex
The cycle is caused by four lock acquisition paths:
1. ff upload: input_ff_upload() holds ff->mutex and calls uinput_dev_upload_effect() -> uinput_request_submit() -> uinput_request_send(), which acquires udev->mutex.
2. device create: uinput_ioctl_handler() holds udev->mutex and calls uinput_create_device() -> input_register_device(), which acquires input_mutex.
3. device register: input_register_device() holds input_mutex and calls kbd_connect() -> input_register_handle(), which acquires dev->mutex.
4. evdev release: evdev_release() calls input_flush_device() under dev->mutex, which calls input_ff_flush() acquiring ff->mutex.
Fix this by introducing a new state_lock spinlock to protect udev->state and udev->dev access in uinput_request_send() instead of acquiring udev->mutex. The function only needs to atomically check device state and queue an input event into the ring buffer via uinput_dev_event() -- both operations are safe under a spinlock (ktime_get_ts64() and wake_up_interruptible() do not sleep). This breaks the ff->mutex -> udev->mutex link since a spinlock is a leaf in the lock ordering and cannot form cycles with mutexes.
To keep state transitions visible to uinput_request_send(), protect writes to udev->state in uinput_create_device() and uinput_destroy_device() with the same state_lock spinlock.
Additionally, move init_completion(&request->done) from uinput_request_send() to uinput_request_submit() before uinput_request_reserve_slot(). Once the slot is allocated, uinput_flush_requests() may call complete() on it at any time from the destroy path, so the completion must be initialised before the request becomes visible.
Lock ordering after the fix:
ff->mutex -> state_lock (spinlock, leaf)
udev->mutex -> state_lock (spinlock, leaf)
udev->mutex -> input_mutex -> dev->mutex -> ff->mutex (no back-edge)
--- drivers/input/misc/uinput.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-)
drivers/input/misc/uinput.c +21 -7
@@ -57,6 +57,7 @@ struct uinput_device {struct input_dev *dev;struct mutex mutex;enum uinput_state state; +spinlock_t state_lock;wait_queue_head_t waitq;unsigned char ready;unsigned char head;
@@ -146,19 +147,15 @@ static void uinput_request_release_slot(static int uinput_request_send (struct uinput_device *udev,struct uinput_request *request) { -int retval; +int retval =0 ; - retval =mutex_lock_interruptible (&udev->mutex); -if (retval) -return retval; +spin_lock (&udev->state_lock);if (udev->state !=UIST_CREATED ) { retval = -ENODEV ; goto out; } -init_completion (&request->done); -/* * Tell our userspace application about this new request * by queueing an input event.
@@ -166,7 +163,7 @@ static int uinput_request_send(struct uiuinput_dev_event (udev->dev,EV_UINPUT , request->code, request->id); out: -mutex_unlock (&udev->mutex); +spin_unlock (&udev->state_lock);return retval; }
@@ -175,6 +172,13 @@ static int uinput_request_submit(struct {int retval; +/* +* Initialize completion before allocating the request slot. +* Once the slot is allocated, uinput_flush_requests() may +* complete it at any time, so it must be initialized first. +*/ +init_completion (&request->done); + retval =uinput_request_reserve_slot (udev, request);if (retval)return retval;
@@ -289,7 +293,14 @@ static void uinput_destroy_device(structstruct input_dev *dev = udev->dev;enum uinput_state old_state = udev->state; +/* +* Update state under state_lock so that concurrent +* uinput_request_send() sees the state change before we +* flush pending requests and tear down the device. +*/ +spin_lock (&udev->state_lock); udev->state =UIST_NEW_DEVICE ; +spin_unlock (&udev->state_lock);if (dev) { name = dev->name;
@@ -366,7 +377,9 @@ static int uinput_create_device(struct uif (error) goto fail2; +spin_lock (&udev->state_lock); udev->state =UIST_CREATED ; +spin_unlock (&udev->state_lock);return 0 ;
@@ -384,6 +397,7 @@ static int uinput_open(struct inode *inoreturn -ENOMEM ;mutex_init (&newdev->mutex); +spin_lock_init (&newdev->state_lock);spin_lock_init (&newdev->requests_lock);init_waitqueue_head (&newdev->requests_waitq);init_waitqueue_head (&newdev->waitq);
Greg Kroah-Hartman
maintainerPATCH 9/70 Input: uinput - take event lock when submitting FF request "event"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit ff14dafde15c11403fac61367a34fea08926e9ee upstream.
To avoid racing with FF playback events and corrupting device's event queue take event_lock spinlock when calling uinput_dev_event() when submitting a FF upload or erase "event".
--- drivers/input/misc/uinput.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/misc/uinput.c +7 -0
@@ -25,8 +25,10 @@#include <linux/module.h> #include <linux/init.h> #include <linux/fs.h> +#include <linux/lockdep.h> #include <linux/miscdevice.h> #include <linux/overflow.h> +#include <linux/spinlock.h> #include <linux/input/mt.h> #include "../input-compat.h"
@@ -76,6 +78,8 @@ static int uinput_dev_event(struct inputstruct uinput_device *udev =input_get_drvdata (dev);struct timespec64 ts; +lockdep_assert_held (&dev->event_lock); +ktime_get_ts64 (&ts); udev->buff[udev->head] = (struct input_event ) {
@@ -147,6 +151,7 @@ static void uinput_request_release_slot(static int uinput_request_send (struct uinput_device *udev,struct uinput_request *request) { +unsigned long flags;int retval =0 ;spin_lock (&udev->state_lock);
@@ -160,7 +165,9 @@ static int uinput_request_send(struct ui* Tell our userspace application about this new request * by queueing an input event. */ +spin_lock_irqsave (&udev->dev->event_lock, flags);uinput_dev_event (udev->dev,EV_UINPUT , request->code, request->id); +spin_unlock_irqrestore (&udev->dev->event_lock, flags); out:spin_unlock (&udev->state_lock);
Greg Kroah-Hartman
maintainerPATCH 10/70 MIPS: Always record SEGBITS in cpu_data.vmbits
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit 8374c2cb83b95b3c92f129fd56527225c20a058c upstream.
With a 32-bit kernel running on 64-bit MIPS hardware the hardcoded value of `cpu_vmbits' only records the size of compatibility useg and does not reflect the size of native xuseg or the complete range of values allowed in the VPN2 field of TLB entries.
An upcoming change will need the actual VPN2 value range permitted even in 32-bit kernel configurations, so always include the vmbits' member in struct cpuinfo_mips' and probe for SEGBITS when running on 64-bit hardware and resorting to the currently hardcoded value of 31 on 32-bit processors. No functional change for users of `cpu_vmbits'.
--- arch/mips/include/asm/cpu-features.h | 1 - arch/mips/include/asm/cpu-info.h | 2 -- arch/mips/include/asm/mipsregs.h | 2 ++ arch/mips/kernel/cpu-probe.c | 13 ++++++++----- arch/mips/kernel/cpu-r3k-probe.c | 2 ++ 5 files changed, 12 insertions(+), 8 deletions(-)
arch/mips/include/asm/cpu-features.h +0 -1
@@ -484,7 +484,6 @@# endif # ifndef cpu_vmbits# define cpu_vmbits cpu_data[0].vmbits -# define __NEED_VMBITS_PROBE# endif #endif
arch/mips/include/asm/cpu-info.h +0 -2
@@ -80,9 +80,7 @@ struct cpuinfo_mips {int srsets;/* Shadow register sets */ int package;/* physical package number */ unsigned int globalnumber; -#ifdef CONFIG_64BIT int vmbits;/* Virtual memory size in bits */ -#endif void *data;/* Additional data */ unsigned int watch_reg_count;/* Number that exist */ unsigned int watch_reg_use_cnt;/* Usable by ptrace */
arch/mips/include/asm/mipsregs.h +2 -0
@@ -1871,6 +1871,8 @@ do { \#define read_c0_entryhi () __read_ulong_c0_register($10, 0)#define write_c0_entryhi (val) __write_ulong_c0_register($10, 0, val) +#define read_c0_entryhi_64 () __read_64bit_c0_register($10, 0) +#define write_c0_entryhi_64 (val) __write_64bit_c0_register($10, 0, val)#define read_c0_guestctl1 () __read_32bit_c0_register($10, 4)#define write_c0_guestctl1 (val) __write_32bit_c0_register($10, 4, val)
arch/mips/kernel/cpu-probe.c +8 -5
@@ -207,11 +207,14 @@ static inline void set_elf_base_platform(const char *plat)static inline void cpu_probe_vmbits (struct cpuinfo_mips *c) { -#ifdef __NEED_VMBITS_PROBE -write_c0_entryhi (0x3fffffffffffe000ULL ); -back_to_back_c0_hazard (); - c->vmbits =fls64 (read_c0_entryhi () &0x3fffffffffffe000ULL ); -#endif +int vmbits =31 ; + +if (cpu_has_64bits) { +write_c0_entryhi_64 (0x3fffffffffffe000ULL ); +back_to_back_c0_hazard (); + vmbits =fls64 (read_c0_entryhi_64 () &0x3fffffffffffe000ULL ); + } + c->vmbits = vmbits; }static void set_isa (struct cpuinfo_mips *c,unsigned int isa)
arch/mips/kernel/cpu-r3k-probe.c +2 -0
@@ -137,6 +137,8 @@ void cpu_probe(void)else cpu_set_nofpu_opts (c); + c->vmbits =31 ; +reserve_exception_space (0 ,0x400 ); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 11/70 MIPS: mm: Suppress TLB uniquification on EHINV hardware
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit 74283cfe216392c7b776ebf6045b5b15ed9dffcd upstream.
Hardware that supports the EHINV feature, mandatory for R6 ISA and FTLB implementation, lets software mark TLB entries invalid, which eliminates the need to ensure no duplicate matching entries are ever created. This feature is already used by local_flush_tlb_all(), via the UNIQUE_ENTRYHI macro, making the preceding call to r4k_tlb_uniquify() superfluous.
The next change will also modify uniquification code such that it'll become incompatible with the FTLB and MMID features, as well as MIPSr6 CPUs that do not implement 4KiB pages.
Therefore prevent r4k_tlb_uniquify() from being used on EHINV hardware, as denoted by `cpu_has_tlbinv'.
--- arch/mips/mm/tlb-r4k.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/mips/mm/tlb-r4k.c +2 -1
@@ -640,7 +640,8 @@ static void r4k_tlb_configure(void) temp_tlb_entry = current_cpu_data.tlbsize -1 ;/* From this point on the ARC firmware is dead. */ -r4k_tlb_uniquify (); +if (!cpu_has_tlbinv) +r4k_tlb_uniquify ();local_flush_tlb_all ();/* Did I tell you that ARC SUCKS? */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 12/70 MIPS: mm: Rewrite TLB uniquification for the hidden bit feature
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit 540760b77b8fc49d39d1b2b76196e5ec57711a32 upstream.
Before the introduction of the EHINV feature, which lets software mark TLB entries invalid, certain older implementations of the MIPS ISA were equipped with an analogous bit, as a vendor extension, which however is hidden from software and only ever set at reset, and then any software write clears it, making the intended TLB entry valid.
This feature makes it unsafe to read a TLB entry with TLBR, modify the page mask, and write the entry back with TLBWI, because this operation will implicitly clear the hidden bit and this may create a duplicate entry, as with the presence of the hidden bit there is no guarantee all the entries across the TLB are unique each.
Usually the firmware has already uniquified TLB entries before handing control over, in which case we only need to guarantee at bootstrap no clash will happen with the VPN2 values chosen in local_flush_tlb_all().
However with systems such as Mikrotik RB532 we get handed the TLB as at reset, with the hidden bit set across the entries and possibly duplicate entries present. This then causes a machine check exception when page sizes are reset in r4k_tlb_uniquify() and prevents the system from booting.
Rewrite the algorithm used in r4k_tlb_uniquify() then such as to avoid the reuse of ASID/VPN values across the TLB. Get rid of global entries first as they may be blocking the entire address space, e.g. 16 256MiB pages will exhaust the whole address space of a 32-bit CPU and a single big page can exhaust the 32-bit compatibility space on a 64-bit CPU.
Details of the algorithm chosen are given across the code itself.
--- arch/mips/mm/tlb-r4k.c | 282 +++++++++++++++++++++++++++++++++-------- 1 file changed, 228 insertions(+), 54 deletions(-)
arch/mips/mm/tlb-r4k.c +228 -54
@@ -13,6 +13,7 @@#include <linux/sched.h> #include <linux/smp.h> #include <linux/memblock.h> +#include <linux/minmax.h> #include <linux/mm.h> #include <linux/hugetlb.h> #include <linux/export.h>
@@ -24,6 +25,7 @@#include <asm/hazards.h> #include <asm/mmu_context.h> #include <asm/tlb.h> +#include <asm/tlbdebug.h> #include <asm/tlbex.h> #include <asm/tlbmisc.h> #include <asm/setup.h>
@@ -511,87 +513,259 @@ static int __init set_ntlb(char *str)__setup ("ntlb=" , set_ntlb); -/* Comparison function for EntryHi VPN fields. */ -static int r4k_vpn_cmp (const void *a,const void *b) +/* The start bit position of VPN2 and Mask in EntryHi/PageMask registers. */ +#define VPN2_SHIFT 13 + +/* Read full EntryHi even with CONFIG_32BIT. */ +static inline unsigned long long read_c0_entryhi_native (void ) +{ +return cpu_has_64bits ?read_c0_entryhi_64 () :read_c0_entryhi (); +} + +/* Write full EntryHi even with CONFIG_32BIT. */ +static inline void write_c0_entryhi_native (unsigned long long v) { -long v = *(unsigned long *)a - *(unsigned long *)b; -int s =sizeof (long ) >sizeof (int ) ?sizeof (long ) *8 -1 :0 ; -return s ? (v !=0 ) | v >> s : v; +if (cpu_has_64bits) +write_c0_entryhi_64 (v); +else +write_c0_entryhi (v); } +/* TLB entry state for uniquification. */ +struct tlbent { +unsigned long long wired:1 ; +unsigned long long global:1 ; +unsigned long long asid:10 ; +unsigned long long vpn:51 ; +unsigned long long pagesz:5 ; +unsigned long long index:14 ; +}; +/* -* Initialise all TLB entries with unique values that do not clash with -* what we have been handed over and what we'll be using ourselves. +* Comparison function for TLB entry sorting. Place wired entries first, +* then global entries, then order by the increasing VPN/ASID and the +* decreasing page size. This lets us avoid clashes with wired entries +* easily and get entries for larger pages out of the way first. +* +* We could group bits so as to reduce the number of comparisons, but this +* is seldom executed and not performance-critical, so prefer legibility. */ -static void __ref r4k_tlb_uniquify (void ) +static int r4k_entry_cmp (const void *a,const void *b) { -int tlbsize = current_cpu_data.tlbsize; -bool use_slab =slab_is_available (); -int start =num_wired_entries (); -phys_addr_t tlb_vpn_size; -unsigned long *tlb_vpns; -unsigned long vpn_mask; -int cnt, ent, idx, i; - - vpn_mask =GENMASK (cpu_vmbits -1 ,13 ); - vpn_mask |=IS_ENABLED (CONFIG_64BIT ) ?3ULL <<62 :1 <<31 ; +struct tlbent ea = *(struct tlbent *)a, eb = *(struct tlbent *)b; + +if (ea.wired > eb.wired) +return -1 ; +else if (ea.wired < eb.wired) +return 1 ; +else if (ea.global > eb.global) +return -1 ; +else if (ea.global < eb.global) +return 1 ; +else if (ea.vpn < eb.vpn) +return -1 ; +else if (ea.vpn > eb.vpn) +return 1 ; +else if (ea.asid < eb.asid) +return -1 ; +else if (ea.asid > eb.asid) +return 1 ; +else if (ea.pagesz > eb.pagesz) +return -1 ; +else if (ea.pagesz < eb.pagesz) +return 1 ; +else +return 0 ; +} - tlb_vpn_size = tlbsize *sizeof (*tlb_vpns); - tlb_vpns = (use_slab ? -kmalloc (tlb_vpn_size,GFP_ATOMIC ) : -memblock_alloc_raw (tlb_vpn_size,sizeof (*tlb_vpns))); -if (WARN_ON (!tlb_vpns)) -return ;/* Pray local_flush_tlb_all() is good enough. */ +/* +* Fetch all the TLB entries. Mask individual VPN values retrieved with +* the corresponding page mask and ignoring any 1KiB extension as we'll +* be using 4KiB pages for uniquification. +*/ +static void __ref r4k_tlb_uniquify_read (struct tlbent *tlb_vpns,int tlbsize) +{ +int start =num_wired_entries (); +unsigned long long vpn_mask; +bool global; +int i; -htw_stop (); + vpn_mask =GENMASK (current_cpu_data.vmbits -1 ,VPN2_SHIFT ); + vpn_mask |= cpu_has_64bits ?3ULL <<62 :1 <<31 ; -for (i = start, cnt =0 ; i < tlbsize; i++, cnt++) { -unsigned long vpn; +for (i =0 ; i < tlbsize; i++) { +unsigned long long entryhi, vpn, mask, asid; +unsigned int pagesz;write_c0_index (i);mtc0_tlbr_hazard ();tlb_read ();tlb_read_hazard (); - vpn =read_c0_entryhi (); - vpn &= vpn_mask &PAGE_MASK ; - tlb_vpns[cnt] = vpn; -/* Prevent any large pages from overlapping regular ones. */ -write_c0_pagemask (read_c0_pagemask () &PM_DEFAULT_MASK ); -mtc0_tlbw_hazard (); -tlb_write_indexed (); -tlbw_use_hazard (); + global = !!(read_c0_entrylo0 () &ENTRYLO_G ); + entryhi =read_c0_entryhi_native (); + mask =read_c0_pagemask (); + + asid = entryhi &cpu_asid_mask (¤t_cpu_data); + vpn = (entryhi & vpn_mask & ~mask) >>VPN2_SHIFT ; + pagesz =ilog2 ((mask >>VPN2_SHIFT ) +1 ); + + tlb_vpns[i].global = global; + tlb_vpns[i].asid = global ?0 : asid; + tlb_vpns[i].vpn = vpn; + tlb_vpns[i].pagesz = pagesz; + tlb_vpns[i].wired = i < start; + tlb_vpns[i].index = i; } +} -sort (tlb_vpns, cnt,sizeof (tlb_vpns[0 ]), r4k_vpn_cmp,NULL ); +/* +* Write unique values to all but the wired TLB entries each, using +* the 4KiB page size. This size might not be supported with R6, but +* EHINV is mandatory for R6, so we won't ever be called in that case. +* +* A sorted table is supplied with any wired entries at the beginning, +* followed by any global entries, and then finally regular entries. +* We start at the VPN and ASID values of zero and only assign user +* addresses, therefore guaranteeing no clash with addresses produced +* by UNIQUE_ENTRYHI. We avoid any VPN values used by wired or global +* entries, by increasing the VPN value beyond the span of such entry. +* +* When a VPN/ASID clash is found with a regular entry we increment the +* ASID instead until no VPN/ASID clash has been found or the ASID space +* has been exhausted, in which case we increase the VPN value beyond +* the span of the largest clashing entry. +* +* We do not need to be concerned about FTLB or MMID configurations as +* those are required to implement the EHINV feature. +*/ +static void __ref r4k_tlb_uniquify_write (struct tlbent *tlb_vpns,int tlbsize) +{ +unsigned long long asid, vpn, vpn_size, pagesz; +int widx, gidx, idx, sidx, lidx, i; -write_c0_pagemask (PM_DEFAULT_MASK ); + vpn_size =1ULL << (current_cpu_data.vmbits -VPN2_SHIFT ); + pagesz =ilog2 ((PM_4K >>VPN2_SHIFT ) +1 ); + +write_c0_pagemask (PM_4K );write_c0_entrylo0 (0 );write_c0_entrylo1 (0 ); - idx =0 ; - ent = tlbsize; -for (i = start; i < tlbsize; i++) -while (1 ) { -unsigned long entryhi, vpn; + asid =0 ; + vpn =0 ; + widx =0 ; + gidx =0 ; +for (sidx =0 ; sidx < tlbsize && tlb_vpns[sidx].wired; sidx++) + ; +for (lidx = sidx; lidx < tlbsize && tlb_vpns[lidx].global; lidx++) + ; + idx = gidx = sidx +1 ; +for (i = sidx; i < tlbsize; i++) { +unsigned long long entryhi, vpn_pagesz =0 ; - entryhi =UNIQUE_ENTRYHI (ent); - vpn = entryhi & vpn_mask &PAGE_MASK ; +while (1 ) { +if (WARN_ON (vpn >= vpn_size)) { +dump_tlb_all (); +/* Pray local_flush_tlb_all() will cope. */ +return ; + } -if (idx >= cnt || vpn < tlb_vpns[idx]) { -write_c0_entryhi (entryhi); -write_c0_index (i); -mtc0_tlbw_hazard (); -tlb_write_indexed (); - ent++; -break ; - }else if (vpn == tlb_vpns[idx]) { - ent++; - }else { +/* VPN must be below the next wired entry. */ +if (widx < sidx && vpn >= tlb_vpns[widx].vpn) { + vpn =max (vpn, + (tlb_vpns[widx].vpn + + (1ULL << tlb_vpns[widx].pagesz))); + asid =0 ; + widx++; +continue ; + } +/* VPN must be below the next global entry. */ +if (gidx < lidx && vpn >= tlb_vpns[gidx].vpn) { + vpn =max (vpn, + (tlb_vpns[gidx].vpn + + (1ULL << tlb_vpns[gidx].pagesz))); + asid =0 ; + gidx++; +continue ; + } +/* Try to find a free ASID so as to conserve VPNs. */ +if (idx < tlbsize && vpn == tlb_vpns[idx].vpn && + asid == tlb_vpns[idx].asid) { +unsigned long long idx_pagesz; + + idx_pagesz = tlb_vpns[idx].pagesz; + vpn_pagesz =max (vpn_pagesz, idx_pagesz); +do + idx++; +while (idx < tlbsize && + vpn == tlb_vpns[idx].vpn && + asid == tlb_vpns[idx].asid); + asid++; +if (asid >cpu_asid_mask (¤t_cpu_data)) { + vpn += vpn_pagesz; + asid =0 ; + vpn_pagesz =0 ; + } +continue ; + } +/* VPN mustn't be above the next regular entry. */ +if (idx < tlbsize && vpn > tlb_vpns[idx].vpn) { + vpn =max (vpn, + (tlb_vpns[idx].vpn + + (1ULL << tlb_vpns[idx].pagesz))); + asid =0 ; idx++; +continue ; } +break ; } + entryhi = (vpn <<VPN2_SHIFT ) | asid; +write_c0_entryhi_native (entryhi); +write_c0_index (tlb_vpns[i].index); +mtc0_tlbw_hazard (); +tlb_write_indexed (); + + tlb_vpns[i].asid = asid; + tlb_vpns[i].vpn = vpn; + tlb_vpns[i].pagesz = pagesz; + + asid++; +if (asid >cpu_asid_mask (¤t_cpu_data)) { + vpn +=1ULL << pagesz; + asid =0 ; + } + } +} + +/* +* Initialise all TLB entries with unique values that do not clash with +* what we have been handed over and what we'll be using ourselves. +*/ +static void __ref r4k_tlb_uniquify (void ) +{ +int tlbsize = current_cpu_data.tlbsize; +bool use_slab =slab_is_available (); +phys_addr_t tlb_vpn_size; +struct tlbent *tlb_vpns; + + tlb_vpn_size = tlbsize *sizeof (*tlb_vpns); + tlb_vpns = (use_slab ? +kmalloc (tlb_vpn_size,GFP_ATOMIC ) : +memblock_alloc_raw (tlb_vpn_size,sizeof (*tlb_vpns))); +if (WARN_ON (!tlb_vpns)) +return ;/* Pray local_flush_tlb_all() is good enough. */ + +htw_stop (); + +r4k_tlb_uniquify_read (tlb_vpns, tlbsize); + +sort (tlb_vpns, tlbsize,sizeof (*tlb_vpns), r4k_entry_cmp,NULL ); + +r4k_tlb_uniquify_write (tlb_vpns, tlbsize); + +write_c0_pagemask (PM_DEFAULT_MASK ); +tlbw_use_hazard ();htw_start ();flush_micro_tlb ();
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 13/70 ASoC: simple-card-utils: Dont use __free(device_node) at graph_util_parse_dai()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit de74ec718e0788e1998eb7289ad07970e27cae27 ]
commit 419d1918105e ("ASoC: simple-card-utils: use __free(device_node) for device node") uses __free(device_node) for dlc->of_node, but we need to keep it while driver is in use.
