6.18.24-rc1 review
Subsystems (6)
Greg Kroah-Hartman
maintainercover 6.18.24-rc1 review
This is the start of the stable review cycle for the 6.18.24 release. There are 198 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Apr 2026 15:38:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.24-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.18.24-rc1
Leon Romanovsky <[email protected]>
dma-mapping: handle DMA_ATTR_CPU_CACHE_CLEAN in trace output
Leon Romanovsky <[email protected]>
dma-debug: Allow multiple invocations of overlapping entries
Jianhui Zhou <[email protected]>
mm/userfaultfd: fix hugetlb fault mutex hash calculation
Jeongjun Park <[email protected]>
media: hackrf: fix to not free memory after the device is registered in hackrf_probe()
Abd-Alrhman Masalkhi <[email protected]>
media: vidtv: fix pass-by-value structs causing MSAN warnings
Deepanshu Kartikey <[email protected]>
nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
Jeongjun Park <[email protected]>
media: as102: fix to not free memory after the device is registered in as102_usb_probe()
Shardul Bankar <[email protected]>
wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit
Mingzhe Zou <[email protected]>
bcache: fix cached_dev.sb_bio use-after-free and crash
Berk Cem Goksel <[email protected]>
ALSA: 6fire: fix use-after-free on disconnect
Sanman Pradhan <[email protected]>
hwmon: (powerz) Fix use-after-free on USB disconnect
Abhishek Kumar <[email protected]>
media: em28xx: fix use-after-free in em28xx_v4l2_open()
Fan Wu <[email protected]>
media: mediatek: vcodec: fix use-after-free in encoder release path
Ruslan Valiyev <[email protected]>
media: vidtv: fix nfeeds state corruption on start_streaming failure
Breno Leitao <[email protected]>
mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
Ritesh Harjani (IBM) <[email protected]>
mm/kasan: fix double free for kasan pXds
Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6apm: move component registration to unmanaged version
Sean Christopherson <[email protected]>
KVM: x86: Use scratch field in MMIO fragment to hold small write values
Linus Torvalds <[email protected]>
x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache
Linus Torvalds <[email protected]>
x86: rename and clean up __copy_from_user_inatomic_nocache()
Linus Torvalds <[email protected]>
x86-64: rename misleadingly named '__copy_user_nocache()' function
Sasha Levin <[email protected]>
checkpatch: add support for Assisted-by tag
Joseph Qi <[email protected]>
ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
Deepanshu Kartikey <[email protected]>
ocfs2: validate inline data i_size during inode read
Dmitry Antipov <[email protected]>
ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()
David Woodhouse <[email protected]>
KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs
Sean Christopherson <[email protected]>
KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay
Paul Chaignon <[email protected]>
selftests/bpf: Test refinement of single-value tnum
Sean Christopherson <[email protected]>
KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
Sean Christopherson <[email protected]>
KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish
Sean Christopherson <[email protected]>
KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created
Sean Christopherson <[email protected]>
KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock
Sean Christopherson <[email protected]>
KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU
Sean Christopherson <[email protected]>
KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test
Koichiro Den <[email protected]>
PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
Koichiro Den <[email protected]>
PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup
ZhengYuan Huang <[email protected]>
ocfs2: handle invalid dinode in ocfs2_group_extend
Tejas Bharambe <[email protected]>
ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
Joseph Qi <[email protected]>
ocfs2: fix possible deadlock between unlink and dio_end_io_write
Ruslan Valiyev <[email protected]>
media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections
Ryan Roberts <[email protected]>
arm64: mm: Handle invalid large leaf mappings correctly
Zhihao Cheng <[email protected]>
dcache: Limit the minimal number of bucket to two
Harin Lee <[email protected]>
ALSA: ctxfi: Limit PTP to a single page
SeongJae Park <[email protected]>
Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race
Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FN990A MBIM composition
Junrui Luo <[email protected]>
staging: sm750fb: fix division by zero in ps_to_hz()
Johan Hovold <[email protected]>
wifi: rtw88: fix device leak on probe failure
Tamir Duberstein <[email protected]>
scripts: generate_rust_analyzer.py: avoid FD leak
Greg Kroah-Hartman <[email protected]>
fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
Xu Yang <[email protected]>
usb: port: add delay after usb_hub_set_port_power()
Michael Zimmermann <[email protected]>
usb: gadget: f_hid: don't call cdev_init while cdev in use
Dave Carey <[email protected]>
USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen
Daniel Brát <[email protected]>
usb: storage: Expand range of matched versions for VL817 quirks entry
Alexey Charkov <[email protected]>
usb: typec: fusb302: Switch to threaded IRQ handler
Nathan Rebello <[email protected]>
usbip: validate number_of_packets in usbip_pack_ret_submit()
Stefan Metzmacher <[email protected]>
smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()
Stefan Metzmacher <[email protected]>
smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()
Greg Kroah-Hartman <[email protected]>
ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
Greg Kroah-Hartman <[email protected]>
ksmbd: require 3 sub-authorities before reading sub_auth[2]
Greg Kroah-Hartman <[email protected]>
ksmbd: validate EaNameLength in smb2_get_ea()
Greg Kroah-Hartman <[email protected]>
smb: client: fix OOB reads parsing symlink error response
Greg Kroah-Hartman <[email protected]>
smb: client: fix off-by-8 bounds check in check_wsl_eas()
Greg Kroah-Hartman <[email protected]>
usb: gadget: renesas_usb3: validate endpoint index in standard request handlers
Greg Kroah-Hartman <[email protected]>
usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
Greg Kroah-Hartman <[email protected]>
usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
Greg Kroah-Hartman <[email protected]>
fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
Greg Kroah-Hartman <[email protected]>
ALSA: fireworks: bound device-supplied status before string array lookup
Greg Kroah-Hartman <[email protected]>
ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0
Greg Kroah-Hartman <[email protected]>
drm/vc4: platform_get_irq_byname() returns an int
Greg Kroah-Hartman <[email protected]>
NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
Greg Kroah-Hartman <[email protected]>
net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
Greg Kroah-Hartman <[email protected]>
HID: core: clamp report_size in s32ton() to avoid undefined shift
Greg Kroah-Hartman <[email protected]>
HID: alps: fix NULL pointer dereference in alps_raw_event()
Lin YuChen <[email protected]>
staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
Greg Kroah-Hartman <[email protected]>
i2c: s3c24xx: check the size of the SMBUS message before using it
Samuel Page <[email protected]>
can: raw: fix ro->uniq use-after-free in raw_rcv()
Junxi Qian <[email protected]>
nfc: llcp: add missing return after LLCP_CLOSED checks
Florian Westphal <[email protected]>
netfilter: conntrack: add missing netlink policy validations
Herbert Xu <[email protected]>
crypto: algif_aead - Fix minimum RX size check for decryption
Herbert Xu <[email protected]>
crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
Thomas Gleixner <[email protected]>
clockevents: Prevent timer interrupt starvation
Peter Zijlstra <[email protected]>
sched/deadline: Use revised wakeup rule for dl_server
Zide Chen <[email protected]>
perf/x86/intel/uncore: Skip discovery table for offline dies
Douya Le <[email protected]>
crypto: af_alg - limit RX SG extraction by receive buffer budget
Samasth Norway Ananda <[email protected]>
gpio: tegra: fix irq_release_resources calling enable instead of disable
Alice Mikityanska <[email protected]>
l2tp: Drop large packets with UDP encap
Alexander Koskovich <[email protected]>
net: ipa: fix event ring index not programmed for IPA v5.0+
Alexander Koskovich <[email protected]>
net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
Li RongQing <[email protected]>
devlink: Fix incorrect skb socket family dumping
Jiexun Wang <[email protected]>
af_unix: read UNIX_DIAG_VFS data under unix_state_lock
Fabio Baltieri <[email protected]>
net: txgbe: leave space for null terminators on property_entry
Justin Iurman <[email protected]>
net: ioam6: fix OOB and missing lock
Felix Gu <[email protected]>
net: mdio: realtek-rtl9300: use scoped device_for_each_child_node loop
Syed Saba Kareem <[email protected]>
ASoC: amd: acp: update DMI quirk and add ACP DMIC for Lenovo platforms
Maciej Strozek <[email protected]>
ASoC: SDCA: Fix overwritten var within for loop
Florian Westphal <[email protected]>
netfilter: nfnetlink_queue: make hash table per queue
Scott Mitchell <[email protected]>
netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation
Zhengchuan Liang <[email protected]>
netfilter: ip6t_eui64: reject invalid MAC header for all packets
Ren Wei <[email protected]>
netfilter: xt_multiport: validate range encoding in checkentry
Xiang Mei <[email protected]>
netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
Weiming Shi <[email protected]>
ipvs: fix NULL deref in ip_vs_add_service error path
Daniel Golle <[email protected]>
selftests: net: bridge_vlan_mcast: wait for h1 before querier check
Vinay Belgaumkar <[email protected]>
drm/xe: Fix bug in idledly unit conversion
Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Fix memory leak in avs_register_i2s_test_boards()
Greg Kroah-Hartman <[email protected]>
xfrm_user: fix info leak in build_mapping()
Kotlyarov Mihail <[email protected]>
xfrm: fix refcount leak in xfrm_migrate_policy_find
Steffen Klassert <[email protected]>
xfrm: Wait for RCU readers during policy netns exit
Maciej Fijalkowski <[email protected]>
xsk: validate MTU against usable frame size on bind
Maciej Fijalkowski <[email protected]>
xsk: fix XDP_UMEM_SG_FLAG issues
Maciej Fijalkowski <[email protected]>
xsk: respect tailroom for ZC setups
Maciej Fijalkowski <[email protected]>
xsk: tighten UMEM headroom validation to account for tailroom and min frame
Agalakov Daniil <[email protected]>
e1000: check return value of e1000_read_eeprom
Michal Schmidt <[email protected]>
ixgbevf: add missing negotiate_features op to Hyper-V ops table
Aleksandr Loktionov <[email protected]>
ixgbe: stop re-reading flash on every get_drvinfo for e610
Kohei Enju <[email protected]>
ice: ptp: don't WARN when controlling PF is unavailable
Pengpeng Hou <[email protected]>
tracing/probe: reject non-closed empty immediate strings
Jon Hunter <[email protected]>
dt-bindings: net: Fix Tegra234 MGBE PTP clock
Jon Hunter <[email protected]>
net: stmmac: Fix PTP ref clock for Tegra234
Pengpeng Hou <[email protected]>
nfc: s3fwrn5: allocate rx skb before consuming bytes
Chris J Arges <[email protected]>
net: increase IP_TUNNEL_RECURSION_LIMIT to 5
Yiqi Sun <[email protected]>
ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
Fernando Fernandez Mancera <[email protected]>
ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
Fernando Fernandez Mancera <[email protected]>
ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump
Nikolaos Gkarlis <[email protected]>
rtnetlink: add missing netlink_ns_capable() check for peer netns
Zijing Yin <[email protected]>
bridge: guard local VLAN-0 FDB helpers against NULL vlan group
Eric Dumazet <[email protected]>
ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
Lorenzo Bianconi <[email protected]>
net: airoha: Fix memory leak in airoha_qdma_rx_process()
Eric Dumazet <[email protected]>
net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
Ruide Cao <[email protected]>
net: sched: act_csum: validate nested VLAN headers
Nicholas Carlini <[email protected]>
eventpoll: defer struct eventpoll free to RCU grace period
Maíra Canal <[email protected]>
drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
Maíra Canal <[email protected]>
drm/vc4: Fix a memory leak in hang state error path
Maíra Canal <[email protected]>
drm/vc4: Fix memory leak of BO array in hang state
Maíra Canal <[email protected]>
drm/vc4: Release runtime PM reference after binding V3D
Mikhail Gavrilov <[email protected]>
dma-debug: suppress cacheline overlap warning when arch has no DMA alignment requirement
Michael S. Tsirkin <[email protected]>
dma-debug: track cache clean flag in entries
Michael S. Tsirkin <[email protected]>
dma-mapping: add DMA_ATTR_CPU_CACHE_CLEAN
Keenan Dong <[email protected]>
xfrm: account XFRMA_IF_ID in aevent size calculation
Maximilian Pezzullo <[email protected]>
HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP
Long Li <[email protected]>
PCI: hv: Set default NUMA node to 0 for devices without affinity info
Mihai Sain <[email protected]>
ARM: dts: microchip: sam9x7: fix gpio-lines count for pioB
Loic Poulain <[email protected]>
arm64: dts: qcom: monaco: Reserve full Gunyah metadata region
Artem Bityutskiy <[email protected]>
tools/power turbostat: Fix --show/--hide for individual cpuidle counters
Serhii Pievniev <[email protected]>
tools/power/turbostat: Fix microcode patch level output for AMD/Hygon
Mukesh Ojha <[email protected]>
soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei
Loic Poulain <[email protected]>
arm64: dts: qcom: monaco: Fix UART10 pinconf
Markus Niebel <[email protected]>
arm64: dts: imx93-tqma9352: improve eMMC pad configuration
Markus Niebel <[email protected]>
arm64: dts: imx91-tqma9131: improve eMMC pad configuration
Luke Wang <[email protected]>
arm64: dts: imx93-9x9-qsb: change usdhc tuning step for eMMC and SD
Sebastian Krzyszkowiak <[email protected]>
arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency
Ravi Hothi <[email protected]>
arm64: dts: qcom: qcm6490-idp: Fix WCD9370 reset GPIO polarity
Daniel J Blueman <[email protected]>
arm64: dts: qcom: hamoa/x1: fix idle exit latency
Potin Lai <[email protected]>
soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching
Tomasz Merta <[email protected]>
ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
Linus Torvalds <[email protected]>
x86: shadow stacks: proper error handling for mmap lock
John Pavlick <[email protected]>
net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules
Pengpeng Hou <[email protected]>
wifi: brcmfmac: validate bsscfg indices in IF events
Arthur Husband <[email protected]>
ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
Benoît Sevens <[email protected]>
HID: roccat: fix use-after-free in roccat_report_event
songxiebing <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10
leo vriska <[email protected]>
HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
Even Xu <[email protected]>
HID: Intel-thc-hid: Intel-quickspi: Add NVL Device IDs
Mario Limonciello <[email protected]>
platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug
Andy Shevchenko <[email protected]>
pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer)
Alexander Savenko <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9
Gilson Marquato Júnior <[email protected]>
ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx
Fredric Cover <[email protected]>
fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
Donet Tom <[email protected]>
drm/amdkfd: Fix queue preemption/eviction failures by aligning control stack size to GPU page size
songxiebing <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo Yoga Slim 7 14AKP10
Phil Willoughby <[email protected]>
ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED)
Kuninori Morimoto <[email protected]>
ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list
Pengpeng Hou <[email protected]>
wifi: wl1251: validate packet IDs before indexing tx_frames
Dustin L. Howett <[email protected]>
ALSA: hda/realtek: add quirk for Framework F111:000F
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
Kshamendra Kumar Mishra <[email protected]>
ALSA: hda/realtek: add HP Laptop 15-fd0xxx mute LED quirk
Joel Fernandes <[email protected]>
srcu: Use irq_work to start GP in tiny SRCU
Donet Tom <[email protected]>
drm/amdgpu: Handle GPU page faults correctly on non-4K page systems
Pablo Neira Ayuso <[email protected]>
netfilter: ctnetlink: ensure safe access to master conntrack
César Montoya <[email protected]>
ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
Goldwyn Rodrigues <[email protected]>
btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()
Krishna Chomal <[email protected]>
platform/x86: hp-wmi: Add support for Omen 16-wf1xxx (8C76)
Filipe Manana <[email protected]>
btrfs: fix zero size inode with non-zero size after log replay
Matthew Schwartz <[email protected]>
platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP GZ302EAC
Frank Zhang <[email protected]>
ALSA:usb:qcom: add AUXILIARY_BUS to Kconfig dependencies
Hasun Park <[email protected]>
ASoC: amd: acp: add ASUS HN7306EA quirk for legacy SDW machine
Wenyuan Li <[email protected]>
can: mcp251x: add error handling for power enable in open and resume
Cássio Gabriel <[email protected]>
ASoC: SOF: topology: reject invalid vendor array size in token parser
Zhang Heng <[email protected]>
ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF
Cen Zhang <[email protected]>
Bluetooth: hci_sync: annotate data-races around hdev->req_status
Arnd Bergmann <[email protected]>
ALSA: asihpi: avoid write overflow check warning
Arnd Bergmann <[email protected]>
media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl()
Matthew Schwartz <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC
Zhang Heng <[email protected]>
ALSA: hda/realtek: add quirk for Lenovo Yoga 7 2-in-1 16AKP10
Andrii Kovalchuk <[email protected]>
ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk
Vee Satayamas <[email protected]>
ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA
Jacob Moroni <[email protected]>
RDMA/irdma: Fix double free related to rereg_user_mr
Vinicius Costa Gomes <[email protected]>
dmaengine: idxd: Fix lockdep warnings when calling idxd_device_config()
-------------
Diffstat:
Documentation/admin-guide/mm/damon/reclaim.rst | 4 + .../bindings/net/nvidia,tegra234-mgbe.yaml | 4 +- Makefile | 4 +- arch/arm/boot/dts/microchip/sam9x7.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx91-tqma9131.dtsi | 20 +- arch/arm64/boot/dts/freescale/imx93-9x9-qsb.dts | 2 + arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 26 +-- arch/arm64/boot/dts/qcom/qcm6490-idp.dts | 2 +- arch/arm64/boot/dts/qcom/qcs8300.dtsi | 9 +- arch/arm64/boot/dts/qcom/x1e80100.dtsi | 2 +- arch/arm64/include/asm/pgtable-prot.h | 2 + arch/arm64/include/asm/pgtable.h | 9 +- arch/arm64/include/asm/uaccess.h | 2 +- arch/arm64/kvm/guest.c | 4 +- arch/arm64/mm/mmu.c | 4 + arch/arm64/mm/pageattr.c | 50 ++--- arch/arm64/mm/trans_pgd.c | 42 +--- arch/loongarch/kvm/vcpu.c | 2 +- arch/loongarch/kvm/vm.c | 2 +- arch/mips/kvm/mips.c | 4 +- arch/powerpc/include/asm/uaccess.h | 3 +- arch/powerpc/kvm/book3s.c | 4 +- arch/powerpc/kvm/booke.c | 4 +- arch/powerpc/lib/pmem.c | 11 +- arch/riscv/kvm/vcpu.c | 2 +- arch/riscv/kvm/vm.c | 2 +- arch/s390/kvm/kvm-s390.c | 4 +- arch/x86/events/intel/uncore_discovery.c | 2 +- arch/x86/include/asm/uaccess.h | 2 +- arch/x86/include/asm/uaccess_32.h | 8 +- arch/x86/include/asm/uaccess_64.h | 16 +- arch/x86/include/uapi/asm/kvm.h | 12 +- arch/x86/kernel/shstk.c | 3 +- arch/x86/kvm/svm/sev.c | 46 +++-- arch/x86/kvm/x86.c | 18 +- arch/x86/lib/copy_user_uncached_64.S | 6 +- arch/x86/lib/usercopy_32.c | 9 +- arch/x86/lib/usercopy_64.c | 12 +- crypto/af_alg.c | 6 +- crypto/algif_aead.c | 2 +- crypto/algif_skcipher.c | 5 + drivers/ata/ahci.c | 14 ++ drivers/dma/idxd/device.c | 17 +- drivers/dma/idxd/init.c | 10 +- drivers/gpio/gpio-tegra.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 7 +- drivers/gpu/drm/i915/i915_gem.c | 2 +- drivers/gpu/drm/qxl/qxl_ioctl.c | 2 +- drivers/gpu/drm/vc4/vc4_bo.c | 3 + drivers/gpu/drm/vc4/vc4_gem.c | 19 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 14 +- drivers/gpu/drm/vc4/vc4_v3d.c | 1 + drivers/gpu/drm/xe/xe_hw_engine.c | 3 +- drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 3 +- drivers/hid/hid-alps.c | 3 + drivers/hid/hid-core.c | 3 + drivers/hid/hid-ids.h | 3 + drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-roccat.c | 2 + .../intel-thc-hid/intel-quickspi/pci-quickspi.c | 6 + .../intel-thc-hid/intel-quickspi/quickspi-dev.h | 2 + drivers/hwmon/powerz.c | 8 +- drivers/i2c/busses/i2c-s3c2410.c | 7 +- drivers/infiniband/hw/irdma/verbs.c | 1 + drivers/infiniband/sw/rdmavt/qp.c | 8 +- drivers/md/bcache/super.c | 7 + .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 9 + .../media/platform/rockchip/rkvdec/rkvdec-vp9.c | 3 +- drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_ts.c | 48 ++--- drivers/media/test-drivers/vidtv/vidtv_ts.h | 4 +- drivers/media/usb/as102/as102_usb_drv.c | 2 + drivers/media/usb/em28xx/em28xx-video.c | 14 +- drivers/media/usb/hackrf/hackrf.c | 7 +- drivers/net/can/spi/mcp251x.c | 29 ++- drivers/net/ethernet/airoha/airoha_eth.c | 3 +- drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +- drivers/net/ethernet/intel/ice/ice_ptp.c | 8 +- drivers/net/ethernet/intel/ixgbe/devlink/devlink.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe.h | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 13 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 10 + drivers/net/ethernet/intel/ixgbevf/vf.c | 7 + drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c | 19 +- drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 8 +- drivers/net/ipa/reg/gsi_reg-v5.0.c | 9 +- drivers/net/mdio/mdio-realtek-rtl9300.c | 3 +- drivers/net/phy/sfp.c | 16 ++ drivers/net/usb/cdc-phonet.c | 7 +- drivers/net/wan/lapbether.c | 13 +- drivers/net/wireguard/device.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 + drivers/net/wireless/realtek/rtw88/usb.c | 3 +- drivers/net/wireless/ti/wl1251/tx.c | 8 +- drivers/nfc/s3fwrn5/uart.c | 10 +- drivers/ntb/ntb_transport.c | 7 +- drivers/pci/controller/pci-hyperv.c | 8 + drivers/pci/endpoint/functions/pci-epf-vntb.c | 20 +- drivers/pinctrl/intel/pinctrl-intel.c | 2 +- drivers/platform/x86/amd/pmc/pmc-quirks.c | 9 + drivers/platform/x86/asus-nb-wmi.c | 2 +- drivers/platform/x86/hp/hp-wmi.c | 4 + drivers/soc/aspeed/aspeed-socinfo.c | 2 +- drivers/soc/qcom/pdr_internal.h | 2 +- drivers/soc/qcom/qcom_pdr_msg.c | 2 +- drivers/staging/rtl8723bs/core/rtw_security.c | 2 +- drivers/staging/sm750fb/sm750.c | 3 + drivers/usb/class/cdc-acm.c | 53 ++++- drivers/usb/core/port.c | 1 + drivers/usb/gadget/function/f_hid.c | 15 +- drivers/usb/gadget/function/f_ncm.c | 4 +- drivers/usb/gadget/function/f_phonet.c | 9 + drivers/usb/gadget/udc/renesas_usb3.c | 7 +- drivers/usb/serial/option.c | 2 + drivers/usb/storage/unusual_devs.h | 7 +- drivers/usb/typec/tcpm/fusb302.c | 5 +- drivers/usb/usbip/usbip_common.c | 12 ++ drivers/video/fbdev/tdfxfb.c | 3 + drivers/video/fbdev/udlfb.c | 3 + fs/btrfs/tree-log.c | 98 ++++++---- fs/dcache.c | 4 +- fs/eventpoll.c | 6 +- fs/nilfs2/dat.c | 3 + fs/ocfs2/aops.c | 3 +- fs/ocfs2/inode.c | 31 +++ fs/ocfs2/mmap.c | 7 +- fs/ocfs2/ocfs2_trace.h | 10 +- fs/ocfs2/resize.c | 10 +- fs/smb/client/fs_context.c | 4 + fs/smb/client/smb2file.c | 20 +- fs/smb/client/smb2inode.c | 2 +- fs/smb/client/smbdirect.c | 8 + fs/smb/server/connection.c | 1 + fs/smb/server/smb2pdu.c | 7 +- fs/smb/server/smbacl.c | 3 +- fs/smb/server/transport_rdma.c | 8 +- include/linux/clockchips.h | 2 + include/linux/dma-mapping.h | 7 + include/linux/hugetlb.h | 17 ++ include/linux/kvm_host.h | 93 +++++---- include/linux/mmap_lock.h | 6 +- include/linux/soc/qcom/pdr.h | 1 + include/linux/srcutiny.h | 4 + include/linux/uaccess.h | 11 +- include/net/ip_tunnels.h | 2 +- include/net/netfilter/nf_conntrack_core.h | 5 + include/net/netfilter/nf_queue.h | 1 - include/net/xdp_sock.h | 2 +- include/net/xdp_sock_drv.h | 23 ++- include/trace/events/btrfs.h | 11 +- include/trace/events/dma.h | 3 +- include/uapi/linux/kvm.h | 19 +- kernel/dma/debug.c | 35 +++- kernel/rcu/srcutiny.c | 19 +- kernel/sched/deadline.c | 2 +- kernel/time/clockevents.c | 27 ++- kernel/time/hrtimer.c | 1 + kernel/time/tick-broadcast.c | 8 +- kernel/time/tick-common.c | 1 + kernel/time/tick-sched.c | 1 + kernel/trace/trace_probe.c | 2 +- lib/iov_iter.c | 4 +- mm/backing-dev.c | 5 +- mm/kasan/init.c | 8 +- mm/userfaultfd.c | 2 +- net/bluetooth/hci_conn.c | 2 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_sync.c | 20 +- net/bridge/br_fdb.c | 6 + net/can/raw.c | 11 +- net/core/rtnetlink.c | 40 ++-- net/devlink/health.c | 2 +- net/ipv4/icmp.c | 7 + net/ipv4/nexthop.c | 41 ++-- net/ipv6/ioam6.c | 33 ++-- net/ipv6/netfilter/ip6t_eui64.c | 3 +- net/l2tp/l2tp_core.c | 5 + net/netfilter/ipvs/ip_vs_ctl.c | 1 - net/netfilter/nf_conntrack_ecache.c | 2 + net/netfilter/nf_conntrack_expect.c | 10 +- net/netfilter/nf_conntrack_netlink.c | 30 ++- net/netfilter/nf_conntrack_proto_sctp.c | 3 +- net/netfilter/nfnetlink_log.c | 8 +- net/netfilter/nfnetlink_queue.c | 214 ++++++++------------- net/netfilter/nft_set_pipapo_avx2.c | 20 +- net/netfilter/xt_multiport.c | 34 +++- net/nfc/digital_technology.c | 6 + net/nfc/llcp_core.c | 2 + net/sched/act_csum.c | 6 +- net/unix/diag.c | 21 +- net/xdp/xdp_umem.c | 3 +- net/xdp/xsk.c | 4 +- net/xdp/xsk_buff_pool.c | 32 ++- net/xfrm/xfrm_policy.c | 5 +- net/xfrm/xfrm_user.c | 11 +- scripts/checkpatch.pl | 10 + scripts/generate_rust_analyzer.py | 3 +- sound/firewire/fireworks/fireworks_command.c | 5 +- sound/hda/codecs/realtek/alc269.c | 13 ++ sound/pci/asihpi/hpimsgx.c | 6 +- sound/pci/ctxfi/ctvmem.h | 2 +- sound/soc/amd/acp/acp-sdw-legacy-mach.c | 16 +- sound/soc/amd/yc/acp6x-mach.c | 21 ++ sound/soc/intel/avs/board_selection.c | 9 +- sound/soc/qcom/qdsp6/q6apm.c | 14 +- sound/soc/sdca/sdca_interrupts.c | 4 +- sound/soc/soc-core.c | 1 + sound/soc/sof/topology.c | 2 +- sound/soc/stm/stm32_sai_sub.c | 3 + sound/usb/6fire/chip.c | 17 +- sound/usb/Kconfig | 1 + sound/usb/quirks.c | 2 + sound/usb/usx2y/us144mkii.c | 6 +- tools/objtool/check.c | 2 +- tools/power/x86/turbostat/turbostat.c | 44 +++-- .../testing/selftests/bpf/progs/verifier_bounds.c | 137 +++++++++++++ .../testing/selftests/kvm/x86/sev_migrate_tests.c | 2 - .../selftests/net/forwarding/bridge_vlan_mcast.sh | 1 + virt/kvm/binary_stats.c | 2 +- virt/kvm/kvm_main.c | 20 +- 224 files changed, 1675 insertions(+), 802 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/198 dmaengine: idxd: Fix lockdep warnings when calling idxd_device_config()
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinicius Costa Gomes <[email protected]>
[ Upstream commit caf91cdf2de8b7134749d32cd4ae5520b108abb7 ]
Move the check for IDXD_FLAG_CONFIGURABLE and the locking to "inside" idxd_device_config(), as this is common to all callers, and the one that wasn't holding the lock was an error (that was causing the lockdep warning).
--- drivers/dma/idxd/device.c | 17 +++++++---------- drivers/dma/idxd/init.c | 10 ++++------ 2 files changed, 11 insertions(+), 16 deletions(-)
drivers/dma/idxd/device.c +7 -10
@@ -1106,7 +1106,11 @@ int idxd_device_config(struct idxd_device *idxd) {int rc; -lockdep_assert_held (&idxd->dev_lock); +guard (spinlock)(&idxd->dev_lock); + +if (!test_bit (IDXD_FLAG_CONFIGURABLE , &idxd->flags)) +return 0 ; + rc =idxd_wqs_setup (idxd);if (rc <0 )return rc;
@@ -1433,11 +1437,7 @@ int idxd_drv_enable_wq(struct idxd_wq *wq) } } - rc =0 ; -spin_lock (&idxd->dev_lock); -if (test_bit (IDXD_FLAG_CONFIGURABLE , &idxd->flags)) - rc =idxd_device_config (idxd); -spin_unlock (&idxd->dev_lock); + rc =idxd_device_config (idxd);if (rc <0 ) {dev_dbg (dev,"Writing wq %d config failed: %d\n" , wq->id, rc); goto err;
@@ -1532,10 +1532,7 @@ int idxd_device_drv_probe(struct idxd_dev *idxd_dev) }/* Device configuration */ -spin_lock (&idxd->dev_lock); -if (test_bit (IDXD_FLAG_CONFIGURABLE , &idxd->flags)) - rc =idxd_device_config (idxd); -spin_unlock (&idxd->dev_lock); + rc =idxd_device_config (idxd);if (rc <0 )return -ENXIO ;
drivers/dma/idxd/init.c +4 -6
@@ -1094,12 +1094,10 @@ static void idxd_reset_done(struct pci_dev *pdev)idxd_device_config_restore (idxd, idxd->idxd_saved);/* Re-configure IDXD device if allowed. */ -if (test_bit (IDXD_FLAG_CONFIGURABLE , &idxd->flags)) { - rc =idxd_device_config (idxd); -if (rc <0 ) { -dev_err (dev,"HALT: %s config fails\n" , idxd_name); - goto out; - } + rc =idxd_device_config (idxd); +if (rc <0 ) { +dev_err (dev,"HALT: %s config fails\n" , idxd_name); + goto out; }/* Bind IDXD device to driver. */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 2/198 RDMA/irdma: Fix double free related to rereg_user_mr
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <[email protected]>
[ Upstream commit 29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2 ]
If IB_MR_REREG_TRANS is set during rereg_user_mr, the umem will be released and a new one will be allocated in irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans fails after the new umem is allocated, it releases the umem, but does not set iwmr->region to NULL. The problem is that this failure is propagated to the user, who will then call ibv_dereg_mr (as they should). Then, the dereg_mr path will see a non-NULL umem and attempt to call ib_umem_release again.
Fix this by setting iwmr->region to NULL after ib_umem_release.