Don't use __free(device_node) in graph_util_parse_dai().
--- sound/soc/generic/simple-card-utils.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
sound/soc/generic/simple-card-utils.c +5 -2
@@ -1072,6 +1072,7 @@ static int graph_get_dai_id(struct device_node *ep)int graph_util_parse_dai (struct device *dev,struct device_node *ep,struct snd_soc_dai_link_component *dlc,int *is_single_link) { +struct device_node *node;struct of_phandle_args args = {};struct snd_soc_dai *dai;int ret;
@@ -1079,7 +1080,7 @@ int graph_util_parse_dai(struct device *dev, struct device_node *ep,if (!ep)return 0 ; - struct device_node *node __free(device_node) = of_graph_get_port_parent(ep); + node =of_graph_get_port_parent (ep);/* * Try to find from DAI node
@@ -1121,8 +1122,10 @@ int graph_util_parse_dai(struct device *dev, struct device_node *ep,* if he unbinded CPU or Codec. */ ret =snd_soc_get_dlc (&args, dlc); -if (ret <0 ) +if (ret <0 ) { +of_node_put (node);return ret; + } parse_dai_end:if (is_single_link)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 14/70 btrfs: make wait_on_extent_buffer_writeback() static inline
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Sterba <[email protected]>
[ Upstream commit 075adeeb9204359e8232aeccf8b3c350ff6d9ff4 ]
The simple helper can be inlined, no need for the separate function.
Stable-dep-of: 316fb1b3169e ("btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()")
--- fs/btrfs/extent_io.c | 6 ------ fs/btrfs/extent_io.h | 7 ++++++- 2 files changed, 6 insertions(+), 7 deletions(-)
fs/btrfs/extent_io.c +0 -6
@@ -1671,12 +1671,6 @@ static int extent_writepage(struct folio *folio, struct btrfs_bio_ctrl *bio_ctrlreturn ret; } -void wait_on_extent_buffer_writeback (struct extent_buffer *eb) -{ -wait_on_bit_io (&eb->bflags,EXTENT_BUFFER_WRITEBACK , -TASK_UNINTERRUPTIBLE ); -} -/* * Lock extent buffer status and pages for writeback. *
fs/btrfs/extent_io.h +6 -1
@@ -266,7 +266,12 @@ void free_extent_buffer_stale(struct extent_buffer *eb);#define WAIT_PAGE_LOCK 2int read_extent_buffer_pages (struct extent_buffer *eb,int wait,int mirror_num,const struct btrfs_tree_parent_check *parent_check); -void wait_on_extent_buffer_writeback (struct extent_buffer *eb); +static inline void wait_on_extent_buffer_writeback (struct extent_buffer *eb) +{ +wait_on_bit_io (&eb->bflags,EXTENT_BUFFER_WRITEBACK , +TASK_UNINTERRUPTIBLE ); +} +void btrfs_readahead_tree_block (struct btrfs_fs_info *fs_info,u64 bytenr,u64 owner_root,u64 gen,int level);void btrfs_readahead_node_child (struct extent_buffer *node,int slot);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 15/70 btrfs: remove unused define WAIT_PAGE_LOCK for extent io
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Sterba <[email protected]>
[ Upstream commit db9eef2ea8633714ccdcb224f13ca3f3b5ed62cc ]
Last use was in the readahead code that got removed by f26c9238602856 ("btrfs: remove reada infrastructure").
Stable-dep-of: 316fb1b3169e ("btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()")
--- fs/btrfs/extent_io.h | 1 - 1 file changed, 1 deletion(-)
fs/btrfs/extent_io.h +0 -1
@@ -263,7 +263,6 @@ void free_extent_buffer(struct extent_buffer *eb);void free_extent_buffer_stale (struct extent_buffer *eb);#define WAIT_NONE 0#define WAIT_COMPLETE 1 -#define WAIT_PAGE_LOCK 2int read_extent_buffer_pages (struct extent_buffer *eb,int wait,int mirror_num,const struct btrfs_tree_parent_check *parent_check);static inline void wait_on_extent_buffer_writeback (struct extent_buffer *eb)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 16/70 btrfs: split waiting from read_extent_buffer_pages(), drop parameter wait
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Sterba <[email protected]>
[ Upstream commit 248c4ff3935252a82504c55cfd3592e413575bd0 ]
There are only 2 WAIT_* values left for wait parameter, we can encode this to the function name if the waiting functionality is split.
Stable-dep-of: 316fb1b3169e ("btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()")
--- fs/btrfs/disk-io.c | 2 +- fs/btrfs/extent_io.c | 27 +++++++++++++++++---------- fs/btrfs/extent_io.h | 7 ++++--- 3 files changed, 22 insertions(+), 14 deletions(-)
fs/btrfs/disk-io.c +1 -1
@@ -226,7 +226,7 @@ int btrfs_read_extent_buffer(struct extent_buffer *eb,while (1 ) {clear_bit (EXTENT_BUFFER_CORRUPT , &eb->bflags); - ret =read_extent_buffer_pages (eb,WAIT_COMPLETE , mirror_num, check); + ret =read_extent_buffer_pages (eb, mirror_num, check);if (!ret)break ;
fs/btrfs/extent_io.c +17 -10
@@ -3636,8 +3636,8 @@ static void end_bbio_meta_read(struct btrfs_bio *bbio)bio_put (&bbio->bio); } -int read_extent_buffer_pages (struct extent_buffer *eb,int wait,int mirror_num, -const struct btrfs_tree_parent_check *check) +int read_extent_buffer_pages_nowait (struct extent_buffer *eb,int mirror_num, +const struct btrfs_tree_parent_check *check) {struct btrfs_bio *bbio;bool ret;
@@ -3655,7 +3655,7 @@ int read_extent_buffer_pages(struct extent_buffer *eb, int wait, int mirror_num,/* Someone else is already reading the buffer, just wait for it. */ if (test_and_set_bit (EXTENT_BUFFER_READING , &eb->bflags)) - goto done; +return 0 ;/* * Between the initial test_bit(EXTENT_BUFFER_UPTODATE) and the above
@@ -3695,14 +3695,21 @@ int read_extent_buffer_pages(struct extent_buffer *eb, int wait, int mirror_num, } }btrfs_submit_bbio (bbio, mirror_num); +return 0 ; +} -done: -if (wait ==WAIT_COMPLETE ) { -wait_on_bit_io (&eb->bflags,EXTENT_BUFFER_READING ,TASK_UNINTERRUPTIBLE ); -if (!test_bit (EXTENT_BUFFER_UPTODATE , &eb->bflags)) -return -EIO ; - } +int read_extent_buffer_pages (struct extent_buffer *eb,int mirror_num, +const struct btrfs_tree_parent_check *check) +{ +int ret; + ret =read_extent_buffer_pages_nowait (eb, mirror_num, check); +if (ret <0 ) +return ret; + +wait_on_bit_io (&eb->bflags,EXTENT_BUFFER_READING ,TASK_UNINTERRUPTIBLE ); +if (!test_bit (EXTENT_BUFFER_UPTODATE , &eb->bflags)) +return -EIO ;return 0 ; }
@@ -4434,7 +4441,7 @@ void btrfs_readahead_tree_block(struct btrfs_fs_info *fs_info,return ; } - ret =read_extent_buffer_pages (eb,WAIT_NONE ,0 , &check); + ret =read_extent_buffer_pages_nowait (eb,0 , &check);if (ret <0 )free_extent_buffer_stale (eb);else
fs/btrfs/extent_io.h +4 -3
@@ -261,10 +261,11 @@ struct extent_buffer *find_extent_buffer(struct btrfs_fs_info *fs_info, u64 start);void free_extent_buffer (struct extent_buffer *eb);void free_extent_buffer_stale (struct extent_buffer *eb); -#define WAIT_NONE 0 -#define WAIT_COMPLETE 1 -int read_extent_buffer_pages (struct extent_buffer *eb,int wait,int mirror_num, +int read_extent_buffer_pages (struct extent_buffer *eb,int mirror_num,const struct btrfs_tree_parent_check *parent_check); +int read_extent_buffer_pages_nowait (struct extent_buffer *eb,int mirror_num, +const struct btrfs_tree_parent_check *parent_check); +static inline void wait_on_extent_buffer_writeback (struct extent_buffer *eb) { wait_on_bit_io(&eb->bflags, EXTENT_BUFFER_WRITEBACK,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 17/70 btrfs: remove unused flag EXTENT_BUFFER_READAHEAD
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vacek <[email protected]>
[ Upstream commit 350362e95fbbe86008c240093697756d52049686 ]
This flag is no longer being used. It was added by commit ab0fff03055d ("btrfs: add READAHEAD extent buffer flag") and used in commits:
79fb65a1f6d9 ("Btrfs: don't call readahead hook until we have read the entire eb") 78e62c02abb9 ("btrfs: Remove extent_io_ops::readpage_io_failed_hook") 371cdc0700c7 ("btrfs: introduce subpage metadata validation check")
Finally all the code using it was removed by commit f26c92386028 ("btrfs: remove reada infrastructure").
Stable-dep-of: 316fb1b3169e ("btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()")
--- fs/btrfs/extent_io.h | 2 -- 1 file changed, 2 deletions(-)
fs/btrfs/extent_io.h +0 -2
@@ -39,8 +39,6 @@ enum {EXTENT_BUFFER_UPTODATE ,EXTENT_BUFFER_DIRTY ,EXTENT_BUFFER_CORRUPT , -/* this got triggered by readahead */ -EXTENT_BUFFER_READAHEAD ,EXTENT_BUFFER_TREE_REF ,EXTENT_BUFFER_STALE , EXTENT_BUFFER_WRITEBACK,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 18/70 btrfs: remove unused flag EXTENT_BUFFER_CORRUPT
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vacek <[email protected]>
[ Upstream commit c61660ec341e65650e58c92d0af71184aa216ff0 ]
This flag is no longer being used. It was added by commit a826d6dcb32d ("Btrfs: check items for correctness as we search") but it's no longer being used after commit f26c92386028 ("btrfs: remove reada infrastructure").
Stable-dep-of: 316fb1b3169e ("btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()")
--- fs/btrfs/disk-io.c | 11 ++--------- fs/btrfs/extent-tree.c | 6 ------ fs/btrfs/extent_io.h | 1 - 3 files changed, 2 insertions(+), 16 deletions(-)
fs/btrfs/disk-io.c +2 -9
@@ -225,7 +225,6 @@ int btrfs_read_extent_buffer(struct extent_buffer *eb,ASSERT (check);while (1 ) { -clear_bit (EXTENT_BUFFER_CORRUPT , &eb->bflags); ret =read_extent_buffer_pages (eb, mirror_num, check);if (!ret)break ;
@@ -454,15 +453,9 @@ int btrfs_validate_extent_buffer(struct extent_buffer *eb, goto out; } -/* -* If this is a leaf block and it is corrupt, set the corrupt bit so -* that we don't try and read the other copies of this block, just -* return -EIO. -*/ -if (found_level ==0 &&btrfs_check_leaf (eb)) { -set_bit (EXTENT_BUFFER_CORRUPT , &eb->bflags); +/* If this is a leaf block and it is corrupt, just return -EIO. */ +if (found_level ==0 &&btrfs_check_leaf (eb)) ret = -EIO ; - }if (found_level >0 &&btrfs_check_node (eb)) ret = -EIO ;
fs/btrfs/extent-tree.c +0 -6
@@ -3517,12 +3517,6 @@ int btrfs_free_tree_block(struct btrfs_trans_handle *trans,trace_btrfs_reserved_extent_free (fs_info, buf->start, buf->len); out: - -/* -* Deleting the buffer, clear the corrupt flag since it doesn't -* matter anymore. -*/ -clear_bit (EXTENT_BUFFER_CORRUPT , &buf->bflags);return 0 ; }
fs/btrfs/extent_io.h +0 -1
@@ -38,7 +38,6 @@ struct btrfs_tree_parent_check;enum {EXTENT_BUFFER_UPTODATE ,EXTENT_BUFFER_DIRTY , -EXTENT_BUFFER_CORRUPT ,EXTENT_BUFFER_TREE_REF ,EXTENT_BUFFER_STALE ,EXTENT_BUFFER_WRITEBACK ,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 19/70 btrfs: remove pointless out labels from extent-tree.c
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit ea8f9210050136bdd14f5e32b04cd01c8bd5c0ca ]
Some functions (lookup_extent_data_ref(), __btrfs_mod_ref() and btrfs_free_tree_block()) have an 'out' label that does nothing but return, making it pointless. Simplify this by removing the label and returning instead of gotos plus setting the 'ret' variable.
Stable-dep-of: 316fb1b3169e ("btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()")
--- fs/btrfs/extent-tree.c | 24 ++++++++++-------------- 1 file changed, 10 insertions(+), 14 deletions(-)
fs/btrfs/extent-tree.c +10 -14
@@ -479,7 +479,7 @@ static noinline int lookup_extent_data_ref(struct btrfs_trans_handle *trans,btrfs_item_key_to_cpu (leaf, &key, path->slots[0 ]);if (key.objectid != bytenr || key.type !=BTRFS_EXTENT_DATA_REF_KEY ) - goto fail; +return ret; ref =btrfs_item_ptr (leaf, path->slots[0 ], struct btrfs_extent_data_ref);
@@ -490,12 +490,11 @@ static noinline int lookup_extent_data_ref(struct btrfs_trans_handle *trans,btrfs_release_path (path); goto again; } - ret =0 ; -break ; +return 0 ; } path->slots[0 ]++; } -fail: +return ret; }
@@ -2470,7 +2469,7 @@ static int __btrfs_mod_ref(struct btrfs_trans_handle *trans,int i;int action;int level; -int ret =0 ; +int ret;if (btrfs_is_testing (fs_info))return 0 ;
@@ -2522,7 +2521,7 @@ static int __btrfs_mod_ref(struct btrfs_trans_handle *trans,else ret =btrfs_free_extent (trans, &ref);if (ret) - goto fail; +return ret; }else {/* We don't know the owning_root, leave as 0. */ ref.bytenr =btrfs_node_blockptr (buf, i);
@@ -2535,12 +2534,10 @@ static int __btrfs_mod_ref(struct btrfs_trans_handle *trans,else ret =btrfs_free_extent (trans, &ref);if (ret) - goto fail; +return ret; } }return 0 ; -fail: -return ret; } int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
@@ -3469,12 +3466,12 @@ int btrfs_free_tree_block(struct btrfs_trans_handle *trans,return 0 ;if (btrfs_header_generation (buf) != trans->transid) - goto out; +return 0 ;if (root_id !=BTRFS_TREE_LOG_OBJECTID ) { ret =check_ref_cleanup (trans, buf->start);if (!ret) - goto out; +return 0 ; } bg =btrfs_lookup_block_group (fs_info, buf->start);
@@ -3482,7 +3479,7 @@ int btrfs_free_tree_block(struct btrfs_trans_handle *trans,if (btrfs_header_flag (buf,BTRFS_HEADER_FLAG_WRITTEN )) {pin_down_extent (trans, bg, buf->start, buf->len,1 );btrfs_put_block_group (bg); - goto out; +return 0 ; }/*
@@ -3506,7 +3503,7 @@ int btrfs_free_tree_block(struct btrfs_trans_handle *trans, || btrfs_is_zoned(fs_info)) {pin_down_extent (trans, bg, buf->start, buf->len,1 );btrfs_put_block_group (bg); - goto out; +return 0 ; }WARN_ON (test_bit (EXTENT_BUFFER_DIRTY , &buf->bflags));
@@ -3516,7 +3513,6 @@ int btrfs_free_tree_block(struct btrfs_trans_handle *trans,btrfs_put_block_group (bg);trace_btrfs_reserved_extent_free (fs_info, buf->start, buf->len); -out:return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 20/70 btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: robbieko <[email protected]>
[ Upstream commit 316fb1b3169efb081d2db910cbbfef445afa03b9 ]
After commit 1618aa3c2e01 ("btrfs: simplify return variables in lookup_extent_data_ref()"), the err and ret variables were merged into a single ret variable. However, when btrfs_next_leaf() returns 0 (success), ret is overwritten from -ENOENT to 0. If the first key in the next leaf does not match (different objectid or type), the function returns 0 instead of -ENOENT, making the caller believe the lookup succeeded when it did not. This can lead to operations on the wrong extent tree item, potentially causing extent tree corruption.
Fix this by returning -ENOENT directly when the key does not match, instead of relying on the ret variable.
--- fs/btrfs/extent-tree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/extent-tree.c +1 -1
@@ -479,7 +479,7 @@ static noinline int lookup_extent_data_ref(struct btrfs_trans_handle *trans,btrfs_item_key_to_cpu (leaf, &key, path->slots[0 ]);if (key.objectid != bytenr || key.type !=BTRFS_EXTENT_DATA_REF_KEY ) -return ret; +return -ENOENT ; ref =btrfs_item_ptr (leaf, path->slots[0 ], struct btrfs_extent_data_ref);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 21/70 blktrace: fix __this_cpu_read/write in preemptible context
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chaitanya Kulkarni <[email protected]>
[ Upstream commit da46b5dfef48658d03347cda21532bcdbb521e67 ]
tracing_record_cmdline() internally uses __this_cpu_read() and __this_cpu_write() on the per-CPU variable trace_cmdline_save, and trace_save_cmdline() explicitly asserts preemption is disabled via lockdep_assert_preemption_disabled(). These operations are only safe when preemption is off, as they were designed to be called from the scheduler context (probe_wakeup_sched_switch() / probe_wakeup()).
__blk_add_trace() was calling tracing_record_cmdline(current) early in the blk_tracer path, before ring buffer reservation, from process context where preemption is fully enabled. This triggers the following using blktests/blktrace/002:
blktrace/002 (blktrace ftrace corruption with sysfs trace) [failed]
runtime 0.367s ... 0.437s
something found in dmesg:
[ 81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33
[ 81.239580] null_blk: disk nullb1 created
[ 81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516
[ 81.362842] caller is tracing_record_cmdline+0x10/0x40
[ 81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G N 7.0.0-rc1lblk+ #84 PREEMPT(full)
[ 81.362877] Tainted: [N]=TEST
[ 81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
[ 81.362881] Call Trace:
[ 81.362884] <TASK>
[ 81.362886] dump_stack_lvl+0x8d/0xb0
...
(See '/mnt/sda/blktests/results/nodev/blktrace/002.dmesg' for the entire message)[ 81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33 [ 81.239580] null_blk: disk nullb1 created [ 81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516 [ 81.362842] caller is tracing_record_cmdline+0x10/0x40 [ 81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G N 7.0.0-rc1lblk+ #84 PREEMPT(full) [ 81.362877] Tainted: [N]=TEST [ 81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 81.362881] Call Trace: [ 81.362884] <TASK> [ 81.362886] dump_stack_lvl+0x8d/0xb0 [ 81.362895] check_preemption_disabled+0xce/0xe0 [ 81.362902] tracing_record_cmdline+0x10/0x40 [ 81.362923] __blk_add_trace+0x307/0x5d0 [ 81.362934] ? lock_acquire+0xe0/0x300 [ 81.362940] ? iov_iter_extract_pages+0x101/0xa30 [ 81.362959] blk_add_trace_bio+0x106/0x1e0 [ 81.362968] submit_bio_noacct_nocheck+0x24b/0x3a0 [ 81.362979] ? lockdep_init_map_type+0x58/0x260 [ 81.362988] submit_bio_wait+0x56/0x90 [ 81.363009] __blkdev_direct_IO_simple+0x16c/0x250 [ 81.363026] ? __pfx_submit_bio_wait_endio+0x10/0x10 [ 81.363038] ? rcu_read_lock_any_held+0x73/0xa0 [ 81.363051] blkdev_read_iter+0xc1/0x140 [ 81.363059] vfs_read+0x20b/0x330 [ 81.363083] ksys_read+0x67/0xe0 [ 81.363090] do_syscall_64+0xbf/0xf00 [ 81.363102] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 81.363106] RIP: 0033:0x7f281906029d [ 81.363111] Code: 31 c0 e9 c6 fe ff ff 50 48 8d 3d 66 63 0a 00 e8 59 ff 01 00 66 0f 1f 84 00 00 00 00 00 80 3d 41 33 0e 00 00 74 17 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 5b c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec [ 81.363113] RSP: 002b:00007ffca127dd48 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 81.363120] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f281906029d [ 81.363122] RDX: 0000000000001000 RSI: 0000559f8bfae000 RDI: 0000000000000000 [ 81.363123] RBP: 0000000000001000 R08: 0000002863a10a81 R09: 00007f281915f000 [ 81.363124] R10: 00007f2818f77b60 R11: 0000000000000246 R12: 0000559f8bfae000 [ 81.363126] R13: 0000000000000000 R14: 0000000000000000 R15: 000000000000000a [ 81.363142] </TASK>
The same BUG fires from blk_add_trace_plug(), blk_add_trace_unplug(), and blk_add_trace_rq() paths as well.
The purpose of tracing_record_cmdline() is to cache the task->comm for a given PID so that the trace can later resolve it. It is only meaningful when a trace event is actually being recorded. Ring buffer reservation via ring_buffer_lock_reserve() disables preemption, and preemption remains disabled until the event is committed :-
__blk_add_trace()
__trace_buffer_lock_reserve()
__trace_buffer_lock_reserve()
ring_buffer_lock_reserve()
preempt_disable_notrace(); <---With this fix blktests for blktrace pass:
blktests (master) # ./check blktrace
blktrace/001 (blktrace zone management command tracing) [passed]
runtime 3.650s ... 3.647s
blktrace/002 (blktrace ftrace corruption with sysfs trace) [passed]
runtime 0.411s ... 0.384s--- kernel/trace/blktrace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/trace/blktrace.c +2 -2
@@ -251,8 +251,6 @@ static void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes, cpu =raw_smp_processor_id ();if (blk_tracer) { -tracing_record_cmdline (current); - buffer = blk_tr->array_buffer.buffer; trace_ctx =tracing_gen_ctx_flags (0 ); event = trace_buffer_lock_reserve(buffer, TRACE_BLK,
@@ -260,6 +258,8 @@ static void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes, trace_ctx);if (!event)return ; + +tracing_record_cmdline (current); t =ring_buffer_event_data (event); goto record_it; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 22/70 nfc: nci: complete pending data exchange on device close
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 66083581945bd5b8e99fe49b5aeb83d03f62d053 ]
In nci_close_device(), complete any pending data exchange before closing. The data exchange callback (e.g. rawsock_data_exchange_complete) holds a socket reference.
NIPA occasionally hits this leak:
unreferenced object 0xff1100000f435000 (size 2048):
comm "nci_dev", pid 3954, jiffies 4295441245 hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............
backtrace (crc ec2b3c5):
__kmalloc_noprof+0x4db/0x730
sk_prot_alloc.isra.0+0xe4/0x1d0
sk_alloc+0x36/0x760
rawsock_create+0xd1/0x540
nfc_sock_create+0x11f/0x280
__sock_create+0x22d/0x630
__sys_socket+0x115/0x1d0
__x64_sys_socket+0x72/0xd0
do_syscall_64+0x117/0xfc0
entry_SYSCALL_64_after_hwframe+0x4b/0x53--- net/nfc/nci/core.c | 9 +++++++++ 1 file changed, 9 insertions(+)
net/nfc/nci/core.c +9 -0
@@ -567,6 +567,10 @@ static int nci_close_device(struct nci_dev *ndev)flush_workqueue (ndev->cmd_wq);del_timer_sync (&ndev->cmd_timer);del_timer_sync (&ndev->data_timer); +if (test_bit (NCI_DATA_EXCHANGE , &ndev->flags)) +nci_data_exchange_complete (ndev,NULL , + ndev->cur_conn_id, + -ENODEV );mutex_unlock (&ndev->req_lock);return 0 ; }
@@ -597,6 +601,11 @@ static int nci_close_device(struct nci_dev *ndev)flush_workqueue (ndev->cmd_wq);del_timer_sync (&ndev->cmd_timer); +del_timer_sync (&ndev->data_timer); + +if (test_bit (NCI_DATA_EXCHANGE , &ndev->flags)) +nci_data_exchange_complete (ndev,NULL , ndev->cur_conn_id, + -ENODEV );/* Clear flags except NCI_UNREG */ ndev->flags &=BIT (NCI_UNREG );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 23/70 arm64: dts: renesas: white-hawk-cpu-common: Add pin control for DSI-eDP IRQ
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
commit 8219a455efd4ba11c1d30c1bbc9ce853466c19bf upstream.
When the DSI to eDP bridge was added, pin control for the IRQ pin was left out, because the pin controller did not support INTC-EX pins yet.
Commit 10544ec1b3436037 ("pinctrl: renesas: r8a779g0: Add INTC-EX pins, groups, and function") added support for these pins, so add the missing pin control description.
--- arch/arm64/boot/dts/renesas/white-hawk-cpu-common.dtsi | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/arm64/boot/dts/renesas/white-hawk-cpu-common.dtsi +8 -0
@@ -239,6 +239,9 @@ clock-frequency = <400000>; bridge@2c { + pinctrl-0 = <&irq0_pins>; + pinctrl-names = "default"; + compatible = "ti,sn65dsi86"; reg = <0x2c>;
@@ -343,6 +346,11 @@ function = "i2c1"; }; + irq0_pins: irq0 { + groups = "intc_ex_irq0_a"; + function = "intc_ex"; + }; + keys_pins: keys { pins = "GP_5_0", "GP_5_1", "GP_5_2"; bias-pull-up;
Greg Kroah-Hartman
maintainerPATCH 24/70 misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingjing Deng <[email protected]>
[ Upstream commit 6a502776f4a4f80fb839b22f12aeaf0267fca344 ]
In the SDSP probe path, qcom_scm_assign_mem() is used to assign the reserved memory to the configured VMIDs, but its return value was not checked.
Fail the probe if the SCM call fails to avoid continuing with an unexpected/incorrect memory permission configuration.
This issue was found by an in-house analysis workflow that extracts AST-based information and runs static checks, with LLM assistance for triage, and was confirmed by manual code review.
No hardware testing was performed.
--- drivers/misc/fastrpc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/misc/fastrpc.c +3 -1
@@ -2346,8 +2346,10 @@ static int fastrpc_rpmsg_probe(struct rp src_perms =BIT (QCOM_SCM_VMID_HLOS ); -qcom_scm_assign_mem (rmem->base, rmem->size, &src_perms, + err =qcom_scm_assign_mem (rmem->base, rmem->size, &src_perms, data->vmperms, data->vmcount); +if (err) + goto fdev_error; }
Greg Kroah-Hartman
maintainerPATCH 25/70 sched_ext: Fix stale direct dispatch state in ddsp_dsq_id
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Righi <[email protected]>
[ Upstream commit 7e0ffb72de8aa3b25989c2d980e81b829c577010 ]
@p->scx.ddsp_dsq_id can be left set (non-SCX_DSQ_INVALID) triggering a spurious warning in mark_direct_dispatch() when the next wakeup's ops.select_cpu() calls scx_bpf_dsq_insert(), such as:
WARNING: kernel/sched/ext.c:1273 at scx_dsq_insert_commit+0xcd/0x140
The root cause is that ddsp_dsq_id was only cleared in dispatch_enqueue(), which is not reached in all paths that consume or cancel a direct dispatch verdict.
Fix it by clearing it at the right places:
- direct_dispatch(): cache the direct dispatch state in local variables and clear it before dispatch_enqueue() on the synchronous path. For the deferred path, the direct dispatch state must remain set until process_ddsp_deferred_locals() consumes them.
- process_ddsp_deferred_locals(): cache the dispatch state in local variables and clear it before calling dispatch_to_local_dsq(), which may migrate the task to another rq.
- do_enqueue_task(): clear the dispatch state on the enqueue path (local/global/bypass fallbacks), where the direct dispatch verdict is ignored.
- dequeue_task_scx(): clear the dispatch state after dispatch_dequeue() to handle both the deferred dispatch cancellation and the holding_cpu race, covering all cases where a pending direct dispatch is cancelled.
- scx_disable_task(): clear the direct dispatch state when transitioning a task out of the current scheduler. Waking tasks may have had the direct dispatch state set by the outgoing scheduler's ops.select_cpu() and then been queued on a wake_list via ttwu_queue_wakelist(), when SCX_OPS_ALLOW_QUEUED_WAKEUP is set. Such tasks are not on the runqueue and are not iterated by scx_bypass(), so their direct dispatch state won't be cleared. Without this clear, any subsequent SCX scheduler that tries to direct dispatch the task will trigger the WARN_ON_ONCE() in mark_direct_dispatch().
--- kernel/sched/ext.c | 48 ++++++++++++++++++++++++++++++++++++------------ 1 file changed, 36 insertions(+), 12 deletions(-)
kernel/sched/ext.c +36 -12
@@ -1782,15 +1782,6 @@ static void dispatch_enqueue(struct scx_ p->scx.dsq = dsq;/* -* scx.ddsp_dsq_id and scx.ddsp_enq_flags are only relevant on the -* direct dispatch path, but we clear them here because the direct -* dispatch verdict may be overridden on the enqueue path during e.g. -* bypass. -*/ - p->scx.ddsp_dsq_id =SCX_DSQ_INVALID ; - p->scx.ddsp_enq_flags =0 ; - -/* * We're transitioning out of QUEUEING or DISPATCHING. store_release to * match waiters' load_acquire. */
@@ -1930,11 +1921,33 @@ static void mark_direct_dispatch(struct p->scx.ddsp_enq_flags = enq_flags; } +/* +* Clear @p direct dispatch state when leaving the scheduler. +* +* Direct dispatch state must be cleared in the following cases: +* - direct_dispatch(): cleared on the synchronous enqueue path, deferred +* dispatch keeps the state until consumed +* - process_ddsp_deferred_locals(): cleared after consuming deferred state, +* - do_enqueue_task(): cleared on enqueue fallbacks where the dispatch +* verdict is ignored (local/global/bypass) +* - dequeue_task_scx(): cleared after dispatch_dequeue(), covering deferred +* cancellation and holding_cpu races +* - scx_disable_task(): cleared for queued wakeup tasks, which are excluded by +* the scx_bypass() loop, so that stale state is not reused by a subsequent +* scheduler instance +*/ +static inline void clear_direct_dispatch (struct task_struct *p) +{ + p->scx.ddsp_dsq_id =SCX_DSQ_INVALID ; + p->scx.ddsp_enq_flags =0 ; +} +static void direct_dispatch (struct task_struct *p,u64 enq_flags) {struct rq *rq =task_rq (p);struct scx_dispatch_q *dsq =find_dsq_for_dispatch (rq, p->scx.ddsp_dsq_id, p); +u64 ddsp_enq_flags;touch_core_sched_dispatch (rq, p);
@@ -1975,7 +1988,10 @@ static void direct_dispatch(struct task_return ; } -dispatch_enqueue (dsq, p, p->scx.ddsp_enq_flags |SCX_ENQ_CLEAR_OPSS ); + ddsp_enq_flags = p->scx.ddsp_enq_flags; +clear_direct_dispatch (p); + +dispatch_enqueue (dsq, p, ddsp_enq_flags |SCX_ENQ_CLEAR_OPSS ); }static bool scx_rq_online (struct rq *rq)
@@ -2060,12 +2076,14 @@ local:touch_core_sched (rq, p); p->scx.slice =SCX_SLICE_DFL ; local_norefill: +clear_direct_dispatch (p);dispatch_enqueue (&rq->scx.local_dsq, p, enq_flags);return ; global:touch_core_sched (rq, p);/* see the comment in local: */ p->scx.slice =SCX_SLICE_DFL ; +clear_direct_dispatch (p);dispatch_enqueue (find_global_dsq (p), p, enq_flags); }
@@ -2225,6 +2243,7 @@ static bool dequeue_task_scx(struct rq *sub_nr_running (rq,1 );dispatch_dequeue (rq, p); +clear_direct_dispatch (p);return true; }
@@ -2905,12 +2924,15 @@ static void process_ddsp_deferred_localswhile ((p =list_first_entry_or_null (&rq->scx.ddsp_deferred_locals, struct task_struct, scx.dsq_list.node))) {struct scx_dispatch_q *dsq; +u64 dsq_id = p->scx.ddsp_dsq_id; +u64 enq_flags = p->scx.ddsp_enq_flags;list_del_init (&p->scx.dsq_list.node); +clear_direct_dispatch (p); - dsq =find_dsq_for_dispatch (rq, p->scx.ddsp_dsq_id, p); + dsq =find_dsq_for_dispatch (rq, dsq_id, p);if (!WARN_ON_ONCE (dsq->id !=SCX_DSQ_LOCAL )) -dispatch_to_local_dsq (rq, dsq, p, p->scx.ddsp_enq_flags); +dispatch_to_local_dsq (rq, dsq, p, enq_flags); } }
@@ -3707,6 +3729,8 @@ static void scx_ops_disable_task(structlockdep_assert_rq_held (task_rq (p));WARN_ON_ONCE (scx_get_task_state (p) !=SCX_TASK_ENABLED ); +clear_direct_dispatch (p); +if (SCX_HAS_OP (disable))SCX_CALL_OP_TASK (SCX_KF_REST , disable, p);scx_set_task_state (p,SCX_TASK_READY );
Greg Kroah-Hartman
maintainerPATCH 26/70 Revert "mptcp: add needs_id for netlink appending addr"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <[email protected]>
[ Upstream commit 8e2760eaab778494fc1fa257031e0e1799647f46 ]
This commit was originally adding the ability to add MPTCP endpoints with ID 0 by accident. The in-kernel PM, handling MPTCP endpoints at the net namespace level, is not supposed to handle endpoints with such ID, because this ID 0 is reserved to the initial subflow, as mentioned in the MPTCPv1 protocol [1], a per-connection setting.
Note that 'ip mptcp endpoint add id 0' stops early with an error, but other tools might still request the in-kernel PM to create MPTCP endpoints with this restricted ID 0.
In other words, it was wrong to call the mptcp_pm_has_addr_attr_id helper to check whether the address ID attribute is set: if it was set to 0, a new MPTCP endpoint would be created with ID 0, which is not expected, and might cause various issues later.
--- net/mptcp/pm_netlink.c | 24 +++++------------------- 1 file changed, 5 insertions(+), 19 deletions(-)
net/mptcp/pm_netlink.c +5 -19
@@ -1076,7 +1076,7 @@ static void __mptcp_pm_release_addr_entrstatic int mptcp_pm_nl_append_new_local_addr (struct pm_nl_pernet *pernet,struct mptcp_pm_addr_entry *entry, -bool needs_id,bool replace) +bool replace) {struct mptcp_pm_addr_entry *cur, *del_entry =NULL ;unsigned int addr_max;
@@ -1135,7 +1135,7 @@ static int mptcp_pm_nl_append_new_local_ } } -if (!entry->addr.id && needs_id) { +if (!entry->addr.id) { find_next: entry->addr.id = find_next_zero_bit(pernet->id_bitmap, MPTCP_PM_MAX_ADDR_ID + 1,
@@ -1146,7 +1146,7 @@ find_next: } } -if (!entry->addr.id && needs_id) +if (!entry->addr.id) goto out;__set_bit (entry->addr.id, pernet->id_bitmap);
@@ -1279,7 +1279,7 @@ int mptcp_pm_nl_get_local_id(struct mptc entry->ifindex =0 ; entry->flags =MPTCP_PM_ADDR_FLAG_IMPLICIT ; entry->lsk =NULL ; - ret =mptcp_pm_nl_append_new_local_addr (pernet, entry, true, false); + ret =mptcp_pm_nl_append_new_local_addr (pernet, entry, false);if (ret <0 )kfree (entry);
@@ -1498,18 +1498,6 @@ next:return 0 ; } -static bool mptcp_pm_has_addr_attr_id (const struct nlattr *attr, -struct genl_info *info) -{ -struct nlattr *tb[MPTCP_PM_ADDR_ATTR_MAX +1 ]; - -if (!nla_parse_nested_deprecated (tb,MPTCP_PM_ADDR_ATTR_MAX , attr, - mptcp_pm_address_nl_policy, info->extack) && - tb[MPTCP_PM_ADDR_ATTR_ID ]) -return true; -return false; -} -int mptcp_pm_nl_add_addr_doit (struct sk_buff *skb,struct genl_info *info) {struct nlattr *attr = info->attrs[MPTCP_PM_ENDPOINT_ADDR ];
@@ -1551,9 +1539,7 @@ int mptcp_pm_nl_add_addr_doit(struct sk_ goto out_free; } } - ret =mptcp_pm_nl_append_new_local_addr (pernet, entry, - !mptcp_pm_has_addr_attr_id (attr, info), - true); + ret =mptcp_pm_nl_append_new_local_addr (pernet, entry, true);if (ret <0 ) {GENL_SET_ERR_MSG_FMT (info,"too many addresses or duplicate one: %d" , ret); goto out_free;
Greg Kroah-Hartman
maintainerPATCH 27/70 net: annotate data-races around sk->sk_{data_ready,write_space}
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 2ef2b20cf4e04ac8a6ba68493f8780776ff84300 ]
skmsg (and probably other layers) are changing these pointers while other cpus might read them concurrently.
Add corresponding READ_ONCE()/WRITE_ONCE() annotations for UDP, TCP and AF_UNIX.