Fixed: 5ac388db27c4 ("RDMA/irdma: Add support to re-register a memory region")
--- drivers/infiniband/hw/irdma/verbs.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/irdma/verbs.c +1 -0
@@ -3714,6 +3714,7 @@ static int irdma_rereg_mr_trans(struct irdma_mr *iwmr, u64 start, u64 len, err:ib_umem_release (region); + iwmr->region =NULL ;return err; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 3/198 ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vee Satayamas <[email protected]>
[ Upstream commit f200b2f9a810c440c6750b56fc647b73337749a1 ]
Add a DMI quirk for the Asus Expertbook BM1403CDA to resolve the issue of the internal microphone not being detected.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -717,6 +717,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_BOARD_NAME, "PM1503CDA"), } }, + { + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_BOARD_NAME, "BM1403CDA"), + } + }, {} };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 4/198 ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Kovalchuk <[email protected]>
[ Upstream commit 793b008cd39516385791a1d1d223d817e947a471 ]
Add a PCI quirk for HP ENVY Laptop 13-ba0xxx (PCI device ID 0x8756) to enable proper mute LED and mic mute behavior using the ALC245_FIXUP_HP_X360_MUTE_LEDS fixup.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -6732,6 +6732,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x8730 ,"HP ProBook 445 G7" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ),SND_PCI_QUIRK (0x103c ,0x8735 ,"HP ProBook 435 G7" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ),SND_PCI_QUIRK (0x103c ,0x8736 ,"HP" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ), +SND_PCI_QUIRK (0x103c ,0x8756 ,"HP ENVY Laptop 13-ba0xxx" ,ALC245_FIXUP_HP_X360_MUTE_LEDS ),SND_PCI_QUIRK (0x103c ,0x8760 ,"HP EliteBook 8{4,5}5 G7" ,ALC285_FIXUP_HP_BEEP_MICMUTE_LED ),SND_PCI_QUIRK (0x103c ,0x876e ,"HP ENVY x360 Convertible 13-ay0xxx" ,ALC245_FIXUP_HP_X360_MUTE_LEDS ), SND_PCI_QUIRK(0x103c, 0x877a, "HP", ALC285_FIXUP_HP_MUTE_LED),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 5/198 ALSA: hda/realtek: add quirk for Lenovo Yoga 7 2-in-1 16AKP10
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <[email protected]>
[ Upstream commit 7bae956cac0433c4d41aac9f1d04e42694e0b706 ]
This machine is equipped with ALC287 and requires the quirk ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN to fix the issue where the bass speakers are not configured and the speaker volume cannot be controlled.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -7429,6 +7429,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x38ab ,"Thinkbook 16P" ,ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD ),SND_PCI_QUIRK (0x17aa ,0x38b4 ,"Legion Slim 7 16IRH8" ,ALC287_FIXUP_CS35L41_I2C_2 ),HDA_CODEC_QUIRK (0x17aa ,0x391c ,"Lenovo Yoga 7 2-in-1 14AKP10" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ), +HDA_CODEC_QUIRK (0x17aa ,0x391d ,"Lenovo Yoga 7 2-in-1 16AKP10" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ),SND_PCI_QUIRK (0x17aa ,0x38b5 ,"Legion Slim 7 16IRH8" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x17aa ,0x38b6 ,"Legion Slim 7 16APH8" ,ALC287_FIXUP_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x17aa, 0x38b7, "Legion Slim 7 16APH8", ALC287_FIXUP_CS35L41_I2C_2),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 6/198 ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Schwartz <[email protected]>
[ Upstream commit 59f68dc1d8df3142cb58fd2568966a9bb7b0ed8a ]
Fixes lack of audio output on the ASUS ROG Flow Z13-KJP GZ302EAC model, similar to the ASUS ROG Flow Z13 GZ302EA.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -7065,6 +7065,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x14e3 ,"ASUS G513PI/PU/PV" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x1043 ,0x14f2 ,"ASUS VivoBook X515JA" ,ALC256_FIXUP_ASUS_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1043 ,0x1503 ,"ASUS G733PY/PZ/PZV/PYV" ,ALC287_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x1043 ,0x1514 ,"ASUS ROG Flow Z13 GZ302EAC" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x1043 ,0x1517 ,"Asus Zenbook UX31A" ,ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A ),SND_PCI_QUIRK (0x1043 ,0x1533 ,"ASUS GV302XA/XJ/XQ/XU/XV/XI" ,ALC287_FIXUP_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x1043, 0x1573, "ASUS GZ301VV/VQ/VU/VJ/VA/VC/VE/VVC/VQC/VUC/VJC/VEC/VCC", ALC285_FIXUP_ASUS_HEADSET_MIC),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 7/198 media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit c03b7dec3c4ddc97872fa12bfca75bae9cb46510 ]
The deeply nested loop in rkvdec_init_v4l2_vp9_count_tbl() needs a lot of registers, so when the clang register allocator runs out, it ends up spilling countless temporaries to the stack:
drivers/media/platform/rockchip/rkvdec/rkvdec-vp9.c:966:12: error: stack frame size (1472) exceeds limit (1280) in 'rkvdec_vp9_start' [-Werror,-Wframe-larger-than]
Marking this function as noinline_for_stack keeps it out of rkvdec_vp9_start(), giving the compiler more room for optimization.
The resulting code is good enough that both the total stack usage and the loop get enough better to stay under the warning limit, though it's still slow, and would need a larger rework if this function ends up being called in a fast path.
--- drivers/media/platform/rockchip/rkvdec/rkvdec-vp9.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/media/platform/rockchip/rkvdec/rkvdec-vp9.c +2 -1
@@ -923,7 +923,8 @@ static void rkvdec_vp9_done(struct rkvdec_ctx *ctx,update_ctx_last_info (vp9_ctx); } -static void rkvdec_init_v4l2_vp9_count_tbl (struct rkvdec_ctx *ctx) +static noinline_for_stack void +rkvdec_init_v4l2_vp9_count_tbl (struct rkvdec_ctx *ctx) {struct rkvdec_vp9_ctx *vp9_ctx = ctx->priv;struct rkvdec_vp9_intra_frame_symbol_counts *intra_cnts = vp9_ctx->count_tbl.cpu;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 8/198 ALSA: asihpi: avoid write overflow check warning
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 591721223be9e28f83489a59289579493b8e3d83 ]
clang-22 rightfully warns that the memcpy() in adapter_prepare() copies between different structures, crossing the boundary of nested structures inside it:
In file included from sound/pci/asihpi/hpimsgx.c:13:
In file included from include/linux/string.h:386:include/linux/fortify-string.h:569:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning]
569 | __write_overflow_field(p_size_field, size);
The two structures seem to refer to the same layout, despite the separate definitions, so the code is in fact correct.
Avoid the warning by copying the two inner structures separately. I see the same pattern happens in other functions in the same file, so there is a chance that this may come back in the future, but this instance is the only one that I saw in practice, hitting it multiple times per day in randconfig build.
--- sound/pci/asihpi/hpimsgx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/pci/asihpi/hpimsgx.c +4 -2
@@ -581,8 +581,10 @@ static u16 adapter_prepare(u16 adapter) HPI_ADAPTER_OPEN); hm.adapter_index = adapter;hw_entry_point (&hm, &hr); -memcpy (&rESP_HPI_ADAPTER_OPEN[adapter], &hr, -sizeof (rESP_HPI_ADAPTER_OPEN[0 ])); +memcpy (&rESP_HPI_ADAPTER_OPEN[adapter].h, &hr, +sizeof (rESP_HPI_ADAPTER_OPEN[adapter].h)); +memcpy (&rESP_HPI_ADAPTER_OPEN[adapter].a, &hr.u.ax.info, +sizeof (rESP_HPI_ADAPTER_OPEN[adapter].a));if (hr.error)return hr.error;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 9/198 Bluetooth: hci_sync: annotate data-races around hdev->req_status
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <[email protected]>
[ Upstream commit b6807cfc195ef99e1ac37b2e1e60df40295daa8c ]
__hci_cmd_sync_sk() sets hdev->req_status under hdev->req_lock:
hdev->req_status = HCI_REQ_PEND;
However, several other functions read or write hdev->req_status without holding any lock:
- hci_send_cmd_sync() reads req_status in hci_cmd_work (workqueue)
- hci_cmd_sync_complete() reads/writes from HCI event completion
- hci_cmd_sync_cancel() / hci_cmd_sync_cancel_sync() read/write
- hci_abort_conn() reads in connection abort path
Since __hci_cmd_sync_sk() runs on hdev->req_workqueue while hci_send_cmd_sync() runs on hdev->workqueue, these are different workqueues that can execute concurrently on different CPUs. The plain C accesses constitute a data race.
Add READ_ONCE()/WRITE_ONCE() annotations on all concurrent accesses to hdev->req_status to prevent potential compiler optimizations that could affect correctness (e.g., load fusing in the wait_event condition or store reordering).
--- net/bluetooth/hci_conn.c | 2 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_sync.c | 20 ++++++++++---------- 3 files changed, 12 insertions(+), 12 deletions(-)
net/bluetooth/hci_conn.c +1 -1
@@ -2967,7 +2967,7 @@ int hci_abort_conn(struct hci_conn *conn, u8 reason)* hci_connect_le serializes the connection attempts so only one * connection can be in BT_CONNECT at time. */ -if (conn->state ==BT_CONNECT && hdev->req_status ==HCI_REQ_PEND ) { +if (conn->state ==BT_CONNECT &&READ_ONCE (hdev->req_status) ==HCI_REQ_PEND ) {switch (hci_skb_event (hdev->sent_cmd)) {case HCI_EV_CONN_COMPLETE :case HCI_EV_LE_CONN_COMPLETE :
net/bluetooth/hci_core.c +1 -1
@@ -4125,7 +4125,7 @@ static int hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb)kfree_skb (skb); } -if (hdev->req_status ==HCI_REQ_PEND && +if (READ_ONCE (hdev->req_status) ==HCI_REQ_PEND && !hci_dev_test_and_set_flag (hdev,HCI_CMD_PENDING )) {kfree_skb (hdev->req_skb); hdev->req_skb =skb_clone (hdev->sent_cmd,GFP_KERNEL );
net/bluetooth/hci_sync.c +10 -10
@@ -25,11 +25,11 @@ static void hci_cmd_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode, {bt_dev_dbg (hdev,"result 0x%2.2x" , result); -if (hdev->req_status !=HCI_REQ_PEND ) +if (READ_ONCE (hdev->req_status) !=HCI_REQ_PEND )return ; hdev->req_result = result; - hdev->req_status =HCI_REQ_DONE ; +WRITE_ONCE (hdev->req_status,HCI_REQ_DONE );/* Free the request command so it is not used as response */ kfree_skb (hdev->req_skb);
@@ -167,20 +167,20 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen,hci_cmd_sync_add (&req, opcode, plen, param, event, sk); - hdev->req_status =HCI_REQ_PEND ; +WRITE_ONCE (hdev->req_status,HCI_REQ_PEND ); err =hci_req_sync_run (&req);if (err <0 )return ERR_PTR (err); err =wait_event_interruptible_timeout (hdev->req_wait_q, - hdev->req_status !=HCI_REQ_PEND , +READ_ONCE (hdev->req_status) !=HCI_REQ_PEND , timeout);if (err == -ERESTARTSYS )return ERR_PTR (-EINTR ); -switch (hdev->req_status) { +switch (READ_ONCE (hdev->req_status)) {case HCI_REQ_DONE : err = -bt_to_errno (hdev->req_result);break ;
@@ -194,7 +194,7 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen,break ; } - hdev->req_status =0 ; +WRITE_ONCE (hdev->req_status,0 ); hdev->req_result =0 ; skb = hdev->req_rsp; hdev->req_rsp =NULL ;
@@ -665,9 +665,9 @@ void hci_cmd_sync_cancel(struct hci_dev *hdev, int err) {bt_dev_dbg (hdev,"err 0x%2.2x" , err); -if (hdev->req_status ==HCI_REQ_PEND ) { +if (READ_ONCE (hdev->req_status) ==HCI_REQ_PEND ) { hdev->req_result = err; - hdev->req_status =HCI_REQ_CANCELED ; +WRITE_ONCE (hdev->req_status,HCI_REQ_CANCELED );queue_work (hdev->workqueue, &hdev->cmd_sync_cancel_work); }
@@ -683,12 +683,12 @@ void hci_cmd_sync_cancel_sync(struct hci_dev *hdev, int err) {bt_dev_dbg (hdev,"err 0x%2.2x" , err); -if (hdev->req_status ==HCI_REQ_PEND ) { +if (READ_ONCE (hdev->req_status) ==HCI_REQ_PEND ) {/* req_result is __u32 so error must be positive to be properly * propagated. */ hdev->req_result = err <0 ? -err : err; - hdev->req_status =HCI_REQ_CANCELED ; +WRITE_ONCE (hdev->req_status,HCI_REQ_CANCELED );wake_up_interruptible (&hdev->req_wait_q); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 10/198 ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <[email protected]>
[ Upstream commit 1f182ec9d7084db7dfdb2372d453c28f0e5c3f0a ]
Add a DMI quirk for the Thin A15 B7VF fixing the issue where the internal microphone was not detected.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -724,6 +724,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_BOARD_NAME, "BM1403CDA"), } }, + { + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "Micro-Star International Co., Ltd."), + DMI_MATCH(DMI_PRODUCT_NAME, "Thin A15 B7VE"), + } + }, {} };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 11/198 ASoC: SOF: topology: reject invalid vendor array size in token parser
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
[ Upstream commit 215e5fe75881a7e2425df04aeeed47a903d5cd5d ]
sof_parse_token_sets() accepts array->size values that can be invalid for a vendor tuple array header. In particular, a zero size does not advance the parser state and can lead to non-progress parsing on malformed topology data.
Validate array->size against the minimum header size and reject values smaller than sizeof(*array) before parsing. This preserves behavior for valid topologies and hardens malformed-input handling.
--- sound/soc/sof/topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/sof/topology.c +1 -1
@@ -736,7 +736,7 @@ static int sof_parse_token_sets(struct snd_soc_component *scomp, asize =le32_to_cpu (array->size);/* validate asize */ -if (asize <0 ) {/* FIXME: A zero-size array makes no sense */ +if (asize <sizeof (*array)) {dev_err (scomp->dev,"error: invalid array size 0x%x\n" , asize);return -EINVAL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 12/198 can: mcp251x: add error handling for power enable in open and resume
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenyuan Li <[email protected]>
[ Upstream commit 7a57354756c7df223abe2c33774235ad70cb4231 ]
Add missing error handling for mcp251x_power_enable() calls in both mcp251x_open() and mcp251x_can_resume() functions.
In mcp251x_open(), if power enable fails, jump to error path to close candev without attempting to disable power again.
In mcp251x_can_resume(), properly check return values of power enable calls for both power and transceiver regulators. If any fails, return the error code to the PM framework and log the failure.
This ensures the driver properly handles power control failures and maintains correct device state.
--- drivers/net/can/spi/mcp251x.c | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-)
drivers/net/can/spi/mcp251x.c +24 -5
@@ -1225,7 +1225,11 @@ static int mcp251x_open(struct net_device *net) }mutex_lock (&priv->mcp_lock); -mcp251x_power_enable (priv->transceiver,1 ); + ret =mcp251x_power_enable (priv->transceiver,1 ); +if (ret) { +dev_err (&spi->dev,"failed to enable transceiver power: %pe\n" ,ERR_PTR (ret)); + goto out_close_candev; + } priv->force_quit =0 ; priv->tx_skb =NULL ;
@@ -1272,6 +1276,7 @@ static int mcp251x_open(struct net_device *net)mcp251x_hw_sleep (spi); out_close:mcp251x_power_enable (priv->transceiver,0 ); +out_close_candev:close_candev (net);mutex_unlock (&priv->mcp_lock);if (release_irq)
@@ -1508,11 +1513,25 @@ static int __maybe_unused mcp251x_can_resume(struct device *dev) {struct spi_device *spi =to_spi_device (dev);struct mcp251x_priv *priv =spi_get_drvdata (spi); +int ret =0 ; -if (priv->after_suspend &AFTER_SUSPEND_POWER ) -mcp251x_power_enable (priv->power,1 ); -if (priv->after_suspend &AFTER_SUSPEND_UP ) -mcp251x_power_enable (priv->transceiver,1 ); +if (priv->after_suspend &AFTER_SUSPEND_POWER ) { + ret =mcp251x_power_enable (priv->power,1 ); +if (ret) { +dev_err (dev,"failed to restore power: %pe\n" ,ERR_PTR (ret)); +return ret; + } + } + +if (priv->after_suspend &AFTER_SUSPEND_UP ) { + ret =mcp251x_power_enable (priv->transceiver,1 ); +if (ret) { +dev_err (dev,"failed to restore transceiver power: %pe\n" ,ERR_PTR (ret)); +if (priv->after_suspend &AFTER_SUSPEND_POWER ) +mcp251x_power_enable (priv->power,0 ); +return ret; + } + }if (priv->after_suspend & (AFTER_SUSPEND_POWER |AFTER_SUSPEND_UP ))queue_work (priv->wq, &priv->restart_work);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 13/198 ASoC: amd: acp: add ASUS HN7306EA quirk for legacy SDW machine
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hasun Park <[email protected]>
[ Upstream commit 2594196f4e3bd70782e7cf1e22e3e398cdb74f78 ]
Add a DMI quirk entry for ASUS HN7306EA in the ACP SoundWire legacy machine driver.
Set driver_data to ASOC_SDW_ACP_DMIC for this board so the platform-specific DMIC quirk path is selected.
--- sound/soc/amd/acp/acp-sdw-legacy-mach.c | 8 ++++++++ 1 file changed, 8 insertions(+)
sound/soc/amd/acp/acp-sdw-legacy-mach.c +8 -0
@@ -111,6 +111,14 @@ static const struct dmi_system_id soc_sdw_quirk_table[] = { }, .driver_data = (void *)(ASOC_SDW_CODEC_SPKR), }, + { + .callback = soc_sdw_quirk_cb, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "HN7306EA"), + }, + .driver_data = (void *)(ASOC_SDW_ACP_DMIC), + }, {} };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 14/198 ALSA:usb:qcom: add AUXILIARY_BUS to Kconfig dependencies
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Zhang <[email protected]>
[ Upstream commit b8bee48e38f2ddbdba5e58bc54ef54bb7d8d341b ]
The build can fail with:
ERROR: modpost: "__auxiliary_driver_register"
[sound/usb/qcom/snd-usb-audio-qmi.ko] undefined!
ERROR: modpost: "auxiliary_driver_unregister"
[sound/usb/qcom/snd-usb-audio-qmi.ko] undefined!
Select AUXILIARY_BUS when SND_USB_AUDIO_QMI is enabled.
--- sound/usb/Kconfig | 1 + 1 file changed, 1 insertion(+)
sound/usb/Kconfig +1 -0
@@ -192,6 +192,7 @@ config SND_USB_AUDIO_QMI tristate "Qualcomm Audio Offload driver" depends on QCOM_QMI_HELPERS && SND_USB_AUDIO && SND_SOC_USB depends on USB_XHCI_HCD && USB_XHCI_SIDEBAND + select AUXILIARY_BUS help Say Y here to enable the Qualcomm USB audio offloading feature.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 15/198 platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP GZ302EAC
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Schwartz <[email protected]>
[ Upstream commit 0198d2743207d67f995cd6df89e267e1b9f5e1f1 ]
The ASUS ROG Flow Z13-KJP GZ302EAC model uses sys_vendor name ASUS rather than ASUSTeK COMPUTER INC., but it needs the same folio quirk as the other ROG Flow Z13. To keep things simple, just match on sys_vendor ASUS since it covers both.
--- drivers/platform/x86/asus-nb-wmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/asus-nb-wmi.c +1 -1
@@ -548,7 +548,7 @@ static const struct dmi_system_id asus_quirks[] = { .callback = dmi_matched, .ident = "ASUS ROG Z13", .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), +DMI_MATCH (DMI_SYS_VENDOR ,"ASUS" ), DMI_MATCH(DMI_PRODUCT_NAME, "ROG Flow Z13"), }, .driver_data = &quirk_asus_z13,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 16/198 btrfs: fix zero size inode with non-zero size after log replay
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 5254d4181add9dfaa5e3519edd71cc8f752b2f85 ]
When logging that an inode exists, as part of logging a new name or logging new dir entries for a directory, we always set the generation of the logged inode item to 0. This is to signal during log replay (in overwrite_item()), that we should not set the i_size since we only logged that an inode exists, so the i_size of the inode in the subvolume tree must be preserved (as when we log new names or that an inode exists, we don't log extents).
This works fine except when we have already logged an inode in full mode or it's the first time we are logging an inode created in a past transaction, that inode has a new i_size of 0 and then we log a new name for the inode (due to a new hardlink or a rename), in which case we log an i_size of 0 for the inode and a generation of 0, which causes the log replay code to not update the inode's i_size to 0 (in overwrite_item()).
An example scenario:
mkdir /mnt/dir
xfs_io -f -c "pwrite 0 64K" /mnt/dir/foo
sync
xfs_io -c "truncate 0" -c "fsync" /mnt/dir/foo
ln /mnt/dir/foo /mnt/dir/bar
xfs_io -c "fsync" /mnt/dir
<power fail>
After log replay the file remains with a size of 64K. This is because when we first log the inode, when we fsync file foo, we log its current i_size of 0, and then when we create a hard link we log again the inode in exists mode (LOG_INODE_EXISTS) but we set a generation of 0 for the inode item we add to the log tree, so during log replay overwrite_item() sees that the generation is 0 and i_size is 0 so we skip updating the inode's i_size from 64K to 0.
Fix this by making sure at fill_inode_item() we always log the real generation of the inode if it was logged in the current transaction with the i_size we logged before. Also if an inode created in a previous transaction is logged in exists mode only, make sure we log the i_size stored in the inode item located from the commit root, so that if we log multiple times that the inode exists we get the correct i_size.
A test case for fstests will follow soon.
--- fs/btrfs/tree-log.c | 98 ++++++++++++++++++++++++++++++--------------- 1 file changed, 65 insertions(+), 33 deletions(-)
fs/btrfs/tree-log.c +65 -33
@@ -4608,21 +4608,32 @@ static void fill_inode_item(struct btrfs_trans_handle *trans, struct inode *inode, bool log_inode_only, u64 logged_isize) { + u64 gen = BTRFS_I(inode)->generation;u64 flags;if (log_inode_only) { -/* set the generation to zero so the recover code -* can tell the difference between an logging -* just to say 'this inode exists' and a logging -* to say 'update this inode with these values' +/* +* Set the generation to zero so the recover code can tell the +* difference between a logging just to say 'this inode exists' +* and a logging to say 'update this inode with these values'. +* But only if the inode was not already logged before. +* We access ->logged_trans directly since it was already set +* up in the call chain by btrfs_log_inode(), and data_race() +* to avoid false alerts from KCSAN and since it was set already +* and one can set it to 0 since that only happens on eviction +* and we are holding a ref on the inode. */ -btrfs_set_inode_generation (leaf, item,0 ); +ASSERT (data_race (BTRFS_I (inode)->logged_trans) >0 ); +if (data_race (BTRFS_I (inode)->logged_trans) < trans->transid) + gen =0 ; +btrfs_set_inode_size (leaf, item, logged_isize); }else { -btrfs_set_inode_generation (leaf, item,BTRFS_I (inode)->generation);btrfs_set_inode_size (leaf, item, inode->i_size); } +btrfs_set_inode_generation (leaf, item, gen); +btrfs_set_inode_uid (leaf, item,i_uid_read (inode));btrfs_set_inode_gid (leaf, item,i_gid_read (inode));btrfs_set_inode_mode (leaf, item, inode->i_mode);
@@ -5428,42 +5439,63 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,return 0 ; } -static int logged_inode_size (struct btrfs_root *log,struct btrfs_inode *inode, -struct btrfs_path *path,u64 *size_ret) +static int get_inode_size_to_log (struct btrfs_trans_handle *trans, +struct btrfs_inode *inode, +struct btrfs_path *path,u64 *size_ret) {struct btrfs_key key; +struct btrfs_inode_item *item;int ret; key.objectid =btrfs_ino (inode); key.type =BTRFS_INODE_ITEM_KEY ; key.offset =0 ; - ret =btrfs_search_slot (NULL , log, &key, path,0 ,0 ); -if (ret <0 ) { -return ret; - }else if (ret >0 ) { - *size_ret =0 ; - }else { -struct btrfs_inode_item *item; +/* +* Our caller called inode_logged(), so logged_trans is up to date. +* Use data_race() to silence any warning from KCSAN. Once logged_trans +* is set, it can only be reset to 0 after inode eviction. +*/ +if (data_race (inode->logged_trans) == trans->transid) { + ret =btrfs_search_slot (NULL , inode->root->log_root, &key, path,0 ,0 ); + }else if (inode->generation < trans->transid) { + path->search_commit_root = true; + path->skip_locking = true; + ret =btrfs_search_slot (NULL , inode->root, &key, path,0 ,0 ); + path->search_commit_root = false; + path->skip_locking = false; - item =btrfs_item_ptr (path->nodes[0 ], path->slots[0 ], - struct btrfs_inode_item); - *size_ret =btrfs_inode_size (path->nodes[0 ], item); -/* -* If the in-memory inode's i_size is smaller then the inode -* size stored in the btree, return the inode's i_size, so -* that we get a correct inode size after replaying the log -* when before a power failure we had a shrinking truncate -* followed by addition of a new name (rename / new hard link). -* Otherwise return the inode size from the btree, to avoid -* data loss when replaying a log due to previously doing a -* write that expands the inode's size and logging a new name -* immediately after. -*/ -if (*size_ret > inode->vfs_inode.i_size) - *size_ret = inode->vfs_inode.i_size; + }else { + *size_ret =0 ; +return 0 ; } +/* +* If the inode was logged before or is from a past transaction, then +* its inode item must exist in the log root or in the commit root. +*/ +ASSERT (ret <=0 ); +if (WARN_ON_ONCE (ret >0 )) + ret = -ENOENT ; + +if (ret <0 ) +return ret; + + item =btrfs_item_ptr (path->nodes[0 ], path->slots[0 ], + struct btrfs_inode_item); + *size_ret =btrfs_inode_size (path->nodes[0 ], item); +/* +* If the in-memory inode's i_size is smaller then the inode size stored +* in the btree, return the inode's i_size, so that we get a correct +* inode size after replaying the log when before a power failure we had +* a shrinking truncate followed by addition of a new name (rename / new +* hard link). Otherwise return the inode size from the btree, to avoid +* data loss when replaying a log due to previously doing a write that +* expands the inode's size and logging a new name immediately after. +*/ +if (*size_ret > inode->vfs_inode.i_size) + *size_ret = inode->vfs_inode.i_size; +btrfs_release_path (path);return 0 ; }
@@ -6978,7 +7010,7 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans, ret =drop_inode_items (trans, log, path, inode,BTRFS_XATTR_ITEM_KEY ); }else { -if (inode_only ==LOG_INODE_EXISTS && ctx->logged_before) { +if (inode_only ==LOG_INODE_EXISTS ) {/* * Make sure the new inode item we write to the log has * the same isize as the current one (if it exists).
@@ -6992,7 +7024,7 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,* (zeroes), as if an expanding truncate happened, * instead of getting a file of 4Kb only. */ - ret =logged_inode_size (log, inode, path, &logged_isize); + ret =get_inode_size_to_log (trans, inode, path, &logged_isize);if (ret) goto out_unlock; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 17/198 platform/x86: hp-wmi: Add support for Omen 16-wf1xxx (8C76)
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Chomal <[email protected]>
[ Upstream commit 84d29bfd1929d08f092851162a3d055a2134d043 ]
The HP Omen 16-wf1xxx (board ID: 8C76) has the same WMI interface as other Victus S boards, but requires quirks for correctly switching thermal profile (similar to board 8C78).
Add the DMI board name to victus_s_thermal_profile_boards[] table and map it to omen_v1_thermal_params.
Testing on board 8C76 confirmed that platform profile is registered successfully and fan RPMs are readable and controllable.
--- drivers/platform/x86/hp/hp-wmi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/platform/x86/hp/hp-wmi.c +4 -0
@@ -174,6 +174,10 @@ static const struct dmi_system_id victus_s_thermal_profile_boards[] __initconst .matches = { DMI_MATCH(DMI_BOARD_NAME, "8BD5") }, .driver_data = (void *)&victus_s_thermal_params, }, + { + .matches = { DMI_MATCH(DMI_BOARD_NAME, "8C76") }, + .driver_data = (void *)&omen_v1_thermal_params, + }, { .matches = { DMI_MATCH(DMI_BOARD_NAME, "8C78") }, .driver_data = (void *)&omen_v1_thermal_params,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 18/198 btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Goldwyn Rodrigues <[email protected]>
[ Upstream commit a85b46db143fda5869e7d8df8f258ccef5fa1719 ]
If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will lead to a crash.
Use file_inode(file)->i_sb to always get btrfs_sb.
--- include/trace/events/btrfs.h | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
include/trace/events/btrfs.h +7 -4
@@ -769,12 +769,15 @@ TRACE_EVENT(btrfs_sync_file, ),TP_fast_assign ( - const struct dentry *dentry = file->f_path.dentry; -const struct inode *inode =d_inode (dentry); + struct dentry *dentry = file_dentry(file); +struct inode *inode =file_inode (file); +struct dentry *parent =dget_parent (dentry); +struct inode *parent_inode =d_inode (parent); -TP_fast_assign_fsid (btrfs_sb (file->f_path.dentry->d_sb)); +dput (parent); +TP_fast_assign_fsid (btrfs_sb (inode->i_sb)); __entry->ino =btrfs_ino (BTRFS_I (inode)); - __entry->parent =btrfs_ino (BTRFS_I (d_inode (dentry->d_parent))); + __entry->parent =btrfs_ino (BTRFS_I (parent_inode)); __entry->datasync = datasync; __entry->root_objectid =btrfs_root_id (BTRFS_I (inode)->root); ),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 19/198 ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: César Montoya <[email protected]>
[ Upstream commit 2f388b4e8fdd6b0f27cafd281658daacfd85807e ]
The HP Pavilion 15-eg0xxx with subsystem ID 0x103c87cb uses a Realtek ALC287 codec with a mute LED wired to GPIO pin 4 (mask 0x10). The existing ALC287_FIXUP_HP_GPIO_LED fixup already handles this correctly, but the subsystem ID was missing from the quirk table.
GPIO pin confirmed via manual hda-verb testing:
hda-verb SET_GPIO_MASK 0x10
hda-verb SET_GPIO_DIRECTION 0x10
hda-verb SET_GPIO_DATA 0x10
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -6746,6 +6746,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x8788 ,"HP OMEN 15" ,ALC285_FIXUP_HP_MUTE_LED ),SND_PCI_QUIRK (0x103c ,0x87b7 ,"HP Laptop 14-fq0xxx" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x87c8 ,"HP" ,ALC287_FIXUP_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x87cb ,"HP Pavilion 15-eg0xxx" ,ALC287_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x87cc ,"HP Pavilion 15-eg0xxx" ,ALC287_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x87d3 ,"HP Laptop 15-gw0xxx" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ), SND_PCI_QUIRK(0x103c, 0x87df, "HP ProBook 430 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 20/198 netfilter: ctnetlink: ensure safe access to master conntrack
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 ]
Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid.
To access exp->master safely:
- Grab the nf_conntrack_expect_lock, this gets serialized with clean_from_lists() which also holds this lock when the master conntrack goes away.
- Hold reference on master conntrack via nf_conntrack_find_get(). Not so easy since the master tuple to look up for the master conntrack is not available in the existing problematic paths.
This patch goes for extending the nf_conntrack_expect_lock section to address this issue for simplicity, in the cases that are described below this is just slightly extending the lock section.
The add expectation command already holds a reference to the master conntrack from ctnetlink_create_expect().
However, the delete expectation command needs to grab the spinlock before looking up for the expectation. Expand the existing spinlock section to address this to cover the expectation lookup. Note that, the nf_ct_expect_iterate_net() calls already grabs the spinlock while iterating over the expectation table, which is correct.
The get expectation command needs to grab the spinlock to ensure master conntrack does not go away. This also expands the existing spinlock section to cover the expectation lookup too. I needed to move the netlink skb allocation out of the spinlock to keep it GFP_KERNEL.
For the expectation events, the IPEXP_DESTROY event is already delivered under the spinlock, just move the delivery of IPEXP_NEW under the spinlock too because the master conntrack event cache is reached through exp->master.
While at it, add lockdep notations to help identify what codepaths need to grab the spinlock.
--- include/net/netfilter/nf_conntrack_core.h | 5 ++++ net/netfilter/nf_conntrack_ecache.c | 2 ++ net/netfilter/nf_conntrack_expect.c | 10 +++++++- net/netfilter/nf_conntrack_netlink.c | 28 +++++++++++++++-------- 4 files changed, 35 insertions(+), 10 deletions(-)
include/net/netfilter/nf_conntrack_core.h +5 -0
@@ -83,6 +83,11 @@ void nf_conntrack_lock(spinlock_t *lock);extern spinlock_t nf_conntrack_expect_lock; +static inline void lockdep_nfct_expect_lock_held (void ) +{ +lockdep_assert_held (&nf_conntrack_expect_lock); +} +/* ctnetlink code shared by both ctnetlink and nf_conntrack_bpf */ static inline void __nf_ct_set_timeout (struct nf_conn *ct,u64 timeout)
net/netfilter/nf_conntrack_ecache.c +2 -0
@@ -247,6 +247,8 @@ void nf_ct_expect_event_report(enum ip_conntrack_expect_events event,struct nf_ct_event_notifier *notify;struct nf_conntrack_ecache *e; +lockdep_nfct_expect_lock_held (); +rcu_read_lock (); notify =rcu_dereference (net->ct.nf_conntrack_event_cb);if (!notify)
net/netfilter/nf_conntrack_expect.c +9 -1
@@ -51,6 +51,7 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,struct net *net =nf_ct_exp_net (exp);struct nf_conntrack_net *cnet; +lockdep_nfct_expect_lock_held ();WARN_ON (!master_help);WARN_ON (timer_pending (&exp->timeout));
@@ -118,6 +119,8 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple,bool nf_ct_remove_expect (struct nf_conntrack_expect *exp) { +lockdep_nfct_expect_lock_held (); +if (timer_delete (&exp->timeout)) {nf_ct_unlink_expect (exp);nf_ct_expect_put (exp);
@@ -177,6 +180,8 @@ nf_ct_find_expectation(struct net *net,struct nf_conntrack_expect *i, *exp =NULL ;unsigned int h; +lockdep_nfct_expect_lock_held (); +if (!cnet->expect_count)return NULL ;
@@ -459,6 +464,8 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect,unsigned int h;int ret =0 ; +lockdep_nfct_expect_lock_held (); +if (!master_help) { ret = -ESHUTDOWN ; goto out;
@@ -515,8 +522,9 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect,nf_ct_expect_insert (expect); -spin_unlock_bh (&nf_conntrack_expect_lock);nf_ct_expect_event_report (IPEXP_NEW , expect, portid, report); +spin_unlock_bh (&nf_conntrack_expect_lock); +return 0 ; out:spin_unlock_bh (&nf_conntrack_expect_lock);
net/netfilter/nf_conntrack_netlink.c +19 -9
@@ -3337,31 +3337,37 @@ static int ctnetlink_get_expect(struct sk_buff *skb,if (err <0 )return err; + skb2 =nlmsg_new (NLMSG_DEFAULT_SIZE ,GFP_KERNEL ); +if (!skb2) +return -ENOMEM ; + +spin_lock_bh (&nf_conntrack_expect_lock); exp =nf_ct_expect_find_get (info->net, &zone, &tuple); -if (!exp) +if (!exp) { +spin_unlock_bh (&nf_conntrack_expect_lock); +kfree_skb (skb2);return -ENOENT ; + }if (cda[CTA_EXPECT_ID ]) {__be32 id =nla_get_be32 (cda[CTA_EXPECT_ID ]);if (id !=nf_expect_get_id (exp)) {nf_ct_expect_put (exp); +spin_unlock_bh (&nf_conntrack_expect_lock); +kfree_skb (skb2);return -ENOENT ; } } - skb2 =nlmsg_new (NLMSG_DEFAULT_SIZE ,GFP_KERNEL ); -if (!skb2) { -nf_ct_expect_put (exp); -return -ENOMEM ; - } -rcu_read_lock (); err =ctnetlink_exp_fill_info (skb2,NETLINK_CB (skb).portid, info->nlh->nlmsg_seq,IPCTNL_MSG_EXP_NEW , exp);rcu_read_unlock ();nf_ct_expect_put (exp); +spin_unlock_bh (&nf_conntrack_expect_lock); +if (err <=0 ) {kfree_skb (skb2);return -ENOMEM ;
@@ -3408,22 +3414,26 @@ static int ctnetlink_del_expect(struct sk_buff *skb,if (err <0 )return err; +spin_lock_bh (&nf_conntrack_expect_lock); +/* bump usage count to 2 */ exp =nf_ct_expect_find_get (info->net, &zone, &tuple); -if (!exp) +if (!exp) { +spin_unlock_bh (&nf_conntrack_expect_lock);return -ENOENT ; + }if (cda[CTA_EXPECT_ID ]) {__be32 id =nla_get_be32 (cda[CTA_EXPECT_ID ]);if (id !=nf_expect_get_id (exp)) {nf_ct_expect_put (exp); +spin_unlock_bh (&nf_conntrack_expect_lock);return -ENOENT ; } }/* after list removal, usage count == 1 */ -spin_lock_bh (&nf_conntrack_expect_lock);if (timer_delete (&exp->timeout)) {nf_ct_unlink_expect_report (exp,NETLINK_CB (skb).portid,nlmsg_report (info->nlh));
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 21/198 drm/amdgpu: Handle GPU page faults correctly on non-4K page systems
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donet Tom <[email protected]>
[ Upstream commit 4e9597f22a3cb8600c72fc266eaac57981d834c8 ]
During a GPU page fault, the driver restores the SVM range and then maps it into the GPU page tables. The current implementation passes a GPU-page-size (4K-based) PFN to svm_range_restore_pages() to restore the range.