--- net/core/skmsg.c | 14 +++++++------- net/ipv4/tcp.c | 4 ++-- net/ipv4/tcp_bpf.c | 2 +- net/ipv4/tcp_input.c | 14 ++++++++------ net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/udp.c | 3 ++- net/ipv4/udp_bpf.c | 2 +- net/unix/af_unix.c | 8 ++++---- 8 files changed, 26 insertions(+), 23 deletions(-)
net/core/skmsg.c +7 -7
@@ -1204,8 +1204,8 @@ void sk_psock_start_strp(struct sock *skreturn ; psock->saved_data_ready = sk->sk_data_ready; - sk->sk_data_ready = sk_psock_strp_data_ready; - sk->sk_write_space = sk_psock_write_space; +WRITE_ONCE (sk->sk_data_ready, sk_psock_strp_data_ready); +WRITE_ONCE (sk->sk_write_space, sk_psock_write_space); }void sk_psock_stop_strp (struct sock *sk,struct sk_psock *psock)
@@ -1215,8 +1215,8 @@ void sk_psock_stop_strp(struct sock *sk,if (!psock->saved_data_ready)return ; - sk->sk_data_ready = psock->saved_data_ready; - psock->saved_data_ready =NULL ; +WRITE_ONCE (sk->sk_data_ready, psock->saved_data_ready); +WRITE_ONCE (psock->saved_data_ready,NULL );strp_stop (&psock->strp); }
@@ -1298,8 +1298,8 @@ void sk_psock_start_verdict(struct sockreturn ; psock->saved_data_ready = sk->sk_data_ready; - sk->sk_data_ready = sk_psock_verdict_data_ready; - sk->sk_write_space = sk_psock_write_space; +WRITE_ONCE (sk->sk_data_ready, sk_psock_verdict_data_ready); +WRITE_ONCE (sk->sk_write_space, sk_psock_write_space); }void sk_psock_stop_verdict (struct sock *sk,struct sk_psock *psock)
@@ -1310,6 +1310,6 @@ void sk_psock_stop_verdict(struct sock *if (!psock->saved_data_ready)return ; - sk->sk_data_ready = psock->saved_data_ready; +WRITE_ONCE (sk->sk_data_ready, psock->saved_data_ready); psock->saved_data_ready =NULL ; }
net/ipv4/tcp.c +2 -2
@@ -1346,7 +1346,7 @@ out_err: err =sk_stream_error (sk, flags, err);/* make sure we wake any epoll edge trigger waiter */ if (unlikely (tcp_rtx_and_write_queues_empty (sk) && err == -EAGAIN )) { - sk->sk_write_space (sk); +READ_ONCE (sk->sk_write_space)(sk);tcp_chrono_stop (sk,TCP_CHRONO_SNDBUF_LIMITED ); }return err;
@@ -4023,7 +4023,7 @@ ao_parse:break ;case TCP_NOTSENT_LOWAT :WRITE_ONCE (tp->notsent_lowat, val); - sk->sk_write_space (sk); +READ_ONCE (sk->sk_write_space)(sk);break ;case TCP_INQ :if (val >1 || val <0 )
net/ipv4/tcp_bpf.c +1 -1
@@ -725,7 +725,7 @@ int tcp_bpf_update_proto(struct sock *skWRITE_ONCE (sk->sk_prot->unhash, psock->saved_unhash);tcp_update_ulp (sk, psock->sk_proto, psock->saved_write_space); }else { - sk->sk_write_space = psock->saved_write_space; +WRITE_ONCE (sk->sk_write_space, psock->saved_write_space);/* Pairs with lockless read in sk_clone_lock() */ sock_replace_proto (sk, psock->sk_proto); }
net/ipv4/tcp_input.c +8 -6
@@ -5034,7 +5034,7 @@ static void tcp_data_queue_ofo(struct soif (unlikely (tcp_try_rmem_schedule (sk, skb, skb->truesize))) {NET_INC_STATS (sock_net (sk),LINUX_MIB_TCPOFODROP ); - sk->sk_data_ready (sk); +READ_ONCE (sk->sk_data_ready)(sk);tcp_drop_reason (sk, skb,SKB_DROP_REASON_PROTO_MEM );return ; }
@@ -5241,7 +5241,7 @@ err:void tcp_data_ready (struct sock *sk) {if (tcp_epollin_ready (sk, sk->sk_rcvlowat) ||sock_flag (sk,SOCK_DONE )) - sk->sk_data_ready (sk); +READ_ONCE (sk->sk_data_ready)(sk); }static void tcp_data_queue (struct sock *sk,struct sk_buff *skb)
@@ -5297,7 +5297,7 @@ queue_and_out:inet_csk (sk)->icsk_ack.pending |= (ICSK_ACK_NOMEM |ICSK_ACK_NOW );inet_csk_schedule_ack (sk); - sk->sk_data_ready (sk); +READ_ONCE (sk->sk_data_ready)(sk);if (skb_queue_len (&sk->sk_receive_queue) && skb->len) { reason =SKB_DROP_REASON_PROTO_MEM ;
@@ -5735,7 +5735,9 @@ static void tcp_new_space(struct sock *s tp->snd_cwnd_stamp = tcp_jiffies32; } -INDIRECT_CALL_1 (sk->sk_write_space, sk_stream_write_space, sk); +INDIRECT_CALL_1 (READ_ONCE (sk->sk_write_space), + sk_stream_write_space, + sk); }/* Caller made space either from:
@@ -5941,7 +5943,7 @@ static void tcp_urg(struct sock *sk, strBUG ();WRITE_ONCE (tp->urg_data,TCP_URG_VALID | tmp);if (!sock_flag (sk,SOCK_DEAD )) - sk->sk_data_ready (sk); +READ_ONCE (sk->sk_data_ready)(sk); } } }
@@ -7341,7 +7343,7 @@ int tcp_conn_request(struct request_socksock_put (fastopen_sk); goto drop_and_free; } - sk->sk_data_ready (sk); +READ_ONCE (sk->sk_data_ready)(sk);bh_unlock_sock (fastopen_sk);sock_put (fastopen_sk); }else {
net/ipv4/tcp_minisocks.c +1 -1
@@ -928,7 +928,7 @@ enum skb_drop_reason tcp_child_process(s reason =tcp_rcv_state_process (child, skb);/* Wakeup parent, send SIGIO */ if (state ==TCP_SYN_RECV && child->sk_state != state) - parent->sk_data_ready (parent); +READ_ONCE (parent->sk_data_ready)(parent); }else {/* Alas, it is possible again, because we do lookup * in main socket hash table and lock on listening
net/ipv4/udp.c +2 -1
@@ -1622,7 +1622,8 @@ int __udp_enqueue_schedule_skb(struct sospin_unlock (&list->lock);if (!sock_flag (sk,SOCK_DEAD )) -INDIRECT_CALL_1 (sk->sk_data_ready, sock_def_readable, sk); +INDIRECT_CALL_1 (READ_ONCE (sk->sk_data_ready), + sock_def_readable, sk);busylock_release (busy);return 0 ;
net/ipv4/udp_bpf.c +1 -1
@@ -158,7 +158,7 @@ int udp_bpf_update_proto(struct sock *skint family = sk->sk_family ==AF_INET ?UDP_BPF_IPV4 :UDP_BPF_IPV6 ;if (restore) { - sk->sk_write_space = psock->saved_write_space; +WRITE_ONCE (sk->sk_write_space, psock->saved_write_space);sock_replace_proto (sk, psock->sk_proto);return 0 ; }
net/unix/af_unix.c +4 -4
@@ -1707,7 +1707,7 @@ restart:__skb_queue_tail (&other->sk_receive_queue, skb);spin_unlock (&other->sk_receive_queue.lock);unix_state_unlock (other); - other->sk_data_ready (other); +READ_ONCE (other->sk_data_ready)(other);sock_put (other);return 0 ;
@@ -2175,7 +2175,7 @@ restart_locked:scm_stat_add (other, skb);skb_queue_tail (&other->sk_receive_queue, skb);unix_state_unlock (other); - other->sk_data_ready (other); +READ_ONCE (other->sk_data_ready)(other);sock_put (other);scm_destroy (&scm);return len;
@@ -2243,7 +2243,7 @@ static int queue_oob(struct socket *socksk_send_sigurg (other);unix_state_unlock (other); - other->sk_data_ready (other); +READ_ONCE (other->sk_data_ready)(other);return err; }
@@ -2354,7 +2354,7 @@ static int unix_stream_sendmsg(struct soscm_stat_add (other, skb);skb_queue_tail (&other->sk_receive_queue, skb);unix_state_unlock (other); - other->sk_data_ready (other); +READ_ONCE (other->sk_data_ready)(other); sent += size; }
Greg Kroah-Hartman
maintainerPATCH 28/70 mptcp: fix soft lockup in mptcp_recvmsg()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Xiasong <[email protected]>
commit 5dd8025a49c268ab6b94d978532af3ad341132a7 upstream.
syzbot reported a soft lockup in mptcp_recvmsg() [0].
When receiving data with MSG_PEEK | MSG_WAITALL flags, the skb is not removed from the sk_receive_queue. This causes sk_wait_data() to always find available data and never perform actual waiting, leading to a soft lockup.
Fix this by adding a 'last' parameter to track the last peeked skb. This allows sk_wait_data() to make informed waiting decisions and prevent infinite loops when MSG_PEEK is used.
[0]:
watchdog: BUG: soft lockup - CPU#2 stuck for 156s! [server:1963] Modules linked in: CPU: 2 UID: 0 PID: 1963 Comm: server Not tainted 6.19.0-rc8 #61 PREEMPT(none) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:sk_wait_data+0x15/0x190 Code: 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 56 41 55 41 54 49 89 f4 55 48 89 d5 53 48 89 fb <48> 83 ec 30 65 48 8b 05 17 a4 6b 01 48 89 44 24 28 31 c0 65 48 8b RSP: 0018:ffffc90000603ca0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff888102bf0800 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffc90000603d18 RDI: ffff888102bf0800 RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000101 R10: 0000000000000000 R11: 0000000000000075 R12: ffffc90000603d18 R13: ffff888102bf0800 R14: ffff888102bf0800 R15: 0000000000000000 FS: 00007f6e38b8c4c0(0000) GS:ffff8881b877e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055aa7bff1680 CR3: 0000000105cbe000 CR4: 00000000000006f0 Call Trace: <TASK> mptcp_recvmsg+0x547/0x8c0 net/mptcp/protocol.c:2329 inet_recvmsg+0x11f/0x130 net/ipv4/af_inet.c:891 sock_recvmsg+0x94/0xc0 net/socket.c:1100 __sys_recvfrom+0xb2/0x130 net/socket.c:2256 __x64_sys_recvfrom+0x1f/0x30 net/socket.c:2267 do_syscall_64+0x59/0x2d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:131 RIP: 0033:0x7f6e386a4a1d Code: 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8d 05 f1 de 2c 00 41 89 ca 8b 00 85 c0 75 20 45 31 c9 45 31 c0 b8 2d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 6b f3 c3 66 0f 1f 84 00 00 00 00 00 41 56 41 RSP: 002b:00007ffc3c4bb078 EFLAGS: 00000246 ORIG_RAX: 000000000000002d RAX: ffffffffffffffda RBX: 000000000000861e RCX: 00007f6e386a4a1d RDX: 00000000000003ff RSI: 00007ffc3c4bb150 RDI: 0000000000000004 RBP: 00007ffc3c4bb570 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000103 R11: 0000000000000246 R12: 00005605dbc00be0 R13: 00007ffc3c4bb650 R14: 0000000000000000 R15: 0000000000000000 </TASK>
[ Conflicts in protocol.c, because commit bc68b0efa1bf ("mptcp: move the
whole rx path under msk socket lock protection") and commit d88b2127b242 ("mptcp: add eat_recv_skb helper") (with some dependences) are not in this version. These conflicts were in the context, and not related to this fix. ]
--- net/mptcp/protocol.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
net/mptcp/protocol.c +8 -3
@@ -1997,7 +1997,7 @@ static int __mptcp_recvmsg_mskq(struct mstruct msghdr *msg, size_t len, int flags, int copied_total, struct scm_timestamping_internal *tss, - int *cmsg_flags) + int *cmsg_flags, struct sk_buff **last) { struct sk_buff *skb, *tmp;int total_data_len =0 ;
@@ -2013,6 +2013,7 @@ static int __mptcp_recvmsg_mskq(struct m/* skip already peeked skbs */ if (total_data_len + data_len <= copied_total) { total_data_len += data_len; + *last = skb;continue ; }
@@ -2053,6 +2054,8 @@ static int __mptcp_recvmsg_mskq(struct mWRITE_ONCE (msk->rmem_released, msk->rmem_released + skb->truesize);__skb_unlink (skb, &msk->receive_queue);__kfree_skb (skb); + }else { + *last = skb; }if (copied >= len)
@@ -2274,10 +2277,12 @@ static int mptcp_recvmsg(struct sock *sk cmsg_flags =MPTCP_CMSG_INQ ;while (copied < len) { +struct sk_buff *last =NULL ;int err, bytes_read; bytes_read =__mptcp_recvmsg_mskq (msk, msg, len - copied, flags, - copied, &tss, &cmsg_flags); + copied, &tss, &cmsg_flags, + &last);if (unlikely (bytes_read <0 )) {if (!copied) copied = bytes_read;
@@ -2335,7 +2340,7 @@ static int mptcp_recvmsg(struct sock *skpr_debug ("block timeout %ld\n" , timeo);mptcp_cleanup_rbuf (msk, copied); - err =sk_wait_data (sk, &timeo,NULL ); + err =sk_wait_data (sk, &timeo, last);if (err <0 ) { err = copied ? : err; goto out_err;
Re: [PATCH 6.12 28/70] mptcp: fix soft lockup in mptcp_recvmsg()
Hi Greg,
Quoted 2 lines · Greg Kroah-Hartman
6.12-stable review patch. If anyone has any objections, please let me know.
Sorry for the delayed reply. Same issue as 6.6.y - queue mismatch in mptcp_recvmsg() (msk->receive_queue vs sk->sk_receive_queue), so the fix is not applicable to 6.12.y either.
Note that the soft lockup issue still exists in 6.12. A different approach may be needed for these branches and will be addressed later.
Thanks,
Li Xiasong
Quoted 121 lines
------------------
From: Li Xiasong <[email protected]>
commit
5dd8025a49c268ab6b94d978532af3ad341132a7upstream.syzbot reported a soft lockup in
mptcp_recvmsg()[0].When receiving data with
MSG_PEEK|MSG_WAITALLflags, the skb is not removed from thesk_receive_queue. This causessk_wait_data()to always find available data and never perform actual waiting, leading to a soft lockup.Fix this by adding a 'last' parameter to track the last peeked skb. This allows
sk_wait_data()to make informed waiting decisions and prevent infinite loops whenMSG_PEEKis used.[0]:
watchdog: BUG: soft lockup - CPU#2 stuck for 156s! [server:1963] Modules linked in: CPU: 2 UID: 0 PID: 1963 Comm: server Not tainted 6.19.0-rc8 #61 PREEMPT(none) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:sk_wait_data+0x15/0x190 Code: 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 56 41 55 41 54 49 89 f4 55 48 89 d5 53 48 89 fb <48> 83 ec 30 65 48 8b 05 17 a4 6b 01 48 89 44 24 28 31 c0 65 48 8b RSP: 0018:ffffc90000603ca0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff888102bf0800 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffc90000603d18 RDI: ffff888102bf0800 RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000101 R10: 0000000000000000 R11: 0000000000000075 R12: ffffc90000603d18 R13: ffff888102bf0800 R14: ffff888102bf0800 R15: 0000000000000000 FS: 00007f6e38b8c4c0(0000) GS:ffff8881b877e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055aa7bff1680 CR3: 0000000105cbe000 CR4: 00000000000006f0 Call Trace: <TASK> mptcp_recvmsg+0x547/0x8c0 net/mptcp/protocol.c:2329 inet_recvmsg+0x11f/0x130 net/ipv4/af_inet.c:891 sock_recvmsg+0x94/0xc0 net/socket.c:1100 __sys_recvfrom+0xb2/0x130 net/socket.c:2256 __x64_sys_recvfrom+0x1f/0x30 net/socket.c:2267 do_syscall_64+0x59/0x2d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:131 RIP: 0033:0x7f6e386a4a1d Code: 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8d 05 f1 de 2c 00 41 89 ca 8b 00 85 c0 75 20 45 31 c9 45 31 c0 b8 2d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 6b f3 c3 66 0f 1f 84 00 00 00 00 00 41 56 41 RSP: 002b:00007ffc3c4bb078 EFLAGS: 00000246 ORIG_RAX: 000000000000002d RAX: ffffffffffffffda RBX: 000000000000861e RCX: 00007f6e386a4a1d RDX: 00000000000003ff RSI: 00007ffc3c4bb150 RDI: 0000000000000004 RBP: 00007ffc3c4bb570 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000103 R11: 0000000000000246 R12: 00005605dbc00be0 R13: 00007ffc3c4bb650 R14: 0000000000000000 R15: 0000000000000000 </TASK>Fixes 8e04ce45a8db ("mptcp: fix MSG_PEEK stream corruption")Signed-off-by Li Xiasong <[email protected]>Reviewed-by Matthieu Baerts (NGI0) <[email protected]>Signed-off-by Jakub Kicinski <[email protected]>[ Conflicts in
protocol.c, because commitbc68b0efa1bf("mptcp: move the
whole rx path under msk socket lock protection") and commitd88b2127b242("mptcp: addeat_recv_skbhelper") (with some dependences) are not in this version. These conflicts were in the context, and not related to this fix. ]Signed-off-by Matthieu Baerts (NGI0) <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- net/mptcp/protocol.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)net/mptcp/protocol.c +8
-3@@ -1997,7 +1997,7 @@ static int __mptcp_recvmsg_mskq(struct mstruct msghdr *msg, size_t len, int flags, int copied_total, struct scm_timestamping_internal *tss, - int *cmsg_flags) + int *cmsg_flags, struct sk_buff **last) { struct sk_buff *skb, *tmp;int total_data_len =0 ;@@ -2013,6 +2013,7 @@ static int __mptcp_recvmsg_mskq(struct m/* skip already peeked skbs */ if (total_data_len + data_len <= copied_total) { total_data_len += data_len; + *last = skb;continue ; }@@ -2053,6 +2054,8 @@ static int __mptcp_recvmsg_mskq(struct mWRITE_ONCE (msk->rmem_released, msk->rmem_released + skb->truesize);__skb_unlink (skb, &msk->receive_queue);__kfree_skb (skb); + }else { + *last = skb; }if (copied >= len)@@ -2274,10 +2277,12 @@ static int mptcp_recvmsg(struct sock *sk cmsg_flags =MPTCP_CMSG_INQ ;while (copied < len) { +struct sk_buff *last =NULL ;int err, bytes_read; bytes_read =__mptcp_recvmsg_mskq (msk, msg, len - copied, flags, - copied, &tss, &cmsg_flags); + copied, &tss, &cmsg_flags, + &last);if (unlikely (bytes_read <0 )) {if (!copied) copied = bytes_read;@@ -2335,7 +2340,7 @@ static int mptcp_recvmsg(struct sock *skpr_debug ("block timeout %ld\n" , timeo);mptcp_cleanup_rbuf (msk, copied); - err =sk_wait_data (sk, &timeo,NULL ); + err =sk_wait_data (sk, &timeo, last);if (err <0 ) { err = copied ? : err; goto out_err;
Sasha Levin
maintainerRe: [PATCH 6.12 28/70] mptcp: fix soft lockup in mptcp_recvmsg()
Quoted 3 lines · Li Xiasong
Same issue as 6.6.y - queue mismatch in
mptcp_recvmsg()(msk->receive_queuevssk->sk_receive_queue), so the fix is not applicable to 6.12.y either.
Dropped from the 6.12 and 6.6 queues, thanks.
Greg Kroah-Hartman
maintainerPATCH 29/70 LoongArch: Remove unnecessary checks for ORC unwinder
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
[ Upstream commit 4cd641a79e69270a062777f64a0dd330abb9044a ]
According to the following function definitions, __kernel_text_address() already checks __module_text_address(), so it should remove the check of __module_text_address() in bt_address() at least.
int __kernel_text_address(unsigned long addr)
{
if (kernel_text_address(addr))
return 1;
...
return 0;
}int kernel_text_address(unsigned long addr)
{
bool no_rcu;
int ret = 1;
...
if (is_module_text_address(addr))
goto out;
...
return ret;
}bool is_module_text_address(unsigned long addr)
{
guard(rcu)();
return __module_text_address(addr) != NULL;
}Furthermore, there are two checks of __kernel_text_address(), one is in bt_address() and the other is after calling bt_address(), it looks like redundant.
Handle the exception address first and then use __kernel_text_address() to validate the calculated address for exception or the normal address in bt_address(), then it can remove the check of __kernel_text_address() after calling bt_address().
Just remove unnecessary checks, no functional changes intended.
---
V2: Add upstream commit ID.
arch/loongarch/kernel/unwind_orc.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-)
arch/loongarch/kernel/unwind_orc.c +5 -11
@@ -359,12 +359,6 @@ static inline unsigned long bt_address(u {extern unsigned long eentry; -if (__kernel_text_address (ra)) -return ra; - -if (__module_text_address (ra)) -return ra; -if (ra >= eentry && ra < eentry +EXCCODE_INT_END *VECSIZE ) {unsigned long func;unsigned long type = (ra - eentry) /VECSIZE ;
@@ -382,10 +376,13 @@ static inline unsigned long bt_address(ubreak ; } -return func + offset; + ra = func + offset; } -return ra; +if (__kernel_text_address (ra)) +return ra; + +return 0 ; }bool unwind_next_frame (struct unwind_state *state)
@@ -511,9 +508,6 @@ bool unwind_next_frame(struct unwind_sta goto err; } -if (!__kernel_text_address (state->pc)) - goto err; -preempt_enable ();return true;
Greg Kroah-Hartman
maintainerPATCH 30/70 LoongArch: Handle percpu handler address for ORC unwinder
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
[ Upstream commit 055c7e75190e0be43037bd663a3f6aced194416e ]
After commit 4cd641a79e69 ("LoongArch: Remove unnecessary checks for ORC unwinder"), the system can not boot normally under some configs (such as enable KASAN), there are many error messages "cannot find unwind pc".
The kernel boots normally with the defconfig, so no problem found out at the first time. Here is one way to reproduce:
cd linux make mrproper defconfig -j"$(nproc)" scripts/config -e KASAN make olddefconfig all -j"$(nproc)" sudo make modules_install sudo make install sudo reboot
The address that can not unwind is not a valid kernel address which is between "pcpu_handlers[cpu]" and "pcpu_handlers[cpu] + vec_sz" due to the code of eentry was copied to the new area of pcpu_handlers[cpu] in setup_tlb_handler(), handle this special case to get the valid address to unwind normally.
---
V2: Add upstream commit ID.
arch/loongarch/include/asm/setup.h | 3 +++ arch/loongarch/kernel/unwind_orc.c | 16 ++++++++++++++++ 2 files changed, 19 insertions(+)
arch/loongarch/include/asm/setup.h +3 -0
@@ -7,6 +7,7 @@#define _LOONGARCH_SETUP_H#include <linux/types.h> +#include <linux/threads.h> #include <asm/sections.h> #include <uapi/asm/setup.h>
@@ -14,6 +15,8 @@extern unsigned long eentry;extern unsigned long tlbrentry; +extern unsigned long pcpu_handlers[NR_CPUS ]; +extern long exception_handlers[VECSIZE *128 /sizeof (long )];extern char init_command_line[COMMAND_LINE_SIZE ];extern void tlb_init (int cpu);extern void cpu_cache_init (void );
arch/loongarch/kernel/unwind_orc.c +16 -0
@@ -359,6 +359,22 @@ static inline unsigned long bt_address(u {extern unsigned long eentry; +#if defined(CONFIG_NUMA ) && !defined(CONFIG_PREEMPT_RT ) +int cpu; +int vec_sz =sizeof (exception_handlers); + +for_each_possible_cpu (cpu) { +if (!pcpu_handlers[cpu]) +continue ; + +if (ra >= pcpu_handlers[cpu] && + ra < pcpu_handlers[cpu] + vec_sz) { + ra = ra + eentry - pcpu_handlers[cpu]; +break ; + } + } +#endif +if (ra >= eentry && ra < eentry +EXCCODE_INT_END *VECSIZE ) {unsigned long func;unsigned long type = (ra - eentry) /VECSIZE ;
Greg Kroah-Hartman
maintainerPATCH 31/70 netfilter: nft_ct: fix use-after-free in timeout object destroy
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tuan Do <[email protected]>
commit f8dca15a1b190787bbd03285304b569631160eda upstream.
nft_ct_timeout_obj_destroy() frees the timeout object with kfree() immediately after nf_ct_untimeout(), without waiting for an RCU grace period. Concurrent packet processing on other CPUs may still hold RCU-protected references to the timeout object obtained via rcu_dereference() in nf_ct_timeout_data().
Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer freeing until after an RCU grace period, matching the approach already used in nfnetlink_cttimeout.c.
KASAN report:
BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0 Read of size 4 at addr ffff8881035fe19c by task exploit/80 Call Trace: nf_conntrack_tcp_packet+0x1381/0x29d0 nf_conntrack_in+0x612/0x8b0 nf_hook_slow+0x70/0x100 __ip_local_out+0x1b2/0x210 tcp_sendmsg_locked+0x722/0x1580 __sys_sendto+0x2d8/0x320 Allocated by task 75: nft_ct_timeout_obj_init+0xf6/0x290 nft_obj_init+0x107/0x1b0 nf_tables_newobj+0x680/0x9c0 nfnetlink_rcv_batch+0xc29/0xe00 Freed by task 26: nft_obj_destroy+0x3f/0xa0 nf_tables_trans_destroy_work+0x51c/0x5c0 process_one_work+0x2c4/0x5a0
--- include/net/netfilter/nf_conntrack_timeout.h | 1 + net/netfilter/nft_ct.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)
include/net/netfilter/nf_conntrack_timeout.h +1 -0
@@ -14,6 +14,7 @@struct nf_ct_timeout {__u16 l3num;const struct nf_conntrack_l4proto *l4proto; +struct rcu_head rcu;char data[]; };
net/netfilter/nft_ct.c +1 -1
@@ -1002,7 +1002,7 @@ static void nft_ct_timeout_obj_destroy(cnf_queue_nf_hook_drop (ctx->net);nf_ct_untimeout (ctx->net, timeout);nf_ct_netns_put (ctx->net, ctx->family); -kfree (priv->timeout); +kfree_rcu (priv->timeout, rcu); } static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
Greg Kroah-Hartman
maintainerPATCH 32/70 workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <[email protected]>
commit 703ccb63ae9f7444d6ff876d024e17f628103c69 upstream.
In unplug_oldest_pwq(), the first inactive work item on the pool_workqueue is activated correctly. However, if multiple inactive works exist on the same pool_workqueue, subsequent works fail to activate because wq_node_nr_active.pending_pwqs is empty — the list insertion is skipped when the pool_workqueue is plugged.
Fix this by checking for additional inactive works in unplug_oldest_pwq() and updating wq_node_nr_active.pending_pwqs accordingly.
--- kernel/workqueue.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
kernel/workqueue.c +13 -1
@@ -1856,8 +1856,20 @@ static void unplug_oldest_pwq(struct worraw_spin_lock_irq (&pwq->pool->lock);if (pwq->plugged) { pwq->plugged = false; -if (pwq_activate_first_inactive (pwq, true)) +if (pwq_activate_first_inactive (pwq, true)) { +/* +* While plugged, queueing skips activation which +* includes bumping the nr_active count and adding the +* pwq to nna->pending_pwqs if the count can't be +* obtained. We need to restore both for the pwq being +* unplugged. The first call activates the first +* inactive work item and the second, if there are more +* inactive, puts the pwq on pending_pwqs. +*/ +pwq_activate_first_inactive (pwq, false); +kick_pool (pwq->pool); + } }raw_spin_unlock_irq (&pwq->pool->lock); }
Greg Kroah-Hartman
maintainerPATCH 33/70 xfrm: clear trailing padding in build_polexpire()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yasuaki Torimaru <[email protected]>
commit 71a98248c63c535eaa4d4c22f099b68d902006d0 upstream.
build_expire() clears the trailing padding bytes of struct xfrm_user_expire after setting the hard field via memset_after(), but the analogous function build_polexpire() does not do this for struct xfrm_user_polexpire.
The padding bytes after the __u8 hard field are left uninitialized from the heap allocation, and are then sent to userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners, leaking kernel heap memory contents.
Add the missing memset_after() call, matching build_expire().
--- net/xfrm/xfrm_user.c | 2 ++ 1 file changed, 2 insertions(+)
net/xfrm/xfrm_user.c +2 -0
@@ -3849,6 +3849,8 @@ static int build_polexpire(struct sk_bufreturn err; } upe->hard = !!hard; +/* clear the padding bytes */ +memset_after (upe,0 , hard);nlmsg_end (skb, nlh);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 34/70 tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleh Konko <[email protected]>
commit 48a5fe38772b6f039522469ee6131a67838221a8 upstream.
The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on every inbound group ACK, even when the same member has already acknowledged the current broadcast round.
Because bc_ackers is a u16, a duplicate ACK received after the last legitimate ACK wraps the counter to 65535. Once wrapped, tipc_group_bc_cong() keeps reporting congestion and later group broadcasts on the affected socket stay blocked until the group is recreated.
Fix this by ignoring duplicate or stale ACKs before touching bc_acked or bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and prevents the underflow path.
--- net/tipc/group.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/tipc/group.c +5 -1
@@ -746,6 +746,7 @@ void tipc_group_proto_rcv(struct tipc_gru32 port =msg_origport (hdr);struct tipc_member *m, *pm;u16 remitted, in_flight; +u16 acked;if (!grp)return ;
@@ -798,7 +799,10 @@ void tipc_group_proto_rcv(struct tipc_grcase GRP_ACK_MSG :if (!m)return ; - m->bc_acked =msg_grp_bc_acked (hdr); + acked =msg_grp_bc_acked (hdr); +if (less_eq (acked, m->bc_acked)) +return ; + m->bc_acked = acked;if (--grp->bc_ackers)return ;list_del_init (&m->small_win);
Greg Kroah-Hartman
maintainerPATCH 35/70 wifi: brcmsmac: Fix dma_free_coherent() size
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 12cd7632757a54ce586e36040210b1a738a0fc53 upstream.
dma_alloc_consistent() may change the size to align it. The new size is saved in alloced.
Change the free size to match the allocation size.
--- drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c +1 -1
@@ -483,7 +483,7 @@ static void *dma_ringalloc(struct dma_inif (((desc_strtaddr + size -1 ) & boundary) != (desc_strtaddr & boundary)) { *alignbits =dma_align_sizetobits (size); -dma_free_coherent (di->dmadev, size, va, *descpa); +dma_free_coherent (di->dmadev, *alloced, va, *descpa); va =dma_alloc_consistent (di, size, *alignbits, alloced, descpa); }
Greg Kroah-Hartman
maintainerPATCH 36/70 platform/x86/intel-uncore-freq: Handle autonomous UFS status bit
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit 4ab604b3f3aa8dcccc7505f5d310016682a99d5f upstream.
When the AUTONOMOUS_UFS_DISABLED bit is set in the header, the ELC (Efficiency Latency Control) feature is non-functional. Hence, return error for read or write to ELC attributes.
--- drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c +7 -1
@@ -421,6 +421,7 @@ static void remove_cluster_entries(struc#define UNCORE_VERSION_MASK GENMASK_ULL(7, 0)#define UNCORE_LOCAL_FABRIC_CLUSTER_ID_MASK GENMASK_ULL(15, 8)#define UNCORE_CLUSTER_OFF_MASK GENMASK_ULL(7, 0) +#define UNCORE_AUTONOMOUS_UFS_DISABLED BIT(32)#define UNCORE_MAX_CLUSTER_PER_DOMAIN 8static int uncore_probe (struct auxiliary_device *auxdev,const struct auxiliary_device_id *id)
@@ -482,6 +483,7 @@ static int uncore_probe(struct auxiliaryfor (i =0 ; i < num_resources; ++i) {struct tpmi_uncore_power_domain_info *pd_info; +bool auto_ufs_enabled;struct resource *res;u64 cluster_offset;u8 cluster_mask;
@@ -531,6 +533,8 @@ static int uncore_probe(struct auxiliarycontinue ; } + auto_ufs_enabled = !(header &UNCORE_AUTONOMOUS_UFS_DISABLED ); +/* Find out number of clusters in this resource */ pd_info->cluster_count =hweight8 (cluster_mask);
@@ -568,7 +572,9 @@ static int uncore_probe(struct auxiliary cluster_info->uncore_root = tpmi_uncore; -if (TPMI_MINOR_VERSION (pd_info->ufs_header_ver) >=UNCORE_ELC_SUPPORTED_VERSION ) +if ((TPMI_MINOR_VERSION (pd_info->ufs_header_ver) >= +UNCORE_ELC_SUPPORTED_VERSION ) && + auto_ufs_enabled) cluster_info->elc_supported = true; ret =uncore_freq_add_entry (&cluster_info->uncore_data,0 );
Greg Kroah-Hartman
maintainerPATCH 37/70 Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Krzyszkowiak <[email protected]>
commit 4cd46ea0eb4504f7f4fea92cb4601c5c9a3e545e upstream.
This reverts commit c24a9b698fb02cd0723fa8375abab07f94b97b10.
It's been found that there's a significant per-unit variance in accepted supply voltages and the current set still makes some units unstable.
Revert back to nominal values.
--- arch/arm64/boot/dts/freescale/imx8mq-librem5-r3.dts | 2 - arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 22 +++++--------------- 2 files changed, 7 insertions(+), 17 deletions(-)
arch/arm64/boot/dts/freescale/imx8mq-librem5-r3.dts +1 -1
@@ -7,7 +7,7 @@ &a53_opp_table { opp-1000000000 { - opp-microvolt = <950000>; + opp-microvolt = <1000000>; }; };
arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi +6 -16
@@ -845,8 +845,8 @@ regulator-max-microvolt = <1300000>; regulator-boot-on; regulator-ramp-delay = <1250>; - rohm,dvs-run-voltage = <880000>; - rohm,dvs-idle-voltage = <820000>; + rohm,dvs-run-voltage = <900000>; + rohm,dvs-idle-voltage = <850000>; rohm,dvs-suspend-voltage = <810000>; regulator-always-on; };
@@ -857,8 +857,8 @@ regulator-max-microvolt = <1300000>; regulator-boot-on; regulator-ramp-delay = <1250>; - rohm,dvs-run-voltage = <950000>; - rohm,dvs-idle-voltage = <850000>; + rohm,dvs-run-voltage = <1000000>; + rohm,dvs-idle-voltage = <900000>; regulator-always-on; };
@@ -867,14 +867,14 @@ regulator-min-microvolt = <700000>; regulator-max-microvolt = <1300000>; regulator-boot-on; - rohm,dvs-run-voltage = <850000>; + rohm,dvs-run-voltage = <900000>; }; buck4_reg: BUCK4 { regulator-name = "buck4"; regulator-min-microvolt = <700000>; regulator-max-microvolt = <1300000>; - rohm,dvs-run-voltage = <930000>; + rohm,dvs-run-voltage = <1000000>; }; buck5_reg: BUCK5 {
@@ -1405,13 +1405,3 @@ fsl,ext-reset-output; status = "okay"; }; - -&a53_opp_table { - opp-1000000000 { - opp-microvolt = <850000>; - }; - - opp-1500000000 { - opp-microvolt = <950000>; - }; -};
Greg Kroah-Hartman
maintainerPATCH 38/70 arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Krzyszkowiak <[email protected]>
commit 511f76bf1dce5acf8907b65a7d1bc8f7e7c0d637 upstream.
The minimal voltage of VDD_SOC sourced from BUCK1 is 0.81V, which is the currently set value. However, BD71837 only guarantees accuracy of ±0.01V, and this still doesn't factor other reasons for actual voltage to slightly drop in, resulting in the possibility of running out of the operational range.
Bump the voltage up to 0.85V, which should give enough headroom.
--- arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi +1 -1
@@ -847,7 +847,7 @@ regulator-ramp-delay = <1250>; rohm,dvs-run-voltage = <900000>; rohm,dvs-idle-voltage = <850000>; - rohm,dvs-suspend-voltage = <810000>; + rohm,dvs-suspend-voltage = <850000>; regulator-always-on; };
Greg Kroah-Hartman
maintainerPATCH 39/70 arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Guo <[email protected]>
commit c1f2b0f2b5e37b2c27540a175aea2755a3799433 upstream.
The PCIe reset GPIO on Poplar is actually active low. The active high worked before because kernel driver didn't respect the setting from DT. This is changed since commit 1d26a55fbeb9 ("PCI: histb: Switch to using gpiod API"), and thus PCIe on Poplar got brken since then.
Fix the problem by correcting the polarity.
--- arch/arm64/boot/dts/hisilicon/hi3798cv200-poplar.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/hisilicon/hi3798cv200-poplar.dts +1 -1
@@ -179,7 +179,7 @@ }; &pcie { - reset-gpios = <&gpio4 4 GPIO_ACTIVE_HIGH>; + reset-gpios = <&gpio4 4 GPIO_ACTIVE_LOW>; vpcie-supply = <®_pcie>; status = "okay"; };
Greg Kroah-Hartman
maintainerPATCH 40/70 arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Guo <[email protected]>
commit 1af997cad473d505248df6d9577183bb91f69670 upstream.
Reboot starts failing on Poplar since commit 8424ecdde7df ("arm64: mm:
Set ZONE_DMA size based on devicetree's dma-ranges"), which effectively changes zone_dma_bits from 30 to 32 for arm64 platforms that do not properly define dma-ranges in device tree. It's unclear how Poplar reboot gets broken by this change exactly, but a dma-ranges limiting zone_dma to the first 1 GB fixes the regression.
--- arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi +1 -0
@@ -122,6 +122,7 @@ #address-cells = <1>; #size-cells = <1>; ranges = <0x0 0x0 0xf0000000 0x10000000>; + dma-ranges = <0x0 0x0 0x0 0x40000000>; crg: clock-reset-controller@8a22000 { compatible = "hisilicon,hi3798cv200-crg", "syscon", "simple-mfd";
Greg Kroah-Hartman
maintainerPATCH 41/70 nfc: pn533: allocate rx skb before consuming bytes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
commit c71ba669b570c7b3f86ec875be222ea11dacb352 upstream.
pn532_receive_buf() reports the number of accepted bytes to the serdev core. The current code consumes bytes into recv_skb and may already hand a complete frame to pn533_recv_frame() before allocating a fresh receive buffer.
If that alloc_skb() fails, the callback returns 0 even though it has already consumed bytes, and it leaves recv_skb as NULL for the next receive callback. That breaks the receive_buf() accounting contract and can also lead to a NULL dereference on the next skb_put_u8().
Allocate the receive skb lazily before consuming the next byte instead. If allocation fails, return the number of bytes already accepted.
--- drivers/nfc/pn533/uart.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/nfc/pn533/uart.c +8 -3
@@ -211,6 +211,13 @@ static size_t pn532_receive_buf(struct sdel_timer (&dev->cmd_timeout);for (i =0 ; i < count; i++) { +if (!dev->recv_skb) { + dev->recv_skb =alloc_skb (PN532_UART_SKB_BUFF_LEN , +GFP_KERNEL ); +if (!dev->recv_skb) +return i; + } +if (unlikely (!skb_tailroom (dev->recv_skb)))skb_trim (dev->recv_skb,0 );
@@ -219,9 +226,7 @@ static size_t pn532_receive_buf(struct scontinue ;pn533_recv_frame (dev->priv, dev->recv_skb,0 ); - dev->recv_skb =alloc_skb (PN532_UART_SKB_BUFF_LEN ,GFP_KERNEL ); -if (!dev->recv_skb) -return 0 ; + dev->recv_skb =NULL ; }return i;
Greg Kroah-Hartman
maintainerPATCH 42/70 batman-adv: reject oversized global TT response buffers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruide Cao <[email protected]>
commit 3a359bf5c61d52e7f09754108309d637532164a6 upstream.
batadv_tt_prepare_tvlv_global_data() builds the allocation length for a global TT response in 16-bit temporaries. When a remote originator advertises a large enough global TT, the TT payload length plus the VLAN header offset can exceed 65535 and wrap before kmalloc().
The full-table response path still uses the original TT payload length when it fills tt_change, so the wrapped allocation is too small and batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object before the later packet-size check runs.
Fix this by rejecting TT responses whose TVLV value length cannot fit in the 16-bit TVLV payload length field.
--- net/batman-adv/translation-table.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
net/batman-adv/translation-table.c +7 -2
@@ -844,8 +844,8 @@ batadv_tt_prepare_tvlv_global_data(struc {u16 num_vlan =0 ;u16 num_entries =0 ; -u16 change_offset; -u16 tvlv_len; +u16 tvlv_len =0 ; +unsigned int change_offset;struct batadv_tvlv_tt_vlan_data *tt_vlan;struct batadv_orig_node_vlan *vlan;u8 *tt_change_ptr;
@@ -863,6 +863,11 @@ batadv_tt_prepare_tvlv_global_data(strucif (*tt_len <0 ) *tt_len =batadv_tt_len (num_entries); +if (change_offset >U16_MAX || *tt_len >U16_MAX - change_offset) { + *tt_len =0 ; + goto out; + } + tvlv_len = *tt_len; tvlv_len += change_offset;
Greg Kroah-Hartman
maintainerPATCH 43/70 X.509: Fix out-of-bounds access when parsing extensions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit d702c3408213bb12bd570bb97204d8340d141c51 upstream.
Leo reports an out-of-bounds access when parsing a certificate with empty Basic Constraints or Key Usage extension because the first byte of the extension is read before checking its length. Fix it.
The bug can be triggered by an unprivileged user by submitting a specially crafted certificate to the kernel through the keyrings(7) API. Leo has demonstrated this with a proof-of-concept program responsibly disclosed off-list.
--- crypto/asymmetric_keys/x509_cert_parser.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
crypto/asymmetric_keys/x509_cert_parser.c +4 -4
@@ -585,10 +585,10 @@ int x509_process_extension(void *context* 0x04 is where keyCertSign lands in this bit string * 0x80 is where digitalSignature lands in this bit string */ -if (v[0 ] !=ASN1_BTS ) -return -EBADMSG ;if (vlen <4 )return -EBADMSG ; +if (v[0 ] !=ASN1_BTS ) +return -EBADMSG ;if (v[2 ] >=8 )return -EBADMSG ;if (v[3 ] &0x80 )
@@ -621,10 +621,10 @@ int x509_process_extension(void *context* (Expect 0xFF if the CA is TRUE) * vlen should match the entire extension size */ -if (v[0 ] != (ASN1_CONS_BIT |ASN1_SEQ )) -return -EBADMSG ;if (vlen <2 )return -EBADMSG ; +if (v[0 ] != (ASN1_CONS_BIT |ASN1_SEQ )) +return -EBADMSG ;if (v[1 ] != vlen -2 )return -EBADMSG ;/* Empty SEQUENCE means CA:FALSE (default value omitted per DER) */
Greg Kroah-Hartman
maintainerPATCH 44/70 EDAC/mc: Fix error path ordering in edac_mc_alloc()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
commit 51520e03e70d6c73e33ee7cbe0319767d05764fe upstream.
When the mci->pvt_info allocation in edac_mc_alloc() fails, the error path will call put_device() which will end up calling the device's release function.
However, the init ordering is wrong such that device_initialize() happens *after* the failed allocation and thus the device itself and the release function pointer are not initialized yet when they're called:
MCE: In-kernel MCE decoding enabled.
------------[ cut here ]------------ kobject: '(null)': is not initialized, yet kobject_put() is being called. WARNING: lib/kobject.c:734 at kobject_put, CPU#22: systemd-udevd CPU: 22 UID: 0 PID: 538 Comm: systemd-udevd Not tainted 7.0.0-rc1+ #2 PREEMPT(full) RIP: 0010:kobject_put Call Trace: <TASK> edac_mc_alloc+0xbe/0xe0 [edac_core] amd64_edac_init+0x7a4/0xff0 [amd64_edac] ? __pfx_amd64_edac_init+0x10/0x10 [amd64_edac] do_one_initcall ...
Reorder the calling sequence so that the device is initialized and thus the release function pointer is properly set before it can be used.
This was found by Claude while reviewing another EDAC patch.
--- drivers/edac/edac_mc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/edac/edac_mc.c +3 -3
@@ -370,13 +370,13 @@ struct mem_ctl_info *edac_mc_alloc(unsigif (!mci->layers) goto error; + mci->dev.release = mci_release; +device_initialize (&mci->dev); + mci->pvt_info =kzalloc (sz_pvt,GFP_KERNEL );if (!mci->pvt_info) goto error; - mci->dev.release = mci_release; -device_initialize (&mci->dev); -/* setup index and various internal pointers */ mci->mc_idx = mc_num; mci->tot_dimms = tot_dimms;
Greg Kroah-Hartman
maintainerPATCH 45/70 net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Alifa Ramdhan <[email protected]>
commit a9b8b18364fffce4c451e6f6fd218fa4ab646705 upstream.