SVM ranges are tracked using system-page-size PFNs. On systems where the system page size is larger than 4K, using GPU-page-size PFNs to restore the range causes two problems:
Range lookup fails:
Because the restore function receives PFNs in GPU (4K) units, the SVM range lookup does not find the existing range. This will result in a duplicate SVM range being created.
VMA lookup failure:
The restore function also tries to locate the VMA for the faulting address. It converts the GPU-page-size PFN into an address using the system page size, which results in an incorrect address on non-4K page-size systems. As a result, the VMA lookup fails with the message: "address 0xxxx VMA is removed".
This patch passes the system-page-size PFN to svm_range_restore_pages() so that the SVM range is restored correctly on non-4K page systems.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +3 -3
@@ -2960,14 +2960,14 @@ bool amdgpu_vm_handle_fault(struct amdgpu_device *adev, u32 pasid,if (!root)return false; - addr /=AMDGPU_GPU_PAGE_SIZE ; -if (is_compute_context && !svm_range_restore_pages (adev, pasid, vmid, - node_id, addr, ts, write_fault)) { + node_id, addr >>PAGE_SHIFT , ts, write_fault)) {amdgpu_bo_unref (&root);return true; } + addr /=AMDGPU_GPU_PAGE_SIZE ; + r =amdgpu_bo_reserve (root, true);if (r) goto error_unref;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 22/198 srcu: Use irq_work to start GP in tiny SRCU
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joel Fernandes <[email protected]>
[ Upstream commit a6fc88b22bc8d12ad52e8412c667ec0f5bf055af ]
Tiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(), which acquires the workqueue pool->lock.
This causes a lockdep splat when call_srcu() is called with a scheduler lock held, due to:
call_srcu() [holding pi_lock]
srcu_gp_start_if_needed()
schedule_work() -> pool->lock workqueue_init() / create_worker() [holding pool->lock]
wake_up_process() -> try_to_wake_up() -> pi_lock
Also add irq_work_sync() to cleanup_srcu_struct() to prevent a use-after-free if a queued irq_work fires after cleanup begins.
Tested with rcutorture SRCU-T and no lockdep warnings.
[ Thanks to Boqun for similar fix in patch "rcu: Use an intermediate irq_work to start process_srcu()" ]
--- include/linux/srcutiny.h | 4 ++++ kernel/rcu/srcutiny.c | 19 ++++++++++++++++++- 2 files changed, 22 insertions(+), 1 deletion(-)
include/linux/srcutiny.h +4 -0
@@ -11,6 +11,7 @@#ifndef _LINUX_SRCU_TINY_H#define _LINUX_SRCU_TINY_H +#include <linux/irq_work_types.h> #include <linux/swait.h> struct srcu_struct {
@@ -24,18 +25,21 @@ struct srcu_struct {struct rcu_head *srcu_cb_head;/* Pending callbacks: Head. */ struct rcu_head **srcu_cb_tail;/* Pending callbacks: Tail. */ struct work_struct srcu_work;/* For driving grace periods. */ +struct irq_work srcu_irq_work;/* Defer schedule_work() to irq work. */ #ifdef CONFIG_DEBUG_LOCK_ALLOC struct lockdep_map dep_map;#endif /* #ifdef CONFIG_DEBUG_LOCK_ALLOC */ };void srcu_drive_gp (struct work_struct *wp); +void srcu_tiny_irq_work (struct irq_work *irq_work);#define __SRCU_STRUCT_INIT (name, __ignored, ___ignored) \ { \ .srcu_wq = __SWAIT_QUEUE_HEAD_INITIALIZER(name.srcu_wq), \ .srcu_cb_tail = &name.srcu_cb_head, \ .srcu_work = __WORK_INITIALIZER(name.srcu_work, srcu_drive_gp), \ + .srcu_irq_work = { .func = srcu_tiny_irq_work }, \ __SRCU_DEP_MAP_INIT(name) \ }
kernel/rcu/srcutiny.c +18 -1
@@ -9,6 +9,7 @@*/ #include <linux/export.h> +#include <linux/irq_work.h> #include <linux/mutex.h> #include <linux/preempt.h> #include <linux/rcupdate_wait.h>
@@ -41,6 +42,7 @@ static int init_srcu_struct_fields(struct srcu_struct *ssp) ssp->srcu_idx_max =0 ;INIT_WORK (&ssp->srcu_work, srcu_drive_gp);INIT_LIST_HEAD (&ssp->srcu_work.entry); +init_irq_work (&ssp->srcu_irq_work, srcu_tiny_irq_work);return 0 ; }
@@ -84,6 +86,7 @@ EXPORT_SYMBOL_GPL(init_srcu_struct);void cleanup_srcu_struct (struct srcu_struct *ssp) {WARN_ON (ssp->srcu_lock_nesting[0 ] || ssp->srcu_lock_nesting[1 ]); +irq_work_sync (&ssp->srcu_irq_work);flush_work (&ssp->srcu_work);WARN_ON (ssp->srcu_gp_running);WARN_ON (ssp->srcu_gp_waiting);
@@ -172,6 +175,20 @@ void srcu_drive_gp(struct work_struct *wp) }EXPORT_SYMBOL_GPL (srcu_drive_gp); +/* +* Use an irq_work to defer schedule_work() to avoid acquiring the workqueue +* pool->lock while the caller might hold scheduler locks, causing lockdep +* splats due to workqueue_init() doing a wakeup. +*/ +void srcu_tiny_irq_work (struct irq_work *irq_work) +{ +struct srcu_struct *ssp; + + ssp = container_of(irq_work, struct srcu_struct, srcu_irq_work); +schedule_work (&ssp->srcu_work); +} +EXPORT_SYMBOL_GPL (srcu_tiny_irq_work); +static void srcu_gp_start_if_needed (struct srcu_struct *ssp) {unsigned long cookie;
@@ -184,7 +201,7 @@ static void srcu_gp_start_if_needed(struct srcu_struct *ssp)WRITE_ONCE (ssp->srcu_idx_max, cookie);if (!READ_ONCE (ssp->srcu_gp_running)) {if (likely (srcu_init_done)) -schedule_work (&ssp->srcu_work); +irq_work_queue (&ssp->srcu_irq_work);else if (list_empty (&ssp->srcu_work.entry))list_add (&ssp->srcu_work.entry, &srcu_boot_list); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 23/198 ALSA: hda/realtek: add HP Laptop 15-fd0xxx mute LED quirk
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kshamendra Kumar Mishra <[email protected]>
[ Upstream commit faceb5cf5d7a08f4a40335d22d833bb75f05d99e ]
HP Laptop 15-fd0xxx with ALC236 codec does not handle the toggling of the mute LED.
This patch adds a quirk entry for subsystem ID 0x8dd7 using ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 fixup, enabling correct mute LED behavior.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -6977,6 +6977,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x8da7 ,"HP 14 Enstrom OmniBook X" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x103c ,0x8da8 ,"HP 16 Piston OmniBook X" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x103c ,0x8dd4 ,"HP EliteStudio 8 AIO" ,ALC274_FIXUP_HP_AIO_BIND_DACS ), +SND_PCI_QUIRK (0x103c ,0x8dd7 ,"HP Laptop 15-fd0xxx" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x8de8 ,"HP Gemtree" ,ALC245_FIXUP_TAS2781_SPI_2 ),SND_PCI_QUIRK (0x103c ,0x8de9 ,"HP Gemtree" ,ALC245_FIXUP_TAS2781_SPI_2 ), SND_PCI_QUIRK(0x103c, 0x8dec, "HP EliteBook 640 G12", ALC236_FIXUP_HP_GPIO_LED),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 24/198 netfilter: nft_set_pipapo_avx2: dont return non-matching entry on expiry
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit d3c0037ffe1273fa1961e779ff6906234d6cf53c ]
New test case fails unexpectedly when avx2 matching functions are used.
The test first loads a ranomly generated pipapo set with 'ipv4 . port' key, i.e. nft -f foo.
This works. Then, it reloads the set after a flush:
(echo flush set t s; cat foo) | nft -f -
This is expected to work, because its the same set after all and it was already loaded once.
But with avx2, this fails: nft reports a clashing element.
The reported clash is of following form:
We successfully re-inserted
a . b
c . d
Then we try to insert a . d
avx2 finds the already existing a . d, which (due to 'flush set') is marked as invalid in the new generation. It skips the element and moves to next.
Due to incorrect masking, the skip-step finds the next matching element *only considering the first field*,
i.e. we return the already reinserted "a . b", even though the last field is different and the entry should not have been matched.
No such error is reported for the generic c implementation (no avx2) or when the last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback.
Bisection points to7711f4bb4b36 ("netfilter: nft_set_pipapo: fix range overlap detection") but that fix merely uncovers this bug.
Before this commit, the wrong element is returned, but erronously reported as a full, identical duplicate.
The root-cause is too early return in the avx2 match functions. When we process the last field, we should continue to process data until the entire input size has been consumed to make sure no stale bits remain in the map.
--- net/netfilter/nft_set_pipapo_avx2.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
net/netfilter/nft_set_pipapo_avx2.c +10 -10
@@ -242,7 +242,7 @@ static int nft_pipapo_avx2_lookup_4b_2(unsigned long *map, unsigned long *fill, b =nft_pipapo_avx2_refill (i_ul, &map[i_ul], fill, f->mt, last);if (last) -return b; + ret = b;if (unlikely (ret ==-1 )) ret = b /XSAVE_YMM_SIZE ;
@@ -319,7 +319,7 @@ static int nft_pipapo_avx2_lookup_4b_4(unsigned long *map, unsigned long *fill, b =nft_pipapo_avx2_refill (i_ul, &map[i_ul], fill, f->mt, last);if (last) -return b; + ret = b;if (unlikely (ret ==-1 )) ret = b /XSAVE_YMM_SIZE ;
@@ -414,7 +414,7 @@ static int nft_pipapo_avx2_lookup_4b_8(unsigned long *map, unsigned long *fill, b =nft_pipapo_avx2_refill (i_ul, &map[i_ul], fill, f->mt, last);if (last) -return b; + ret = b;if (unlikely (ret ==-1 )) ret = b /XSAVE_YMM_SIZE ;
@@ -505,7 +505,7 @@ static int nft_pipapo_avx2_lookup_4b_12(unsigned long *map, unsigned long *fill, b =nft_pipapo_avx2_refill (i_ul, &map[i_ul], fill, f->mt, last);if (last) -return b; + ret = b;if (unlikely (ret ==-1 )) ret = b /XSAVE_YMM_SIZE ;
@@ -641,7 +641,7 @@ static int nft_pipapo_avx2_lookup_4b_32(unsigned long *map, unsigned long *fill, b =nft_pipapo_avx2_refill (i_ul, &map[i_ul], fill, f->mt, last);if (last) -return b; + ret = b;if (unlikely (ret ==-1 )) ret = b /XSAVE_YMM_SIZE ;
@@ -699,7 +699,7 @@ static int nft_pipapo_avx2_lookup_8b_1(unsigned long *map, unsigned long *fill, b =nft_pipapo_avx2_refill (i_ul, &map[i_ul], fill, f->mt, last);if (last) -return b; + ret = b;if (unlikely (ret ==-1 )) ret = b /XSAVE_YMM_SIZE ;
@@ -764,7 +764,7 @@ static int nft_pipapo_avx2_lookup_8b_2(unsigned long *map, unsigned long *fill, b =nft_pipapo_avx2_refill (i_ul, &map[i_ul], fill, f->mt, last);if (last) -return b; + ret = b;if (unlikely (ret ==-1 )) ret = b /XSAVE_YMM_SIZE ;
@@ -839,7 +839,7 @@ static int nft_pipapo_avx2_lookup_8b_4(unsigned long *map, unsigned long *fill, b =nft_pipapo_avx2_refill (i_ul, &map[i_ul], fill, f->mt, last);if (last) -return b; + ret = b;if (unlikely (ret ==-1 )) ret = b /XSAVE_YMM_SIZE ;
@@ -925,7 +925,7 @@ static int nft_pipapo_avx2_lookup_8b_6(unsigned long *map, unsigned long *fill, b =nft_pipapo_avx2_refill (i_ul, &map[i_ul], fill, f->mt, last);if (last) -return b; + ret = b;if (unlikely (ret ==-1 )) ret = b /XSAVE_YMM_SIZE ;
@@ -1019,7 +1019,7 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill, b =nft_pipapo_avx2_refill (i_ul, &map[i_ul], fill, f->mt, last);if (last) -return b; + ret = b;if (unlikely (ret ==-1 )) ret = b /XSAVE_YMM_SIZE ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 25/198 ALSA: hda/realtek: add quirk for Framework F111:000F
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dustin L. Howett <[email protected]>
[ Upstream commit bac1e57adf08c9ee33e95fb09cd032f330294e70 ]
Similar to commit 7b509910b3ad ("ALSA hda/realtek: Add quirk for Framework F111:000C") and previous quirks for Framework systems with Realtek codecs.
000F is another new platform with an ALC285 which needs the same quirk.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -7555,6 +7555,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0xf111 ,0x0009 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x000b ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x000c ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0xf111 ,0x000f ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), #if 0/* Below is a quirk table taken from the old code.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 26/198 wifi: wl1251: validate packet IDs before indexing tx_frames
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0 ]
wl1251_tx_packet_cb() uses the firmware completion ID directly to index the fixed 16-entry wl->tx_frames[] array. The ID is a raw u8 from the completion block, and the callback does not currently verify that it fits the array before dereferencing it.
Reject completion IDs that fall outside wl->tx_frames[] and keep the existing NULL check in the same guard. This keeps the fix local to the trust boundary and avoids touching the rest of the completion flow.
--- drivers/net/wireless/ti/wl1251/tx.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/wireless/ti/wl1251/tx.c +5 -3
@@ -402,12 +402,14 @@ static void wl1251_tx_packet_cb(struct wl1251 *wl,int hdrlen;u8 *frame; - skb = wl->tx_frames[result->id]; -if (skb ==NULL ) { -wl1251_error ("SKB for packet %d is NULL" , result->id); +if (unlikely (result->id >=ARRAY_SIZE (wl->tx_frames) || + wl->tx_frames[result->id] ==NULL )) { +wl1251_error ("invalid packet id %u" , result->id);return ; } + skb = wl->tx_frames[result->id]; + info =IEEE80211_SKB_CB (skb); if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 27/198 ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit b9eff9732cb0f86a68c9d1592a98ceab47c01e95 ]
Component has "card_aux_list" which is added/deled in bind/unbind aux dev function (A), and used in for_each_card_auxs() loop (B).
static void soc_unbind_aux_dev(...)
{
...
for_each_card_auxs_safe(...) {
...
(A) list_del(&component->card_aux_list);
} ^^^^^^^^^^^^^
}
static int soc_bind_aux_dev(...)
{
...
for_each_card_pre_auxs(...) {
...
(A) list_add(&component->card_aux_list, ...);
} ^^^^^^^^^^^^^
...
}
#define for_each_card_auxs(card, component) \
(B) list_for_each_entry(component, ..., card_aux_list)
^^^^^^^^^^^^^But it has been used without calling INIT_LIST_HEAD().
> git grep card_aux_list sound/soc sound/soc/soc-core.c: list_del(&component->card_aux_list); sound/soc/soc-core.c: list_add(&component->card_aux_list, ...);
call missing INIT_LIST_HEAD() for it.
--- sound/soc/soc-core.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/soc-core.c +1 -0
@@ -2845,6 +2845,7 @@ int snd_soc_component_initialize(struct snd_soc_component *component,INIT_LIST_HEAD (&component->dobj_list);INIT_LIST_HEAD (&component->card_list);INIT_LIST_HEAD (&component->list); +INIT_LIST_HEAD (&component->card_aux_list);mutex_init (&component->io_mutex);if (!component->name) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 28/198 ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED)
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit ea31be8a2c8c99eac198f3b7f2dc770111f2b182 ]
There is another Book2 Pro model (NP950QED) that seems equipped with the same speaker module as the non-360 model, which requires ALC298_FIXUP_SAMSUNG_AMP_V2_2_AMPS quirk.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -7211,6 +7211,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x144d ,0xc188 ,"Samsung Galaxy Book Flex (NT950QCT-A38A)" ,ALC298_FIXUP_SAMSUNG_AMP ),SND_PCI_QUIRK (0x144d ,0xc189 ,"Samsung Galaxy Book Flex (NT950QCG-X716)" ,ALC298_FIXUP_SAMSUNG_AMP ),SND_PCI_QUIRK (0x144d ,0xc18a ,"Samsung Galaxy Book Ion (NP930XCJ-K01US)" ,ALC298_FIXUP_SAMSUNG_AMP ), +SND_PCI_QUIRK (0x144d ,0xc1ac ,"Samsung Galaxy Book2 Pro 360 (NP950QED)" ,ALC298_FIXUP_SAMSUNG_AMP_V2_2_AMPS ),SND_PCI_QUIRK (0x144d ,0xc1a3 ,"Samsung Galaxy Book Pro (NP935XDB-KC1SE)" ,ALC298_FIXUP_SAMSUNG_AMP ),SND_PCI_QUIRK (0x144d ,0xc1a4 ,"Samsung Galaxy Book Pro 360 (NT935QBD)" ,ALC298_FIXUP_SAMSUNG_AMP ), SND_PCI_QUIRK(0x144d, 0xc1a6, "Samsung Galaxy Book Pro 360 (NP930QBD)", ALC298_FIXUP_SAMSUNG_AMP),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 29/198 ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Willoughby <[email protected]>
[ Upstream commit bc5b4e5ae1a67700a618328217b6a3bd0f296e97 ]
The NeuralDSP Quad Cortex does not support DSD playback. We need this product-specific entry with zero quirks because otherwise it falls through to the vendor-specific entry which marks it as supporting DSD playback.
--- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/quirks.c +2 -0
@@ -2296,6 +2296,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { QUIRK_FLAG_PLAYBACK_FIRST | QUIRK_FLAG_GENERIC_IMPLICIT_FB),DEVICE_FLG (0x13e5 ,0x0001 ,/* Serato Phono */ QUIRK_FLAG_IGNORE_CTL_ERROR ), +DEVICE_FLG (0x152a ,0x880a ,/* NeuralDSP Quad Cortex */ +0 ),/* Doesn't have the vendor quirk which would otherwise apply */ DEVICE_FLG (0x154e ,0x1002 ,/* Denon DCD-1500RE */ QUIRK_FLAG_ITF_USB_DSD_DAC |QUIRK_FLAG_CTL_MSG_DELAY ), DEVICE_FLG(0x154e, 0x1003, /* Denon DA-300USB */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 30/198 ALSA: hda/realtek: Add quirk for Lenovo Yoga Slim 7 14AKP10
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: songxiebing <[email protected]>
[ Upstream commit e6c888202297eca21860b669edb74fc600e679d9 ]
The Pin Complex 0x17 (bass/woofer speakers) is incorrectly reported as unconnected in the BIOS (pin default 0x411111f0 = N/A). This causes the kernel to configure speaker_outs=0, meaning only the tweeters (pin 0x14) are used. The result is very low, tinny audio with no bass.
The existing quirk ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN (already present in patch_realtek.c for SSID 0x17aa3801) fixes the issue completely.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -7464,6 +7464,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x3902 ,"Lenovo E50-80" ,ALC269_FIXUP_DMIC_THINKPAD_ACPI ),SND_PCI_QUIRK (0x17aa ,0x390d ,"Lenovo Yoga Pro 7 14ASP10" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ),SND_PCI_QUIRK (0x17aa ,0x3913 ,"Lenovo 145" ,ALC236_FIXUP_LENOVO_INV_DMIC ), +SND_PCI_QUIRK (0x17aa ,0x391a ,"Lenovo Yoga Slim 7 14AKP10" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ),SND_PCI_QUIRK (0x17aa ,0x391f ,"Yoga S990-16 pro Quad YC Quad" ,ALC287_FIXUP_TXNW2781_I2C ),SND_PCI_QUIRK (0x17aa ,0x3920 ,"Yoga S990-16 pro Quad VECO Quad" ,ALC287_FIXUP_TXNW2781_I2C ), SND_PCI_QUIRK(0x17aa, 0x3929, "Thinkbook 13x Gen 5", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 31/198 drm/amdkfd: Fix queue preemption/eviction failures by aligning control stack size to GPU page size
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donet Tom <[email protected]>
[ Upstream commit 78746a474e92fc7aaed12219bec7c78ae1bd6156 ]
The control stack size is calculated based on the number of CUs and waves, and is then aligned to PAGE_SIZE. When the resulting control stack size is aligned to 64 KB, GPU hangs and queue preemption failures are observed while running RCCL unit tests on systems with more than two GPUs.
amdgpu 0048:0f:00.0: amdgpu: Queue preemption failed for queue withdoorbell_id: 80030008
amdgpu 0048:0f:00.0: amdgpu: Failed to evict process queues amdgpu 0048:0f:00.0: amdgpu: GPU reset begin!. Source: 4 amdgpu 0048:0f:00.0: amdgpu: Queue preemption failed for queue withdoorbell_id: 80030008
amdgpu 0048:0f:00.0: amdgpu: Failed to evict process queues amdgpu 0048:0f:00.0: amdgpu: Failed to restore process queues
This issue is observed on both 4 KB and 64 KB system page-size configurations.
This patch fixes the issue by aligning the control stack size to AMDGPU_GPU_PAGE_SIZE instead of PAGE_SIZE, so the control stack size will not be 64 KB on systems with a 64 KB page size and queue preemption works correctly.
Additionally, In the current code, wg_data_size is aligned to PAGE_SIZE, which can waste memory if the system page size is large. In this patch, wg_data_size is aligned to AMDGPU_GPU_PAGE_SIZE. The cwsr_size, calculated from wg_data_size and the control stack size, is aligned to PAGE_SIZE.
--- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_queue.c +4 -3
@@ -444,10 +444,11 @@ void kfd_queue_ctx_save_restore_size(struct kfd_topology_device *dev)min (cu_num *40 , props->array_count / props->simd_arrays_per_engine *512 ) : cu_num * 32; - wg_data_size =ALIGN (cu_num *WG_CONTEXT_DATA_SIZE_PER_CU (gfxv, props),PAGE_SIZE ); + wg_data_size =ALIGN (cu_num *WG_CONTEXT_DATA_SIZE_PER_CU (gfxv, props), +AMDGPU_GPU_PAGE_SIZE ); ctl_stack_size = wave_num *CNTL_STACK_BYTES_PER_WAVE (gfxv) +8 ; ctl_stack_size =ALIGN (SIZEOF_HSA_USER_CONTEXT_SAVE_AREA_HEADER + ctl_stack_size, -PAGE_SIZE ); +AMDGPU_GPU_PAGE_SIZE );if ((gfxv /10000 *10000 ) ==100000 ) {/* HW design limits control stack size to 0x7000.
@@ -459,7 +460,7 @@ void kfd_queue_ctx_save_restore_size(struct kfd_topology_device *dev) props->ctl_stack_size = ctl_stack_size; props->debug_memory_size =ALIGN (wave_num *DEBUGGER_BYTES_PER_WAVE ,DEBUGGER_BYTES_ALIGN ); - props->cwsr_size = ctl_stack_size + wg_data_size; + props->cwsr_size =ALIGN (ctl_stack_size + wg_data_size,PAGE_SIZE );if (gfxv ==80002 )/* GFX_VERSION_TONGA */ props->eop_buffer_size =0x8000 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 32/198 fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fredric Cover <[email protected]>
[ Upstream commit 78ec5bf2f589ec7fd8f169394bfeca541b077317 ]
When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check *(cursor2 - 1) before cursor2 has advanced. This results in an out-of-bounds read.
This patch adds an early exit check after stripping prepended delimiters. If no path content remains, the function returns NULL.
The bug was identified via manual audit and verified using a standalone test case compiled with AddressSanitizer, which triggered a SEGV on affected inputs.
--- fs/smb/client/fs_context.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/smb/client/fs_context.c +4 -0
@@ -589,6 +589,10 @@ char *cifs_sanitize_prepath(char *prepath, gfp_t gfp)while (IS_DELIM (*cursor1)) cursor1++; +/* exit in case of only delimiters */ +if (!*cursor1) +return NULL ; +/* copy the first letter */ *cursor2 = *cursor1;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 33/198 ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gilson Marquato Júnior <[email protected]>
[ Upstream commit 8ec017cf31299c4b6287ebe27afe81c986aeef88 ]
The HP Laptop 15-fc0xxx (subsystem ID 0x103c8dc9) has an internal DMIC connected to the AMD ACP6x audio coprocessor. Add a DMI quirk entry so the internal microphone is properly detected on this model.
Tested on HP Laptop 15-fc0237ns with Fedora 43 (kernel 6.19.9).
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -45,6 +45,13 @@ static struct snd_soc_card acp6x_card = { };static const struct dmi_system_id yc_acp_quirk_table[] = { + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"HP" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"HP Laptop 15-fc0xxx" ), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 34/198 ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Savenko <[email protected]>
[ Upstream commit 217d5bc9f96272316ac5a3215c7cc32a5127bbf3 ]
The Lenovo Yoga Pro 7 14IMH9 (DMI: 83E2) shares PCI SSID 17aa:3847 with the Legion 7 16ACHG6, but has a different codec subsystem ID (17aa:38cf). The existing SND_PCI_QUIRK for 17aa:3847 applies ALC287_FIXUP_LEGION_16ACHG6, which attempts to initialize an external I2C amplifier (CLSA0100) that is not present on the Yoga Pro 7 14IMH9.
As a result, pin 0x17 (bass speakers) is connected to DAC 0x06 which has no volume control, making hardware volume adjustment completely non-functional. Audio is either silent or at maximum volume regardless of the slider position.
Add a HDA_CODEC_QUIRK entry using the codec subsystem ID (17aa:38cf) to correctly identify the Yoga Pro 7 14IMH9 and apply ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN, which redirects pin 0x17 to DAC 0x02 and restores proper volume control. The existing Legion entry is preserved unchanged.
This follows the same pattern used for 17aa:386e, where Legion Y9000X and Yoga Pro 7 14ARP8 share a PCI SSID but are distinguished via HDA_CODEC_QUIRK.
--- sound/hda/codecs/realtek/alc269.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/hda/codecs/realtek/alc269.c +4 -0
@@ -7402,6 +7402,10 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x3834 ,"Lenovo IdeaPad Slim 9i 14ITL5" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x383d ,"Legion Y9000X 2019" ,ALC285_FIXUP_LEGION_Y9000X_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3843 ,"Lenovo Yoga 9i / Yoga Book 9i" ,ALC287_FIXUP_LENOVO_YOGA_BOOK_9I ), +/* Yoga Pro 7 14IMH9 shares PCI SSID 17aa:3847 with Legion 7 16ACHG6; +* use codec SSID to distinguish them +*/ +HDA_CODEC_QUIRK (0x17aa ,0x38cf ,"Lenovo Yoga Pro 7 14IMH9" ,ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN ),SND_PCI_QUIRK (0x17aa ,0x3847 ,"Legion 7 16ACHG6" ,ALC287_FIXUP_LEGION_16ACHG6 ),SND_PCI_QUIRK (0x17aa ,0x384a ,"Lenovo Yoga 7 15ITL5" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ), SND_PCI_QUIRK(0x17aa, 0x3852, "Lenovo Yoga 7 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 35/198 pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer)
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit a4337a24d13e9e3b98a113e71d6b80dc5ed5f8c4 ]
The 1kOhm pull down and hardware debouncer are features of the revision 0.92 of the Chassis specification. Fix that in the code accordingly.
--- drivers/pinctrl/intel/pinctrl-intel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/intel/pinctrl-intel.c +1 -1
@@ -1606,7 +1606,7 @@ int intel_pinctrl_probe(struct platform_device *pdev, value =readl (regs +REVID );if (value == ~0u )return -ENODEV ; -if (((value &REVID_MASK ) >>REVID_SHIFT ) >=0x94 ) { +if (((value &REVID_MASK ) >>REVID_SHIFT ) >=0x92 ) { community->features |=PINCTRL_FEATURE_DEBOUNCE ; community->features |=PINCTRL_FEATURE_1K_PD ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 36/198 platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 1a9452c428a6b76f0b797bae21daa454fccef1a2 ]
This platform is a similar vintage of platforms that had a BIOS bug leading to a 10s delay at resume from s0i3.
Add a quirk for it.
--- drivers/platform/x86/amd/pmc/pmc-quirks.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/platform/x86/amd/pmc/pmc-quirks.c +9 -0
@@ -203,6 +203,15 @@ static const struct dmi_system_id fwbug_list[] = { DMI_MATCH(DMI_PRODUCT_NAME, "82XQ"), } }, +/* https://bugzilla.kernel.org/show_bug.cgi?id=221273 */ + { + .ident = "Thinkpad L14 Gen3", + .driver_data = &quirk_s2idle_bug, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "21C6"), + } + }, /* https://gitlab.freedesktop.org/drm/amd/-/issues/4434 */ { .ident = "Lenovo Yoga 6 13ALC6",
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 37/198 HID: Intel-thc-hid: Intel-quickspi: Add NVL Device IDs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Even Xu <[email protected]>
[ Upstream commit 48e91af0cbe942d50ef6257d850accdca1d01378 ]
Add Nova Lake THC QuickSPI device IDs to support list.
--- drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | 6 ++++++ drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h | 2 ++ 2 files changed, 8 insertions(+)
drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c +6 -0
@@ -37,6 +37,10 @@ struct quickspi_driver_data arl = { .max_packet_size_value = MAX_PACKET_SIZE_VALUE_MTL, }; +struct quickspi_driver_data nvl = { + .max_packet_size_value =MAX_PACKET_SIZE_VALUE_LNL , +}; +/* THC QuickSPI ACPI method to get device properties */ /* HIDSPI Method: {6e2ac436-0fcf-41af-a265-b32a220dcfab} */ static guid_t hidspi_guid =
@@ -984,6 +988,8 @@ static const struct pci_device_id quickspi_pci_tbl[] = { {PCI_DEVICE_DATA(INTEL, THC_WCL_DEVICE_ID_SPI_PORT2, &ptl), }, {PCI_DEVICE_DATA(INTEL, THC_ARL_DEVICE_ID_SPI_PORT1, &arl), }, {PCI_DEVICE_DATA(INTEL, THC_ARL_DEVICE_ID_SPI_PORT2, &arl), }, + {PCI_DEVICE_DATA(INTEL, THC_NVL_H_DEVICE_ID_SPI_PORT1, &nvl), }, + {PCI_DEVICE_DATA(INTEL, THC_NVL_H_DEVICE_ID_SPI_PORT2, &nvl), }, {} };MODULE_DEVICE_TABLE (pci, quickspi_pci_tbl);
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h +2 -0
@@ -23,6 +23,8 @@#define PCI_DEVICE_ID_INTEL_THC_WCL_DEVICE_ID_SPI_PORT2 0x4D4B#define PCI_DEVICE_ID_INTEL_THC_ARL_DEVICE_ID_SPI_PORT1 0x7749#define PCI_DEVICE_ID_INTEL_THC_ARL_DEVICE_ID_SPI_PORT2 0x774B +#define PCI_DEVICE_ID_INTEL_THC_NVL_H_DEVICE_ID_SPI_PORT1 0xD349 +#define PCI_DEVICE_ID_INTEL_THC_NVL_H_DEVICE_ID_SPI_PORT2 0xD34B/* HIDSPI special ACPI parameters DSM methods */ #define ACPI_QUICKSPI_REVISION_NUM 2
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 38/198 HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: leo vriska <[email protected]>
[ Upstream commit 532743944324a873bbaf8620fcabcd0e69e30c36 ]
According to a mailing list report [1], this controller's predecessor has the same issue. However, it uses the xpad driver instead of HID, so this quirk wouldn't apply.