The -EBUSY handling in tls_do_encryption(), introduced by commit 859054147318 ("net: tls: handle backlogging of crypto requests"), has a use-after-free due to double cleanup of encrypt_pending and the scatterlist entry.
When crypto_aead_encrypt() returns -EBUSY, the request is enqueued to the cryptd backlog and the async callback tls_encrypt_done() will be invoked upon completion. That callback unconditionally restores the scatterlist entry (sge->offset, sge->length) and decrements ctx->encrypt_pending. However, if tls_encrypt_async_wait() returns an error, the synchronous error path in tls_do_encryption() performs the same cleanup again, double-decrementing encrypt_pending and double-restoring the scatterlist.
The double-decrement corrupts the encrypt_pending sentinel (initialized to 1), making tls_encrypt_async_wait() permanently skip the wait for pending async callbacks. A subsequent sendmsg can then free the tls_rec via bpf_exec_tx_verdict() while a cryptd callback is still pending, resulting in a use-after-free when the callback fires on the freed record.
Fix this by skipping the synchronous cleanup when the -EBUSY async wait returns an error, since the callback has already handled encrypt_pending and sge restoration.
--- net/tls/tls_sw.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
net/tls/tls_sw.c +10 -0
@@ -584,6 +584,16 @@ static int tls_do_encryption(struct sockif (rc == -EBUSY ) { rc =tls_encrypt_async_wait (ctx); rc = rc ?: -EINPROGRESS ; +/* +* The async callback tls_encrypt_done() has already +* decremented encrypt_pending and restored the sge on +* both success and error. Skip the synchronous cleanup +* below on error, just remove the record and return. +*/ +if (rc != -EINPROGRESS ) { +list_del (&rec->list); +return rc; + } }if (!rc || rc != -EINPROGRESS ) {atomic_dec (&ctx->encrypt_pending);
Greg Kroah-Hartman
maintainerPATCH 46/70 net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <[email protected]>
commit 6dede3967619b5944003227a5d09fdc21ed57d10 upstream.
When dma_map_single() fails in tse_start_xmit(), the function returns NETDEV_TX_OK without freeing the skb. Since NETDEV_TX_OK tells the stack the packet was consumed, the skb is never freed, leaking memory on every DMA mapping failure.
Add dev_kfree_skb_any() before returning to properly free the skb.
--- drivers/net/ethernet/altera/altera_tse_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/altera/altera_tse_main.c +1 -0
@@ -572,6 +572,7 @@ static netdev_tx_t tse_start_xmit(struct DMA_TO_DEVICE);if (dma_mapping_error (priv->device, dma_addr)) {netdev_err (priv->dev,"%s: DMA mapping error\n" , __func__); +dev_kfree_skb_any (skb); ret =NETDEV_TX_OK ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 47/70 batman-adv: hold claim backbone gateways by reference
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoze Xie <[email protected]>
commit 82d8701b2c930d0e96b0dbc9115a218d791cb0d2 upstream.
batadv_bla_add_claim() can replace claim->backbone_gw and drop the old gateway's last reference while readers still follow the pointer.
The netlink claim dump path dereferences claim->backbone_gw->orig and takes claim->backbone_gw->crc_lock without pinning the underlying backbone gateway. batadv_bla_check_claim() still has the same naked pointer access pattern.
Reuse batadv_bla_claim_get_backbone_gw() in both readers so they operate on a stable gateway reference until the read-side work is complete. This keeps the dump and claim-check paths aligned with the lifetime rules introduced for the other BLA claim readers.
--- net/batman-adv/bridge_loop_avoidance.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-)
net/batman-adv/bridge_loop_avoidance.c +18 -9
@@ -2132,6 +2132,7 @@ batadv_bla_claim_dump_entry(struct sk_bu struct batadv_bla_claim *claim) {const u8 *primary_addr = primary_if->net_dev->dev_addr; +struct batadv_bla_backbone_gw *backbone_gw;u16 backbone_crc;bool is_own;void *hdr;
@@ -2147,32 +2148,35 @@ batadv_bla_claim_dump_entry(struct sk_bugenl_dump_check_consistent (cb, hdr); - is_own =batadv_compare_eth (claim->backbone_gw->orig, - primary_addr); + backbone_gw =batadv_bla_claim_get_backbone_gw (claim); + + is_own =batadv_compare_eth (backbone_gw->orig, primary_addr); -spin_lock_bh (&claim->backbone_gw->crc_lock); - backbone_crc = claim->backbone_gw->crc; -spin_unlock_bh (&claim->backbone_gw->crc_lock); +spin_lock_bh (&backbone_gw->crc_lock); + backbone_crc = backbone_gw->crc; +spin_unlock_bh (&backbone_gw->crc_lock);if (is_own)if (nla_put_flag (msg,BATADV_ATTR_BLA_OWN )) {genlmsg_cancel (msg, hdr); - goto out; + goto put_backbone_gw; }if (nla_put (msg,BATADV_ATTR_BLA_ADDRESS ,ETH_ALEN , claim->addr) ||nla_put_u16 (msg,BATADV_ATTR_BLA_VID , claim->vid) ||nla_put (msg,BATADV_ATTR_BLA_BACKBONE ,ETH_ALEN , - claim->backbone_gw->orig) || + backbone_gw->orig) ||nla_put_u16 (msg,BATADV_ATTR_BLA_CRC , backbone_crc)) {genlmsg_cancel (msg, hdr); - goto out; + goto put_backbone_gw; }genlmsg_end (msg, hdr); ret =0 ; +put_backbone_gw: +batadv_backbone_gw_put (backbone_gw); out:return ret; }
@@ -2468,6 +2472,7 @@ out:bool batadv_bla_check_claim (struct batadv_priv *bat_priv,u8 *addr,unsigned short vid) { +struct batadv_bla_backbone_gw *backbone_gw;struct batadv_bla_claim search_claim;struct batadv_bla_claim *claim =NULL ;struct batadv_hard_iface *primary_if =NULL ;
@@ -2490,9 +2495,13 @@ bool batadv_bla_check_claim(struct batad* return false. */ if (claim) { -if (!batadv_compare_eth (claim->backbone_gw->orig, + backbone_gw =batadv_bla_claim_get_backbone_gw (claim); + +if (!batadv_compare_eth (backbone_gw->orig, primary_if->net_dev->dev_addr)) ret = false; + +batadv_backbone_gw_put (backbone_gw);batadv_claim_put (claim); }
Greg Kroah-Hartman
maintainerPATCH 48/70 drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Brzezinka <[email protected]>
commit 4c71fd099513bfa8acab529b626e1f0097b76061 upstream.
A use-after-free / refcount underflow is possible when the heartbeat worker and intel_engine_park_heartbeat() race to release the same engine->heartbeat.systole request.
The heartbeat worker reads engine->heartbeat.systole and calls i915_request_put() on it when the request is complete, but clears the pointer in a separate, non-atomic step. Concurrently, a request retirement on another CPU can drop the engine wakeref to zero, triggering __engine_park() -> intel_engine_park_heartbeat(). If the heartbeat timer is pending at that point, cancel_delayed_work() returns true and intel_engine_park_heartbeat() reads the stale non-NULL systole pointer and calls i915_request_put() on it again, causing a refcount underflow:
``` <4> [487.221889] Workqueue: i915-unordered engine_retire [i915] <4> [487.222640] RIP: 0010:refcount_warn_saturate+0x68/0xb0 ... <4> [487.222707] Call Trace: <4> [487.222711] <TASK> <4> [487.222716] intel_engine_park_heartbeat.part.0+0x6f/0x80 [i915] <4> [487.223115] intel_engine_park_heartbeat+0x25/0x40 [i915] <4> [487.223566] __engine_park+0xb9/0x650 [i915] <4> [487.223973] ____intel_wakeref_put_last+0x2e/0xb0 [i915] <4> [487.224408] __intel_wakeref_put_last+0x72/0x90 [i915] <4> [487.224797] intel_context_exit_engine+0x7c/0x80 [i915] <4> [487.225238] intel_context_exit+0xf1/0x1b0 [i915] <4> [487.225695] i915_request_retire.part.0+0x1b9/0x530 [i915] <4> [487.226178] i915_request_retire+0x1c/0x40 [i915] <4> [487.226625] engine_retire+0x122/0x180 [i915] <4> [487.227037] process_one_work+0x239/0x760 <4> [487.227060] worker_thread+0x200/0x3f0 <4> [487.227068] ? __pfx_worker_thread+0x10/0x10 <4> [487.227075] kthread+0x10d/0x150 <4> [487.227083] ? __pfx_kthread+0x10/0x10 <4> [487.227092] ret_from_fork+0x3d4/0x480 <4> [487.227099] ? __pfx_kthread+0x10/0x10 <4> [487.227107] ret_from_fork_asm+0x1a/0x30 <4> [487.227141] </TASK> ```
Fix this by replacing the non-atomic pointer read + separate clear with xchg() in both racing paths. xchg() is a single indivisible hardware instruction that atomically reads the old pointer and writes NULL. This guarantees only one of the two concurrent callers obtains the non-NULL pointer and performs the put, the other gets NULL and skips it.
--- drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c | 26 +++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)
drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c +18 -8
@@ -145,10 +145,12 @@ static void heartbeat(struct work_struct/* Just in case everything has gone horribly wrong, give it a kick */ intel_engine_flush_submission (engine); - rq = engine->heartbeat.systole; -if (rq &&i915_request_completed (rq)) { -i915_request_put (rq); - engine->heartbeat.systole =NULL ; + rq =xchg (&engine->heartbeat.systole,NULL ); +if (rq) { +if (i915_request_completed (rq)) +i915_request_put (rq); +else + engine->heartbeat.systole = rq; }if (!intel_engine_pm_get_if_awake (engine))
@@ -229,8 +231,11 @@ static void heartbeat(struct work_struct unlock:mutex_unlock (&ce->timeline->mutex); out: -if (!engine->i915->params.enable_hangcheck || !next_heartbeat (engine)) -i915_request_put (fetch_and_zero (&engine->heartbeat.systole)); +if (!engine->i915->params.enable_hangcheck || !next_heartbeat (engine)) { + rq =xchg (&engine->heartbeat.systole,NULL ); +if (rq) +i915_request_put (rq); + }intel_engine_pm_put (engine); }
@@ -244,8 +249,13 @@ void intel_engine_unpark_heartbeat(strucvoid intel_engine_park_heartbeat (struct intel_engine_cs *engine) { -if (cancel_delayed_work (&engine->heartbeat.work)) -i915_request_put (fetch_and_zero (&engine->heartbeat.systole)); +if (cancel_delayed_work (&engine->heartbeat.work)) { +struct i915_request *rq; + + rq =xchg (&engine->heartbeat.systole,NULL ); +if (rq) +i915_request_put (rq); + } }void intel_gt_unpark_heartbeats (struct intel_gt *gt)
Greg Kroah-Hartman
maintainerPATCH 49/70 drm/i915/psr: Do not use pipe_src as borders for SU area
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jouni Högander <[email protected]>
commit 75519f5df2a9b23f7bf305e12dc9a6e3e65c24b7 upstream.
This far using crtc_state->pipe_src as borders for Selective Update area haven't caused visible problems as drm_rect_width(crtc_state->pipe_src) == crtc_state->hw.adjusted_mode.crtc_hdisplay and drm_rect_height(crtc_state->pipe_src) == crtc_state->hw.adjusted_mode.crtc_vdisplay when pipe scaling is not used. On the other hand using pipe scaling is forcing full frame updates and all the Selective Update area calculations are skipped. Now this improper usage of crtc_state->pipe_src is causing following warnings:
<4> [7771.978166] xe 0000:00:02.0: [drm] drm_WARN_ON_ONCE(su_lines % vdsc_cfg->slice_height)
after WARN_ON_ONCE was added by commit:
"drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters"
These warnings are seen when DSC and pipe scaling are enabled simultaneously. This is because on full frame update SU area is improperly set as pipe_src which is not aligned with DSC slice height.
Fix these by creating local rectangle using crtc_state->hw.adjusted_mode.crtc_hdisplay and crtc_state->hw.adjusted_mode.crtc_vdisplay. Use this local rectangle as borders for SU area.
--- drivers/gpu/drm/i915/display/intel_psr.c | 30 +++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-)
drivers/gpu/drm/i915/display/intel_psr.c +19 -11
@@ -2375,9 +2375,9 @@ static u32 psr2_pipe_srcsz_early_tpt_calstatic void clip_area_update (struct drm_rect *overlap_damage_area,struct drm_rect *damage_area, -struct drm_rect *pipe_src) +struct drm_rect *display_area) { -if (!drm_rect_intersect (damage_area, pipe_src)) +if (!drm_rect_intersect (damage_area, display_area))return ;if (overlap_damage_area->y1 ==-1 ) {
@@ -2429,6 +2429,7 @@ static bool intel_psr2_sel_fetch_pipe_alstatic void intel_psr2_sel_fetch_et_alignment (struct intel_atomic_state *state,struct intel_crtc *crtc, +struct drm_rect *display_area,bool *cursor_in_su_area) {struct intel_crtc_state *crtc_state =intel_atomic_get_new_crtc_state (state, crtc);
@@ -2456,7 +2457,7 @@ intel_psr2_sel_fetch_et_alignment(structcontinue ;clip_area_update (&crtc_state->psr2_su_area, &new_plane_state->uapi.dst, - &crtc_state->pipe_src); + display_area); *cursor_in_su_area = true; } }
@@ -2504,6 +2505,12 @@ int intel_psr2_sel_fetch_update(struct istruct intel_crtc_state *crtc_state =intel_atomic_get_new_crtc_state (state, crtc);struct intel_plane_state *new_plane_state, *old_plane_state;struct intel_plane *plane; +struct drm_rect display_area = { + .x1 =0 , + .y1 =0 , + .x2 = crtc_state->hw.adjusted_mode.crtc_hdisplay, + .y2 = crtc_state->hw.adjusted_mode.crtc_vdisplay, + };bool full_update = false, su_area_changed;int i, ret;
@@ -2517,7 +2524,7 @@ int intel_psr2_sel_fetch_update(struct i crtc_state->psr2_su_area.x1 =0 ; crtc_state->psr2_su_area.y1 =-1 ; - crtc_state->psr2_su_area.x2 =drm_rect_width (&crtc_state->pipe_src); + crtc_state->psr2_su_area.x2 =drm_rect_width (&display_area); crtc_state->psr2_su_area.y2 =-1 ;/*
@@ -2555,14 +2562,14 @@ int intel_psr2_sel_fetch_update(struct i damaged_area.y1 = old_plane_state->uapi.dst.y1; damaged_area.y2 = old_plane_state->uapi.dst.y2;clip_area_update (&crtc_state->psr2_su_area, &damaged_area, - &crtc_state->pipe_src); + &display_area); }if (new_plane_state->uapi.visible) { damaged_area.y1 = new_plane_state->uapi.dst.y1; damaged_area.y2 = new_plane_state->uapi.dst.y2;clip_area_update (&crtc_state->psr2_su_area, &damaged_area, - &crtc_state->pipe_src); + &display_area); }continue ; }else if (new_plane_state->uapi.alpha != old_plane_state->uapi.alpha) {
@@ -2570,7 +2577,7 @@ int intel_psr2_sel_fetch_update(struct i damaged_area.y1 = new_plane_state->uapi.dst.y1; damaged_area.y2 = new_plane_state->uapi.dst.y2;clip_area_update (&crtc_state->psr2_su_area, &damaged_area, - &crtc_state->pipe_src); + &display_area);continue ; }
@@ -2586,7 +2593,7 @@ int intel_psr2_sel_fetch_update(struct i damaged_area.x1 += new_plane_state->uapi.dst.x1 - src.x1; damaged_area.x2 += new_plane_state->uapi.dst.x1 - src.x1; -clip_area_update (&crtc_state->psr2_su_area, &damaged_area, &crtc_state->pipe_src); +clip_area_update (&crtc_state->psr2_su_area, &damaged_area, &display_area); }/*
@@ -2626,7 +2633,8 @@ int intel_psr2_sel_fetch_update(struct i* cursor is added into affected planes even when * cursor is not updated by itself. */ -intel_psr2_sel_fetch_et_alignment (state, crtc, &cursor_in_su_area); +intel_psr2_sel_fetch_et_alignment (state, crtc, &display_area, + &cursor_in_su_area); su_area_changed =intel_psr2_sel_fetch_pipe_alignment (crtc_state);
@@ -2702,8 +2710,8 @@ int intel_psr2_sel_fetch_update(struct i skip_sel_fetch_set_loop:if (full_update) -clip_area_update (&crtc_state->psr2_su_area, &crtc_state->pipe_src, - &crtc_state->pipe_src); +clip_area_update (&crtc_state->psr2_su_area, &display_area, + &display_area);psr2_man_trk_ctl_calc (crtc_state, full_update); crtc_state->pipe_srcsz_early_tpt =
Greg Kroah-Hartman
maintainerPATCH 50/70 net/mlx5: Update the list of the PCI supported devices
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Guralnik <[email protected]>
commit a9d4f4f6e65e0bf9bbddedecc84d67249991979c upstream.
Add the upcoming ConnectX-10 NVLink-C2C device ID to the table of supported PCI device IDs.
--- drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx5/core/main.c +1 -0
@@ -2246,6 +2246,7 @@ static const struct pci_device_id mlx5_c { PCI_VDEVICE(MELLANOX, 0x1023) }, /* ConnectX-8 */ { PCI_VDEVICE(MELLANOX, 0x1025) }, /* ConnectX-9 */ { PCI_VDEVICE(MELLANOX, 0x1027) }, /* ConnectX-10 */ + { PCI_VDEVICE(MELLANOX, 0x2101) }, /* ConnectX-10 NVLink-C2C */ { PCI_VDEVICE(MELLANOX, 0xa2d2) }, /* BlueField integrated ConnectX-5 network controller */ { PCI_VDEVICE(MELLANOX, 0xa2d3), MLX5_PCI_DEV_IS_VF}, /* BlueField integrated ConnectX-5 network controller VF */ { PCI_VDEVICE(MELLANOX, 0xa2d6) }, /* BlueField-2 integrated ConnectX-6 Dx network controller */
Greg Kroah-Hartman
maintainerPATCH 51/70 pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacky Bai <[email protected]>
commit e91d5f94acf68618ea3ad9c92ac28614e791ae7d upstream.
Keep the NOC_HDCP clock always enabled to fix the potential hang caused by the NoC ADB400 port power down handshake.
--- drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/pmdomain/imx/imx8mp-blk-ctrl.c +1 -7
@@ -352,9 +352,6 @@ static void imx8mp_hdmi_blk_ctrl_power_oregmap_set_bits (bc->regmap,HDMI_RTX_RESET_CTL0 ,BIT (12 ));regmap_clear_bits (bc->regmap,HDMI_TX_CONTROL0 ,BIT (3 ));break ; -case IMX8MP_HDMIBLK_PD_HDCP : -regmap_set_bits (bc->regmap,HDMI_RTX_CLK_CTL0 ,BIT (11 )); -break ;case IMX8MP_HDMIBLK_PD_HRV :regmap_set_bits (bc->regmap,HDMI_RTX_CLK_CTL1 ,BIT (3 ) |BIT (4 ) |BIT (5 ));regmap_set_bits (bc->regmap,HDMI_RTX_RESET_CTL0 ,BIT (15 ));
@@ -408,9 +405,6 @@ static void imx8mp_hdmi_blk_ctrl_power_oregmap_clear_bits (bc->regmap,HDMI_RTX_CLK_CTL0 ,BIT (7 ));regmap_clear_bits (bc->regmap,HDMI_RTX_CLK_CTL1 ,BIT (22 ) |BIT (24 ));break ; -case IMX8MP_HDMIBLK_PD_HDCP : -regmap_clear_bits (bc->regmap,HDMI_RTX_CLK_CTL0 ,BIT (11 )); -break ;case IMX8MP_HDMIBLK_PD_HRV :regmap_clear_bits (bc->regmap,HDMI_RTX_RESET_CTL0 ,BIT (15 ));regmap_clear_bits (bc->regmap,HDMI_RTX_CLK_CTL1 ,BIT (3 ) |BIT (4 ) |BIT (5 ));
@@ -439,7 +433,7 @@ static int imx8mp_hdmi_power_notifier(stregmap_write (bc->regmap,HDMI_RTX_CLK_CTL0 ,0x0 );regmap_write (bc->regmap,HDMI_RTX_CLK_CTL1 ,0x0 );regmap_set_bits (bc->regmap,HDMI_RTX_CLK_CTL0 , -BIT (0 ) |BIT (1 ) |BIT (10 )); +BIT (0 ) |BIT (1 ) |BIT (10 ) |BIT (11 ));regmap_set_bits (bc->regmap,HDMI_RTX_RESET_CTL0 ,BIT (0 ));/*
Greg Kroah-Hartman
maintainerPATCH 52/70 mmc: vub300: fix NULL-deref on disconnect
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit dff34ef879c5e73298443956a8b391311ba78d57 upstream.
Make sure to deregister the controller before dropping the reference to the driver data on disconnect to avoid NULL-pointer dereferences or use-after-free.
--- drivers/mmc/host/vub300.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/vub300.c +1 -1
@@ -2369,8 +2369,8 @@ static void vub300_disconnect(struct usbusb_set_intfdata (interface,NULL );/* prevent more I/O from starting */ vub300->interface =NULL ; -kref_put (&vub300->kref, vub300_delete);mmc_remove_host (mmc); +kref_put (&vub300->kref, vub300_delete);pr_info ("USB vub300 remote SDIO host controller[%d]" " now disconnected" , ifnum);return ;
Greg Kroah-Hartman
maintainerPATCH 53/70 net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
commit b76254c55dc8f23edc089027dd3f8792554c69fb upstream.
qca_tty_receive() consumes each input byte before checking whether a completed frame needs a fresh receive skb. When the current byte completes a frame, the driver delivers that frame and then allocates a new skb for the next one.
If that allocation fails, the current code returns i even though data[i] has already been consumed and may already have completed the delivered frame. Since serdev interprets the return value as the number of accepted bytes, this under-reports progress by one byte and can replay the final byte of the completed frame into a fresh parser state on the next call.
Return i + 1 in that failure path so the accepted-byte count matches the actual receive-state progress.
--- drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/qualcomm/qca_uart.c +1 -1
@@ -100,7 +100,7 @@ qca_tty_receive(struct serdev_device *seif (!qca->rx_skb) {netdev_dbg (netdev,"recv: out of RX resources\n" ); n_stats->rx_errors++; -return i; +return i +1 ; } } }
Greg Kroah-Hartman
maintainerPATCH 54/70 net: stmmac: fix integer underflow in chain mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyllis Xu <[email protected]>
commit 51f4e090b9f87b40c21b6daadb5c06e6c0a07b67 upstream.
The jumbo_frm() chain-mode implementation unconditionally computes
len = nopaged_len - bmax;
where nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is BUF_SIZE_8KiB or BUF_SIZE_2KiB. However, the caller stmmac_xmit() decides to invoke jumbo_frm() based on skb->len (total length including page fragments):
is_jumbo = stmmac_is_jumbo_frm(priv, skb->len, enh_desc);
When a packet has a small linear portion (nopaged_len <= bmax) but a large total length due to page fragments (skb->len > bmax), the subtraction wraps as an unsigned integer, producing a huge len value (~0xFFFFxxxx). This causes the while (len != 0) loop to execute hundreds of thousands of iterations, passing skb->data + bmax * i pointers far beyond the skb buffer to dma_map_single(). On IOMMU-less SoCs (the typical deployment for stmmac), this maps arbitrary kernel memory to the DMA engine, constituting a kernel memory disclosure and potential memory corruption from hardware.
Fix this by introducing a buf_len local variable clamped to min(nopaged_len, bmax). Computing len = nopaged_len - buf_len is then always safe: it is zero when the linear portion fits within a single descriptor, causing the while (len != 0) loop to be skipped naturally, and the fragment loop in stmmac_xmit() handles page fragments afterward.
--- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/net/ethernet/stmicro/stmmac/chain_mode.c +6 -5
@@ -20,7 +20,7 @@ static int jumbo_frm(struct stmmac_tx_quunsigned int nopaged_len =skb_headlen (skb);struct stmmac_priv *priv = tx_q->priv_data;unsigned int entry = tx_q->cur_tx; -unsigned int bmax, des2; +unsigned int bmax, buf_len, des2;unsigned int i =1 , len;struct dma_desc *desc;
@@ -31,17 +31,18 @@ static int jumbo_frm(struct stmmac_tx_quelse bmax = BUF_SIZE_2KiB; - len = nopaged_len - bmax; + buf_len = min_t(unsigned int, nopaged_len, bmax); + len = nopaged_len - buf_len; des2 =dma_map_single (priv->device, skb->data, - bmax,DMA_TO_DEVICE ); + buf_len,DMA_TO_DEVICE ); desc->des2 =cpu_to_le32 (des2);if (dma_mapping_error (priv->device, des2))return -1 ; tx_q->tx_skbuff_dma[entry].buf = des2; - tx_q->tx_skbuff_dma[entry].len = bmax; + tx_q->tx_skbuff_dma[entry].len = buf_len;/* do not close the descriptor and do not set own bit */ -stmmac_prepare_tx_desc (priv, desc,1 , bmax, csum,STMMAC_CHAIN_MODE , +stmmac_prepare_tx_desc (priv, desc,1 , buf_len, csum,STMMAC_CHAIN_MODE ,0 , false, skb->len);while (len !=0 ) {
Greg Kroah-Hartman
maintainerPATCH 55/70 mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baolin Wang <[email protected]>
commit f58df566524ebcdfa394329c64f47e3c9257516e upstream.
When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I encountered some very strange crash issues showing up as "Bad page state":
"
[ 734.496287] BUG: Bad page state in process stress-ng-env pfn:415735fb [ 734.496427] page: refcount:0 mapcount:1 mapping:0000000000000000 index:0x4cf316 pfn:0x415735fb [ 734.496434] flags: 0x57fffe000000800(owner_2|node=1|zone=2|lastcpupid=0x3ffff) [ 734.496439] raw: 057fffe000000800 0000000000000000 dead000000000122 0000000000000000 [ 734.496440] raw: 00000000004cf316 0000000000000000 0000000000000000 0000000000000000 [ 734.496442] page dumped because: nonzero mapcount
"
After analyzing this page’s state, it is hard to understand why the mapcount is not 0 while the refcount is 0, since this page is not where the issue first occurred. By enabling the CONFIG_DEBUG_VM config, I can reproduce the crash as well and captured the first warning where the issue appears:
"
[ 734.469226] page: refcount:33 mapcount:0 mapping:00000000bef2d187 index:0x81a0 pfn:0x415735c0 [ 734.469304] head: order:5 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 734.469315] memcg:ffff000807a8ec00 [ 734.469320] aops:ext4_da_aops ino:100b6f dentry name(?):"stress-ng-mmaptorture-9397-0-2736200540" [ 734.469335] flags: 0x57fffe400000069(locked|uptodate|lru|head|node=1|zone=2|lastcpupid=0x3ffff) ...... [ 734.469364] page dumped because: VM_WARN_ON_FOLIO((_Generic((page + nr_pages - 1), const struct page *: (const struct folio *)_compound_head(page + nr_pages - 1), struct page *: (struct folio *)_compound_head(page + nr_pages - 1))) != folio) [ 734.469390] ------------[ cut here ]------------ [ 734.469393] WARNING: ./include/linux/rmap.h:351 at folio_add_file_rmap_ptes+0x3b8/0x468, CPU#90: stress-ng-mlock/9430 [ 734.469551] folio_add_file_rmap_ptes+0x3b8/0x468 (P) [ 734.469555] set_pte_range+0xd8/0x2f8 [ 734.469566] filemap_map_folio_range+0x190/0x400 [ 734.469579] filemap_map_pages+0x348/0x638 [ 734.469583] do_fault_around+0x140/0x198 ...... [ 734.469640] el0t_64_sync+0x184/0x188
"
The code that triggers the warning is: "VM_WARN_ON_FOLIO(page_folio(page + nr_pages - 1) != folio, folio)", which indicates that set_pte_range() tried to map beyond the large folio’s size.
By adding more debug information, I found that 'nr_pages' had overflowed in filemap_map_pages(), causing set_pte_range() to establish mappings for a range exceeding the folio size, potentially corrupting fields of pages that do not belong to this folio (e.g., page->_mapcount).
After above analysis, I think the possible race is as follows:
CPU 0 CPU 1filemap_map_pages() ext4_setattr()
//get and lock folio with old inode->i_size
next_uptodate_folio()
.......
//shrink the inode->i_size
i_size_write(inode, attr->ia_size); //calculate the end_pgoff with the new inode->i_size
file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1;
end_pgoff = min(end_pgoff, file_end);
......
//nr_pages can be overflowed, cause xas.xa_index > end_pgoff
end = folio_next_index(folio) - 1;
nr_pages = min(end, end_pgoff) - xas.xa_index + 1;
......
//map large folio
filemap_map_folio_range()
......
//truncate folios
truncate_pagecache(inode, inode->i_size);To fix this issue, move the 'end_pgoff' calculation before next_uptodate_folio(), so the retrieved folio stays consistent with the file end to avoid 'nr_pages' calculation overflow. After this patch, the crash issue is gone.
--- mm/filemap.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
mm/filemap.c +8 -3
@@ -3655,14 +3655,19 @@ vm_fault_t filemap_map_pages(struct vm_funsigned int nr_pages =0 , mmap_miss =0 , mmap_miss_saved, folio_type;bool can_map_large; +/* +* Recalculate end_pgoff based on file_end before calling +* next_uptodate_folio() to avoid races with concurrent +* truncation. +*/ + file_end =DIV_ROUND_UP (i_size_read (mapping->host),PAGE_SIZE ) -1 ; + end_pgoff =min (end_pgoff, file_end); +rcu_read_lock (); folio =next_uptodate_folio (&xas, mapping, end_pgoff);if (!folio) goto out; - file_end =DIV_ROUND_UP (i_size_read (mapping->host),PAGE_SIZE ) -1 ; - end_pgoff =min (end_pgoff, file_end); -/* * Do not allow to map with PTEs beyond i_size and with PMD * across i_size to preserve SIGBUS semantics.
Greg Kroah-Hartman
maintainerPATCH 56/70 idpf: improve locking around idpf_vc_xn_push_free()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Tantilov <[email protected]>
commit d086fae65006368618104ba4c57779440eab2217 upstream.
Protect the set_bit() operation for the free_xn bitmask in idpf_vc_xn_push_free(), to make the locking consistent with rest of the code and avoid potential races in that logic.
--- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/intel/idpf/idpf_virtchnl.c +2 -0
@@ -431,7 +431,9 @@ static void idpf_vc_xn_push_free(struct struct idpf_vc_xn *xn) {idpf_vc_xn_release_bufs (xn); +spin_lock_bh (&vcxn_mngr->xn_bm_lock);set_bit (xn->idx, vcxn_mngr->free_xn_bm); +spin_unlock_bh (&vcxn_mngr->xn_bm_lock); }/**
Greg Kroah-Hartman
maintainerPATCH 57/70 idpf: set the payload size before calling the async handler
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Tantilov <[email protected]>
commit 8e2a2420e267a515f6db56a6e9570b5cacd92919 upstream.
Set the payload size before forwarding the reply to the async handler. Without this, xn->reply_sz will be 0 and idpf_mac_filter_async_handler() will never get past the size check.
--- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/intel/idpf/idpf_virtchnl.c +4 -0
@@ -641,6 +641,10 @@ idpf_vc_xn_forward_reply(struct idpf_ada err = -ENXIO ; goto out_unlock;case IDPF_VC_XN_ASYNC : +/* Set reply_sz from the actual payload so that async_handler +* can evaluate the response. +*/ + xn->reply_sz = ctlq_msg->data_len; err =idpf_vc_xn_forward_async (adapter, xn, ctlq_msg);idpf_vc_xn_unlock (xn);return err;
Greg Kroah-Hartman
maintainerPATCH 58/70 net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <[email protected]>
commit 3fd0da4fd8851a7e62d009b7db6c4a05b092bc19 upstream.
page_pool_create() can return an ERR_PTR on failure. The return value is used unconditionally in the loop that follows, passing the error pointer through xdp_rxq_info_reg_mem_model() into page_pool_use_xdp_mem(), which dereferences it, causing a kernel oops.
Add an IS_ERR check after page_pool_create() to return early on failure.
--- drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c +2 -0
@@ -91,6 +91,8 @@ static int lan966x_fdma_rx_alloc_page_po pp_params.dma_dir =DMA_BIDIRECTIONAL ; rx->page_pool =page_pool_create (&pp_params); +if (unlikely (IS_ERR (rx->page_pool))) +return PTR_ERR (rx->page_pool);for (int i =0 ; i < lan966x->num_phys_ports; ++i) {struct lan966x_port *port;
Greg Kroah-Hartman
maintainerPATCH 59/70 net: lan966x: fix page pool leak in error paths
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <[email protected]>
commit 076344a6ad9d1308faaed1402fdcfdda68b604ab upstream.
lan966x_fdma_rx_alloc() creates a page pool but does not destroy it if the subsequent fdma_alloc_coherent() call fails, leaking the pool.
Similarly, lan966x_fdma_init() frees the coherent DMA memory when lan966x_fdma_tx_alloc() fails but does not destroy the page pool that was successfully created by lan966x_fdma_rx_alloc(), leaking it.
Add the missing page_pool_destroy() calls in both error paths.
--- drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c +4 -1
@@ -119,8 +119,10 @@ static int lan966x_fdma_rx_alloc(structreturn PTR_ERR (rx->page_pool); err =fdma_alloc_coherent (lan966x->dev, fdma); -if (err) +if (err) { +page_pool_destroy (rx->page_pool);return err; + }fdma_dcbs_init (fdma,FDMA_DCB_INFO_DATAL (fdma->db_size),FDMA_DCB_STATUS_INTR );
@@ -958,6 +960,7 @@ int lan966x_fdma_init(struct lan966x *la err =lan966x_fdma_tx_alloc (&lan966x->tx);if (err) {fdma_free_coherent (lan966x->dev, &lan966x->rx.fdma); +page_pool_destroy (lan966x->rx.page_pool);return err; }
Greg Kroah-Hartman
maintainerPATCH 60/70 net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <[email protected]>
commit 59c3d55a946cacdb4181600723c20ac4f4c20c84 upstream.
When lan966x_fdma_reload() fails to allocate new RX buffers, the restore path restarts DMA using old descriptors whose pages were already freed via lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can release pages back to the buddy allocator, the hardware may DMA into memory now owned by other kernel subsystems.
Additionally, on the restore path, the newly created page pool (if allocation partially succeeded) is overwritten without being destroyed, leaking it.
Fix both issues by deferring the release of old pages until after the new allocation succeeds. Save the old page array before the allocation so old pages can be freed on the success path. On the failure path, the old descriptors, pages and page pool are all still valid, making the restore safe. Also ensure the restore path re-enables NAPI and wakes the netdev, matching the success path.
--- drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c | 21 +++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c +18 -3
@@ -813,9 +813,15 @@ static int lan966x_qsys_sw_status(structstatic int lan966x_fdma_reload (struct lan966x *lan966x,int new_mtu) { +struct page *(*old_pages)[FDMA_RX_DCB_MAX_DBS ];struct page_pool *page_pool;struct fdma fdma_rx_old; -int err; +int err, i, j; + + old_pages =kmemdup (lan966x->rx.page,sizeof (lan966x->rx.page), +GFP_KERNEL ); +if (!old_pages) +return -ENOMEM ;/* Store these for later to free them */ memcpy (&fdma_rx_old, &lan966x->rx.fdma,sizeof (struct fdma ));
@@ -826,7 +832,6 @@ static int lan966x_fdma_reload(struct lalan966x_fdma_stop_netdev (lan966x);lan966x_fdma_rx_disable (&lan966x->rx); -lan966x_fdma_rx_free_pages (&lan966x->rx); lan966x->rx.page_order =round_up (new_mtu,PAGE_SIZE ) /PAGE_SIZE -1 ; lan966x->rx.max_mtu = new_mtu; err =lan966x_fdma_rx_alloc (&lan966x->rx);
@@ -834,6 +839,11 @@ static int lan966x_fdma_reload(struct la goto restore;lan966x_fdma_rx_start (&lan966x->rx); +for (i =0 ; i < fdma_rx_old.n_dcbs; ++i) +for (j =0 ; j < fdma_rx_old.n_dbs; ++j) +page_pool_put_full_page (page_pool, + old_pages[i][j], false); +fdma_free_coherent (lan966x->dev, &fdma_rx_old);page_pool_destroy (page_pool);
@@ -841,12 +851,17 @@ static int lan966x_fdma_reload(struct lalan966x_fdma_wakeup_netdev (lan966x);napi_enable (&lan966x->napi); -return err; +kfree (old_pages); +return 0 ; restore: lan966x->rx.page_pool = page_pool;memcpy (&lan966x->rx.fdma, &fdma_rx_old,sizeof (struct fdma ));lan966x_fdma_rx_start (&lan966x->rx); +lan966x_fdma_wakeup_netdev (lan966x); +napi_enable (&lan966x->napi); + +kfree (old_pages);return err; }
Greg Kroah-Hartman
maintainerPATCH 61/70 rxrpc: Fix anonymous key handling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
commit 6a59d84b4fc2f27f7b40e348506cc686712e260b upstream.
In rxrpc_new_client_call_for_sendmsg(), a key with no payload is meant to be substituted for a NULL key pointer, but the variable this is done with is subsequently not used.
Fix this by using "key" rather than "rx->key" when filling in the connection parameters.
Note that this only affects direct use of AF_RXRPC; the kAFS filesystem doesn't use sendmsg() directly and so bypasses the issue. Further, AF_RXRPC passes a NULL key in if no key is set, so using an anonymous key in that manner works. Since this hasn't been noticed to this point, it might be better just to remove the "key" variable and the code that sets it
- and, arguably, rxrpc_init_client_call_security() would be a better place to handle it.
--- net/rxrpc/sendmsg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/rxrpc/sendmsg.c +1 -1
@@ -586,7 +586,7 @@ rxrpc_new_client_call_for_sendmsg(structmemset (&cp,0 ,sizeof (cp)); cp.local = rx->local; cp.peer = peer; - cp.key = rx->key; + cp.key = key; cp.security_level = rx->min_sec_level; cp.exclusive = rx->exclusive | p->exclusive; cp.upgrade = p->upgrade;
Greg Kroah-Hartman
maintainerPATCH 62/70 rxrpc: Fix call removal to use RCU safe deletion
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
commit 146d4ab94cf129ee06cd467cb5c71368a6b5bad6 upstream.
Fix rxrpc call removal from the rxnet->calls list to use list_del_rcu() rather than list_del_init() to prevent stuffing up reading /proc/net/rxrpc/calls from potentially getting into an infinite loop.
This, however, means that list_empty() no longer works on an entry that's been deleted from the list, making it harder to detect prior deletion. Fix this by:
Firstly, make rxrpc_destroy_all_calls() only dump the first ten calls that are unexpectedly still on the list. Limiting the number of steps means there's no need to call cond_resched() or to remove calls from the list here, thereby eliminating the need for rxrpc_put_call() to check for that.
rxrpc_put_call() can then be fixed to unconditionally delete the call from the list as it is the only place that the deletion occurs.
--- include/trace/events/rxrpc.h | 2 +- net/rxrpc/call_object.c | 24 +++++++++--------------- 2 files changed, 10 insertions(+), 16 deletions(-)
include/trace/events/rxrpc.h +1 -1
@@ -298,7 +298,7 @@ EM(rxrpc_call_see_release, "SEE release ") \ EM(rxrpc_call_see_userid_exists, "SEE u-exists") \ EM(rxrpc_call_see_waiting_call, "SEE q-conn ") \ - E_(rxrpc_call_see_zap, "SEE zap ") + E_(rxrpc_call_see_still_live, "SEE !still-l")#define rxrpc_txqueue_traces \ EM(rxrpc_txqueue_await_reply, "AWR") \
net/rxrpc/call_object.c +9 -15
@@ -640,11 +640,9 @@ void rxrpc_put_call(struct rxrpc_call *cif (dead) { ASSERTCMP(__rxrpc_call_state(call), ==, RXRPC_CALL_COMPLETE); -if (!list_empty (&call->link)) { -spin_lock (&rxnet->call_lock); -list_del_init (&call->link); -spin_unlock (&rxnet->call_lock); - } +spin_lock (&rxnet->call_lock); +list_del_rcu (&call->link); +spin_unlock (&rxnet->call_lock);rxrpc_cleanup_call (call); }
@@ -728,24 +726,20 @@ void rxrpc_destroy_all_calls(struct rxrp_enter ("" );if (!list_empty (&rxnet->calls)) { -spin_lock (&rxnet->call_lock); +int shown =0 ; -while (!list_empty (&rxnet->calls)) { - call =list_entry (rxnet->calls.next, - struct rxrpc_call, link); -_debug ("Zapping call %p" , call); +spin_lock (&rxnet->call_lock); -rxrpc_see_call (call, rxrpc_call_see_zap); -list_del_init (&call->link); +list_for_each_entry (call, &rxnet->calls, link) { +rxrpc_see_call (call, rxrpc_call_see_still_live);pr_err ("Call %p still in use (%d,%s,%lx,%lx)!\n" , call,refcount_read (&call->ref), rxrpc_call_states[__rxrpc_call_state (call)], call->flags, call->events); -spin_unlock (&rxnet->call_lock); -cond_resched (); -spin_lock (&rxnet->call_lock); +if (++shown >=10 ) +break ; }spin_unlock (&rxnet->call_lock);
Greg Kroah-Hartman
maintainerPATCH 63/70 rxrpc: Fix key reference count leak from call->key
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anderson Nascimento <[email protected]>
commit d666540d217e8d420544ebdfbadeedd623562733 upstream.
When creating a client call in rxrpc_alloc_client_call(), the code obtains a reference to the key. This is never cleaned up and gets leaked when the call is destroyed.
Fix this by freeing call->key in rxrpc_destroy_call().
Before the patch, it shows the key reference counter elevated:
$ cat /proc/keys | grep afs@54321 1bffe9cd I--Q--i 8053480 4169w 3b010000 1000 1000 rxrpc afs@54321: ka $
After the patch, the invalidated key is removed when the code exits:
$ cat /proc/keys | grep afs@54321 $
--- net/rxrpc/call_object.c | 1 + 1 file changed, 1 insertion(+)
net/rxrpc/call_object.c +1 -0
@@ -690,6 +690,7 @@ static void rxrpc_destroy_call(struct worxrpc_put_bundle (call->bundle, rxrpc_bundle_put_call);rxrpc_put_peer (call->peer, rxrpc_peer_put_call);rxrpc_put_local (call->local, rxrpc_local_put_call); +key_put (call->key);call_rcu (&call->rcu, rxrpc_rcu_free_call); }
Greg Kroah-Hartman
maintainerPATCH 64/70 rxrpc: Only put the call ref if one was acquired
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douya Le <[email protected]>
commit 6331f1b24a3e85465f6454e003a3e6c22005a5c5 upstream.
rxrpc_input_packet_on_conn() can process a to-client packet after the current client call on the channel has already been torn down. In that case chan->call is NULL, rxrpc_try_get_call() returns NULL and there is no reference to drop.