[1]: https://lore.kernel.org/linux-input/[email protected]/
--- drivers/hid/hid-ids.h | 3 +++ drivers/hid/hid-quirks.c | 1 + 2 files changed, 4 insertions(+)
drivers/hid/hid-ids.h +3 -0
@@ -22,6 +22,9 @@#define USB_DEVICE_ID_3M2256 0x0502#define USB_DEVICE_ID_3M3266 0x0506 +#define USB_VENDOR_ID_8BITDO 0x2dc8 +#define USB_DEVICE_ID_8BITDO_PRO_3 0x6009 +#define USB_VENDOR_ID_A4TECH 0x09da#define USB_DEVICE_ID_A4TECH_WCP32PU 0x0006#define USB_DEVICE_ID_A4TECH_X5_005D 0x000a
drivers/hid/hid-quirks.c +1 -0
@@ -25,6 +25,7 @@*/ static const struct hid_device_id hid_quirks[] = { + {HID_USB_DEVICE (USB_VENDOR_ID_8BITDO ,USB_DEVICE_ID_8BITDO_PRO_3 ),HID_QUIRK_ALWAYS_POLL }, {HID_USB_DEVICE (USB_VENDOR_ID_AASHIMA ,USB_DEVICE_ID_AASHIMA_GAMEPAD ),HID_QUIRK_BADPAD }, {HID_USB_DEVICE (USB_VENDOR_ID_AASHIMA ,USB_DEVICE_ID_AASHIMA_PREDATOR ),HID_QUIRK_BADPAD }, {HID_USB_DEVICE (USB_VENDOR_ID_ADATA_XPG ,USB_VENDOR_ID_ADATA_XPG_WL_GAMING_MOUSE ),HID_QUIRK_ALWAYS_POLL },
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 39/198 ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: songxiebing <[email protected]>
[ Upstream commit f0541edb2e7333f320642c7b491a67912c1f65db ]
The bass speakers are not working, and add the following entry in /etc/modprobe.d/snd.conf:
options snd-sof-intel-hda-generic hda_model=alc287-yoga9-bass-spk-pin Fixes the bass speakers.
So add the quick ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN here.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -7467,6 +7467,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x38fd ,"ThinkBook plus Gen5 Hybrid" ,ALC287_FIXUP_TAS2781_I2C ),SND_PCI_QUIRK (0x17aa ,0x3902 ,"Lenovo E50-80" ,ALC269_FIXUP_DMIC_THINKPAD_ACPI ),SND_PCI_QUIRK (0x17aa ,0x390d ,"Lenovo Yoga Pro 7 14ASP10" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ), +SND_PCI_QUIRK (0x17aa ,0x3911 ,"Lenovo Yoga Pro 7 14IAH10" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ),SND_PCI_QUIRK (0x17aa ,0x3913 ,"Lenovo 145" ,ALC236_FIXUP_LENOVO_INV_DMIC ),SND_PCI_QUIRK (0x17aa ,0x391a ,"Lenovo Yoga Slim 7 14AKP10" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ), SND_PCI_QUIRK(0x17aa, 0x391f, "Yoga S990-16 pro Quad YC Quad", ALC287_FIXUP_TXNW2781_I2C),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 40/198 HID: roccat: fix use-after-free in roccat_report_event
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benoît Sevens <[email protected]>
[ Upstream commit d802d848308b35220f21a8025352f0c0aba15c12 ]
roccat_report_event() iterates over the device->readers list without holding the readers_lock. This allows a concurrent roccat_release() to remove and free a reader while it's still being accessed, leading to a use-after-free.
Protect the readers list traversal with the readers_lock mutex.
--- drivers/hid/hid-roccat.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hid/hid-roccat.c +2 -0
@@ -257,6 +257,7 @@ int roccat_report_event(int minor, u8 const *data)if (!new_value)return -ENOMEM ; +mutex_lock (&device->readers_lock);mutex_lock (&device->cbuf_lock); report = &device->cbuf[device->cbuf_end];
@@ -279,6 +280,7 @@ int roccat_report_event(int minor, u8 const *data) }mutex_unlock (&device->cbuf_lock); +mutex_unlock (&device->readers_lock);wake_up_interruptible (&device->wait);return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 41/198 ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arthur Husband <[email protected]>
[ Upstream commit 105c42566a550e2d05fc14f763216a8765ee5d0e ]
The JMicron JMB585 (and JMB582) SATA controllers advertise 64-bit DMA support via the S64A bit in the AHCI CAP register, but their 64-bit DMA implementation is defective. Under sustained I/O, DMA transfers targeting addresses above 4GB silently corrupt data -- writes land at incorrect memory addresses with no errors logged.
The failure pattern is similar to the ASMedia ASM1061 (commit 20730e9b2778 ("ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers")), which also falsely advertised full 64-bit DMA support. However, the JMB585 requires a stricter 32-bit DMA mask rather than 43-bit, as corruption occurs with any address above 4GB.
On the Minisforum N5 Pro specifically, the combination of the JMB585's broken 64-bit DMA with the AMD Family 1Ah (Strix Point) IOMMU causes silent data corruption that is only detectable via checksumming filesystems (BTRFS/ZFS scrub). The corruption occurs when 32-bit IOVA space is exhausted and the kernel transparently switches to 64-bit DMA addresses.
Add device-specific PCI ID entries for the JMB582 (0x0582) and JMB585 (0x0585) before the generic JMicron class match, using a new board type that combines AHCI_HFLAG_IGN_IRQ_IF_ERR (preserving existing behavior) with AHCI_HFLAG_32BIT_ONLY to force 32-bit DMA masks.
--- drivers/ata/ahci.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/ata/ahci.c +14 -0
@@ -68,6 +68,7 @@ enum board_ids {/* board IDs for specific chipsets in alphabetical order */ board_ahci_al, board_ahci_avn, + board_ahci_jmb585, board_ahci_mcp65, board_ahci_mcp77, board_ahci_mcp89,
@@ -212,6 +213,15 @@ static const struct ata_port_info ahci_port_info[] = { .udma_mask = ATA_UDMA6, .port_ops = &ahci_avn_ops, }, + /* JMicron JMB582/585: 64-bit DMA is broken, force 32-bit */ + [board_ahci_jmb585] = { +AHCI_HFLAGS (AHCI_HFLAG_IGN_IRQ_IF_ERR | + AHCI_HFLAG_32BIT_ONLY), + .flags = AHCI_FLAG_COMMON, + .pio_mask = ATA_PIO4, + .udma_mask = ATA_UDMA6, + .port_ops = &ahci_ops, + }, [board_ahci_mcp65] = {AHCI_HFLAGS (AHCI_HFLAG_NO_FPDMA_AA |AHCI_HFLAG_NO_PMP | AHCI_HFLAG_YES_NCQ),
@@ -439,6 +449,10 @@ static const struct pci_device_id ahci_pci_tbl[] = {/* Elkhart Lake IDs 0x4b60 & 0x4b62 https://sata-io.org/product/8803 not tested yet */ { PCI_VDEVICE(INTEL, 0x4b63), board_ahci_pcs_quirk }, /* Elkhart Lake AHCI */ +/* JMicron JMB582/585: force 32-bit DMA (broken 64-bit implementation) */ + { PCI_VDEVICE(JMICRON, 0x0582), board_ahci_jmb585 }, + { PCI_VDEVICE(JMICRON, 0x0585), board_ahci_jmb585 }, +/* JMicron 360/1/3/5/6, match class to avoid IDE function */ { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci_ign_iferr },
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 42/198 wifi: brcmfmac: validate bsscfg indices in IF events
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 304950a467d83678bd0b0f46331882e2ac23b12d ]
brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw bsscfgidx field as an array index without a matching range check.
Reject IF events whose bsscfg index does not fit in drvr->iflist[] before indexing the interface array.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c +5 -0
@@ -153,6 +153,11 @@ static void brcmf_fweh_handle_if_event(struct brcmf_pub *drvr,bphy_err (drvr,"invalid interface index: %u\n" , ifevent->ifidx);return ; } +if (ifevent->bsscfgidx >=BRCMF_MAX_IFS ) { +bphy_err (drvr,"invalid bsscfg index: %u\n" , + ifevent->bsscfgidx); +return ; + } ifp = drvr->iflist[ifevent->bsscfgidx];
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 43/198 net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Pavlick <[email protected]>
[ Upstream commit 95aca8602ef70ffd3d971675751c81826e124f90 ]
Several GPON ONT SFP sticks based on Realtek RTL960x report 1000BASE-LX at 1300MBd in their EEPROM but can operate at 2500base-X. On hosts capable of 2500base-X (e.g. Banana Pi R3 / MT7986), the kernel negotiates only 1G because it trusts the incorrect EEPROM data.
Add quirks for:
- Hisense-Leox LXT-010S-H
- Hisense ZNID-GPON-2311NA
- HSGQ HSGQ-XPON-Stick
Each quirk advertises 2500base-X and ignores TX_FAULT during the module's ~40s Linux boot time.
Tested on Banana Pi R3 (MT7986) with OpenWrt 25.12.1, confirmed 2.5Gbps link and full throughput with flow offloading.
--- drivers/net/phy/sfp.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/net/phy/sfp.c +16 -0
@@ -543,6 +543,22 @@ static const struct sfp_quirk sfp_quirks[] = {SFP_QUIRK ("HUAWEI" ,"MA5671A" , sfp_quirk_2500basex, sfp_fixup_ignore_tx_fault_and_los), +// Hisense LXT-010S-H is a GPON ONT SFP (sold as LEOX LXT-010S-H) that +// can operate at 2500base-X, but reports 1000BASE-LX / 1300MBd in its +// EEPROM +SFP_QUIRK ("Hisense-Leox" ,"LXT-010S-H" , sfp_quirk_2500basex, + sfp_fixup_ignore_tx_fault), + +// Hisense ZNID-GPON-2311NA can operate at 2500base-X, but reports +// 1000BASE-LX / 1300MBd in its EEPROM +SFP_QUIRK ("Hisense" ,"ZNID-GPON-2311NA" , sfp_quirk_2500basex, + sfp_fixup_ignore_tx_fault), + +// HSGQ HSGQ-XPON-Stick can operate at 2500base-X, but reports +// 1000BASE-LX / 1300MBd in its EEPROM +SFP_QUIRK ("HSGQ" ,"HSGQ-XPON-Stick" , sfp_quirk_2500basex, + sfp_fixup_ignore_tx_fault), +// Lantech 8330-262D-E and 8330-265D can operate at 2500base-X, but // incorrectly report 2500MBd NRZ in their EEPROM. // Some 8330-265D modules have inverted LOS, while all of them report
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 44/198 x86: shadow stacks: proper error handling for mmap lock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
[ Upstream commit 52f657e34d7b21b47434d9d8b26fa7f6778b63a0 ]
김영민 reports that shstk_pop_sigframe() doesn't check for errors from mmap_read_lock_killable(), which is a silly oversight, and also shows that we haven't marked those functions with "__must_check", which would have immediately caught it.
So let's fix both issues.
--- arch/x86/kernel/shstk.c | 3 ++- include/linux/mmap_lock.h | 6 +++--- 2 files changed, 5 insertions(+), 4 deletions(-)
arch/x86/kernel/shstk.c +2 -1
@@ -351,7 +351,8 @@ static int shstk_pop_sigframe(unsigned long *ssp) need_to_check_vma =PAGE_ALIGN (*ssp) == *ssp;if (need_to_check_vma) -mmap_read_lock_killable (current->mm); +if (mmap_read_lock_killable (current->mm)) +return -EINTR ; err =get_shstk_data (&token_addr, (unsigned long __user *)*ssp);if (unlikely (err))
include/linux/mmap_lock.h +3 -3
@@ -322,7 +322,7 @@ static inline void mmap_write_lock_nested(struct mm_struct *mm, int subclass)__mmap_lock_trace_acquire_returned (mm, true, true); } -static inline int mmap_write_lock_killable (struct mm_struct *mm) +static inline int __must_check mmap_write_lock_killable (struct mm_struct *mm) {int ret;
@@ -369,7 +369,7 @@ static inline void mmap_read_lock(struct mm_struct *mm)__mmap_lock_trace_acquire_returned (mm, false, true); } -static inline int mmap_read_lock_killable (struct mm_struct *mm) +static inline int __must_check mmap_read_lock_killable (struct mm_struct *mm) {int ret;
@@ -379,7 +379,7 @@ static inline int mmap_read_lock_killable(struct mm_struct *mm)return ret; } -static inline bool mmap_read_trylock (struct mm_struct *mm) +static inline bool __must_check mmap_read_trylock (struct mm_struct *mm) {bool ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 45/198 ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomasz Merta <[email protected]>
[ Upstream commit 0669631dbccd41cf3ca7aa70213fcd8bb41c4b38 ]
The STM32 SAI driver do not set the clock strobing bit (CKSTR) for DSP_A, DSP_B and LEFT_J formats, causing data to be sampled on the wrong BCLK edge when SND_SOC_DAIFMT_NB_NF is used.
Per ALSA convention, NB_NF requires sampling on the rising BCLK edge. The STM32MP25 SAI reference manual states that CKSTR=1 is required for signals received by the SAI to be sampled on the SCK rising edge. Without setting CKSTR=1, the SAI samples on the falling edge, violating the NB_NF convention. For comparison, the NXP FSL SAI driver correctly sets FSL_SAI_CR2_BCP for DSP_A, DSP_B and LEFT_J, consistent with its I2S handling.
This patch adds SAI_XCR1_CKSTR for DSP_A, DSP_B and LEFT_J in stm32_sai_set_dai_fmt which was verified empirically with a cs47l35 codec. RIGHT_J (LSB) is not investigated and addressed by this patch.
Note: the STM32 I2S driver (stm32_i2s_set_dai_fmt) may have the same issue for DSP_A mode, as I2S_CGFR_CKPOL is not set. This has not been verified and is left for a separate investigation.
--- sound/soc/stm/stm32_sai_sub.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/stm/stm32_sai_sub.c +3 -0
@@ -802,6 +802,7 @@ static int stm32_sai_set_dai_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt)break ;/* Left justified */ case SND_SOC_DAIFMT_MSB : + cr1 |=SAI_XCR1_CKSTR ; frcr |=SAI_XFRCR_FSPOL |SAI_XFRCR_FSDEF ;break ;/* Right justified */
@@ -809,9 +810,11 @@ static int stm32_sai_set_dai_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt) frcr |=SAI_XFRCR_FSPOL |SAI_XFRCR_FSDEF ;break ;case SND_SOC_DAIFMT_DSP_A : + cr1 |=SAI_XCR1_CKSTR ; frcr |=SAI_XFRCR_FSPOL |SAI_XFRCR_FSOFF ;break ;case SND_SOC_DAIFMT_DSP_B : + cr1 |=SAI_XCR1_CKSTR ; frcr |=SAI_XFRCR_FSPOL ;break ;default :
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 46/198 soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Potin Lai <[email protected]>
[ Upstream commit 7ec1bd3d9be671d04325b9e06149b8813f6a4836 ]
The siliconid_to_name() function currently masks the input silicon ID with 0xff00ffff, but compares it against unmasked table entries. This causes matching to fail if the table entries contain non-zero values in the bits covered by the mask (bits 16-23).
Update the logic to apply the 0xff00ffff mask to the table entries during comparison. This ensures that only the relevant model and revision bits are considered, providing a consistent match across different manufacturing batches.
[arj: Add Fixes: tag, fix 'soninfo' typo, clarify function reference]
--- drivers/soc/aspeed/aspeed-socinfo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/aspeed/aspeed-socinfo.c +1 -1
@@ -39,7 +39,7 @@ static const char *siliconid_to_name(u32 siliconid)unsigned int i;for (i =0 ; i <ARRAY_SIZE (rev_table) ; ++i) { -if (rev_table[i].id == id) +if ((rev_table[i].id &0xff00ffff ) == id)return rev_table[i].name; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 47/198 arm64: dts: qcom: hamoa/x1: fix idle exit latency
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel J Blueman <[email protected]>
[ Upstream commit 3ecea84d2b90bbf934d5ca75514fa902fd71e03f ]
Designs based on the Qualcomm X1 Hamoa reference platform report:
driver: Idle state 1 target residency too low
This is because the declared X1 idle entry plus exit latency of 680us exceeds the declared minimum 600us residency time:
entry-latency-us = <180>;
exit-latency-us = <500>;
min-residency-us = <600>;
Fix this to be 320us so the sum of the entry and exit latencies matches the downstream 500us exit latency, as directed by Maulik.
Tested on a Lenovo Yoga Slim 7x with Qualcomm X1E-80-100.
--- arch/arm64/boot/dts/qcom/x1e80100.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/x1e80100.dtsi +1 -1
@@ -281,7 +281,7 @@ cluster_c4: cpu-sleep-0 { idle-state-name = "ret"; arm,psci-suspend-param = <0x00000004>; entry-latency-us = <180>; - exit-latency-us = <500>; + exit-latency-us = <320>; min-residency-us = <600>; }; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 48/198 arm64: dts: qcom: qcm6490-idp: Fix WCD9370 reset GPIO polarity
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ravi Hothi <[email protected]>
[ Upstream commit b7df21c59739cceb7b866c6c5e8a6ba03875ab71 ]
The WCD9370 audio codec reset line on QCM6490 IDP should be active-low, but the device tree described it as active-high. As a result, the codec is kept in reset and fails to reset the SoundWire, leading to timeouts and ASoC card probe failure (-ETIMEDOUT).
Fix the reset GPIO polarity to GPIO_ACTIVE_LOW so the codec can properly initialize.
--- arch/arm64/boot/dts/qcom/qcm6490-idp.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/qcm6490-idp.dts +1 -1
@@ -177,7 +177,7 @@ wcd9370: audio-codec-0 { pinctrl-0 = <&wcd_default>; pinctrl-names = "default"; - reset-gpios = <&tlmm 83 GPIO_ACTIVE_HIGH>; + reset-gpios = <&tlmm 83 GPIO_ACTIVE_LOW>; vdd-buck-supply = <&vreg_l17b_1p7>; vdd-rxtx-supply = <&vreg_l18b_1p8>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 49/198 arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Krzyszkowiak <[email protected]>
[ Upstream commit 1f99b5d93d99ca17d50b386a674d0ce1f20932d8 ]
According to i.MX 8M Quad Reference Manual, GPU_AHB_CLK_ROOT's maximum frequency is 400MHz.
--- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8mq.dtsi +1 -1
@@ -1632,7 +1632,7 @@ gpu: gpu@38000000 { <&clk IMX8MQ_GPU_PLL_OUT>, <&clk IMX8MQ_GPU_PLL>; assigned-clock-rates = <800000000>, <800000000>, - <800000000>, <800000000>, <0>; + <800000000>, <400000000>, <0>; power-domains = <&pgc_gpu>; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 50/198 arm64: dts: imx93-9x9-qsb: change usdhc tuning step for eMMC and SD
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luke Wang <[email protected]>
[ Upstream commit 08903184553def7ba1ad6ba4fa8afe1ba2ee0a21 ]
During system resume, the following errors occurred:
[ 430.638625] mmc1: error -84 writing Cache Enable bit [ 430.643618] mmc1: error -84 doing runtime resume
For eMMC and SD, there are two tuning pass windows and the gap between those two windows may only have one cell. If tuning step > 1, the gap may just be skipped and host assumes those two windows as a continuous windows. This will cause a wrong delay cell near the gap to be selected.
Set the tuning step to 1 to avoid selecting the wrong delay cell.
For SDIO, the gap is sufficiently large, so the default tuning step does not cause this issue.
--- arch/arm64/boot/dts/freescale/imx93-9x9-qsb.dts | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/freescale/imx93-9x9-qsb.dts +2 -0
@@ -507,6 +507,7 @@ &usdhc1 { pinctrl-2 = <&pinctrl_usdhc1_200mhz>; bus-width = <8>; non-removable; + fsl,tuning-step = <1>; status = "okay"; };
@@ -519,6 +520,7 @@ &usdhc2 { vmmc-supply = <®_usdhc2_vmmc>; bus-width = <4>; no-mmc; + fsl,tuning-step = <1>; status = "okay"; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 51/198 arm64: dts: imx91-tqma9131: improve eMMC pad configuration
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Niebel <[email protected]>
[ Upstream commit 44db7bc66eb38e85bb32777c5fd3a4e7baa84147 ]
Use DSE x4 an PullUp for CMD an DAT, DSE x4 and PullDown for CLK to improve stability and detection at low temperatures under -25°C.
--- .../boot/dts/freescale/imx91-tqma9131.dtsi | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
arch/arm64/boot/dts/freescale/imx91-tqma9131.dtsi +10 -10
@@ -272,20 +272,20 @@ pinctrl_reg_usdhc2_vmmc: regusdhc2vmmcgrp { /* enable SION for data and cmd pad due to ERR052021 */ pinctrl_usdhc1: usdhc1grp { fsl,pins = /* PD | FSEL 3 | DSE X5 */ - <MX91_PAD_SD1_CLK__USDHC1_CLK 0x5be>, + <MX91_PAD_SD1_CLK__USDHC1_CLK 0x59e>, /* HYS | FSEL 0 | no drive */ <MX91_PAD_SD1_STROBE__USDHC1_STROBE 0x1000>, /* HYS | FSEL 3 | X5 */ - <MX91_PAD_SD1_CMD__USDHC1_CMD 0x400011be>, + <MX91_PAD_SD1_CMD__USDHC1_CMD 0x4000139e>, /* HYS | FSEL 3 | X4 */ - <MX91_PAD_SD1_DATA0__USDHC1_DATA0 0x4000119e>, - <MX91_PAD_SD1_DATA1__USDHC1_DATA1 0x4000119e>, - <MX91_PAD_SD1_DATA2__USDHC1_DATA2 0x4000119e>, - <MX91_PAD_SD1_DATA3__USDHC1_DATA3 0x4000119e>, - <MX91_PAD_SD1_DATA4__USDHC1_DATA4 0x4000119e>, - <MX91_PAD_SD1_DATA5__USDHC1_DATA5 0x4000119e>, - <MX91_PAD_SD1_DATA6__USDHC1_DATA6 0x4000119e>, - <MX91_PAD_SD1_DATA7__USDHC1_DATA7 0x4000119e>; + <MX91_PAD_SD1_DATA0__USDHC1_DATA0 0x4000139e>, + <MX91_PAD_SD1_DATA1__USDHC1_DATA1 0x4000139e>, + <MX91_PAD_SD1_DATA2__USDHC1_DATA2 0x4000139e>, + <MX91_PAD_SD1_DATA3__USDHC1_DATA3 0x4000139e>, + <MX91_PAD_SD1_DATA4__USDHC1_DATA4 0x4000139e>, + <MX91_PAD_SD1_DATA5__USDHC1_DATA5 0x4000139e>, + <MX91_PAD_SD1_DATA6__USDHC1_DATA6 0x4000139e>, + <MX91_PAD_SD1_DATA7__USDHC1_DATA7 0x4000139e>; }; pinctrl_wdog: wdoggrp {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 52/198 arm64: dts: imx93-tqma9352: improve eMMC pad configuration
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Niebel <[email protected]>
[ Upstream commit b6c94c71f349479b76fcc0ef0dc7147f3f326dff ]
Use DSE x4 an PullUp for CMD an DAT, DSE x4 and PullDown for CLK to improve stability and detection at low temperatures under -25°C.
--- .../boot/dts/freescale/imx93-tqma9352.dtsi | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-)
arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi +13 -13
@@ -270,21 +270,21 @@ MX93_PAD_SD2_RESET_B__GPIO3_IO07 0x106 /* enable SION for data and cmd pad due to ERR052021 */ pinctrl_usdhc1: usdhc1grp { fsl,pins = < - /* PD | FSEL 3 | DSE X5 */ - MX93_PAD_SD1_CLK__USDHC1_CLK 0x5be + /* PD | FSEL 3 | DSE X4 */ + MX93_PAD_SD1_CLK__USDHC1_CLK 0x59e /* HYS | FSEL 0 | no drive */ MX93_PAD_SD1_STROBE__USDHC1_STROBE 0x1000 - /* HYS | FSEL 3 | X5 */ - MX93_PAD_SD1_CMD__USDHC1_CMD 0x400011be - /* HYS | FSEL 3 | X4 */ - MX93_PAD_SD1_DATA0__USDHC1_DATA0 0x4000119e - MX93_PAD_SD1_DATA1__USDHC1_DATA1 0x4000119e - MX93_PAD_SD1_DATA2__USDHC1_DATA2 0x4000119e - MX93_PAD_SD1_DATA3__USDHC1_DATA3 0x4000119e - MX93_PAD_SD1_DATA4__USDHC1_DATA4 0x4000119e - MX93_PAD_SD1_DATA5__USDHC1_DATA5 0x4000119e - MX93_PAD_SD1_DATA6__USDHC1_DATA6 0x4000119e - MX93_PAD_SD1_DATA7__USDHC1_DATA7 0x4000119e + /* HYS | PU | FSEL 3 | DSE X4 */ + MX93_PAD_SD1_CMD__USDHC1_CMD 0x4000139e + /* HYS | PU | FSEL 3 | DSE X4 */ + MX93_PAD_SD1_DATA0__USDHC1_DATA0 0x4000139e + MX93_PAD_SD1_DATA1__USDHC1_DATA1 0x4000139e + MX93_PAD_SD1_DATA2__USDHC1_DATA2 0x4000139e + MX93_PAD_SD1_DATA3__USDHC1_DATA3 0x4000139e + MX93_PAD_SD1_DATA4__USDHC1_DATA4 0x4000139e + MX93_PAD_SD1_DATA5__USDHC1_DATA5 0x4000139e + MX93_PAD_SD1_DATA6__USDHC1_DATA6 0x4000139e + MX93_PAD_SD1_DATA7__USDHC1_DATA7 0x4000139e >; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 53/198 arm64: dts: qcom: monaco: Fix UART10 pinconf
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <[email protected]>
[ Upstream commit 5b2a16ab0dbd090dc545c05ee79a077cc7a9c1e0 ]
UART10 RTS and TX pins were incorrectly mapped to gpio84 and gpio85. Correct them to gpio85 (RTS) and gpio86 (TX) to match the hardware I/O mapping.
--- arch/arm64/boot/dts/qcom/qcs8300.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/qcs8300.dtsi +2 -2
@@ -5430,12 +5430,12 @@ qup_uart10_cts: qup-uart10-cts-state { }; qup_uart10_rts: qup-uart10-rts-state { - pins = "gpio84"; + pins = "gpio85"; function = "qup1_se2"; }; qup_uart10_tx: qup-uart10-tx-state { - pins = "gpio85"; + pins = "gpio86"; function = "qup1_se2"; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 54/198 soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukesh Ojha <[email protected]>
[ Upstream commit 641f6fda143b879da1515f821ee475073678cf2a ]
It looks element length declared in servreg_loc_pfr_req_ei for reason not matching servreg_loc_pfr_req's reason field due which we could observe decoding error on PD crash.
qmi_decode_string_elem: String len 81 >= Max Len 65
Fix this by matching with servreg_loc_pfr_req's reason field.
--- drivers/soc/qcom/pdr_internal.h | 2 +- drivers/soc/qcom/qcom_pdr_msg.c | 2 +- include/linux/soc/qcom/pdr.h | 1 + 3 files changed, 3 insertions(+), 2 deletions(-)
drivers/soc/qcom/pdr_internal.h +1 -1
@@ -84,7 +84,7 @@ struct servreg_set_ack_resp {struct servreg_loc_pfr_req {char service[SERVREG_NAME_LENGTH +1 ]; -char reason[257 ]; +char reason[SERVREG_PFR_LENGTH +1 ]; };struct servreg_loc_pfr_resp {
drivers/soc/qcom/qcom_pdr_msg.c +1 -1
@@ -325,7 +325,7 @@ const struct qmi_elem_info servreg_loc_pfr_req_ei[] = { }, { .data_type = QMI_STRING, - .elem_len = SERVREG_NAME_LENGTH + 1, + .elem_len = SERVREG_PFR_LENGTH + 1, .elem_size = sizeof(char), .array_type = VAR_LEN_ARRAY, .tlv_type = 0x02,
include/linux/soc/qcom/pdr.h +1 -0
@@ -5,6 +5,7 @@#include <linux/soc/qcom/qmi.h> #define SERVREG_NAME_LENGTH 64 +#define SERVREG_PFR_LENGTH 256struct pdr_service ;struct pdr_handle ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 55/198 tools/power/turbostat: Fix microcode patch level output for AMD/Hygon
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serhii Pievniev <[email protected]>
[ Upstream commit a444083286434ec1fd127c5da11a3091e6013008 ]
turbostat always used the same logic to read the microcode patch level, which is correct for Intel but not for AMD/Hygon.
While Intel stores the patch level in the upper 32 bits of MSR, AMD stores it in the lower 32 bits, which causes turbostat to report the microcode version as 0x0 on AMD/Hygon.
Fix by shifting right by 32 for non-AMD/Hygon, preserving the existing behavior for Intel and unknown vendors.
--- tools/power/x86/turbostat/turbostat.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
tools/power/x86/turbostat/turbostat.c +6 -3
@@ -8842,10 +8842,13 @@ void process_cpuid() edx_flags = edx;if (!no_msr) { -if (get_msr (sched_getcpu (),MSR_IA32_UCODE_REV , &ucode_patch)) +if (get_msr (sched_getcpu (),MSR_IA32_UCODE_REV , &ucode_patch)) {warnx ("get_msr(UCODE)" ); -else + }else { ucode_patch_valid = true; +if (!authentic_amd && !hygon_genuine) + ucode_patch >>=32 ; + } }/*
@@ -8860,7 +8863,7 @@ void process_cpuid()fprintf (outf,"CPUID(1): family:model:stepping 0x%x:%x:%x (%d:%d:%d)" , family, model, stepping, family, model, stepping);if (ucode_patch_valid) -fprintf (outf," microcode 0x%x" , (unsigned int )((ucode_patch >>32 ) &0xFFFFFFFF )); +fprintf (outf," microcode 0x%x" , (unsigned int )ucode_patch);fputc ('\n' , outf);fprintf (outf,"CPUID(0x80000000): max_extended_levels: 0x%x\n" , max_extended_level);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 56/198 tools/power turbostat: Fix --show/--hide for individual cpuidle counters
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Bityutskiy <[email protected]>
[ Upstream commit b6398bc2ef3a78f1be37ba01ae0a5eedaee47803 ]
Problem: individual swidle counter names (C1, C1+, C1-, etc.) cannot be selected via --show/--hide due to two bugs in probe_cpuidle_counts():
1. The function returns immediately when BIC_cpuidle is not enabled, without checking deferred_add_index.
2. The deferred name check runs against name_buf before the trailing newline is stripped, so is_deferred_add("C1\n") never matches "C1".
Fix:
1. Relax the early return to pass through when deferred names are queued.
2. Strip the trailing newline from name_buf before performing deferred name checks.
3. Check each suffixed variant (C1+, C1, C1-) individually so that e.g. "--show C1+" enables only the requested metric.
In addition, introduce a helper function to avoid repeating the condition (readability cleanup).
--- tools/power/x86/turbostat/turbostat.c | 35 ++++++++++++++++----------- 1 file changed, 21 insertions(+), 14 deletions(-)
tools/power/x86/turbostat/turbostat.c +21 -14
@@ -10890,6 +10890,14 @@ void probe_cpuidle_residency(void) } } +static bool cpuidle_counter_wanted (char *name) +{ +if (is_deferred_skip (name)) +return false; + +return DO_BIC (BIC_cpuidle) ||is_deferred_add (name); +} +void probe_cpuidle_counts (void ) {char path[64 ];
@@ -10899,7 +10907,7 @@ void probe_cpuidle_counts(void)int min_state =1024 , max_state =0 ;char *sp; -if (!DO_BIC (BIC_cpuidle)) +if (!DO_BIC (BIC_cpuidle) && !deferred_add_index)return ;for (state =10 ; state >=0 ; --state) {
@@ -10914,12 +10922,6 @@ void probe_cpuidle_counts(void)remove_underbar (name_buf); -if (!DO_BIC (BIC_cpuidle) && !is_deferred_add (name_buf)) -continue ; - -if (is_deferred_skip (name_buf)) -continue ; -/* truncate "C1-HSW\n" to "C1", or truncate "C1\n" to "C1" */ sp =strchr (name_buf,'-' );if (!sp)
@@ -10934,16 +10936,19 @@ void probe_cpuidle_counts(void)* Add 'C1+' for C1, and so on. The 'below' sysfs file always contains 0 for * the last state, so do not add it. */ - *sp ='+' ; *(sp +1 ) ='\0' ; -sprintf (path,"cpuidle/state%d/below" , state); -add_counter (0 , path, name_buf,64 ,SCOPE_CPU ,COUNTER_ITEMS ,FORMAT_DELTA ,SYSFS_PERCPU ,0 ); +if (cpuidle_counter_wanted (name_buf)) { +sprintf (path,"cpuidle/state%d/below" , state); +add_counter (0 , path, name_buf,64 ,SCOPE_CPU ,COUNTER_ITEMS ,FORMAT_DELTA ,SYSFS_PERCPU ,0 ); + } } *sp ='\0' ; -sprintf (path,"cpuidle/state%d/usage" , state); -add_counter (0 , path, name_buf,64 ,SCOPE_CPU ,COUNTER_ITEMS ,FORMAT_DELTA ,SYSFS_PERCPU ,0 ); +if (cpuidle_counter_wanted (name_buf)) { +sprintf (path,"cpuidle/state%d/usage" , state); +add_counter (0 , path, name_buf,64 ,SCOPE_CPU ,COUNTER_ITEMS ,FORMAT_DELTA ,SYSFS_PERCPU ,0 ); + }/* * The 'above' sysfs file always contains 0 for the shallowest state (smallest
@@ -10952,8 +10957,10 @@ void probe_cpuidle_counts(void)if (state != min_state) { *sp ='-' ; *(sp +1 ) ='\0' ; -sprintf (path,"cpuidle/state%d/above" , state); -add_counter (0 , path, name_buf,64 ,SCOPE_CPU ,COUNTER_ITEMS ,FORMAT_DELTA ,SYSFS_PERCPU ,0 ); +if (cpuidle_counter_wanted (name_buf)) { +sprintf (path,"cpuidle/state%d/above" , state); +add_counter (0 , path, name_buf,64 ,SCOPE_CPU ,COUNTER_ITEMS ,FORMAT_DELTA ,SYSFS_PERCPU ,0 ); + } } } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 57/198 arm64: dts: qcom: monaco: Reserve full Gunyah metadata region
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <[email protected]>
[ Upstream commit 85d98669fa7f1d3041d962515e45ee6e392db6f8 ]
We observe spurious "Synchronous External Abort" exceptions (ESR=0x96000010) and kernel crashes on Monaco-based platforms. These faults are caused by the kernel inadvertently accessing hypervisor-owned memory that is not properly marked as reserved.