The client-side implicit-end error path does not account for that and unconditionally calls rxrpc_put_call(). This turns a protocol error path into a kernel crash instead of rejecting the packet.
Only drop the call reference if one was actually acquired. Keep the existing protocol error handling unchanged.
--- net/rxrpc/io_thread.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/rxrpc/io_thread.c +2 -1
@@ -400,7 +400,8 @@ static int rxrpc_input_packet_on_conn(stif (sp->hdr.callNumber > chan->call_id) {if (rxrpc_to_client (sp)) { -rxrpc_put_call (call, rxrpc_call_put_input); +if (call) +rxrpc_put_call (call, rxrpc_call_put_input);return rxrpc_protocol_error (skb, rxrpc_eproto_unexpected_implicit_end); }
Greg Kroah-Hartman
maintainerPATCH 65/70 rxrpc: reject undecryptable rxkad response tickets
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuqi Xu <[email protected]>
commit fe4447cd95623b1cfacc15f280aab73a6d7340b2 upstream.
rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether crypto_skcipher_decrypt() succeeded.
A malformed RESPONSE can therefore use a non-block-aligned ticket length, make the decrypt operation fail, and still drive the ticket parser with attacker-controlled bytes.
Check the decrypt result and abort the connection with RXKADBADTICKET when ticket decryption fails.
--- net/rxrpc/rxkad.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/rxrpc/rxkad.c +5 -1
@@ -870,6 +870,7 @@ static int rxkad_decrypt_ticket(struct rstruct in_addr addr;unsigned int life;time64_t issue, now; +int ret;bool little_endian;u8 *p, *q, *name, *end;
@@ -889,8 +890,11 @@ static int rxkad_decrypt_ticket(struct rsg_init_one (&sg[0 ], ticket, ticket_len);skcipher_request_set_callback (req,0 ,NULL ,NULL );skcipher_request_set_crypt (req, sg, sg, ticket_len, iv.x); -crypto_skcipher_decrypt (req); + ret =crypto_skcipher_decrypt (req);skcipher_request_free (req); +if (ret <0 ) +return rxrpc_abort_conn (conn, skb,RXKADBADTICKET , -EPROTO , + rxkad_abort_resp_tkt_short); p = ticket; end = p + ticket_len;
Greg Kroah-Hartman
maintainerPATCH 66/70 rxrpc: fix reference count leak in rxrpc_server_keyring()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luxiao Xu <[email protected]>
commit f125846ee79fcae537a964ce66494e96fa54a6de upstream.
This patch fixes a reference count leak in rxrpc_server_keyring() by checking if rx->securities is already set.
--- net/rxrpc/server_key.c | 3 +++ 1 file changed, 3 insertions(+)
net/rxrpc/server_key.c +3 -0
@@ -125,6 +125,9 @@ int rxrpc_server_keyring(struct rxrpc_so_enter ("" ); +if (rx->securities) +return -EINVAL ; +if (optlen <=0 || optlen >PAGE_SIZE -1 )return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 67/70 rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
commit 2afd86ccbb2082a3c4258aea8c07e5bb6267bc2f upstream.
An AF_RXRPC socket can be both client and server at the same time. When sending new calls (ie. it's acting as a client), it uses rx->key to set the security, and when accepting incoming calls (ie. it's acting as a server), it uses rx->securities.
setsockopt(RXRPC_SECURITY_KEY) sets rx->key to point to an rxrpc-type key and setsockopt(RXRPC_SECURITY_KEYRING) sets rx->securities to point to a keyring of rxrpc_s-type keys.
Now, it should be possible to use both rx->key and rx->securities on the same socket - but for userspace AF_RXRPC sockets rxrpc_setsockopt() prevents that.
Fix this by:
(1) Remove the incorrect check rxrpc_setsockopt(RXRPC_SECURITY_KEYRING)
makes on rx->key.
(2) Move the check that rxrpc_setsockopt(RXRPC_SECURITY_KEY) makes on
rx->key down into rxrpc_request_key().
(3) Remove rxrpc_request_key()'s check on rx->securities.
This (in combination with a previous patch) pushes the checks down into the functions that set those pointers and removes the cross-checks that prevent both key and keyring being set.
--- net/rxrpc/af_rxrpc.c | 6 ------ net/rxrpc/key.c | 2 +- 2 files changed, 1 insertion(+), 7 deletions(-)
net/rxrpc/af_rxrpc.c +0 -6
@@ -681,9 +681,6 @@ static int rxrpc_setsockopt(struct socke goto success;case RXRPC_SECURITY_KEY : - ret = -EINVAL ; -if (rx->key) - goto error; ret = -EISCONN ;if (rx->sk.sk_state !=RXRPC_UNBOUND ) goto error;
@@ -691,9 +688,6 @@ static int rxrpc_setsockopt(struct socke goto error;case RXRPC_SECURITY_KEYRING : - ret = -EINVAL ; -if (rx->key) - goto error; ret = -EISCONN ;if (rx->sk.sk_state !=RXRPC_UNBOUND ) goto error;
net/rxrpc/key.c +1 -1
@@ -452,7 +452,7 @@ int rxrpc_request_key(struct rxrpc_sock_enter ("" ); -if (optlen <=0 || optlen >PAGE_SIZE -1 || rx->securities) +if (optlen <=0 || optlen >PAGE_SIZE -1 || rx->key)return -EINVAL ; description =memdup_sockptr_nul (optval, optlen);
Greg Kroah-Hartman
maintainerPATCH 68/70 rxrpc: Fix missing error checks for rxkad encryption/decryption failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
commit f93af41b9f5f798823d0d0fb8765c2a936d76270 upstream.
Add error checking for failure of crypto_skcipher_en/decrypt() to various rxkad function as the crypto functions can fail with ENOMEM at least.
--- net/rxrpc/rxkad.c | 57 ++++++++++++++++++++++++++++++++++++------------------ 1 file changed, 38 insertions(+), 19 deletions(-)
net/rxrpc/rxkad.c +38 -19
@@ -189,6 +189,7 @@ static int rxkad_prime_packet_security(sstruct rxrpc_crypt iv;__be32 *tmpbuf;size_t tmpsize =4 *sizeof (__be32); +int ret;_enter ("" );
@@ -217,13 +218,13 @@ static int rxkad_prime_packet_security(sskcipher_request_set_sync_tfm (req, ci);skcipher_request_set_callback (req,0 ,NULL ,NULL );skcipher_request_set_crypt (req, &sg, &sg, tmpsize, iv.x); -crypto_skcipher_encrypt (req); + ret =crypto_skcipher_encrypt (req);skcipher_request_free (req);memcpy (&conn->rxkad.csum_iv, tmpbuf +2 ,sizeof (conn->rxkad.csum_iv));kfree (tmpbuf); -_leave (" = 0" ); -return 0 ; +_leave (" = %d" , ret); +return ret; }/*
@@ -257,6 +258,7 @@ static int rxkad_secure_packet_auth(consstruct scatterlist sg;size_t pad;u16 check; +int ret;_enter ("" );
@@ -279,11 +281,11 @@ static int rxkad_secure_packet_auth(consskcipher_request_set_sync_tfm (req, call->conn->rxkad.cipher);skcipher_request_set_callback (req,0 ,NULL ,NULL );skcipher_request_set_crypt (req, &sg, &sg,8 , iv.x); -crypto_skcipher_encrypt (req); + ret =crypto_skcipher_encrypt (req);skcipher_request_zero (req); -_leave (" = 0" ); -return 0 ; +_leave (" = %d" , ret); +return ret; }/*
@@ -342,7 +344,7 @@ static int rxkad_secure_packet(struct rxunion {__be32 buf[2 ]; } crypto__aligned(8) ; -u32 x, y; +u32 x, y =0 ;int ret; _enter("{%d{%x}},{#%u},%u,",
@@ -373,8 +375,10 @@ static int rxkad_secure_packet(struct rxskcipher_request_set_sync_tfm (req, call->conn->rxkad.cipher);skcipher_request_set_callback (req,0 ,NULL ,NULL );skcipher_request_set_crypt (req, &sg, &sg,8 , iv.x); -crypto_skcipher_encrypt (req); + ret =crypto_skcipher_encrypt (req);skcipher_request_zero (req); +if (ret <0 ) + goto out; y =ntohl (crypto.buf[1 ]); y = (y >>16 ) &0xffff ;
@@ -397,6 +401,7 @@ static int rxkad_secure_packet(struct rxbreak ; } +out:skcipher_request_free (req);_leave (" = %d [set %x]" , ret, y);return ret;
@@ -437,8 +442,10 @@ static int rxkad_verify_packet_1(structskcipher_request_set_sync_tfm (req, call->conn->rxkad.cipher);skcipher_request_set_callback (req,0 ,NULL ,NULL );skcipher_request_set_crypt (req, sg, sg,8 , iv.x); -crypto_skcipher_decrypt (req); + ret =crypto_skcipher_decrypt (req);skcipher_request_zero (req); +if (ret <0 ) +return ret;/* Extract the decrypted packet length */ if (skb_copy_bits (skb, sp->offset, &sechdr,sizeof (sechdr)) <0 )
@@ -515,10 +522,14 @@ static int rxkad_verify_packet_2(structskcipher_request_set_sync_tfm (req, call->conn->rxkad.cipher);skcipher_request_set_callback (req,0 ,NULL ,NULL );skcipher_request_set_crypt (req, sg, sg, sp->len, iv.x); -crypto_skcipher_decrypt (req); + ret =crypto_skcipher_decrypt (req);skcipher_request_zero (req);if (sg != _sg)kfree (sg); +if (ret <0 ) { +WARN_ON_ONCE (ret != -ENOMEM ); +return ret; + }/* Extract the decrypted packet length */ if (skb_copy_bits (skb, sp->offset, &sechdr,sizeof (sechdr)) <0 )
@@ -586,8 +597,10 @@ static int rxkad_verify_packet(struct rxskcipher_request_set_sync_tfm (req, call->conn->rxkad.cipher);skcipher_request_set_callback (req,0 ,NULL ,NULL );skcipher_request_set_crypt (req, &sg, &sg,8 , iv.x); -crypto_skcipher_encrypt (req); + ret =crypto_skcipher_encrypt (req);skcipher_request_zero (req); +if (ret <0 ) + goto out; y =ntohl (crypto.buf[1 ]); cksum = (y >>16 ) &0xffff ;
@@ -989,21 +1002,23 @@ static int rxkad_decrypt_ticket(struct r/* * decrypt the response packet */ -static void rxkad_decrypt_response (struct rxrpc_connection *conn, -struct rxkad_response *resp, -const struct rxrpc_crypt *session_key) +static int rxkad_decrypt_response (struct rxrpc_connection *conn, +struct rxkad_response *resp, +const struct rxrpc_crypt *session_key) {struct skcipher_request *req = rxkad_ci_req;struct scatterlist sg[1 ];struct rxrpc_crypt iv; +int ret;_enter (",,%08x%08x" ,ntohl (session_key->n[0 ]),ntohl (session_key->n[1 ]));mutex_lock (&rxkad_ci_mutex); -if (crypto_sync_skcipher_setkey (rxkad_ci, session_key->x, -sizeof (*session_key)) <0 ) -BUG (); + ret =crypto_sync_skcipher_setkey (rxkad_ci, session_key->x, +sizeof (*session_key)); +if (ret <0 ) + goto unlock;memcpy (&iv, session_key,sizeof (iv));
@@ -1012,12 +1027,14 @@ static void rxkad_decrypt_response(strucskcipher_request_set_sync_tfm (req, rxkad_ci);skcipher_request_set_callback (req,0 ,NULL ,NULL );skcipher_request_set_crypt (req, sg, sg,sizeof (resp->encrypted), iv.x); -crypto_skcipher_decrypt (req); + ret =crypto_skcipher_decrypt (req);skcipher_request_zero (req); +unlock:mutex_unlock (&rxkad_ci_mutex);_leave ("" ); +return ret; }/*
@@ -1110,7 +1127,9 @@ static int rxkad_verify_response(struct/* use the session key from inside the ticket to decrypt the * response */ -rxkad_decrypt_response (conn, response, &session_key); + ret =rxkad_decrypt_response (conn, response, &session_key); +if (ret <0 ) + goto temporary_error_free_ticket; if (ntohl(response->encrypted.epoch) != conn->proto.epoch || ntohl(response->encrypted.cid) != conn->proto.cid ||
Greg Kroah-Hartman
maintainerPATCH 69/70 net: skb: fix cross-cache free of KFENCE-allocated skb head
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
commit 0f42e3f4fe2a58394e37241d02d9ca6ab7b7d516 upstream.
SKB_SMALL_HEAD_CACHE_SIZE is intentionally set to a non-power-of-2 value (e.g. 704 on x86_64) to avoid collisions with generic kmalloc bucket sizes. This ensures that skb_kfree_head() can reliably use skb_end_offset to distinguish skb heads allocated from skb_small_head_cache vs. generic kmalloc caches.
However, when KFENCE is enabled, kfence_ksize() returns the exact requested allocation size instead of the slab bucket size. If a caller (e.g. bpf_test_init) allocates skb head data via kzalloc() and the requested size happens to equal SKB_SMALL_HEAD_CACHE_SIZE, then slab_build_skb() -> ksize() returns that exact value. After subtracting skb_shared_info overhead, skb_end_offset ends up matching SKB_SMALL_HEAD_HEADROOM, causing skb_kfree_head() to incorrectly free the object to skb_small_head_cache instead of back to the original kmalloc cache, resulting in a slab cross-cache free:
kmem_cache_free(skbuff_small_head): Wrong slab cache. Expected skbuff_small_head but got kmalloc-1k
Fix this by always calling kfree(head) in skb_kfree_head(). This keeps the free path generic and avoids allocator-specific misclassification for KFENCE objects.
--- net/core/skbuff.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
net/core/skbuff.c +1 -4
@@ -1072,10 +1072,7 @@ static int skb_pp_frag_ref(struct sk_bufstatic void skb_kfree_head (void *head,unsigned int end_offset) { -if (end_offset ==SKB_SMALL_HEAD_HEADROOM ) -kmem_cache_free (net_hotdata.skb_small_head_cache, head); -else -kfree (head); +kfree (head); }static void skb_free_head (struct sk_buff *skb)
Greg Kroah-Hartman
maintainerPATCH 70/70 ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Erhardt <[email protected]>
commit d649c58bcad8fb9b749e3837136a201632fa109d upstream.
Depending on the timing during boot, the BIOS might report wrong pin capabilities, which can lead to HDMI audio being disabled. Therefore, force HDMI audio connection on TUXEDO InfinityBook S 14 Gen6.
--- sound/pci/hda/patch_hdmi.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_hdmi.c +1 -0
@@ -1999,6 +1999,7 @@ static const struct snd_pci_quirk force_SND_PCI_QUIRK (0x1043 ,0x86ae ,"ASUS" ,1 ),/* Z170 PRO */ SND_PCI_QUIRK (0x1043 ,0x86c7 ,"ASUS" ,1 ),/* Z170M PLUS */ SND_PCI_QUIRK (0x1462 ,0xec94 ,"MS-7C94" ,1 ), +SND_PCI_QUIRK (0x1558 ,0x14a1 ,"TUXEDO InfinityBook S 14 Gen6" ,1 ),SND_PCI_QUIRK (0x8086 ,0x2060 ,"Intel NUC5CPYB" ,1 ), SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", 1), {}
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.12.82-rc1-gf4ef43b0a8c4 #1 SMP PREEMPT_DYNAMIC Mon Apr 13 17:19:28 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.82-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.82-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
Tested on an amd64 laptop (Lenovo ThinkPad T14 Gen 1). Working well, no regressions observed.
Signature · 1 line
-Barry K. Nathan <[email protected]>
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.82-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.12:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
133 tests: 133 pass, 0 failLinux version: 6.12.82-rc1-gf4ef43b0a8c4
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra234-p3737-0000+p3701-0000, tegra30-cardhu-a04Jon
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-6.12.y
Best regards,
Pavel
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.82-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Am 13.04.2026 um 17:59 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.82-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 8 lines · On Mon, 13 Apr 2026 17:59:55 +0200 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested for loongarch64:
Of course, we still have the many missing safety comments Clippy warnings we expected from last time, i.e. the ones that we discussed recently, e.g.:
warning: unsafe block missing a safety comment
--> rust/kernel/init/macros.rs:1015:25
I hope this helps!
Cheers,
Miguel
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late.
No problems seen on x86_64 and aarch64 with our testing.
Thanks,
Harshit
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late.
test_progs, test_progs-no_alu32, test_progs-cpuv4, test_maps, test_verifier in BPF selftests all passes[1] on x86_64.
1: https://github.com/shunghsiyu/libbpf/actions/runs/24418242274/job/71333106755
[...]
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 15 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.82-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.
Quoted 5 lines
thanks,
greg k-h
-------------
Build and Boot Report 6.12.82-rc1
I built and tested Linux kernel version 6.12.82 using the default configurations on both x86_64 and arm64 architectures in a virtualized environment.
The kernel compiled successfully on both architectures and booted without issues.
I did not observe any regressions or new warnings in dmesg during boot.
Kernel version: 6.12.82-rc1
Configurations tested: x86_64_defconfig, defconfig
Architectures tested: x86_64, arm64
Kernel source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Commit: f4ef43b0a8c401bcd6d40e3eefd2ac504f23fd00
Best regards,
Dileep Malepu.
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.82-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
I just wanted to point out that the revert of "PCI: Enable ACS after configuring IOMMU for OF platforms" is missing here despite being queued in the 6.1 & 6.6 rcs (it is meant to be reverted from 6.12 as well). I noticed when updating to 6.12.82-rc1 today as I was bit by the regression (all my IOMMU groups messed up).
The revert for 6.12 is in fact here:
https://lore.kernel.org/stable/[email protected]/
but unfortunately easily missed as shown by the confusion here (same thread):
https://lore.kernel.org/stable/[email protected]/
subsequently clarified by the patch author here (also same thread):
https://lore.kernel.org/stable/5hng5r6q525scbclramuv2h2hphljbcsscwohvrs7teuedgfvl@ncr7tqhr4l4z/
Other than that 6.12.82-rc1 boots and runs fine for me on the one AMD Ryzen system I've tried it on.
Thanks,
Eddie
Greg Kroah-Hartman
maintainerQuoted 31 lines · Eddie Chapman
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.82-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
I just wanted to point out that the revert of "PCI: Enable ACS after configuring IOMMU for OF platforms" is missing here despite being queued in the 6.1 & 6.6 rcs (it is meant to be reverted from 6.12 as well). I noticed when updating to 6.12.82-rc1 today as I was bit by the regression (all my IOMMU groups messed up).
The revert for 6.12 is in fact here:
https://lore.kernel.org/stable/[email protected]/but unfortunately easily missed as shown by the confusion here (same thread):
https://lore.kernel.org/stable/[email protected]/
Quoted 5 lines
subsequently clarified by the patch author here (also same thread):
https://lore.kernel.org/stable/5hng5r6q525scbclramuv2h2hphljbcsscwohvrs7teuedgfvl@ncr7tqhr4l4z/Other than that 6.12.82-rc1 boots and runs fine for me on the one AMD Ryzen system I've tried it on.
That was not obvious at all, please don't make us dig through email threads to know what to and not to apply, it doesn't scale when dealing with the email volume we get.
Can someone resend that patch, properly marked fro 6.12, so we know to apply it there?
thanks,
greg k-h
Quoted 42 lines · Greg Kroah-Hartman
Quoted 31 lines · Eddie Chapman
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.82 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.82-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
I just wanted to point out that the revert of "PCI: Enable ACS after configuring IOMMU for OF platforms" is missing here despite being queued in the 6.1 & 6.6 rcs (it is meant to be reverted from 6.12 as well). I noticed when updating to 6.12.82-rc1 today as I was bit by the regression (all my IOMMU groups messed up).
The revert for 6.12 is in fact here:
https://lore.kernel.org/stable/[email protected]/but unfortunately easily missed as shown by the confusion here (same thread):
https://lore.kernel.org/stable/[email protected]/Quoted 5 lines
subsequently clarified by the patch author here (also same thread):
https://lore.kernel.org/stable/5hng5r6q525scbclramuv2h2hphljbcsscwohvrs7teuedgfvl@ncr7tqhr4l4z/Other than that 6.12.82-rc1 boots and runs fine for me on the one AMD Ryzen system I've tried it on.
That was not obvious at all, please don't make us dig through email threads to know what to and not to apply, it doesn't scale when dealing with the email volume we get.
Quoted 7 lines
Can someone resend that patch, properly marked fro 6.12, so we know to apply it there?
thanks,
greg k-h
Adding Manivannan Sadhasivam who is the author of the revert that is in the 5.10, 5.15, 6.1 and 6.6 queues right now.
Manivannan, not sure if you are able to provide an updated patch for 6.12 where the revert is missing right now?
FWIW I applied the patch at
https://lore.kernel.org/stable/[email protected]/
on top of 6.12.82-rc1 today and booted on an AMD system to test. It has context issues but still applies fine, and I can confirm that my IOMMU groups are no longer messed up. As a result have been able to pass through 2 separate PCI cards to 2 separate VMs which I am unable to do without the revert.