Quoted 1 line
From boot log, The Qualcomm hypervisor reports the memory range
at 0x91a80000 of size 0x80000 (512 KiB) as hypervisor-owned:qhee_hyp_assign_remove_memory: 0x91a80000/0x80000 -> ret 0
However, the EFI memory map provided by firmware only reserves the subrange 0x91a40000–0x91a87fff (288 KiB). The remaining portion (0x91a88000–0x91afffff) is incorrectly reported as conventional memory (from efi debug):
efi: 0x000091a40000-0x000091a87fff [Reserved...] efi: 0x000091a88000-0x0000938fffff [Conventional...]
As a result, the allocator may hand out PFNs inside the hypervisor owned region, causing fatal aborts when the kernel accesses those addresses.
Add a reserved-memory carveout for the Gunyah hypervisor metadata at 0x91a80000 (512 KiB) and mark it as no-map so Linux does not map or allocate from this area.
For the record:
Hyp version: gunyah-e78adb36e debug (2025-11-17 05:38:05 UTC) UEFI Ver: 6.0.260122.BOOT.MXF.1.0.c1-00449-KODIAKLA-1
--- arch/arm64/boot/dts/qcom/qcs8300.dtsi | 5 +++++ 1 file changed, 5 insertions(+)
arch/arm64/boot/dts/qcom/qcs8300.dtsi +5 -0
@@ -756,6 +756,11 @@ smem_mem: smem@90900000 { hwlocks = <&tcsr_mutex 3>; }; + gunyah_md_mem: gunyah-md-region@91a80000 { + reg = <0x0 0x91a80000 0x0 0x80000>; + no-map; + }; + lpass_machine_learning_mem: lpass-machine-learning-region@93b00000 { reg = <0x0 0x93b00000 0x0 0xf00000>; no-map;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 58/198 ARM: dts: microchip: sam9x7: fix gpio-lines count for pioB
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mihai Sain <[email protected]>
[ Upstream commit 907150bbe566e23714a25d7bcb910f236c3c44c0 ]
The pioB controller on the SAM9X7 SoC actually supports 27 GPIO lines. The previous value of 26 was incorrect, leading to the last pin being unavailable for use by the GPIO subsystem.
Update the #gpio-lines property to reflect
the correct hardware specification.
--- arch/arm/boot/dts/microchip/sam9x7.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/microchip/sam9x7.dtsi +1 -1
@@ -1226,7 +1226,7 @@ pioB: gpio@fffff600 { interrupt-controller; #gpio-cells = <2>; gpio-controller; - #gpio-lines = <26>; + #gpio-lines = <27>; clocks = <&pmc PMC_TYPE_PERIPHERAL 3>; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 59/198 PCI: hv: Set default NUMA node to 0 for devices without affinity info
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
[ Upstream commit 7b3b1e5a87b2f5e35c52b5386d7c327be869454f ]
When hv_pci_assign_numa_node() processes a device that does not have HV_PCI_DEVICE_FLAG_NUMA_AFFINITY set or has an out-of-range virtual_numa_node, the device NUMA node is left unset. On x86_64, the uninitialized default happens to be 0, but on ARM64 it is NUMA_NO_NODE (-1).
Tests show that when no NUMA information is available from the Hyper-V host, devices perform best when assigned to node 0. With NUMA_NO_NODE the kernel may spread work across NUMA nodes, which degrades performance on Hyper-V, particularly for high-throughput devices like MANA.
Always set the device NUMA node to 0 before the conditional NUMA affinity check, so that devices get a performant default when the host provides no NUMA information, and behavior is consistent on both x86_64 and ARM64.
--- drivers/pci/controller/pci-hyperv.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/pci/controller/pci-hyperv.c +8 -0
@@ -2486,6 +2486,14 @@ static void hv_pci_assign_numa_node(struct hv_pcibus_device *hbus)if (!hv_dev)continue ; +/* +* If the Hyper-V host doesn't provide a NUMA node for the +* device, default to node 0. With NUMA_NO_NODE the kernel +* may spread work across NUMA nodes, which degrades +* performance on Hyper-V. +*/ +set_dev_node (&dev->dev,0 ); +if (hv_dev->desc.flags &HV_PCI_DEVICE_FLAG_NUMA_AFFINITY && hv_dev->desc.virtual_numa_node <num_possible_nodes ())/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 60/198 HID: amd_sfh: dont log error when device discovery fails with -EOPNOTSUPP
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maximilian Pezzullo <[email protected]>
[ Upstream commit 743677a8cb30b09f16a7f167f497c2c927891b5a ]
When sensor discovery fails on systems without AMD SFH sensors, the code already emits a warning via dev_warn() in amd_sfh_hid_client_init(). The subsequent dev_err() in sfh_init_work() for the same -EOPNOTSUPP return value is redundant and causes unnecessary alarm.
Suppress the dev_err() for -EOPNOTSUPP to avoid confusing users who have no AMD SFH sensors.
--- drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/hid/amd-sfh-hid/amd_sfh_pcie.c +2 -1
@@ -413,7 +413,8 @@ static void sfh_init_work(struct work_struct *work) rc =amd_sfh_hid_client_init (mp2);if (rc) {amd_sfh_clear_intr (mp2); -dev_err (&pdev->dev,"amd_sfh_hid_client_init failed err %d\n" , rc); +if (rc != -EOPNOTSUPP ) +dev_err (&pdev->dev,"amd_sfh_hid_client_init failed err %d\n" , rc);return ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 61/198 xfrm: account XFRMA_IF_ID in aevent size calculation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keenan Dong <[email protected]>
[ Upstream commit 7081d46d32312f1a31f0e0e99c6835a394037599 ]
xfrm_get_ae() allocates the reply skb with xfrm_aevent_msgsize(), then build_aevent() appends attributes including XFRMA_IF_ID when x->if_id is set.
xfrm_aevent_msgsize() does not include space for XFRMA_IF_ID. For states with if_id, build_aevent() can fail with -EMSGSIZE and hit BUG_ON(err < 0) in xfrm_get_ae(), turning a malformed netlink interaction into a kernel panic.
Account XFRMA_IF_ID in the size calculation unconditionally and replace the BUG_ON with normal error unwinding.
--- net/xfrm/xfrm_user.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
net/xfrm/xfrm_user.c +8 -2
@@ -2668,7 +2668,8 @@ static inline unsigned int xfrm_aevent_msgsize(struct xfrm_state *x) +nla_total_size (4 )/* XFRM_AE_RTHR */ +nla_total_size (4 )/* XFRM_AE_ETHR */ +nla_total_size (sizeof (x->dir))/* XFRMA_SA_DIR */ - +nla_total_size (4 );/* XFRMA_SA_PCPU */ + +nla_total_size (4 )/* XFRMA_SA_PCPU */ + +nla_total_size (sizeof (x->if_id));/* XFRMA_IF_ID */ }static int build_aevent (struct sk_buff *skb,struct xfrm_state *x,const struct km_event *c)
@@ -2780,7 +2781,12 @@ static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh, c.portid = nlh->nlmsg_pid; err =build_aevent (r_skb, x, &c); -BUG_ON (err <0 ); +if (err <0 ) { +spin_unlock_bh (&x->lock); +xfrm_state_put (x); +kfree_skb (r_skb); +return err; + } err =nlmsg_unicast (net->xfrm.nlsk, r_skb,NETLINK_CB (skb).portid);spin_unlock_bh (&x->lock);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 62/198 dma-mapping: add DMA_ATTR_CPU_CACHE_CLEAN
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <[email protected]>
[ Upstream commit 61868dc55a119a5e4b912d458fc2c48ba80a35fe ]
When multiple small DMA_FROM_DEVICE or DMA_BIDIRECTIONAL buffers share a cacheline, and DMA_API_DEBUG is enabled, we get this warning:
cacheline tracking EEXIST, overlapping mappings aren't supported.
This is because when one of the mappings is removed, while another one is active, CPU might write into the buffer.
Add an attribute for the driver to promise not to do this, making the overlapping safe, and suppressing the warning.
Message-ID: <2d5d091f9d84b68ea96abd545b365dd1d00bbf48.1767601130.git.mst@redhat.com>
Stable-dep-of: 3d48c9fd78dd ("dma-debug: suppress cacheline overlap warning when arch has no DMA alignment requirement")
--- include/linux/dma-mapping.h | 7 +++++++ kernel/dma/debug.c | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-)
include/linux/dma-mapping.h +7 -0
@@ -78,6 +78,13 @@*/ #define DMA_ATTR_MMIO (1UL << 10) +/* +* DMA_ATTR_CPU_CACHE_CLEAN: Indicates the CPU will not dirty any cacheline +* overlapping this buffer while it is mapped for DMA. All mappings sharing +* a cacheline must have this attribute for this to be considered safe. +*/ +#define DMA_ATTR_CPU_CACHE_CLEAN (1UL << 11) +/* * A dma_addr_t can hold any valid DMA or bus address for the platform. It can * be given to a device to use as a DMA source or target. It is specific to a
kernel/dma/debug.c +2 -1
@@ -595,7 +595,8 @@ static void add_dma_entry(struct dma_debug_entry *entry, unsigned long attrs)if (rc == -ENOMEM ) {pr_err_once ("cacheline tracking ENOMEM, dma-debug disabled\n" ); global_disable = true; - }else if (rc == -EEXIST && !(attrs &DMA_ATTR_SKIP_CPU_SYNC ) && + }else if (rc == -EEXIST && + !(attrs & (DMA_ATTR_SKIP_CPU_SYNC |DMA_ATTR_CPU_CACHE_CLEAN )) && !(IS_ENABLED (CONFIG_DMA_BOUNCE_UNALIGNED_KMALLOC ) &&is_swiotlb_active (entry->dev))) { err_printk(entry->dev, entry,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 63/198 dma-debug: track cache clean flag in entries
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <[email protected]>
[ Upstream commit d5d846513128c1a3bc2f2d371f6e903177dea443 ]
If a driver is buggy and has 2 overlapping mappings but only sets cache clean flag on the 1st one of them, we warn. But if it only does it for the 2nd one, we don't.
Fix by tracking cache clean flag in the entry.
Message-ID: <0ffb3513d18614539c108b4548cdfbc64274a7d1.1767601130.git.mst@redhat.com>
Stable-dep-of: 3d48c9fd78dd ("dma-debug: suppress cacheline overlap warning when arch has no DMA alignment requirement")
--- kernel/dma/debug.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-)
kernel/dma/debug.c +22 -5
@@ -63,6 +63,7 @@ enum map_err_types {* @sg_mapped_ents: 'mapped_ents' from dma_map_sg * @paddr: physical start address of the mapping * @map_err_type: track whether dma_mapping_error() was checked +* @is_cache_clean: driver promises not to write to buffer while mapped * @stack_len: number of backtrace entries in @stack_entries * @stack_entries: stack of backtrace history */
@@ -76,7 +77,8 @@ struct dma_debug_entry {int sg_call_ents;int sg_mapped_ents;phys_addr_t paddr; -enum map_err_types map_err_type; +enum map_err_types map_err_type; +bool is_cache_clean;#ifdef CONFIG_STACKTRACE unsigned int stack_len;unsigned long stack_entries[DMA_DEBUG_STACKTRACE_ENTRIES ];
@@ -472,12 +474,15 @@ static int active_cacheline_dec_overlap(phys_addr_t cln)return active_cacheline_set_overlap (cln, --overlap); } -static int active_cacheline_insert (struct dma_debug_entry *entry) +static int active_cacheline_insert (struct dma_debug_entry *entry, +bool *overlap_cache_clean) {phys_addr_t cln =to_cacheline_number (entry);unsigned long flags;int rc; + *overlap_cache_clean = false; +/* If the device is not writing memory then we don't have any * concerns about the cpu consuming stale data. This mitigates * legitimate usages of overlapping mappings.
@@ -487,8 +492,16 @@ static int active_cacheline_insert(struct dma_debug_entry *entry)spin_lock_irqsave (&radix_lock, flags); rc =radix_tree_insert (&dma_active_cacheline, cln, entry); -if (rc == -EEXIST ) +if (rc == -EEXIST ) { +struct dma_debug_entry *existing; +active_cacheline_inc_overlap (cln); + existing =radix_tree_lookup (&dma_active_cacheline, cln); +/* A lookup failure here after we got -EEXIST is unexpected. */ +WARN_ON (!existing); +if (existing) + *overlap_cache_clean = existing->is_cache_clean; + }spin_unlock_irqrestore (&radix_lock, flags);return rc;
@@ -583,20 +596,24 @@ DEFINE_SHOW_ATTRIBUTE(dump);*/ static void add_dma_entry (struct dma_debug_entry *entry,unsigned long attrs) { +bool overlap_cache_clean;struct hash_bucket *bucket;unsigned long flags;int rc; + entry->is_cache_clean = !!(attrs &DMA_ATTR_CPU_CACHE_CLEAN ); + bucket =get_hash_bucket (entry, &flags);hash_bucket_add (bucket, entry);put_hash_bucket (bucket, flags); - rc =active_cacheline_insert (entry); + rc =active_cacheline_insert (entry, &overlap_cache_clean);if (rc == -ENOMEM ) {pr_err_once ("cacheline tracking ENOMEM, dma-debug disabled\n" ); global_disable = true; }else if (rc == -EEXIST && - !(attrs & (DMA_ATTR_SKIP_CPU_SYNC |DMA_ATTR_CPU_CACHE_CLEAN )) && + !(attrs &DMA_ATTR_SKIP_CPU_SYNC ) && + !(entry->is_cache_clean && overlap_cache_clean) && !(IS_ENABLED (CONFIG_DMA_BOUNCE_UNALIGNED_KMALLOC ) &&is_swiotlb_active (entry->dev))) { err_printk(entry->dev, entry,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 64/198 dma-debug: suppress cacheline overlap warning when arch has no DMA alignment requirement
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Gavrilov <[email protected]>
[ Upstream commit 3d48c9fd78dd0b1809669ec49c4d0997b8127512 ]
When CONFIG_DMA_API_DEBUG is enabled, the DMA debug infrastructure tracks active mappings per cacheline and warns if two different DMA mappings share the same cacheline ("cacheline tracking EEXIST, overlapping mappings aren't supported").
On x86_64, ARCH_KMALLOC_MINALIGN defaults to 8, so small kmalloc allocations (e.g. the 8-byte hub->buffer and hub->status in the USB hub driver) frequently land in the same 64-byte cacheline. When both are DMA-mapped, this triggers a false positive warning.
This has been reported repeatedly since v5.14 (when the EEXIST check was added) across various USB host controllers and devices including xhci_hcd with USB hubs, USB audio devices, and USB ethernet adapters.
The cacheline overlap is only a real concern on architectures that require DMA buffer alignment to cacheline boundaries (i.e. where ARCH_DMA_MINALIGN >= L1_CACHE_BYTES). On architectures like x86_64 where dma_get_cache_alignment() returns 1, the hardware is cache-coherent and overlapping cacheline mappings are harmless.
Suppress the EEXIST warning when dma_get_cache_alignment() is less than L1_CACHE_BYTES, indicating the architecture does not require cacheline-aligned DMA buffers.
Verified with a kernel module reproducer that performs two kmalloc(8) allocations back-to-back and DMA-maps both:
Before: allocations share a cacheline, EEXIST fires within ~50 pairs
After: same cacheline pair found, but no warning emitted
--- kernel/dma/debug.c | 1 + 1 file changed, 1 insertion(+)
kernel/dma/debug.c +1 -0
@@ -614,6 +614,7 @@ static void add_dma_entry(struct dma_debug_entry *entry, unsigned long attrs) }else if (rc == -EEXIST && !(attrs &DMA_ATTR_SKIP_CPU_SYNC ) && !(entry->is_cache_clean && overlap_cache_clean) && +dma_get_cache_alignment () >=L1_CACHE_BYTES && !(IS_ENABLED (CONFIG_DMA_BOUNCE_UNALIGNED_KMALLOC ) &&is_swiotlb_active (entry->dev))) { err_printk(entry->dev, entry,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 65/198 drm/vc4: Release runtime PM reference after binding V3D
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <[email protected]>
[ Upstream commit aaefbdde9abdc43699e110679c0e10972a5e1c59 ]
The vc4_v3d_bind() function acquires a runtime PM reference via pm_runtime_resume_and_get() to access V3D registers during setup. However, this reference is never released after a successful bind. This prevents the device from ever runtime suspending, since the reference count never reaches zero.
Release the runtime PM reference by adding pm_runtime_put_autosuspend() after autosuspend is configured, allowing the device to runtime suspend after the delay.
--- drivers/gpu/drm/vc4/vc4_v3d.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/vc4/vc4_v3d.c +1 -0
@@ -479,6 +479,7 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)pm_runtime_use_autosuspend (dev);pm_runtime_set_autosuspend_delay (dev,40 );/* a little over 2 frames. */ +pm_runtime_put_autosuspend (dev);return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 66/198 drm/vc4: Fix memory leak of BO array in hang state
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <[email protected]>
[ Upstream commit f4dfd6847b3e5d24e336bca6057485116d17aea4 ]
The hang state's BO array is allocated separately with kzalloc() in vc4_save_hang_state() but never freed in vc4_free_hang_state(). Add the missing kfree() for the BO array before freeing the hang state struct.
--- drivers/gpu/drm/vc4/vc4_gem.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/vc4/vc4_gem.c +1 -0
@@ -61,6 +61,7 @@ vc4_free_hang_state(struct drm_device *dev, struct vc4_hang_state *state)for (i =0 ; i < state->user_state.bo_count; i++)drm_gem_object_put (state->bo[i]); +kfree (state->bo);kfree (state); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 67/198 drm/vc4: Fix a memory leak in hang state error path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <[email protected]>
[ Upstream commit 9525d169e5fd481538cf8c663cc5839e54f2e481 ]
When vc4_save_hang_state() encounters an early return condition, it returns without freeing the previously allocated kernel_state, leaking memory.
Add the missing kfree() calls by consolidating the early return paths into a single place.
--- drivers/gpu/drm/vc4/vc4_gem.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
drivers/gpu/drm/vc4/vc4_gem.c +10 -8
@@ -170,10 +170,8 @@ vc4_save_hang_state(struct drm_device *dev)spin_lock_irqsave (&vc4->job_lock, irqflags); exec[0 ] =vc4_first_bin_job (vc4); exec[1 ] =vc4_first_render_job (vc4); -if (!exec[0 ] && !exec[1 ]) { -spin_unlock_irqrestore (&vc4->job_lock, irqflags); -return ; - } +if (!exec[0 ] && !exec[1 ]) + goto err_free_state;/* Get the bos from both binner and renderer into hang state. */ state->bo_count =0 ;
@@ -190,10 +188,8 @@ vc4_save_hang_state(struct drm_device *dev) kernel_state->bo =kcalloc (state->bo_count,sizeof (*kernel_state->bo),GFP_ATOMIC ); -if (!kernel_state->bo) { -spin_unlock_irqrestore (&vc4->job_lock, irqflags); -return ; - } +if (!kernel_state->bo) + goto err_free_state; k =0 ;for (i =0 ; i <2 ; i++) {
@@ -285,6 +281,12 @@ vc4_save_hang_state(struct drm_device *dev) vc4->hang_state = kernel_state;spin_unlock_irqrestore (&vc4->job_lock, irqflags); } + +return ; + +err_free_state: +spin_unlock_irqrestore (&vc4->job_lock, irqflags); +kfree (kernel_state); } static void
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 68/198 drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <[email protected]>
[ Upstream commit 338c56050d8e892604da97f67bfa8cc4015a955f ]
The mmap callback reads bo->madv without holding madv_lock, racing with concurrent DRM_IOCTL_VC4_GEM_MADVISE calls that modify the field under the same lock. Add the missing locking to prevent the data race.
--- drivers/gpu/drm/vc4/vc4_bo.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/vc4/vc4_bo.c +3 -0
@@ -738,12 +738,15 @@ static int vc4_gem_object_mmap(struct drm_gem_object *obj, struct vm_area_structreturn -EINVAL ; } +mutex_lock (&bo->madv_lock);if (bo->madv !=VC4_MADV_WILLNEED ) {DRM_DEBUG ("mmapping of %s BO not allowed\n" , bo->madv ==VC4_MADV_DONTNEED ?"purgeable" :"purged" ); +mutex_unlock (&bo->madv_lock);return -EINVAL ; } +mutex_unlock (&bo->madv_lock);return drm_gem_dma_mmap (&bo->base, vma); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 69/198 eventpoll: defer struct eventpoll free to RCU grace period
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Carlini <[email protected]>
[ Upstream commit 07712db80857d5d09ae08f3df85a708ecfc3b61f ]
In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurrent thread. Defer the kfree() to an RCU callback to prevent UAF.
--- fs/eventpoll.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/eventpoll.c +5 -1
@@ -226,6 +226,9 @@ struct eventpoll {*/ refcount_t refcount; +/* used to defer freeing past ep_get_upwards_depth_proc() RCU walk */ +struct rcu_head rcu; +#ifdef CONFIG_NET_RX_BUSY_POLL /* used to track busy poll napi_id */ unsigned int napi_id;
@@ -819,7 +822,8 @@ static void ep_free(struct eventpoll *ep)mutex_destroy (&ep->mtx);free_uid (ep->user);wakeup_source_unregister (ep->ws); -kfree (ep); +/* ep_get_upwards_depth_proc() may still hold epi->ep under RCU */ +kfree_rcu (ep, rcu); }/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 70/198 net: sched: act_csum: validate nested VLAN headers
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruide Cao <[email protected]>
[ Upstream commit c842743d073bdd683606cb414eb0ca84465dd834 ]
tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without first ensuring that the full VLAN header is present in the linear area.
If only part of an inner VLAN header is linearized, accessing h_vlan_encapsulated_proto reads past the linear area, and the following skb_pull(VLAN_HLEN) may violate skb invariants.
Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and pulling each nested VLAN header. If the header still is not fully available, drop the packet through the existing error path.
--- net/sched/act_csum.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/sched/act_csum.c +5 -1
@@ -604,8 +604,12 @@ TC_INDIRECT_SCOPE int tcf_csum_act(struct sk_buff *skb, protocol = skb->protocol; orig_vlan_tag_present = true; }else { -struct vlan_hdr *vlan = (struct vlan_hdr *)skb->data; +struct vlan_hdr *vlan; +if (!pskb_may_pull (skb,VLAN_HLEN )) + goto drop; + + vlan = (struct vlan_hdr *)skb->data; protocol = vlan->h_vlan_encapsulated_proto;skb_pull (skb,VLAN_HLEN );skb_reset_network_header (skb);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 71/198 net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b120e4432f9f56c7103133d6a11245e617695adb ]
lapbeth_data_transmit() expects the underlying device type to be ARPHRD_ETHER.
Returning NOTIFY_BAD from lapbeth_device_event() makes sure bonding driver can not break this expectation.
--- drivers/net/wan/lapbether.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/net/wan/lapbether.c +8 -5
@@ -446,33 +446,36 @@ static void lapbeth_free_device(struct lapbethdev *lapbeth)static int lapbeth_device_event (struct notifier_block *this,unsigned long event,void *ptr) { -struct lapbethdev *lapbeth;struct net_device *dev =netdev_notifier_info_to_dev (ptr); +struct lapbethdev *lapbeth;if (dev_net (dev) != &init_net)return NOTIFY_DONE ; -if (!dev_is_ethdev (dev) && !lapbeth_get_x25_dev (dev)) + lapbeth =lapbeth_get_x25_dev (dev); +if (!dev_is_ethdev (dev) && !lapbeth)return NOTIFY_DONE ;switch (event) {case NETDEV_UP :/* New ethernet device -> new LAPB interface */ -if (!lapbeth_get_x25_dev (dev)) +if (!lapbeth)lapbeth_new_device (dev);break ;case NETDEV_GOING_DOWN :/* ethernet device closes -> close LAPB interface */ - lapbeth =lapbeth_get_x25_dev (dev);if (lapbeth)dev_close (lapbeth->axdev);break ;case NETDEV_UNREGISTER :/* ethernet device disappears -> remove LAPB interface */ - lapbeth =lapbeth_get_x25_dev (dev);if (lapbeth)lapbeth_free_device (lapbeth);break ; +case NETDEV_PRE_TYPE_CHANGE : +/* Our underlying device type must not change. */ +if (lapbeth) +return NOTIFY_BAD ; }return NOTIFY_DONE ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 72/198 net: airoha: Fix memory leak in airoha_qdma_rx_process()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit 285fa6b1e03cff78ead0383e1b259c44b95faf90 ]
If an error occurs on the subsequents buffers belonging to the non-linear part of the skb (e.g. due to an error in the payload length reported by the NIC or if we consumed all the available fragments for the skb), the page_pool fragment will not be linked to the skb so it will not return to the pool in the airoha_qdma_rx_process() error path. Fix the memory leak partially reverting commit 'd6d2b0e1538d ("net: airoha: Fix page recycling in airoha_qdma_rx_process()")' and always running page_pool_put_full_page routine in the airoha_qdma_rx_process() error path.
--- drivers/net/ethernet/airoha/airoha_eth.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/airoha/airoha_eth.c +1 -2
@@ -709,9 +709,8 @@ static int airoha_qdma_rx_process(struct airoha_queue *q, int budget)if (q->skb) {dev_kfree_skb (q->skb); q->skb =NULL ; - }else { -page_pool_put_full_page (q->page_pool, page, true); } +page_pool_put_full_page (q->page_pool, page, true); }airoha_qdma_fill_rx_queue (q);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 73/198 ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 4e65a8b8daa18d63255ec58964dd192c7fdd9f8b ]
We need to check __in6_dev_get() for possible NULL value, as suggested by Yiming Qian.
Also add skb_dst_dev_rcu() instead of skb_dst_dev(), and two missing READ_ONCE().
Note that @dev can't be NULL.
--- net/ipv6/ioam6.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-)
net/ipv6/ioam6.c +16 -11
@@ -710,7 +710,9 @@ static void __ioam6_fill_trace_data(struct sk_buff *skb, struct ioam6_schema *sc, unsigned int sclen, bool is_input) { - struct net_device *dev = skb_dst_dev(skb); +/* Note: skb_dst_dev_rcu() can't be NULL at this point. */ +struct net_device *dev =skb_dst_dev_rcu (skb); +struct inet6_dev *i_skb_dev, *idev;struct timespec64 ts;ktime_t tstamp;u64 raw64;
@@ -721,13 +723,16 @@ static void __ioam6_fill_trace_data(struct sk_buff *skb, data = trace->data + trace->remlen *4 - trace->nodelen *4 - sclen *4 ; + i_skb_dev = skb->dev ?__in6_dev_get (skb->dev) :NULL ; + idev =__in6_dev_get (dev); +/* hop_lim and node_id */ if (trace->type.bit0) { byte =ipv6_hdr (skb)->hop_limit;if (is_input) byte--; - raw32 =dev_net (dev)->ipv6.sysctl.ioam6_id; + raw32 =READ_ONCE (dev_net (dev)->ipv6.sysctl.ioam6_id); *(__be32 *)data =cpu_to_be32 ((byte <<24 ) | raw32); data +=sizeof (__be32);
@@ -735,18 +740,18 @@ static void __ioam6_fill_trace_data(struct sk_buff *skb,/* ingress_if_id and egress_if_id */ if (trace->type.bit1) { -if (!skb->dev) +if (!i_skb_dev) raw16 =IOAM6_U16_UNAVAILABLE ;else - raw16 = (__force u16 )READ_ONCE (__in6_dev_get (skb->dev)->cnf.ioam6_id); + raw16 = (__force u16 )READ_ONCE (i_skb_dev->cnf.ioam6_id); *(__be16 *)data =cpu_to_be16 (raw16); data +=sizeof (__be16); -if (dev->flags &IFF_LOOPBACK ) +if ((dev->flags &IFF_LOOPBACK ) || !idev) raw16 =IOAM6_U16_UNAVAILABLE ;else - raw16 = (__force u16 )READ_ONCE (__in6_dev_get (dev)->cnf.ioam6_id); + raw16 = (__force u16 )READ_ONCE (idev->cnf.ioam6_id); *(__be16 *)data =cpu_to_be16 (raw16); data +=sizeof (__be16);
@@ -822,7 +827,7 @@ static void __ioam6_fill_trace_data(struct sk_buff *skb,if (is_input) byte--; - raw64 =dev_net (dev)->ipv6.sysctl.ioam6_id_wide; + raw64 =READ_ONCE (dev_net (dev)->ipv6.sysctl.ioam6_id_wide); *(__be64 *)data =cpu_to_be64 (((u64 )byte <<56 ) | raw64); data +=sizeof (__be64);
@@ -830,18 +835,18 @@ static void __ioam6_fill_trace_data(struct sk_buff *skb,/* ingress_if_id and egress_if_id (wide) */ if (trace->type.bit9) { -if (!skb->dev) +if (!i_skb_dev) raw32 =IOAM6_U32_UNAVAILABLE ;else - raw32 =READ_ONCE (__in6_dev_get (skb->dev)->cnf.ioam6_id_wide); + raw32 =READ_ONCE (i_skb_dev->cnf.ioam6_id_wide); *(__be32 *)data =cpu_to_be32 (raw32); data +=sizeof (__be32); -if (dev->flags &IFF_LOOPBACK ) +if ((dev->flags &IFF_LOOPBACK ) || !idev) raw32 =IOAM6_U32_UNAVAILABLE ;else - raw32 =READ_ONCE (__in6_dev_get (dev)->cnf.ioam6_id_wide); + raw32 =READ_ONCE (idev->cnf.ioam6_id_wide); *(__be32 *)data =cpu_to_be32 (raw32); data +=sizeof (__be32);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 74/198 bridge: guard local VLAN-0 FDB helpers against NULL vlan group
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijing Yin <[email protected]>
[ Upstream commit 1979645e1842cb7017525a61a0e0e0beb924d02a ]
When CONFIG_BRIDGE_VLAN_FILTERING is not set, br_vlan_group() and nbp_vlan_group() return NULL (br_private.h stub definitions). The BR_BOOLOPT_FDB_LOCAL_VLAN_0 toggle code is compiled unconditionally and reaches br_fdb_delete_locals_per_vlan_port() and br_fdb_insert_locals_per_vlan_port(), where the NULL vlan group pointer is dereferenced via list_for_each_entry(v, &vg->vlan_list, vlist).
The observed crash is in the delete path, triggered when creating a bridge with IFLA_BR_MULTI_BOOLOPT containing BR_BOOLOPT_FDB_LOCAL_VLAN_0 via RTM_NEWLINK. The insert helper has the same bug pattern.
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] KASAN NOPTI KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7] RIP: 0010:br_fdb_delete_locals_per_vlan+0x2b9/0x310 Call Trace: br_fdb_toggle_local_vlan_0+0x452/0x4c0 br_toggle_fdb_local_vlan_0+0x31/0x80 net/bridge/br.c:276 br_boolopt_toggle net/bridge/br.c:313 br_boolopt_multi_toggle net/bridge/br.c:364 br_changelink net/bridge/br_netlink.c:1542 br_dev_newlink net/bridge/br_netlink.c:1575
Add NULL checks for the vlan group pointer in both helpers, returning early when there are no VLANs to iterate. This matches the existing pattern used by other bridge FDB functions such as br_fdb_add() and br_fdb_delete().
--- net/bridge/br_fdb.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/bridge/br_fdb.c +6 -0
@@ -597,6 +597,9 @@ static void br_fdb_delete_locals_per_vlan_port(struct net_bridge *br, dev = br->dev; } +if (!vg) +return ; +list_for_each_entry (v, &vg->vlan_list, vlist)br_fdb_find_delete_local (br, p, dev->dev_addr, v->vid); }
@@ -630,6 +633,9 @@ static int br_fdb_insert_locals_per_vlan_port(struct net_bridge *br, dev = br->dev; } +if (!vg) +return 0 ; +list_for_each_entry (v, &vg->vlan_list, vlist) {if (!br_vlan_should_use (v))continue ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 75/198 rtnetlink: add missing netlink_ns_capable() check for peer netns
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolaos Gkarlis <[email protected]>
[ Upstream commit 7b735ef81286007794a227ce2539419479c02a5f ]
rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer network namespace when creating paired devices (veth, vxcan, netkit). This allows an unprivileged user with a user namespace to create interfaces in arbitrary network namespaces, including init_net.
Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer namespace before allowing device creation to proceed.
--- net/core/rtnetlink.c | 40 +++++++++++++++++++++++++++------------- 1 file changed, 27 insertions(+), 13 deletions(-)
net/core/rtnetlink.c +27 -13
@@ -3887,28 +3887,42 @@ static int rtnl_newlink_create(struct sk_buff *skb, struct ifinfomsg *ifm, goto out; } -static struct net *rtnl_get_peer_net (const struct rtnl_link_ops *ops, +static struct net *rtnl_get_peer_net (struct sk_buff *skb, +const struct rtnl_link_ops *ops,struct nlattr *tbp[],struct nlattr *data[],struct netlink_ext_ack *extack) { -struct nlattr *tb[IFLA_MAX +1 ]; +struct nlattr *tb[IFLA_MAX +1 ], **attrs; +struct net *net;int err; -if (!data || !data[ops->peer_type]) -return rtnl_link_get_net_ifla (tbp); - - err =rtnl_nla_parse_ifinfomsg (tb, data[ops->peer_type], extack); -if (err <0 ) -return ERR_PTR (err); - -if (ops->validate) { - err = ops->validate (tb,NULL , extack); +if (!data || !data[ops->peer_type]) { + attrs = tbp; + }else { + err =rtnl_nla_parse_ifinfomsg (tb, data[ops->peer_type], extack);if (err <0 )return ERR_PTR (err); + +if (ops->validate) { + err = ops->validate (tb,NULL , extack); +if (err <0 ) +return ERR_PTR (err); + } + + attrs = tb; } -return rtnl_link_get_net_ifla (tb); + net =rtnl_link_get_net_ifla (attrs); +if (IS_ERR_OR_NULL (net)) +return net; + +if (!netlink_ns_capable (skb, net->user_ns,CAP_NET_ADMIN )) { +put_net (net); +return ERR_PTR (-EPERM ); + } + +return net; } static int __rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh,
@@ -4047,7 +4061,7 @@ static int rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh, }if (ops->peer_type) { - peer_net =rtnl_get_peer_net (ops, tb, data, extack); + peer_net =rtnl_get_peer_net (skb, ops, tb, data, extack);if (IS_ERR (peer_net)) { ret =PTR_ERR (peer_net); goto put_ops;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 76/198 ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit 06aaf04ca815f7a1f17762fd847b7bc14b8833fb ]
Currently NHA_HW_STATS_ENABLE is included twice everytime a dump of nexthop group is performed with NHA_OP_FLAG_DUMP_STATS. As all the stats querying were moved to nla_put_nh_group_stats(), leave only that instance of the attribute querying.
--- net/ipv4/nexthop.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/ipv4/nexthop.c +1 -2
@@ -905,8 +905,7 @@ static int nla_put_nh_group(struct sk_buff *skb, struct nexthop *nh, goto nla_put_failure;if (op_flags &NHA_OP_FLAG_DUMP_STATS && - (nla_put_u32 (skb,NHA_HW_STATS_ENABLE , nhg->hw_stats) || -nla_put_nh_group_stats (skb, nh, op_flags))) +nla_put_nh_group_stats (skb, nh, op_flags)) goto nla_put_failure;return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 77/198 ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit 14cf0cd35361f4e94824bf8a42f72713d7702a73 ]
When querying a nexthop object via RTM_GETNEXTHOP, the kernel currently allocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for single nexthops and small Equal-Cost Multi-Path groups, this fixed allocation fails for large nexthop groups like 512 nexthops.
This results in the following warning splat:
WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608 [...] RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395) [...] Call Trace: <TASK> rtnetlink_rcv_msg (net/core/rtnetlink.c:6989) netlink_rcv_skb (net/netlink/af_netlink.c:2550) netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585) ___sys_sendmsg (net/socket.c:2641) __sys_sendmsg (net/socket.c:2671) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK>
Fix this by allocating the size dynamically using nh_nlmsg_size() and using nlmsg_new(), this is consistent with nexthop_notify() behavior. In addition, adjust nh_nlmsg_size_grp() so it calculates the size needed based on flags passed. While at it, also add the size of NHA_FDB for nexthop group size calculation as it was missing too.
This cannot be reproduced via iproute2 as the group size is currently limited and the command fails as follows:
addattr_l ERROR: message exceeded bound of 1048
--- net/ipv4/nexthop.c | 38 +++++++++++++++++++++++++++----------- 1 file changed, 27 insertions(+), 11 deletions(-)
net/ipv4/nexthop.c +27 -11
@@ -1006,16 +1006,32 @@ static size_t nh_nlmsg_size_grp_res(struct nh_group *nhg)nla_total_size_64bit (8 );/* NHA_RES_GROUP_UNBALANCED_TIME */ } -static size_t nh_nlmsg_size_grp (struct nexthop *nh) +static size_t nh_nlmsg_size_grp (struct nexthop *nh,u32 op_flags) {struct nh_group *nhg =rtnl_dereference (nh->nh_grp);size_t sz =sizeof (struct nexthop_grp ) * nhg->num_nh;size_t tot =nla_total_size (sz) + -nla_total_size (2 );/* NHA_GROUP_TYPE */ +nla_total_size (2 ) +/* NHA_GROUP_TYPE */ +nla_total_size (0 );/* NHA_FDB */ if (nhg->resilient) tot +=nh_nlmsg_size_grp_res (nhg); +if (op_flags &NHA_OP_FLAG_DUMP_STATS ) { + tot +=nla_total_size (0 ) +/* NHA_GROUP_STATS */ +nla_total_size (4 );/* NHA_HW_STATS_ENABLE */ + tot += nhg->num_nh * + (nla_total_size (0 ) +/* NHA_GROUP_STATS_ENTRY */ +nla_total_size (4 ) +/* NHA_GROUP_STATS_ENTRY_ID */ +nla_total_size_64bit (8 ));/* NHA_GROUP_STATS_ENTRY_PACKETS */ + +if (op_flags &NHA_OP_FLAG_DUMP_HW_STATS ) { + tot += nhg->num_nh * +nla_total_size_64bit (8 );/* NHA_GROUP_STATS_ENTRY_PACKETS_HW */ + tot +=nla_total_size (4 );/* NHA_HW_STATS_USED */ + } + } +return tot; }
@@ -1050,14 +1066,14 @@ static size_t nh_nlmsg_size_single(struct nexthop *nh)return sz; } -static size_t nh_nlmsg_size (struct nexthop *nh) +static size_t nh_nlmsg_size (struct nexthop *nh,u32 op_flags) {size_t sz =NLMSG_ALIGN (sizeof (struct nhmsg )); sz +=nla_total_size (4 );/* NHA_ID */ if (nh->is_group) - sz +=nh_nlmsg_size_grp (nh) + + sz +=nh_nlmsg_size_grp (nh, op_flags) +nla_total_size (4 ) +/* NHA_OP_FLAGS */ 0 ;else
@@ -1073,7 +1089,7 @@ static void nexthop_notify(int event, struct nexthop *nh, struct nl_info *info)struct sk_buff *skb;int err = -ENOBUFS ; - skb =nlmsg_new (nh_nlmsg_size (nh),gfp_any ()); + skb =nlmsg_new (nh_nlmsg_size (nh,0 ),gfp_any ());if (!skb) goto errout;
@@ -3379,15 +3395,15 @@ static int rtm_get_nexthop(struct sk_buff *in_skb, struct nlmsghdr *nlh,if (err)return err; - err = -ENOBUFS ; - skb =alloc_skb (NLMSG_GOODSIZE ,GFP_KERNEL ); -if (!skb) - goto out; - err = -ENOENT ; nh =nexthop_find_by_id (net, id);if (!nh) - goto errout_free; + goto out; + + err = -ENOBUFS ; + skb =nlmsg_new (nh_nlmsg_size (nh, op_flags),GFP_KERNEL ); +if (!skb) + goto out; err =nh_fill_node (skb, nh,RTM_NEWNEXTHOP ,NETLINK_CB (in_skb).portid, nlh->nlmsg_seq,0 , op_flags);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 78/198 ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yiqi Sun <[email protected]>
[ Upstream commit fde29fd9349327acc50d19a0b5f3d5a6c964dfd8 ]
ipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the IPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing this error pointer to dev_hold() will cause a kernel crash with null-ptr-deref.
Instead, silently discard the request. RFC 8335 does not appear to define a specific response for the case where an IPv6 interface identifier is syntactically valid but the implementation cannot perform the lookup at runtime, and silently dropping the request may safer than misreporting "No Such Interface".
--- net/ipv4/icmp.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/ipv4/icmp.c +7 -0
@@ -1145,6 +1145,13 @@ bool icmp_build_probe(struct sk_buff *skb, struct icmphdr *icmphdr)if (iio->ident.addr.ctype3_hdr.addrlen !=sizeof (struct in6_addr )) goto send_mal_query; dev = ipv6_stub->ipv6_dev_find (net, &iio->ident.addr.ip_addr.ipv6_addr, dev); +/* +* If IPv6 identifier lookup is unavailable, silently +* discard the request instead of misreporting NO_IF. +*/ +if (IS_ERR (dev)) +return false; +dev_hold (dev);break ;#endif
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 79/198 net: increase IP_TUNNEL_RECURSION_LIMIT to 5
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris J Arges <[email protected]>
[ Upstream commit 77facb35227c421467cdb49268de433168c2dcef ]
In configurations with multiple tunnel layers and MPLS lwtunnel routing, a single tunnel hop can increment the counter beyond this limit. This causes packets to be dropped with the "Dead loop on virtual device" message even when a routing loop doesn't exist.
Increase IP_TUNNEL_RECURSION_LIMIT from 4 to 5 to handle this use-case.
--- include/net/ip_tunnels.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/ip_tunnels.h +1 -1
@@ -32,7 +32,7 @@* recursion involves route lookups and full IP output, consuming much * more stack per level, so a lower limit is needed. */ -#define IP_TUNNEL_RECURSION_LIMIT 4 +#define IP_TUNNEL_RECURSION_LIMIT 5/* Keep error state on tunnel for 30 sec */ #define IPTUNNEL_ERR_TIMEO (30*HZ)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 80/198 nfc: s3fwrn5: allocate rx skb before consuming bytes
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 5c14a19d5b1645cce1cb1252833d70b23635b632 ]
s3fwrn82_uart_read() reports the number of accepted bytes to the serdev core. The current code consumes bytes into recv_skb and may already deliver a complete frame before allocating a fresh receive buffer.
If that alloc_skb() fails, the callback returns 0 even though it has already consumed bytes, and it leaves recv_skb as NULL for the next receive callback. That breaks the receive_buf() accounting contract and can also lead to a NULL dereference on the next skb_put_u8().
Allocate the receive skb lazily before consuming the next byte instead. If allocation fails, return the number of bytes already accepted.
--- drivers/nfc/s3fwrn5/uart.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/nfc/s3fwrn5/uart.c +7 -3
@@ -58,6 +58,12 @@ static size_t s3fwrn82_uart_read(struct serdev_device *serdev,size_t i;for (i =0 ; i < count; i++) { +if (!phy->recv_skb) { + phy->recv_skb =alloc_skb (NCI_SKB_BUFF_LEN ,GFP_KERNEL ); +if (!phy->recv_skb) +return i; + } +skb_put_u8 (phy->recv_skb, *data++);if (phy->recv_skb->len <S3FWRN82_NCI_HEADER )
@@ -69,9 +75,7 @@ static size_t s3fwrn82_uart_read(struct serdev_device *serdev,s3fwrn5_recv_frame (phy->common.ndev, phy->recv_skb, phy->common.mode); - phy->recv_skb =alloc_skb (NCI_SKB_BUFF_LEN ,GFP_KERNEL ); -if (!phy->recv_skb) -return 0 ; + phy->recv_skb =NULL ; }return i;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 81/198 net: stmmac: Fix PTP ref clock for Tegra234
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Hunter <[email protected]>
[ Upstream commit 1345e9f4e3f3bc7d8a0a2138ae29e205a857a555 ]
Since commit 030ce919e114 ("net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping") was added the following error is observed on Tegra234:
ERR KERN tegra-mgbe 6800000.ethernet eth0: Invalid PTP clock rate WARNING KERN tegra-mgbe 6800000.ethernet eth0: PTP init failed
It turns out that the Tegra234 device-tree binding defines the PTP ref clock name as 'ptp-ref' and not 'ptp_ref' and the above commit now exposes this and that the PTP clock is not configured correctly.
In order to update device-tree to use the correct 'ptp_ref' name, update the Tegra MGBE driver to use 'ptp_ref' by default and fallback to using 'ptp-ref' if this clock name is present.
--- .../net/ethernet/stmicro/stmmac/dwmac-tegra.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c +17 -2
@@ -9,7 +9,7 @@#include "stmmac_platform.h" static const char *const mgbe_clks[] = { -"rx-pcs" ,"tx" ,"tx-pcs" ,"mac-divider" ,"mac" ,"mgbe" ,"ptp-ref" ,"mac" +"rx-pcs" ,"tx" ,"tx-pcs" ,"mac-divider" ,"mac" ,"mgbe" ,"ptp_ref" ,"mac" };struct tegra_mgbe {
@@ -215,6 +215,7 @@ static int tegra_mgbe_probe(struct platform_device *pdev) {struct plat_stmmacenet_data *plat;struct stmmac_resources res; +bool use_legacy_ptp = false;struct tegra_mgbe *mgbe;int irq, err, i;u32 value;
@@ -257,9 +258,23 @@ static int tegra_mgbe_probe(struct platform_device *pdev)if (!mgbe->clks)return -ENOMEM ; -for (i =0 ; i <ARRAY_SIZE (mgbe_clks); i++) +/* Older device-trees use 'ptp-ref' rather than 'ptp_ref'. +* Fall back when the legacy name is present. +*/ +if (of_property_match_string (pdev->dev.of_node,"clock-names" , +"ptp-ref" ) >=0 ) + use_legacy_ptp = true; + +for (i =0 ; i <ARRAY_SIZE (mgbe_clks); i++) { mgbe->clks[i].id = mgbe_clks[i]; +if (use_legacy_ptp && !strcmp (mgbe_clks[i],"ptp_ref" )) { +dev_warn (mgbe->dev, +"Device-tree update needed for PTP clock!\n" ); + mgbe->clks[i].id ="ptp-ref" ; + } + } + err =devm_clk_bulk_get (mgbe->dev,ARRAY_SIZE (mgbe_clks), mgbe->clks);if (err <0 )return err;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 82/198 dt-bindings: net: Fix Tegra234 MGBE PTP clock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Hunter <[email protected]>
[ Upstream commit fb22b1fc5bca3c0aad95388933497ceb30f1fb26 ]
The PTP clock for the Tegra234 MGBE device is incorrectly named 'ptp-ref' and should be 'ptp_ref'. This is causing the following warning to be observed on Tegra234 platforms that use this device:
ERR KERN tegra-mgbe 6800000.ethernet eth0: Invalid PTP clock rate WARNING KERN tegra-mgbe 6800000.ethernet eth0: PTP init failed
Although this constitutes an ABI breakage in the binding for this device, PTP support has clearly never worked and so fix this now so we can correct the device-tree for this device. Note that the MGBE driver still supports the legacy 'ptp-ref' clock name and so older/existing device-trees will still work, but given that this is not the correct name, there is no point to advertise this in the binding.
--- .../devicetree/bindings/net/nvidia,tegra234-mgbe.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Documentation/devicetree/bindings/net/nvidia,tegra234-mgbe.yaml +2 -2
@@ -42,7 +42,7 @@ properties: - const: mgbe - const: mac - const: mac-divider - - const: ptp-ref + - const: ptp_ref - const: rx-input-m - const: rx-input - const: tx
@@ -133,7 +133,7 @@ examples: <&bpmp TEGRA234_CLK_MGBE0_RX_PCS_M>, <&bpmp TEGRA234_CLK_MGBE0_RX_PCS>, <&bpmp TEGRA234_CLK_MGBE0_TX_PCS>; - clock-names = "mgbe", "mac", "mac-divider", "ptp-ref", "rx-input-m", + clock-names = "mgbe", "mac", "mac-divider", "ptp_ref", "rx-input-m", "rx-input", "tx", "eee-pcs", "rx-pcs-input", "rx-pcs-m", "rx-pcs", "tx-pcs"; resets = <&bpmp TEGRA234_RESET_MGBE0_MAC>,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 83/198 tracing/probe: reject non-closed empty immediate strings
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 4346be6577aaa04586167402ae87bbdbe32484a4 ]
parse_probe_arg() accepts quoted immediate strings and passes the body after the opening quote to __parse_imm_string(). That helper currently computes strlen(str) and immediately dereferences str[len - 1], which underflows when the body is empty and not closed with double-quotation.
Reject empty non-closed immediate strings before checking for the closing quote.
--- kernel/trace/trace_probe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace_probe.c +1 -1
@@ -1068,7 +1068,7 @@ static int __parse_imm_string(char *str, char **pbuf, int offs) {size_t len =strlen (str); -if (str[len -1 ] !='"' ) { +if (!len || str[len -1 ] !='"' ) {trace_probe_log_err (offs + len,IMMSTR_NO_CLOSE );return -EINVAL ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 84/198 ice: ptp: dont WARN when controlling PF is unavailable
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
[ Upstream commit bb3f21edc7056cdf44a7f7bd7ba65af40741838c ]
In VFIO passthrough setups, it is possible to pass through only a PF which doesn't own the source timer. In that case the PTP controlling PF (adapter->ctrl_pf) is never initialized in the VM, so ice_get_ctrl_ptp() returns NULL and triggers WARN_ON() in ice_ptp_setup_pf().
Since this is an expected behavior in that configuration, replace WARN_ON() with an informational message and return -EOPNOTSUPP.
--- drivers/net/ethernet/intel/ice/ice_ptp.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_ptp.c +7 -1
@@ -3041,7 +3041,13 @@ static int ice_ptp_setup_pf(struct ice_pf *pf)struct ice_ptp *ctrl_ptp =ice_get_ctrl_ptp (pf);struct ice_ptp *ptp = &pf->ptp; -if (WARN_ON (!ctrl_ptp) || pf->hw.mac_type ==ICE_MAC_UNKNOWN ) +if (!ctrl_ptp) { +dev_info (ice_pf_to_dev (pf), +"PTP unavailable: no controlling PF\n" ); +return -EOPNOTSUPP ; + } + +if (pf->hw.mac_type ==ICE_MAC_UNKNOWN )return -ENODEV ;INIT_LIST_HEAD (&ptp->port.list_node);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 85/198 ixgbe: stop re-reading flash on every get_drvinfo for e610
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Loktionov <[email protected]>
[ Upstream commit d8ae40dc20cbd7bb6e6b36a928e2db2296060ad2 ]
ixgbe_get_drvinfo() calls ixgbe_refresh_fw_version() on every ethtool query for e610 adapters. That ends up in ixgbe_discover_flash_size(), which bisects the full 16 MB NVM space issuing one ACI command per step (~20 ms each, ~24 steps total = ~500 ms).
Profiling on an idle E610-XAT2 system with telegraf scraping ethtool stats every 10 seconds:
kretprobe:ixgbe_get_drvinfo took 527603 us
kretprobe:ixgbe_get_drvinfo took 523978 us
kretprobe:ixgbe_get_drvinfo took 552975 us
kretprobe:ice_get_drvinfo took 3 us kretprobe:igb_get_drvinfo took 2 us kretprobe:i40e_get_drvinfo took 5 us
The half-second stall happens under the RTNL lock, causing visible latency on ip-link and friends.
The FW version can only change after an EMPR reset. All flash data is already populated at probe time and the cached adapter->eeprom_id is what get_drvinfo should be returning. The only place that needs to trigger a re-read is ixgbe_devlink_reload_empr_finish(), right after the EMPR completes and new firmware is running. Additionally, refresh the FW version in ixgbe_reinit_locked() so that any PF that undergoes a reinit after an EMPR (e.g. triggered by another PF's devlink reload) also picks up the new version in adapter->eeprom_id.
ixgbe_devlink_info_get() keeps its refresh call for explicit "devlink dev info" queries, which is fine given those are user-initiated.
--- drivers/net/ethernet/intel/ixgbe/devlink/devlink.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe.h | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 13 +++++++------ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 10 ++++++++++ 4 files changed, 19 insertions(+), 8 deletions(-)
drivers/net/ethernet/intel/ixgbe/devlink/devlink.c +1 -1
@@ -474,7 +474,7 @@ static int ixgbe_devlink_reload_empr_finish(struct devlink *devlink, adapter->flags2 &= ~(IXGBE_FLAG2_API_MISMATCH |IXGBE_FLAG2_FW_ROLLBACK ); -return 0 ; +return ixgbe_refresh_fw_version (adapter); }static const struct devlink_ops ixgbe_devlink_ops = {
drivers/net/ethernet/intel/ixgbe/ixgbe.h +1 -1
@@ -973,7 +973,7 @@ int ixgbe_init_interrupt_scheme(struct ixgbe_adapter *adapter);bool ixgbe_wol_supported (struct ixgbe_adapter *adapter,u16 device_id,u16 subdevice_id);void ixgbe_set_fw_version_e610 (struct ixgbe_adapter *adapter); -void ixgbe_refresh_fw_version (struct ixgbe_adapter *adapter); +int ixgbe_refresh_fw_version (struct ixgbe_adapter *adapter);#ifdef CONFIG_PCI_IOV void ixgbe_full_sync_mac_table (struct ixgbe_adapter *adapter);#endif
drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +7 -6
@@ -1153,12 +1153,17 @@ static int ixgbe_set_eeprom(struct net_device *netdev,return ret_val; } -void ixgbe_refresh_fw_version (struct ixgbe_adapter *adapter) +int ixgbe_refresh_fw_version (struct ixgbe_adapter *adapter) {struct ixgbe_hw *hw = &adapter->hw; +int err; + + err =ixgbe_get_flash_data (hw); +if (err) +return err; -ixgbe_get_flash_data (hw);ixgbe_set_fw_version_e610 (adapter); +return 0 ; } static void ixgbe_get_drvinfo(struct net_device *netdev,
@@ -1166,10 +1171,6 @@ static void ixgbe_get_drvinfo(struct net_device *netdev, {struct ixgbe_adapter *adapter =ixgbe_from_netdev (netdev); -/* need to refresh info for e610 in case fw reloads in runtime */ -if (adapter->hw.mac.type == ixgbe_mac_e610) -ixgbe_refresh_fw_version (adapter); -strscpy (drvinfo->driver, ixgbe_driver_name,sizeof (drvinfo->driver)); strscpy(drvinfo->fw_version, adapter->eeprom_id,
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +10 -0
@@ -6289,6 +6289,16 @@ void ixgbe_reinit_locked(struct ixgbe_adapter *adapter)if (adapter->flags &IXGBE_FLAG_SRIOV_ENABLED )msleep (2000 );ixgbe_up (adapter); + +/* E610 has no FW event to notify all PFs of an EMPR reset, so +* refresh the FW version here to pick up any new FW version after +* a hardware reset (e.g. EMPR triggered by another PF's devlink +* reload). ixgbe_refresh_fw_version() updates both hw->flash and +* adapter->eeprom_id so ethtool -i reports the correct string. +*/ +if (adapter->hw.mac.type == ixgbe_mac_e610) + (void )ixgbe_refresh_fw_version (adapter); +clear_bit (__IXGBE_RESETTING, &adapter->state); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 86/198 ixgbevf: add missing negotiate_features op to Hyper-V ops table
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Schmidt <[email protected]>
[ Upstream commit 4821d563cd7f251ae728be1a6d04af82a294a5b9 ]
Commit a7075f501bd3 ("ixgbevf: fix mailbox API compatibility by negotiating supported features") added the .negotiate_features callback to ixgbe_mac_operations and populated it in ixgbevf_mac_ops, but forgot to add it to ixgbevf_hv_mac_ops. This leaves the function pointer NULL on Hyper-V VMs.
During probe, ixgbevf_negotiate_api() calls ixgbevf_set_features(), which unconditionally dereferences hw->mac.ops.negotiate_features(). On Hyper-V this results in a NULL pointer dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine [...] Workqueue: events work_for_cpu_fn RIP: 0010:0x0 [...] Call Trace: ixgbevf_negotiate_api+0x66/0x160 [ixgbevf] ixgbevf_sw_init+0xe4/0x1f0 [ixgbevf] ixgbevf_probe+0x20f/0x4a0 [ixgbevf] local_pci_probe+0x50/0xa0 work_for_cpu_fn+0x1a/0x30 [...]
Add ixgbevf_hv_negotiate_features_vf() that returns -EOPNOTSUPP and wire it into ixgbevf_hv_mac_ops. The caller already handles -EOPNOTSUPP gracefully.
--- drivers/net/ethernet/intel/ixgbevf/vf.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/ethernet/intel/ixgbevf/vf.c +7 -0
@@ -709,6 +709,12 @@ static int ixgbevf_negotiate_features_vf(struct ixgbe_hw *hw, u32 *pf_features)return err; } +static int ixgbevf_hv_negotiate_features_vf (struct ixgbe_hw *hw, +u32 *pf_features) +{ +return -EOPNOTSUPP ; +} +/** * ixgbevf_set_vfta_vf - Set/Unset VLAN filter table address * @hw: pointer to the HW structure
@@ -1142,6 +1148,7 @@ static const struct ixgbe_mac_operations ixgbevf_hv_mac_ops = { .setup_link = ixgbevf_setup_mac_link_vf, .check_link = ixgbevf_hv_check_mac_link_vf, .negotiate_api_version = ixgbevf_hv_negotiate_api_version_vf, + .negotiate_features = ixgbevf_hv_negotiate_features_vf, .set_rar = ixgbevf_hv_set_rar_vf, .update_mc_addr_list = ixgbevf_hv_update_mc_addr_list_vf, .update_xcast_mode = ixgbevf_hv_update_xcast_mode,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 87/198 e1000: check return value of e1000_read_eeprom
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Agalakov Daniil <[email protected]>
[ Upstream commit d3baa34a470771399c1495bc04b1e26ac15d598e ]
[Why]e1000_set_eeprom() performs a read-modify-write operation when the write range is not word-aligned. This requires reading the first and last words of the range from the EEPROM to preserve the unmodified bytes.
However, the code does not check the return value of e1000_read_eeprom(). If the read fails, the operation continues using uninitialized data from eeprom_buff. This results in corrupted data being written back to the EEPROM for the boundary words.
Add the missing error checks and abort the operation if reading fails.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/e1000/e1000_ethtool.c +7 -1
@@ -496,14 +496,19 @@ static int e1000_set_eeprom(struct net_device *netdev,*/ ret_val =e1000_read_eeprom (hw, first_word,1 , &eeprom_buff[0 ]); +if (ret_val) + goto out; + ptr++; } -if (((eeprom->offset + eeprom->len) &1 ) && (ret_val ==0 )) { +if ((eeprom->offset + eeprom->len) &1 ) {/* need read/modify/write of last changed EEPROM word * only the first byte of the word is being modified */ ret_val =e1000_read_eeprom (hw, last_word,1 , &eeprom_buff[last_word - first_word]); +if (ret_val) + goto out; }/* Device's eeprom is always little-endian, word addressable */
@@ -522,6 +527,7 @@ static int e1000_set_eeprom(struct net_device *netdev,if ((ret_val ==0 ) && (first_word <=EEPROM_CHECKSUM_REG ))e1000_update_eeprom_checksum (hw); +out:kfree (eeprom_buff);return ret_val; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 88/198 xsk: tighten UMEM headroom validation to account for tailroom and min frame
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Fijalkowski <[email protected]>
[ Upstream commit a315e022a72d95ef5f1d4e58e903cb492b0ad931 ]
The current headroom validation in xdp_umem_reg() could leave us with insufficient space dedicated to even receive minimum-sized ethernet frame. Furthermore if multi-buffer would come to play then skb_shared_info stored at the end of XSK frame would be corrupted.
HW typically works with 128-aligned sizes so let us provide this value as bare minimum.
Multi-buffer setting is known later in the configuration process so besides accounting for 128 bytes, let us also take care of tailroom space upfront.
--- net/xdp/xdp_umem.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/xdp/xdp_umem.c +2 -1
@@ -202,7 +202,8 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)if (!unaligned_chunks && chunks_rem)return -EINVAL ; -if (headroom >= chunk_size -XDP_PACKET_HEADROOM ) +if (headroom > chunk_size -XDP_PACKET_HEADROOM - +SKB_DATA_ALIGN (sizeof (struct skb_shared_info )) -128 )return -EINVAL ;if (mr->flags &XDP_UMEM_TX_METADATA_LEN ) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 89/198 xsk: respect tailroom for ZC setups
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Fijalkowski <[email protected]>
[ Upstream commit 1ee1605138fc94cc8f8f273321dd2471c64977f9 ]
Multi-buffer XDP stores information about frags in skb_shared_info that sits at the tailroom of a packet. The storage space is reserved via xdp_data_hard_end():
((xdp)->data_hard_start + (xdp)->frame_sz - \ SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
and then we refer to it via macro below:
static inline struct skb_shared_info * xdp_get_shared_info_from_buff(const struct xdp_buff *xdp)
{
return (struct skb_shared_info *)xdp_data_hard_end(xdp);
}Currently we do not respect this tailroom space in multi-buffer AF_XDP ZC scenario. To address this, introduce xsk_pool_get_tailroom() and use it within xsk_pool_get_rx_frame_size() which is used in ZC drivers to configure length of HW Rx buffer.
Typically drivers on Rx Hw buffers side work on 128 byte alignment so let us align the value returned by xsk_pool_get_rx_frame_size() in order to avoid addressing this on driver's side. This addresses the fact that idpf uses mentioned function *before* pool->dev being set so we were at risk that after subtracting tailroom we would not provide 128-byte aligned value to HW.
Since xsk_pool_get_rx_frame_size() is actively used in xsk_rcv_check() and __xsk_rcv(), add a variant of this routine that will not include 128 byte alignment and therefore old behavior is preserved.
--- include/net/xdp_sock_drv.h | 23 ++++++++++++++++++++++- net/xdp/xsk.c | 4 ++-- 2 files changed, 24 insertions(+), 3 deletions(-)
include/net/xdp_sock_drv.h +22 -1
@@ -37,16 +37,37 @@ static inline u32 xsk_pool_get_headroom(struct xsk_buff_pool *pool)return XDP_PACKET_HEADROOM + pool->headroom; } +static inline u32 xsk_pool_get_tailroom (bool mbuf) +{ +return mbuf ?SKB_DATA_ALIGN (sizeof (struct skb_shared_info )) :0 ; +} +static inline u32 xsk_pool_get_chunk_size (struct xsk_buff_pool *pool) {return pool->chunk_size; } -static inline u32 xsk_pool_get_rx_frame_size (struct xsk_buff_pool *pool) +static inline u32 __xsk_pool_get_rx_frame_size (struct xsk_buff_pool *pool) {return xsk_pool_get_chunk_size (pool) -xsk_pool_get_headroom (pool); } +static inline u32 xsk_pool_get_rx_frame_size (struct xsk_buff_pool *pool) +{ +u32 frame_size =__xsk_pool_get_rx_frame_size (pool); +struct xdp_umem *umem = pool->umem; +bool mbuf; + +/* Reserve tailroom only for zero-copy pools that opted into +* multi-buffer. The reserved area is used for skb_shared_info, +* matching the XDP core's xdp_data_hard_end() layout. +*/ + mbuf = pool->dev && (umem->flags &XDP_UMEM_SG_FLAG ); + frame_size -=xsk_pool_get_tailroom (mbuf); + +return ALIGN_DOWN (frame_size,128 ); +} +static inline u32 xsk_pool_get_rx_frag_step (struct xsk_buff_pool *pool) {return pool->unaligned ?0 :xsk_pool_get_chunk_size (pool);
net/xdp/xsk.c +2 -2
@@ -239,7 +239,7 @@ static u32 xsk_copy_xdp(void *to, void **from, u32 to_len,static int __xsk_rcv (struct xdp_sock *xs,struct xdp_buff *xdp,u32 len) { -u32 frame_size =xsk_pool_get_rx_frame_size (xs->pool); +u32 frame_size =__xsk_pool_get_rx_frame_size (xs->pool);void *copy_from =xsk_copy_xdp_start (xdp), *copy_to;u32 from_len, meta_len, rem, num_desc;struct xdp_buff_xsk *xskb;
@@ -338,7 +338,7 @@ static int xsk_rcv_check(struct xdp_sock *xs, struct xdp_buff *xdp, u32 len)if (xs->dev != xdp->rxq->dev || xs->queue_id != xdp->rxq->queue_index)return -EINVAL ; -if (len >xsk_pool_get_rx_frame_size (xs->pool) && !xs->sg) { +if (len >__xsk_pool_get_rx_frame_size (xs->pool) && !xs->sg) { xs->rx_dropped++;return -ENOSPC ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 90/198 xsk: fix XDP_UMEM_SG_FLAG issues
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Fijalkowski <[email protected]>
[ Upstream commit 93e84fe45b752d17a5a46b306ed78f0133bbc719 ]
Currently xp_assign_dev_shared() is missing XDP_USE_SG being propagated to flags so set it in order to preserve mtu check that is supposed to be done only when no multi-buffer setup is in picture.
Also, this flag has the same value as XDP_UMEM_TX_SW_CSUM so we could get unexpected SG setups for software Tx checksums. Since csum flag is UAPI, modify value of XDP_UMEM_SG_FLAG.
--- include/net/xdp_sock.h | 2 +- net/xdp/xsk_buff_pool.c | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-)
include/net/xdp_sock.h +1 -1
@@ -14,7 +14,7 @@#include <linux/mm.h> #include <net/sock.h> -#define XDP_UMEM_SG_FLAG (1 << 1) +#define XDP_UMEM_SG_FLAG BIT(3)struct net_device ;struct xsk_queue ;
net/xdp/xsk_buff_pool.c +4 -0
@@ -259,6 +259,10 @@ int xp_assign_dev_shared(struct xsk_buff_pool *pool, struct xdp_sock *umem_xs,return -EINVAL ; flags = umem->zc ?XDP_ZEROCOPY :XDP_COPY ; + +if (umem->flags &XDP_UMEM_SG_FLAG ) + flags |=XDP_USE_SG ; +if (umem_xs->pool->uses_need_wakeup) flags |=XDP_USE_NEED_WAKEUP ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 91/198 xsk: validate MTU against usable frame size on bind
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Fijalkowski <[email protected]>
[ Upstream commit 36ee60b569ba0dfb6f961333b90d19ab5b323fa9 ]
AF_XDP bind currently accepts zero-copy pool configurations without verifying that the device MTU fits into the usable frame space provided by the UMEM chunk.
This becomes a problem since we started to respect tailroom which is subtracted from chunk_size (among with headroom). 2k chunk size might not provide enough space for standard 1500 MTU, so let us catch such settings at bind time. Furthermore, validate whether underlying HW will be able to satisfy configured MTU wrt XSK's frame size multiplied by supported Rx buffer chain length (that is exposed via net_device::xdp_zc_max_segs).
--- net/xdp/xsk_buff_pool.c | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-)
net/xdp/xsk_buff_pool.c +25 -3
@@ -10,6 +10,8 @@#include "xdp_umem.h" #include "xsk.h" +#define ETH_PAD_LEN (ETH_HLEN + 2 * VLAN_HLEN + ETH_FCS_LEN) +void xp_add_xsk (struct xsk_buff_pool *pool,struct xdp_sock *xs) {unsigned long flags;
@@ -165,8 +167,12 @@ static void xp_disable_drv_zc(struct xsk_buff_pool *pool)int xp_assign_dev (struct xsk_buff_pool *pool,struct net_device *netdev,u16 queue_id,u16 flags) { +u32 needed = netdev->mtu +ETH_PAD_LEN ; +u32 segs = netdev->xdp_zc_max_segs; +bool mbuf = flags &XDP_USE_SG ;bool force_zc, force_copy;struct netdev_bpf bpf; +u32 frame_size;int err =0 ;ASSERT_RTNL ();
@@ -186,7 +192,7 @@ int xp_assign_dev(struct xsk_buff_pool *pool,if (err)return err; -if (flags &XDP_USE_SG ) +if (mbuf) pool->umem->flags |=XDP_UMEM_SG_FLAG ;if (flags &XDP_USE_NEED_WAKEUP )
@@ -208,8 +214,24 @@ int xp_assign_dev(struct xsk_buff_pool *pool, goto err_unreg_pool; } -if (netdev->xdp_zc_max_segs ==1 && (flags &XDP_USE_SG )) { - err = -EOPNOTSUPP ; +if (mbuf) { +if (segs ==1 ) { + err = -EOPNOTSUPP ; + goto err_unreg_pool; + } + }else { + segs =1 ; + } + +/* open-code xsk_pool_get_rx_frame_size() as pool->dev is not +* set yet at this point; we are before getting down to driver +*/ + frame_size =__xsk_pool_get_rx_frame_size (pool) - +xsk_pool_get_tailroom (mbuf); + frame_size =ALIGN_DOWN (frame_size,128 ); + +if (needed > frame_size * segs) { + err = -EINVAL ; goto err_unreg_pool; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 92/198 xfrm: Wait for RCU readers during policy netns exit
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Klassert <[email protected]>
[ Upstream commit 069daad4f2ae9c5c108131995529d5f02392c446 ]
xfrm_policy_fini() frees the policy_bydst hash tables after flushing the policy work items and deleting all policies, but it does not wait for concurrent RCU readers to leave their read-side critical sections first.
The policy_bydst tables are published via rcu_assign_pointer() and are looked up through rcu_dereference_check(), so netns teardown must also wait for an RCU grace period before freeing the table memory.
Fix this by adding synchronize_rcu() before freeing the policy hash tables.
--- net/xfrm/xfrm_policy.c | 2 ++ 1 file changed, 2 insertions(+)
net/xfrm/xfrm_policy.c +2 -0
@@ -4290,6 +4290,8 @@ static void xfrm_policy_fini(struct net *net)#endif xfrm_policy_flush (net,XFRM_POLICY_TYPE_MAIN , false); +synchronize_rcu (); +WARN_ON (!list_empty (&net->xfrm.policy_all));for (dir =0 ; dir <XFRM_POLICY_MAX ; dir++) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 93/198 xfrm: fix refcount leak in xfrm_migrate_policy_find
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kotlyarov Mihail <[email protected]>
[ Upstream commit 83317cce60a032c49480dcdabe146435bd689d03 ]
syzkaller reported a memory leak in xfrm_policy_alloc:
BUG: memory leak
unreferenced object 0xffff888114d79000 (size 1024):
comm "syz.1.17", pid 931
...
xfrm_policy_alloc+0xb3/0x4b0 net/xfrm/xfrm_policy.c:432The root cause is a double call to xfrm_pol_hold_rcu() in xfrm_migrate_policy_find(). The lookup function already returns a policy with held reference, making the second call redundant.
Remove the redundant xfrm_pol_hold_rcu() call to fix the refcount imbalance and prevent the memory leak.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- net/xfrm/xfrm_policy.c | 3 --- 1 file changed, 3 deletions(-)
net/xfrm/xfrm_policy.c +0 -3
@@ -4528,9 +4528,6 @@ static struct xfrm_policy *xfrm_migrate_policy_find(const struct xfrm_selector * pol =xfrm_policy_lookup_bytype (net, type, &fl, sel->family, dir, if_id);if (IS_ERR_OR_NULL (pol)) goto out_unlock; - -if (!xfrm_pol_hold_rcu (pol)) - pol =NULL ; out_unlock:rcu_read_unlock ();return pol;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 94/198 xfrm_user: fix info leak in build_mapping()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
[ Upstream commit 1beb76b2053b68c491b78370794b8ff63c8f8c02 ]
struct xfrm_usersa_id has a one-byte padding hole after the proto field, which ends up never getting set to zero before copying out to userspace. Fix that up by zeroing out the whole structure before setting individual variables.
--- net/xfrm/xfrm_user.c | 1 + 1 file changed, 1 insertion(+)
net/xfrm/xfrm_user.c +1 -0
@@ -4164,6 +4164,7 @@ static int build_mapping(struct sk_buff *skb, struct xfrm_state *x, um =nlmsg_data (nlh); +memset (&um->id,0 ,sizeof (um->id));memcpy (&um->id.daddr, &x->id.daddr,sizeof (um->id.daddr)); um->id.spi = x->id.spi; um->id.family = x->props.family;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 95/198 ASoC: Intel: avs: Fix memory leak in avs_register_i2s_test_boards()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <[email protected]>
[ Upstream commit c5408d818316061d6063c11a4f47f1ba25a3a708 ]
Caller is responsible for freeing array allocated with parse_int_array().
Found out by Coverity.
--- sound/soc/intel/avs/board_selection.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
sound/soc/intel/avs/board_selection.c +6 -3
@@ -520,7 +520,8 @@ static int avs_register_i2s_test_boards(struct avs_dev *adev)if (num_elems > max_ssps) {dev_err (adev->dev,"board supports only %d SSP, %d specified\n" , max_ssps, num_elems); -return -EINVAL ; + ret = -EINVAL ; + goto exit; }for (ssp_port =0 ; ssp_port < num_elems; ssp_port++) {
@@ -528,11 +529,13 @@ static int avs_register_i2s_test_boards(struct avs_dev *adev)for_each_set_bit (tdm_slot, &tdm_slots,16 ) { ret =avs_register_i2s_test_board (adev, ssp_port, tdm_slot);if (ret) -return ret; + goto exit; } } -return 0 ; +exit: +kfree (array); +return ret; }static int avs_register_i2s_board (struct avs_dev *adev,struct snd_soc_acpi_mach *mach)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 96/198 drm/xe: Fix bug in idledly unit conversion
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinay Belgaumkar <[email protected]>
[ Upstream commit 7596459f3c93d8d45a1bf12d4d7526b50c15baa2 ]
We only need to convert to picosecond units before writing to RING_IDLEDLY.
--- drivers/gpu/drm/xe/xe_hw_engine.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/xe/xe_hw_engine.c +1 -2
@@ -587,9 +587,8 @@ static void adjust_idledly(struct xe_hw_engine *hwe) maxcnt *= maxcnt_units_ns;if (xe_gt_WARN_ON (gt, idledly >= maxcnt || inhibit_switch)) { - idledly =DIV_ROUND_CLOSEST (((maxcnt -1 ) * maxcnt_units_ns), + idledly =DIV_ROUND_CLOSEST (((maxcnt -1 ) *1000 ), idledly_units_ps); - idledly =DIV_ROUND_CLOSEST (idledly,1000 );xe_mmio_write32 (>->mmio,RING_IDLEDLY (hwe->mmio_base), idledly); } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 97/198 selftests: net: bridge_vlan_mcast: wait for h1 before querier check
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Golle <[email protected]>
[ Upstream commit efaa71faf212324ecbf6d5339e9717fe53254f58 ]
The querier-interval test adds h1 (currently a slave of the VRF created by simple_if_init) to a temporary bridge br1 acting as an outside IGMP querier. The kernel VRF driver (drivers/net/vrf.c) calls cycle_netdev() on every slave add and remove, toggling the interface admin-down then up. Phylink takes the PHY down during the admin-down half of that cycle. Since h1 and swp1 are cable-connected, swp1 also loses its link may need several seconds to re-negotiate.
Use setup_wait_dev $h1 0 which waits for h1 to return to UP state, so the test can rely on the link being back up at this point.
--- tools/testing/selftests/net/forwarding/bridge_vlan_mcast.sh | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/net/forwarding/bridge_vlan_mcast.sh +1 -0
@@ -414,6 +414,7 @@ vlmc_querier_intvl_test() bridge vlan add vid 10 dev br1 self pvid untagged ip link set dev $h1 master br1 ip link set dev br1 up + setup_wait_dev $h1 0 bridge vlan add vid 10 dev $h1 master bridge vlan global set vid 10 dev br1 mcast_snooping 1 mcast_querier 1 sleep 2
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 98/198 ipvs: fix NULL deref in ip_vs_add_service error path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit 9a91797e61d286805ae10a92cc48959c30800556 ]
When ip_vs_bind_scheduler() succeeds in ip_vs_add_service(), the local variable sched is set to NULL. If ip_vs_start_estimator() subsequently fails, the out_err cleanup calls ip_vs_unbind_scheduler(svc, sched) with sched == NULL. ip_vs_unbind_scheduler() passes the cur_sched NULL check (because svc->scheduler was set by the successful bind) but then dereferences the NULL sched parameter at sched->done_service, causing a kernel panic at offset 0x30 from NULL.
Oops: general protection fault, [..] [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] RIP: 0010:ip_vs_unbind_scheduler (net/netfilter/ipvs/ip_vs_sched.c:69) Call Trace: <TASK> ip_vs_add_service.isra.0 (net/netfilter/ipvs/ip_vs_ctl.c:1500) do_ip_vs_set_ctl (net/netfilter/ipvs/ip_vs_ctl.c:2809) nf_setsockopt (net/netfilter/nf_sockopt.c:102) [..]
Fix by simply not clearing the local sched variable after a successful bind. ip_vs_unbind_scheduler() already detects whether a scheduler is installed via svc->scheduler, and keeping sched non-NULL ensures the error path passes the correct pointer to both ip_vs_unbind_scheduler() and ip_vs_scheduler_put().
While the bug is older, the problem popups in more recent kernels (6.2), when the new error path is taken after the ip_vs_start_estimator() call.
--- net/netfilter/ipvs/ip_vs_ctl.c | 1 - 1 file changed, 1 deletion(-)
net/netfilter/ipvs/ip_vs_ctl.c +0 -1
@@ -1453,7 +1453,6 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u, ret =ip_vs_bind_scheduler (svc, sched);if (ret) goto out_err; - sched =NULL ; } ret =ip_vs_start_estimator (ipvs, &svc->stats);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 99/198 netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit 1f3083aec8836213da441270cdb1ab612dd82cf4 ]
When batching multiple NFLOG messages (inst->qlen > 1), __nfulnl_send() appends an NLMSG_DONE terminator with sizeof(struct nfgenmsg) payload via nlmsg_put(), but never initializes the nfgenmsg bytes. The nlmsg_put() helper only zeroes alignment padding after the payload, not the payload itself, so four bytes of stale kernel heap data are leaked to userspace in the NLMSG_DONE message body.
Use nfnl_msg_put() to build the NLMSG_DONE terminator, which initializes the nfgenmsg payload via nfnl_fill_hdr(), consistent with how __build_packet_message() already constructs NFULNL_MSG_PACKET headers.
--- net/netfilter/nfnetlink_log.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/netfilter/nfnetlink_log.c +4 -4
@@ -361,10 +361,10 @@ static void __nfulnl_send(struct nfulnl_instance *inst) {if (inst->qlen >1 ) { -struct nlmsghdr *nlh =nlmsg_put (inst->skb,0 ,0 , -NLMSG_DONE , -sizeof (struct nfgenmsg ), -0 ); +struct nlmsghdr *nlh =nfnl_msg_put (inst->skb,0 ,0 , +NLMSG_DONE ,0 , +AF_UNSPEC ,NFNETLINK_V0 , +htons (inst->group_num));if (WARN_ONCE (!nlh,"bad nlskb size: %u, tailroom %d\n" , inst->skb->len,skb_tailroom (inst->skb))) {kfree_skb (inst->skb);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 100/198 netfilter: xt_multiport: validate range encoding in checkentry
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ren Wei <[email protected]>
[ Upstream commit ff64c5bfef12461df8450e0f50bb693b5269c720 ]
ports_match_v1() treats any non-zero pflags entry as the start of a port range and unconditionally consumes the next ports[] element as the range end.
The checkentry path currently validates protocol, flags and count, but it does not validate the range encoding itself. As a result, malformed rules can mark the last slot as a range start or place two range starts back to back, leaving ports_match_v1() to step past the last valid ports[] element while interpreting the rule.
Reject malformed multiport v1 rules in checkentry by validating that each range start has a following element and that the following element is not itself marked as another range start.
--- net/netfilter/xt_multiport.c | 34 ++++++++++++++++++++++++++++++---- 1 file changed, 30 insertions(+), 4 deletions(-)
net/netfilter/xt_multiport.c +30 -4
@@ -105,6 +105,28 @@ multiport_mt(const struct sk_buff *skb, struct xt_action_param *par)return ports_match_v1 (multiinfo,ntohs (pptr[0 ]),ntohs (pptr[1 ])); } +static bool +multiport_valid_ranges (const struct xt_multiport_v1 *multiinfo) +{ +unsigned int i; + +for (i =0 ; i < multiinfo->count; i++) { +if (!multiinfo->pflags[i]) +continue ; + +if (++i >= multiinfo->count) +return false; + +if (multiinfo->pflags[i]) +return false; + +if (multiinfo->ports[i -1 ] > multiinfo->ports[i]) +return false; + } + +return true; +} + static inline bool check(u_int16_t proto, u_int8_t ip_invflags,
@@ -127,8 +149,10 @@ static int multiport_mt_check(const struct xt_mtchk_param *par)const struct ipt_ip *ip = par->entryinfo;const struct xt_multiport_v1 *multiinfo = par->matchinfo; -return check (ip->proto, ip->invflags, multiinfo->flags, - multiinfo->count) ?0 : -EINVAL ; +if (!check (ip->proto, ip->invflags, multiinfo->flags, multiinfo->count)) +return -EINVAL ; + +return multiport_valid_ranges (multiinfo) ?0 : -EINVAL ; }static int multiport_mt6_check (const struct xt_mtchk_param *par)
@@ -136,8 +160,10 @@ static int multiport_mt6_check(const struct xt_mtchk_param *par)const struct ip6t_ip6 *ip = par->entryinfo;const struct xt_multiport_v1 *multiinfo = par->matchinfo; -return check (ip->proto, ip->invflags, multiinfo->flags, - multiinfo->count) ?0 : -EINVAL ; +if (!check (ip->proto, ip->invflags, multiinfo->flags, multiinfo->count)) +return -EINVAL ; + +return multiport_valid_ranges (multiinfo) ?0 : -EINVAL ; }static struct xt_match multiport_mt_reg[]__read_mostly = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 101/198 netfilter: ip6t_eui64: reject invalid MAC header for all packets
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengchuan Liang <[email protected]>
[ Upstream commit fdce0b3590f724540795b874b4c8850c90e6b0a8 ]
eui64_mt6() derives a modified EUI-64 from the Ethernet source address and compares it with the low 64 bits of the IPv6 source address.
The existing guard only rejects an invalid MAC header when par->fragoff != 0. For packets with par->fragoff == 0, eui64_mt6() can still reach eth_hdr(skb) even when the MAC header is not valid.
Fix this by removing the par->fragoff != 0 condition so that packets with an invalid MAC header are rejected before accessing eth_hdr(skb).
--- net/ipv6/netfilter/ip6t_eui64.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/ipv6/netfilter/ip6t_eui64.c +1 -2
@@ -22,8 +22,7 @@ eui64_mt6(const struct sk_buff *skb, struct xt_action_param *par)unsigned char eui64[8 ];if (!(skb_mac_header (skb) >= skb->head && -skb_mac_header (skb) +ETH_HLEN <= skb->data) && - par->fragoff !=0 ) { +skb_mac_header (skb) +ETH_HLEN <= skb->data)) { par->hotdrop = true;return false; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 102/198 netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Mitchell <[email protected]>
[ Upstream commit a4400a5b343d1bc4aa8f685608515413238e7ee2 ]
Currently, instance_create() uses GFP_ATOMIC because it's called while holding instances_lock spinlock. This makes allocation more likely to fail under memory pressure.
Refactor nfqnl_recv_config() to drop RCU lock after instance_lookup() and peer_portid verification. A socket cannot simultaneously send a message and close, so the queue owned by the sending socket cannot be destroyed while processing its CONFIG message. This allows instance_create() to allocate with GFP_KERNEL_ACCOUNT before taking the spinlock.
Stable-dep-of: 936206e3f6ff ("netfilter: nfnetlink_queue: make hash table per queue")
--- net/netfilter/nfnetlink_queue.c | 75 +++++++++++++++------------------ 1 file changed, 34 insertions(+), 41 deletions(-)
net/netfilter/nfnetlink_queue.c +34 -41
@@ -178,17 +178,9 @@ instance_create(struct nfnl_queue_net *q, u_int16_t queue_num, u32 portid)unsigned int h;int err; -spin_lock (&q->instances_lock); -if (instance_lookup (q, queue_num)) { - err = -EEXIST ; - goto out_unlock; - } - - inst =kzalloc (sizeof (*inst),GFP_ATOMIC ); -if (!inst) { - err = -ENOMEM ; - goto out_unlock; - } + inst =kzalloc (sizeof (*inst),GFP_KERNEL_ACCOUNT ); +if (!inst) +return ERR_PTR (-ENOMEM ); inst->queue_num = queue_num; inst->peer_portid = portid;
@@ -198,9 +190,15 @@ instance_create(struct nfnl_queue_net *q, u_int16_t queue_num, u32 portid)spin_lock_init (&inst->lock);INIT_LIST_HEAD (&inst->queue_list); +spin_lock (&q->instances_lock); +if (instance_lookup (q, queue_num)) { + err = -EEXIST ; + goto out_unlock; + } +if (!try_module_get (THIS_MODULE )) { err = -EAGAIN ; - goto out_free; + goto out_unlock; } h =instance_hashfn (queue_num);
@@ -210,10 +208,9 @@ instance_create(struct nfnl_queue_net *q, u_int16_t queue_num, u32 portid)return inst; -out_free: -kfree (inst); out_unlock:spin_unlock (&q->instances_lock); +kfree (inst);return ERR_PTR (err); }
@@ -1604,7 +1601,8 @@ static int nfqnl_recv_config(struct sk_buff *skb, const struct nfnl_info *info,struct nfqnl_msg_config_cmd *cmd =NULL ;struct nfqnl_instance *queue;__u32 flags =0 , mask =0 ; -int ret =0 ; + +WARN_ON_ONCE (!lockdep_nfnl_is_held (NFNL_SUBSYS_QUEUE ));if (nfqa[NFQA_CFG_CMD ]) { cmd =nla_data (nfqa[NFQA_CFG_CMD ]);
@@ -1650,47 +1648,44 @@ static int nfqnl_recv_config(struct sk_buff *skb, const struct nfnl_info *info, } } +/* Lookup queue under RCU. After peer_portid check (or for new queue +* in BIND case), the queue is owned by the socket sending this message. +* A socket cannot simultaneously send a message and close, so while +* processing this CONFIG message, nfqnl_rcv_nl_event() (triggered by +* socket close) cannot destroy this queue. Safe to use without RCU. +*/ rcu_read_lock (); queue =instance_lookup (q, queue_num);if (queue && queue->peer_portid !=NETLINK_CB (skb).portid) { - ret = -EPERM ; - goto err_out_unlock; +rcu_read_unlock (); +return -EPERM ; } +rcu_read_unlock ();if (cmd !=NULL ) {switch (cmd->command) {case NFQNL_CFG_CMD_BIND : -if (queue) { - ret = -EBUSY ; - goto err_out_unlock; - } - queue =instance_create (q, queue_num, -NETLINK_CB (skb).portid); -if (IS_ERR (queue)) { - ret =PTR_ERR (queue); - goto err_out_unlock; - } +if (queue) +return -EBUSY ; + queue =instance_create (q, queue_num,NETLINK_CB (skb).portid); +if (IS_ERR (queue)) +return PTR_ERR (queue);break ;case NFQNL_CFG_CMD_UNBIND : -if (!queue) { - ret = -ENODEV ; - goto err_out_unlock; - } +if (!queue) +return -ENODEV ;instance_destroy (q, queue); - goto err_out_unlock; +return 0 ;case NFQNL_CFG_CMD_PF_BIND :case NFQNL_CFG_CMD_PF_UNBIND :break ;default : - ret = -ENOTSUPP ; - goto err_out_unlock; +return -EOPNOTSUPP ; } } -if (!queue) { - ret = -ENODEV ; - goto err_out_unlock; - } +if (!queue) +return -ENODEV ;if (nfqa[NFQA_CFG_PARAMS ]) { struct nfqnl_msg_config_params *params =
@@ -1715,9 +1710,7 @@ static int nfqnl_recv_config(struct sk_buff *skb, const struct nfnl_info *info,spin_unlock_bh (&queue->lock); } -err_out_unlock: -rcu_read_unlock (); -return ret; +return 0 ; }static const struct nfnl_callback nfqnl_cb[NFQNL_MSG_MAX ] = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 103/198 netfilter: nfnetlink_queue: make hash table per queue
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 936206e3f6ff411581e615e930263d6f8b78df9d ]
Sharing a global hash table among all queues is tempting, but it can cause crash:
BUG: KASAN: slab-use-after-free in nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue] [..] nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue] nfnetlink_rcv_msg+0x46a/0x930 kmem_cache_alloc_node_noprof+0x11e/0x450
struct nf_queue_entry is freed via kfree, but parallel cpu can still encounter such an nf_queue_entry when walking the list.
Alternative fix is to free the nf_queue_entry via kfree_rcu() instead, but as we have to alloc/free for each skb this will cause more mem pressure.
--- include/net/netfilter/nf_queue.h | 1 - net/netfilter/nfnetlink_queue.c | 139 +++++++++++-------------------- 2 files changed, 49 insertions(+), 91 deletions(-)
include/net/netfilter/nf_queue.h +0 -1
@@ -23,7 +23,6 @@ struct nf_queue_entry {struct nf_hook_state state;bool nf_ct_is_unconfirmed;u16 size;/* sizeof(entry) + saved route keys */ -u16 queue_num;/* extra space to store route keys */ };
net/netfilter/nfnetlink_queue.c +49 -90
248 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 104/198 ASoC: SDCA: Fix overwritten var within for loop
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Strozek <[email protected]>
[ Upstream commit 23e0cbe55736de222ed975863cf06baf29bee5fe ]
mask variable should not be overwritten within the for loop or it will skip certain bits. Change to using BIT() macro.
--- sound/soc/sdca/sdca_interrupts.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
sound/soc/sdca/sdca_interrupts.c +1 -3
@@ -104,9 +104,7 @@ static irqreturn_t function_status_handler(int irq, void *data) status = val;for_each_set_bit (mask, &status,BITS_PER_BYTE ) { - mask =1 << mask; - -switch (mask) { +switch (BIT (mask)) {case SDCA_CTL_ENTITY_0_FUNCTION_NEEDS_INITIALIZATION ://FIXME: Add init writes break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 105/198 ASoC: amd: acp: update DMI quirk and add ACP DMIC for Lenovo platforms
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Syed Saba Kareem <[email protected]>
[ Upstream commit 6b6f7263d626886a96fce6352f94dfab7a24c339 ]
Replace DMI_EXACT_MATCH with DMI_MATCH for Lenovo SKU entries (21YW, 21YX) so the quirk applies to all variants of these models, not just exact SKU matches.
Add ASOC_SDW_ACP_DMIC flag alongside ASOC_SDW_CODEC_SPKR in driver_data for these Lenovo platform entries, as these platforms use ACP PDM DMIC instead of SoundWire DMIC for digital microphone support.
--- sound/soc/amd/acp/acp-sdw-legacy-mach.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
sound/soc/amd/acp/acp-sdw-legacy-mach.c +4 -4
@@ -99,17 +99,17 @@ static const struct dmi_system_id soc_sdw_quirk_table[] = { .callback = soc_sdw_quirk_cb, .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), - DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "21YW"), + DMI_MATCH(DMI_PRODUCT_SKU, "21YW"), }, - .driver_data = (void *)(ASOC_SDW_CODEC_SPKR), + .driver_data = (void *)((ASOC_SDW_CODEC_SPKR) | (ASOC_SDW_ACP_DMIC)), }, { .callback = soc_sdw_quirk_cb, .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), - DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "21YX"), + DMI_MATCH(DMI_PRODUCT_SKU, "21YX"), }, - .driver_data = (void *)(ASOC_SDW_CODEC_SPKR), + .driver_data = (void *)((ASOC_SDW_CODEC_SPKR) | (ASOC_SDW_ACP_DMIC)), }, { .callback = soc_sdw_quirk_cb,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 106/198 net: mdio: realtek-rtl9300: use scoped device_for_each_child_node loop
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
[ Upstream commit c09ea768bdb975e828f8e17293c397c3d14ad85d ]
Switch to device_for_each_child_node_scoped() to auto-release fwnode references on early exit.
--- drivers/net/mdio/mdio-realtek-rtl9300.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/mdio/mdio-realtek-rtl9300.c +1 -2
@@ -466,7 +466,6 @@ static int rtl9300_mdiobus_probe(struct platform_device *pdev) {struct device *dev = &pdev->dev;struct rtl9300_mdio_priv *priv; -struct fwnode_handle *child;int err; priv =devm_kzalloc (dev,sizeof (*priv),GFP_KERNEL );
@@ -487,7 +486,7 @@ static int rtl9300_mdiobus_probe(struct platform_device *pdev)if (err)return err; -device_for_each_child_node (dev, child) { +device_for_each_child_node_scoped (dev, child) { err =rtl9300_mdiobus_probe_one (dev, priv, child);if (err)return err;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 107/198 net: ioam6: fix OOB and missing lock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Iurman <[email protected]>
[ Upstream commit b30b1675aa2bcf0491fd3830b051df4e08a7c8ca ]
When trace->type.bit6 is set:
if (trace->type.bit6) {
...
queue = skb_get_tx_queue(dev, skb);
qdisc = rcu_dereference(queue->qdisc);This code can lead to an out-of-bounds access of the dev->_tx[] array when is_input is true. In such a case, the packet is on the RX path and skb->queue_mapping contains the RX queue index of the ingress device. If the ingress device has more RX queues than the egress device (dev) has TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues. Add a check to avoid this situation since skb_get_tx_queue() does not clamp the index. This issue has also revealed that per queue visibility cannot be accurate and will be replaced later as a new feature.
While at it, add missing lock around qdisc_qstats_qlen_backlog(). The function __ioam6_fill_trace_data() is called from both softirq and process contexts, hence the use of spin_lock_bh() here.
--- net/ipv6/ioam6.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/ipv6/ioam6.c +5 -1
@@ -803,12 +803,16 @@ static void __ioam6_fill_trace_data(struct sk_buff *skb,struct Qdisc *qdisc;__u32 qlen, backlog; -if (dev->flags &IFF_LOOPBACK ) { +if (dev->flags &IFF_LOOPBACK || +skb_get_queue_mapping (skb) >= dev->num_tx_queues) { *(__be32 *)data =cpu_to_be32 (IOAM6_U32_UNAVAILABLE ); }else { queue =skb_get_tx_queue (dev, skb); qdisc =rcu_dereference (queue->qdisc); + +spin_lock_bh (qdisc_lock (qdisc));qdisc_qstats_qlen_backlog (qdisc, &qlen, &backlog); +spin_unlock_bh (qdisc_lock (qdisc)); *(__be32 *)data =cpu_to_be32 (backlog); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 108/198 net: txgbe: leave space for null terminators on property_entry
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Baltieri <[email protected]>
[ Upstream commit 5a37d228799b0ec2c277459c83c814a59d310bc3 ]
Lists of struct property_entry are supposed to be terminated with an empty property, this driver currently seems to be allocating exactly the amount of entry used.
Change the struct definition to leave an extra element for all property_entry.
--- drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/wangxun/txgbe/txgbe_type.h +4 -4
@@ -399,10 +399,10 @@ struct txgbe_nodes {char i2c_name[32 ];char sfp_name[32 ];char phylink_name[32 ]; -struct property_entry gpio_props[1 ]; -struct property_entry i2c_props[3 ]; -struct property_entry sfp_props[8 ]; -struct property_entry phylink_props[2 ]; +struct property_entry gpio_props[2 ]; +struct property_entry i2c_props[4 ]; +struct property_entry sfp_props[9 ]; +struct property_entry phylink_props[3 ];struct software_node_ref_args i2c_ref[1 ];struct software_node_ref_args gpio0_ref[1 ];struct software_node_ref_args gpio1_ref[1 ];
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 109/198 af_unix: read UNIX_DIAG_VFS data under unix_state_lock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiexun Wang <[email protected]>
[ Upstream commit 39897df386376912d561d4946499379effa1e7ef ]
Exact UNIX diag lookups hold a reference to the socket, but not to u->path. Meanwhile, unix_release_sock() clears u->path under unix_state_lock() and drops the path reference after unlocking.
Read the inode and device numbers for UNIX_DIAG_VFS while holding unix_state_lock(), then emit the netlink attribute after dropping the lock.
This keeps the VFS data stable while the reply is being built.
--- net/unix/diag.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-)
net/unix/diag.c +13 -8
@@ -28,18 +28,23 @@ static int sk_diag_dump_name(struct sock *sk, struct sk_buff *nlskb)static int sk_diag_dump_vfs (struct sock *sk,struct sk_buff *nlskb) { -struct dentry *dentry =unix_sk (sk)->path.dentry; +struct unix_diag_vfs uv; +struct dentry *dentry; +bool have_vfs = false; +unix_state_lock (sk); + dentry =unix_sk (sk)->path.dentry;if (dentry) { -struct unix_diag_vfs uv = { - .udiag_vfs_ino =d_backing_inode (dentry)->i_ino, - .udiag_vfs_dev = dentry->d_sb->s_dev, - }; - -return nla_put (nlskb,UNIX_DIAG_VFS ,sizeof (uv), &uv); + uv.udiag_vfs_ino =d_backing_inode (dentry)->i_ino; + uv.udiag_vfs_dev = dentry->d_sb->s_dev; + have_vfs = true; } +unix_state_unlock (sk); -return 0 ; +if (!have_vfs) +return 0 ; + +return nla_put (nlskb,UNIX_DIAG_VFS ,sizeof (uv), &uv); }static int sk_diag_dump_peer (struct sock *sk,struct sk_buff *nlskb)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 110/198 devlink: Fix incorrect skb socket family dumping
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <[email protected]>
[ Upstream commit 0006c6f1091bbeea88b8a88a6548b9fb2f803c74 ]
The devlink_fmsg_dump_skb function was incorrectly using the socket type (sk->sk_type) instead of the socket family (sk->sk_family) when filling the "family" field in the fast message dump.
This patch fixes this to properly display the socket family.
--- net/devlink/health.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/devlink/health.c +1 -1
@@ -1327,7 +1327,7 @@ void devlink_fmsg_dump_skb(struct devlink_fmsg *fmsg, const struct sk_buff *skb)if (sk) {devlink_fmsg_pair_nest_start (fmsg,"sk" );devlink_fmsg_obj_nest_start (fmsg); -devlink_fmsg_put (fmsg,"family" , sk->sk_type); +devlink_fmsg_put (fmsg,"family" , sk->sk_family);devlink_fmsg_put (fmsg,"type" , sk->sk_type);devlink_fmsg_put (fmsg,"proto" , sk->sk_protocol);devlink_fmsg_obj_nest_end (fmsg);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 111/198 net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Koskovich <[email protected]>
[ Upstream commit 9709b56d908acc120fe8b4ae250b3c9d749ea832 ]
Fix the field masks to match the hardware layout documented in downstream GSI (GSI_V3_0_EE_n_GSI_EE_GENERIC_CMD_*).
Notably this fixes a WARN I was seeing when I tried to send "stop" to the MPSS remoteproc while IPA was up.
--- drivers/net/ipa/reg/gsi_reg-v5.0.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/ipa/reg/gsi_reg-v5.0.c +4 -3
@@ -156,9 +156,10 @@ REG_FIELDS(EV_CH_CMD, ev_ch_cmd, 0x00025010 + 0x12000 * GSI_EE_AP);static const u32 reg_generic_cmd_fmask[] = { [GENERIC_OPCODE ] =GENMASK (4 ,0 ), - [GENERIC_CHID ] =GENMASK (9 ,5 ), - [GENERIC_EE ] =GENMASK (13 ,10 ), -/* Bits 14-31 reserved */ + [GENERIC_CHID ] =GENMASK (12 ,5 ), + [GENERIC_EE ] =GENMASK (16 ,13 ), +/* Bits 17-23 reserved */ + [GENERIC_PARAMS ] =GENMASK (31 ,24 ), };REG_FIELDS (GENERIC_CMD , generic_cmd,0x00025018 +0x12000 *GSI_EE_AP );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 112/198 net: ipa: fix event ring index not programmed for IPA v5.0+
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Koskovich <[email protected]>
[ Upstream commit 56007972c0b1e783ca714d6f1f4d6e66e531d21f ]
For IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to CH_C_CNTXT_1. The v5.0 register definition intended to define this field in the CH_C_CNTXT_1 fmask array but used the old identifier of ERINDEX instead of CH_ERINDEX.
Without a valid event ring, GSI channels could never signal transfer completions. This caused gsi_channel_trans_quiesce() to block forever in wait_for_completion().
At least for IPA v5.2 this resolves an issue seen where runtime suspend, system suspend, and remoteproc stop all hanged forever. It also meant the IPA data path was completely non functional.
--- drivers/net/ipa/reg/gsi_reg-v5.0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ipa/reg/gsi_reg-v5.0.c +1 -1
@@ -30,7 +30,7 @@ REG_STRIDE_FIELDS(CH_C_CNTXT_0, ch_c_cntxt_0,static const u32 reg_ch_c_cntxt_1_fmask[] = { [CH_R_LENGTH ] =GENMASK (23 ,0 ), - [ERINDEX ] =GENMASK (31 ,24 ), + [CH_ERINDEX ] =GENMASK (31 ,24 ), }; REG_STRIDE_FIELDS(CH_C_CNTXT_1, ch_c_cntxt_1,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 113/198 l2tp: Drop large packets with UDP encap
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Mikityanska <[email protected]>
[ Upstream commit ebe560ea5f54134279356703e73b7f867c89db13 ]
syzbot reported a WARN on my patch series [1]. The actual issue is an overflow of 16-bit UDP length field, and it exists in the upstream code. My series added a debug WARN with an overflow check that exposed the issue, that's why syzbot tripped on my patches, rather than on upstream code.
syzbot's repro:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0xfffffffc}, 0x1c)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0xffff, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x32) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)="ee", 0x34000}], 0x1)
It basically sends an oversized (0x34000 bytes) PPPoL2TP packet with UDP encapsulation, and l2tp_xmit_core doesn't check for overflows when it assigns the UDP length field. The value gets trimmed to 16 bites.
Add an overflow check that drops oversized packets and avoids sending packets with trimmed UDP length to the wire.
syzbot's stack trace (with my patch applied):
len >= 65536u
WARNING: ./include/linux/udp.h:38 at udp_set_len_short include/linux/udp.h:38 [inline], CPU#1: syz.0.17/5957 WARNING: ./include/linux/udp.h:38 at l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline], CPU#1: syz.0.17/5957 WARNING: ./include/linux/udp.h:38 at l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327, CPU#1: syz.0.17/5957 Modules linked in: CPU: 1 UID: 0 PID: 5957 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:udp_set_len_short include/linux/udp.h:38 [inline] RIP: 0010:l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline] RIP: 0010:l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327 Code: 0f 0b 90 e9 21 f9 ff ff e8 e9 05 ec f6 90 0f 0b 90 e9 8d f9 ff ff e8 db 05 ec f6 90 0f 0b 90 e9 cc f9 ff ff e8 cd 05 ec f6 90 <0f> 0b 90 e9 de fa ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 4f RSP: 0018:ffffc90003d67878 EFLAGS: 00010293 RAX: ffffffff8ad985e3 RBX: ffff8881a6400090 RCX: ffff8881697f0000 RDX: 0000000000000000 RSI: 0000000000034010 RDI: 000000000000ffff RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff520007acf00 R12: ffff8881baf20900 R13: 0000000000034010 R14: ffff8881a640008e R15: ffff8881760f7000 FS: 000055557e81f500(0000) GS:ffff8882a9467000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000033000 CR3: 00000001612f4000 CR4: 00000000000006f0 Call Trace: <TASK> pppol2tp_sendmsg+0x40a/0x5f0 net/l2tp/l2tp_ppp.c:302 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] sock_write_iter+0x503/0x550 net/socket.c:1195 do_iter_readv_writev+0x619/0x8c0 fs/read_write.c:-1 vfs_writev+0x33c/0x990 fs/read_write.c:1059 do_writev+0x154/0x2e0 fs/read_write.c:1105 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f636479c629 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffffd4241c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007f6364a15fa0 RCX: 00007f636479c629 RDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000003 RBP: 00007f6364832b39 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6364a15fac R14: 00007f6364a15fa0 R15: 00007f6364a15fa0 </TASK>
[1]: https://lore.kernel.org/all/[email protected]/
--- net/l2tp/l2tp_core.c | 5 +++++ 1 file changed, 5 insertions(+)
net/l2tp/l2tp_core.c +5 -0
@@ -1290,6 +1290,11 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, uns uh->source = inet->inet_sport; uh->dest = inet->inet_dport; udp_len = uhlen + session->hdr_len + data_len; +if (udp_len >U16_MAX ) { +kfree_skb (skb); + ret =NET_XMIT_DROP ; + goto out_unlock; + } uh->len =htons (udp_len);/* Calculate UDP checksum if configured to do so */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 114/198 gpio: tegra: fix irq_release_resources calling enable instead of disable
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samasth Norway Ananda <[email protected]>
[ Upstream commit 1561d96f5f55c1bca9ff047ace5813f4f244eea6 ]
tegra_gpio_irq_release_resources() erroneously calls tegra_gpio_enable() instead of tegra_gpio_disable(). When IRQ resources are released, the GPIO configuration bit (CNF) should be cleared to deconfigure the pin as a GPIO. Leaving it enabled wastes power and can cause unexpected behavior if the pin is later reused for an alternate function via pinctrl.
--- drivers/gpio/gpio-tegra.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-tegra.c +1 -1
@@ -595,7 +595,7 @@ static void tegra_gpio_irq_release_resources(struct irq_data *d)struct tegra_gpio_info *tgi =gpiochip_get_data (chip);gpiochip_relres_irq (chip, d->hwirq); -tegra_gpio_enable (tgi, d->hwirq); +tegra_gpio_disable (tgi, d->hwirq); }static void tegra_gpio_irq_print_chip (struct irq_data *d,struct seq_file *s)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 115/198 crypto: af_alg - limit RX SG extraction by receive buffer budget
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douya Le <[email protected]>
[ Upstream commit 8eceab19eba9dcbfd2a0daec72e1bf48aa100170 ]
Make af_alg_get_rsgl() limit each RX scatterlist extraction to the remaining receive buffer budget.
af_alg_get_rsgl() currently uses af_alg_readable() only as a gate before extracting data into the RX scatterlist. Limit each extraction to the remaining af_alg_rcvbuf(sk) budget so that receive-side accounting matches the amount of data attached to the request.
If skcipher cannot obtain enough RX space for at least one chunk while more data remains to be processed, reject the recvmsg call instead of rounding the request length down to zero.
--- crypto/af_alg.c | 2 ++ crypto/algif_skcipher.c | 5 +++++ 2 files changed, 7 insertions(+)
crypto/af_alg.c +2 -0
@@ -1229,6 +1229,8 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags, seglen =min_t (size_t, (maxsize - len),msg_data_left (msg)); +/* Never pin more pages than the remaining RX accounting budget. */ + seglen =min_t (size_t, seglen,af_alg_rcvbuf (sk));if (list_empty (&areq->rsgl_list)) { rsgl = &areq->first_rsgl;
crypto/algif_skcipher.c +5 -0
@@ -130,6 +130,11 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,* full block size buffers. */ if (ctx->more || len < ctx->used) { +if (len < bs) { + err = -EINVAL ; + goto free; + } + len -= len % bs; cflags |=CRYPTO_SKCIPHER_REQ_NOTFINAL ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 116/198 perf/x86/intel/uncore: Skip discovery table for offline dies
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zide Chen <[email protected]>
[ Upstream commit 7b568e9eba2fad89a696f22f0413d44cf4a1f892 ]
This warning can be triggered if NUMA is disabled and the system boots with fewer CPUs than the number of CPUs in die 0.
WARNING: CPU: 9 PID: 7257 at uncore.c:1157 uncore_pci_pmu_register+0x136/0x160 [intel_uncore]
Currently, the discovery table continues to be parsed even if all CPUs in the associated die are offline. This can lead to an array overflow at "pmu->boxes[die] = box" in uncore_pci_pmu_register(), which may trigger the warning above or cause other issues.
--- arch/x86/events/intel/uncore_discovery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/events/intel/uncore_discovery.c +1 -1
@@ -383,7 +383,7 @@ static bool intel_uncore_has_discovery_tables_pci(int *ignore) (val &UNCORE_DISCOVERY_DVSEC2_BIR_MASK ) *UNCORE_DISCOVERY_BIR_STEP ; die =get_device_die_id (dev); -if (die <0 ) +if ((die <0 ) || (die >=uncore_max_dies ()))continue ;parse_discovery_table (dev, die, bar_offset, &parsed, ignore);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 117/198 sched/deadline: Use revised wakeup rule for dl_server
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 14a857056466be9d3d907a94e92a704ac1be149b ]
John noted that commit 115135422562 ("sched/deadline: Fix 'stuck' dl_server") unfixed the issue from commit a3a70caf7906 ("sched/deadline: Fix dl_server behaviour").
The issue in commit 115135422562 was for wakeups of the server after the deadline; in which case you *have* to start a new period. The case for a3a70caf7906 is wakeups before the deadline.
Now, because the server is effectively running a least-laxity policy, it means that any wakeup during the runnable phase means dl_entity_overflow() will be true. This means we need to adjust the runtime to allow it to still run until the existing deadline expires.
Use the revised wakeup rule for dl_defer entities.
--- kernel/sched/deadline.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/deadline.c +1 -1
@@ -1036,7 +1036,7 @@ static void update_dl_entity(struct sched_dl_entity *dl_se)if (dl_time_before (dl_se->deadline,rq_clock (rq)) ||dl_entity_overflow (dl_se,rq_clock (rq))) { -if (unlikely (!dl_is_implicit (dl_se) && +if (unlikely ((!dl_is_implicit (dl_se) || dl_se->dl_defer) && !dl_time_before (dl_se->deadline,rq_clock (rq)) && !is_dl_boosted (dl_se))) {update_dl_revised_wakeup (dl_se, rq);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 118/198 clockevents: Prevent timer interrupt starvation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit d6e152d905bdb1f32f9d99775e2f453350399a6a ]
Calvin reported an odd NMI watchdog lockup which claims that the CPU locked up in user space. He provided a reproducer, which sets up a timerfd based timer and then rearms it in a loop with an absolute expiry time of 1ns.
As the expiry time is in the past, the timer ends up as the first expiring timer in the per CPU hrtimer base and the clockevent device is programmed with the minimum delta value. If the machine is fast enough, this ends up in a endless loop of programming the delta value to the minimum value defined by the clock event device, before the timer interrupt can fire, which starves the interrupt and consequently triggers the lockup detector because the hrtimer callback of the lockup mechanism is never invoked.
As a first step to prevent this, avoid reprogramming the clock event device when:
- a forced minimum delta event is pending
- the new expiry delta is less then or equal to the minimum delta
Thanks to Calvin for providing the reproducer and to Borislav for testing and providing data from his Zen5 machine.
The problem is not limited to Zen5, but depending on the underlying clock event device (e.g. TSC deadline timer on Intel) and the CPU speed not necessarily observable.
This change serves only as the last resort and further changes will be made to prevent this scenario earlier in the call chain as far as possible.
[ tglx: Updated to restore the old behaviour vs. !force and delta <= 0 and
fixed up the tick-broadcast handlers as pointed out by Borislav ]
--- include/linux/clockchips.h | 2 ++ kernel/time/clockevents.c | 27 +++++++++++++++++++-------- kernel/time/hrtimer.c | 1 + kernel/time/tick-broadcast.c | 8 +++++++- kernel/time/tick-common.c | 1 + kernel/time/tick-sched.c | 1 + 6 files changed, 31 insertions(+), 9 deletions(-)
include/linux/clockchips.h +2 -0
@@ -80,6 +80,7 @@ enum clock_event_state {* @shift: nanoseconds to cycles divisor (power of two) * @state_use_accessors:current state of the device, assigned by the core code * @features: features +* @next_event_forced: True if the last programming was a forced event * @retries: number of forced programming retries * @set_state_periodic: switch state to periodic * @set_state_oneshot: switch state to oneshot
@@ -108,6 +109,7 @@ struct clock_event_device {u32 shift;enum clock_event_state state_use_accessors;unsigned int features; +unsigned int next_event_forced;unsigned long retries;int (*set_state_periodic)(struct clock_event_device *);
kernel/time/clockevents.c +19 -8
@@ -172,6 +172,7 @@ void clockevents_shutdown(struct clock_event_device *dev) {clockevents_switch_state (dev,CLOCK_EVT_STATE_SHUTDOWN ); dev->next_event =KTIME_MAX ; + dev->next_event_forced =0 ; }/**
@@ -305,7 +306,6 @@ int clockevents_program_event(struct clock_event_device *dev, ktime_t expires, {unsigned long long clc;int64_t delta; -int rc;if (WARN_ON_ONCE (expires <0 ))return -ETIME ;
@@ -324,16 +324,27 @@ int clockevents_program_event(struct clock_event_device *dev, ktime_t expires,return dev->set_next_ktime (expires, dev); delta =ktime_to_ns (ktime_sub (expires,ktime_get ())); -if (delta <=0 ) -return force ?clockevents_program_min_delta (dev) : -ETIME ; - delta =min (delta, (int64_t ) dev->max_delta_ns); - delta =max (delta, (int64_t ) dev->min_delta_ns); +/* Required for tick_periodic() during early boot */ +if (delta <=0 && !force) +return -ETIME ; + +if (delta > (int64_t )dev->min_delta_ns) { + delta =min (delta, (int64_t ) dev->max_delta_ns); + clc = ((unsigned long long ) delta * dev->mult) >> dev->shift; +if (!dev->set_next_event ((unsigned long ) clc, dev)) +return 0 ; + } - clc = ((unsigned long long ) delta * dev->mult) >> dev->shift; - rc = dev->set_next_event ((unsigned long ) clc, dev); +if (dev->next_event_forced) +return 0 ; -return (rc && force) ?clockevents_program_min_delta (dev) : rc; +if (dev->set_next_event (dev->min_delta_ticks, dev)) { +if (!force ||clockevents_program_min_delta (dev)) +return -ETIME ; + } + dev->next_event_forced =1 ; +return 0 ; }/*
kernel/time/hrtimer.c +1 -0
@@ -1880,6 +1880,7 @@ void hrtimer_interrupt(struct clock_event_device *dev)BUG_ON (!cpu_base->hres_active); cpu_base->nr_events++; dev->next_event =KTIME_MAX ; + dev->next_event_forced =0 ;raw_spin_lock_irqsave (&cpu_base->lock, flags); entry_time = now =hrtimer_update_base (cpu_base);
kernel/time/tick-broadcast.c +7 -1
@@ -76,8 +76,10 @@ const struct clock_event_device *tick_get_wakeup_device(int cpu)*/ static void tick_broadcast_start_periodic (struct clock_event_device *bc) { -if (bc) +if (bc) { + bc->next_event_forced =0 ;tick_setup_periodic (bc,1 ); + } }/*
@@ -403,6 +405,7 @@ static void tick_handle_periodic_broadcast(struct clock_event_device *dev)bool bc_local;raw_spin_lock (&tick_broadcast_lock); + tick_broadcast_device.evtdev->next_event_forced =0 ;/* Handle spurious interrupts gracefully */ if (clockevent_state_shutdown (tick_broadcast_device.evtdev)) {
@@ -696,6 +699,7 @@ static void tick_handle_oneshot_broadcast(struct clock_event_device *dev)raw_spin_lock (&tick_broadcast_lock); dev->next_event =KTIME_MAX ; + tick_broadcast_device.evtdev->next_event_forced =0 ; next_event =KTIME_MAX ;cpumask_clear (tmpmask); now =ktime_get ();
@@ -1063,6 +1067,7 @@ static void tick_broadcast_setup_oneshot(struct clock_event_device *bc, bc->event_handler = tick_handle_oneshot_broadcast; + bc->next_event_forced =0 ; bc->next_event =KTIME_MAX ;/*
@@ -1175,6 +1180,7 @@ void hotplug_cpu__broadcast_tick_pull(int deadcpu) }/* This moves the broadcast assignment to this CPU: */ + bc->next_event_forced =0 ;clockevents_program_event (bc, bc->next_event,1 ); }raw_spin_unlock_irqrestore (&tick_broadcast_lock, flags);
kernel/time/tick-common.c +1 -0
@@ -110,6 +110,7 @@ void tick_handle_periodic(struct clock_event_device *dev)int cpu =smp_processor_id ();ktime_t next = dev->next_event; + dev->next_event_forced =0 ;tick_periodic (cpu);/*
kernel/time/tick-sched.c +1 -0
@@ -1482,6 +1482,7 @@ static void tick_nohz_lowres_handler(struct clock_event_device *dev)struct tick_sched *ts =this_cpu_ptr (&tick_cpu_sched); dev->next_event =KTIME_MAX ; + dev->next_event_forced =0 ;if (likely (tick_nohz_handler (&ts->sched_timer) ==HRTIMER_RESTART ))tick_program_event (hrtimer_get_expires (&ts->sched_timer),1 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 119/198 crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 31d00156e50ecad37f2cb6cbf04aaa9a260505ef ]
When page reassignment was added to af_alg_pull_tsgl the original loop wasn't updated so it may try to reassign one more page than necessary.
Add the check to the reassignment so that this does not happen.
Also update the comment which still refers to the obsolete offset argument.
--- crypto/af_alg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
crypto/af_alg.c +2 -2
@@ -705,8 +705,8 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst)* Assumption: caller created af_alg_count_tsgl(len) * SG entries in dst. */ -if (dst) { -/* reassign page to dst after offset */ +if (dst && plen) { +/* reassign page to dst */ get_page (page);sg_set_page (dst + j, page, plen, sg[i].offset); j++;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 120/198 crypto: algif_aead - Fix minimum RX size check for decryption
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 3d14bd48e3a77091cbce637a12c2ae31b4a1687c ]
The check for the minimum receive buffer size did not take the tag size into account during decryption. Fix this by adding the required extra length.
--- crypto/algif_aead.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/algif_aead.c +1 -1
@@ -144,7 +144,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,if (usedpages < outlen) {size_t less = outlen - usedpages; -if (used < less) { +if (used < less + (ctx->enc ?0 : as)) { err = -EINVAL ; goto free; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 121/198 netfilter: conntrack: add missing netlink policy validations
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit f900e1d77ee0ef87bfb5ab3fe60f0b3d8ad5ba05 ]
Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink.
These attributes are used by the kernel without any validation. Extend the netlink policies accordingly.
Quoting the reporter:
nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE value directly to ct->proto.sctp.state without checking that it is within the valid range. [..]
and: ... with exp->dir = 100, the access at ct->master->tuplehash[100] reads 5600 bytes past the start of a 320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by UBSAN.
--- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nf_conntrack_proto_sctp.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
net/netfilter/nf_conntrack_netlink.c +1 -1
@@ -3475,7 +3475,7 @@ ctnetlink_change_expect(struct nf_conntrack_expect *x,#if IS_ENABLED (CONFIG_NF_NAT )static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX +1 ] = { - [CTA_EXPECT_NAT_DIR ] = { .type =NLA_U32 }, + [CTA_EXPECT_NAT_DIR ] =NLA_POLICY_MAX (NLA_BE32 ,IP_CT_DIR_REPLY ), [CTA_EXPECT_NAT_TUPLE ] = { .type =NLA_NESTED }, };#endif
net/netfilter/nf_conntrack_proto_sctp.c +2 -1
@@ -582,7 +582,8 @@ static int sctp_to_nlattr(struct sk_buff *skb, struct nlattr *nla, }static const struct nla_policy sctp_nla_policy[CTA_PROTOINFO_SCTP_MAX +1 ] = { - [CTA_PROTOINFO_SCTP_STATE ] = { .type =NLA_U8 }, + [CTA_PROTOINFO_SCTP_STATE ] =NLA_POLICY_MAX (NLA_U8 , +SCTP_CONNTRACK_HEARTBEAT_SENT ), [CTA_PROTOINFO_SCTP_VTAG_ORIGINAL ] = { .type =NLA_U32 }, [CTA_PROTOINFO_SCTP_VTAG_REPLY ] = { .type =NLA_U32 }, };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 122/198 nfc: llcp: add missing return after LLCP_CLOSED checks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxi Qian <[email protected]>
commit 2b5dd4632966c39da6ba74dbc8689b309065e82c upstream.
In nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket state is LLCP_CLOSED, the code correctly calls release_sock() and nfc_llcp_sock_put() but fails to return. Execution falls through to the remainder of the function, which calls release_sock() and nfc_llcp_sock_put() again. This results in a double release_sock() and a refcount underflow via double nfc_llcp_sock_put(), leading to a use-after-free.
Add the missing return statements after the LLCP_CLOSED branches in both functions to prevent the fall-through.
--- net/nfc/llcp_core.c | 2 ++ 1 file changed, 2 insertions(+)
net/nfc/llcp_core.c +2 -0
@@ -1091,6 +1091,7 @@ static void nfc_llcp_recv_hdlc(struct nfif (sk->sk_state ==LLCP_CLOSED ) {release_sock (sk);nfc_llcp_sock_put (llcp_sock); +return ; }/* Pass the payload upstream */
@@ -1182,6 +1183,7 @@ static void nfc_llcp_recv_disc(struct nfif (sk->sk_state ==LLCP_CLOSED ) {release_sock (sk);nfc_llcp_sock_put (llcp_sock); +return ; }if (sk->sk_state ==LLCP_CONNECTED ) {
Greg Kroah-Hartman
maintainerPATCH 123/198 can: raw: fix ro->uniq use-after-free in raw_rcv()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Page <[email protected]>
commit a535a9217ca3f2fccedaafb2fddb4c48f27d36dc upstream.
raw_release() unregisters raw CAN receive filters via can_rx_unregister(), but receiver deletion is deferred with call_rcu(). This leaves a window where raw_rcv() may still be running in an RCU read-side critical section after raw_release() frees ro->uniq, leading to a use-after-free of the percpu uniq storage.
Move free_percpu(ro->uniq) out of raw_release() and into a raw-specific socket destructor. can_rx_unregister() takes an extra reference to the socket and only drops it from the RCU callback, so freeing uniq from sk_destruct ensures the percpu area is not released until the relevant callbacks have drained.
--- net/can/raw.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
net/can/raw.c +10 -1
@@ -360,6 +360,14 @@ static int raw_notifier(struct notifier_return NOTIFY_DONE ; } +static void raw_sock_destruct (struct sock *sk) +{ +struct raw_sock *ro =raw_sk (sk); + +free_percpu (ro->uniq); +can_sock_destruct (sk); +} +static int raw_init (struct sock *sk) {struct raw_sock *ro =raw_sk (sk);
@@ -386,6 +394,8 @@ static int raw_init(struct sock *sk)if (unlikely (!ro->uniq))return -ENOMEM ; + sk->sk_destruct = raw_sock_destruct; +/* set notifier */ spin_lock (&raw_notifier_lock);list_add_tail (&ro->notifier, &raw_notifier_list);
@@ -435,7 +445,6 @@ static int raw_release(struct socket *so ro->bound =0 ; ro->dev =NULL ; ro->count =0 ; -free_percpu (ro->uniq);sock_orphan (sk); sock->sk =NULL ;
Greg Kroah-Hartman
maintainerPATCH 124/198 i2c: s3c24xx: check the size of the SMBUS message before using it
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit c0128c7157d639a931353ea344fb44aad6d6e17a upstream.
The first byte of an i2c SMBUS message is the size, and it should be verified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX before processing it.
This is the same logic that was added in commit a6e04f05ce0b ("i2c:
tegra: check msg length in SMBUS block read") to the i2c tegra driver.
--- drivers/i2c/busses/i2c-s3c2410.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-s3c2410.c +6 -1
@@ -503,8 +503,13 @@ static void i2c_s3c_irq_nextbyte(struct i2c->msg->buf[i2c->msg_ptr++] = byte;/* Add actual length to read for smbus block read */ -if (i2c->msg->flags &I2C_M_RECV_LEN && i2c->msg->len ==1 ) +if (i2c->msg->flags &I2C_M_RECV_LEN && i2c->msg->len ==1 ) { +if (byte ==0 || byte >I2C_SMBUS_BLOCK_MAX ) { +s3c24xx_i2c_stop (i2c, -EPROTO ); +break ; + } i2c->msg->len += byte; + } prepare_read:if (is_msglast (i2c)) {/* last byte of buffer */
Greg Kroah-Hartman
maintainerPATCH 125/198 staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin YuChen <[email protected]>
commit 8c964b82a4e97ec7f25e17b803ee196009b38a57 upstream.
Initialize le_tmp64 to zero in rtw_BIP_verify() to prevent using uninitialized data.
Smatch warns that only 6 bytes are copied to this 8-byte (u64) variable, leaving the last two bytes uninitialized:
drivers/staging/rtl8723bs/core/rtw_security.c:1308 rtw_BIP_verify()
warn: not copying enough bytes for '&le_tmp64' (8 vs 6 bytes)
Initializing the variable at the start of the function fixes this warning and ensures predictable behavior.
--- drivers/staging/rtl8723bs/core/rtw_security.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/rtl8723bs/core/rtw_security.c +1 -1
@@ -1321,7 +1321,7 @@ u32 rtw_BIP_verify(struct adapter *padapu8 mic[16 ];struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;__le16 le_tmp; -__le64 le_tmp64; +__le64 le_tmp64 =0 ; ori_len = pattrib->pkt_len-WLAN_HDR_A3_LEN +BIP_AAD_SIZE ;BIP_AAD =rtw_zmalloc (ori_len);
Greg Kroah-Hartman
maintainerPATCH 126/198 HID: alps: fix NULL pointer dereference in alps_raw_event()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 1badfc4319224820d5d890f8eab6aa52e4e83339 upstream.
Commit ecfa6f34492c ("HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them") attempted to fix up the HID drivers that had missed the previous fix that was done in 2ff5baa9b527 ("HID: appleir:
Fix potential NULL dereference at raw event handle"), but the alps driver was missed.
Fix this up by properly checking in the hid-alps driver that it had been claimed correctly before attempting to process the raw event.
--- drivers/hid/hid-alps.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/hid/hid-alps.c +3 -0
@@ -437,6 +437,9 @@ static int alps_raw_event(struct hid_devint ret =0 ;struct alps_dev *hdata =hid_get_drvdata (hdev); +if (!(hdev->claimed &HID_CLAIMED_INPUT ) || !hdata->input) +return 0 ; +switch (hdev->product) {case HID_PRODUCT_ID_T4_BTNLESS : ret =t4_raw_event (hdata, data, size);
Greg Kroah-Hartman
maintainerPATCH 127/198 HID: core: clamp report_size in s32ton() to avoid undefined shift
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 69c02ffde6ed4d535fa4e693a9e572729cad3d0d upstream.
s32ton() shifts by n-1 where n is the field's report_size, a value that comes directly from a HID device. The HID parser bounds report_size only to <= 256, so a broken HID device can supply a report descriptor with a wide field that triggers shift exponents up to 256 on a 32-bit type when an output report is built via hid_output_field() or hid_set_field().
Commit ec61b41918587 ("HID: core: fix shift-out-of-bounds in hid_report_raw_event") added the same n > 32 clamp to the function snto32(), but s32ton() was never given the same fix as I guess syzbot hadn't figured out how to fuzz a device the same way.
Fix this up by just clamping the max value of n, just like snto32() does.
--- drivers/hid/hid-core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/hid/hid-core.c +3 -0
@@ -71,6 +71,9 @@ static u32 s32ton(__s32 value, unsignedif (!value || !n)return 0 ; +if (n >32 ) + n =32 ; + a = value >> (n -1 );if (a && a !=-1 )return value <0 ?1 << (n -1 ) : (1 << (n -1 )) -1 ;
Greg Kroah-Hartman
maintainerPATCH 128/198 net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 600dc40554dc5ad1e6f3af51f700228033f43ea7 upstream.
A malicious USB device claiming to be a CDC Phonet modem can overflow the skb_shared_info->frags[] array by sending an unbounded sequence of full-page bulk transfers.
Drop the skb and increment the length error when the frag limit is reached. This matches the same fix that commit f0813bcd2d9d ("net:
wwan: t7xx: fix potential skb->frags overflow in RX path") did for the t7xx driver.
--- drivers/net/usb/cdc-phonet.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/usb/cdc-phonet.c +6 -1
@@ -157,11 +157,16 @@ static void rx_complete(struct urb *req) PAGE_SIZE); page =NULL ; } - }else { + }else if (skb_shinfo (skb)->nr_frags <MAX_SKB_FRAGS ) {skb_add_rx_frag (skb,skb_shinfo (skb)->nr_frags, page,0 , req->actual_length,PAGE_SIZE ); page =NULL ; + }else { +dev_kfree_skb_any (skb); + pnd->rx_skb =NULL ; + skb =NULL ; + dev->stats.rx_length_errors++; }if (req->actual_length <PAGE_SIZE ) pnd->rx_skb =NULL ;/* Last fragment */
Greg Kroah-Hartman
maintainerPATCH 129/198 NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 46ce8be2ced389bccd84bcc04a12cf2f4d0c22d1 upstream.
The NFC-A anti-collision cascade in digital_in_recv_sdd_res() appends 3 or 4 bytes to target->nfcid1 on each round, but the number of cascade rounds is controlled entirely by the peer device. The peer sets the cascade tag in the SDD_RES (deciding 3 vs 4 bytes) and the cascade-incomplete bit in the SEL_RES (deciding whether another round follows).
ISO 14443-3 limits NFC-A to three cascade levels and target->nfcid1 is sized accordingly (NFC_NFCID1_MAXSIZE = 10), but nothing in the driver actually enforces this. This means a malicious peer can keep the cascade running, writing past the heap-allocated nfc_target with each round.
Fix this by rejecting the response when the accumulated UID would exceed the buffer.
Commit e329e71013c9 ("NFC: nci: Bounds check struct nfc_target arrays") fixed similar missing checks against the same field on the NCI path.
--- net/nfc/digital_technology.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/nfc/digital_technology.c +6 -0
@@ -424,6 +424,12 @@ static void digital_in_recv_sdd_res(stru size =4 ; } +if (target->nfcid1_len + size >NFC_NFCID1_MAXSIZE ) { +PROTOCOL_ERR ("4.7.2.1" ); + rc = -EPROTO ; + goto exit; + } +memcpy (target->nfcid1 + target->nfcid1_len, sdd_res->nfcid1 + offset, size); target->nfcid1_len += size;
Greg Kroah-Hartman
maintainerPATCH 130/198 drm/vc4: platform_get_irq_byname() returns an int
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit e597a809a2b97e927060ba182f58eb3e6101bc70 upstream.
platform_get_irq_byname() will return a negative value if an error happens, so it should be checked and not just passed directly into devm_request_threaded_irq() hoping all will be ok.
--- drivers/gpu/drm/vc4/vc4_hdmi.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/gpu/drm/vc4/vc4_hdmi.c +10 -4
@@ -2355,17 +2355,23 @@ static int vc4_hdmi_hotplug_init(structint ret;if (vc4_hdmi->variant->external_irq_controller) { -unsigned int hpd_con =platform_get_irq_byname (pdev,"hpd-connected" ); -unsigned int hpd_rm =platform_get_irq_byname (pdev,"hpd-removed" ); +int hpd =platform_get_irq_byname (pdev,"hpd-connected" ); - ret =devm_request_threaded_irq (&pdev->dev, hpd_con, +if (hpd <0 ) +return hpd; + + ret =devm_request_threaded_irq (&pdev->dev, hpd,NULL , vc4_hdmi_hpd_irq_thread,IRQF_ONESHOT ,"vc4 hdmi hpd connected" , vc4_hdmi);if (ret)return ret; - ret =devm_request_threaded_irq (&pdev->dev, hpd_rm, + hpd =platform_get_irq_byname (pdev,"hpd-removed" ); +if (hpd <0 ) +return hpd; + + ret =devm_request_threaded_irq (&pdev->dev, hpd,NULL , vc4_hdmi_hpd_irq_thread,IRQF_ONESHOT ,"vc4 hdmi hpd disconnected" , vc4_hdmi);
Greg Kroah-Hartman
maintainerPATCH 131/198 ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 48bd344e1040b9f2eb512be73c13f5db83efc191 upstream.
A malicious USB device with the TASCAM US-144MKII device id can have a configuration containing bInterfaceNumber=1 but no interface 0. USB configuration descriptors are not required to assign interface numbers sequentially, so usb_ifnum_to_if(dev, 0) returns will NULL, which will then be dereferenced directly.
Fix this up by checking the return value properly.
--- sound/usb/usx2y/us144mkii.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/usb/usx2y/us144mkii.c +5 -1
@@ -421,7 +421,11 @@ static int tascam_probe(struct usb_inter/* The device has two interfaces; we drive both from this driver. */ if (intf->cur_altsetting->desc.bInterfaceNumber ==1 ) { - tascam =usb_get_intfdata (usb_ifnum_to_if (dev,0 )); +struct usb_interface *intf_zero =usb_ifnum_to_if (dev,0 ); + +if (!intf_zero) +return -ENODEV ; + tascam =usb_get_intfdata (intf_zero);if (tascam) {usb_set_intfdata (intf, tascam); tascam->iface1 = intf;
Greg Kroah-Hartman
maintainerPATCH 132/198 ALSA: fireworks: bound device-supplied status before string array lookup
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 07704bbf36f57e4379e4cadf96410dab14621e3b upstream.
The status field in an EFW response is a 32-bit value supplied by the firewire device. efr_status_names[] has 17 entries so a status value outside that range goes off into the weeds when looking at the %s value.
Even worse, the status could return EFR_STATUS_INCOMPLETE which is 0x80000000, and is obviously not in that array of potential strings.
Fix this up by properly bounding the index against the array size and printing "unknown" if it's not recognized.
--- sound/firewire/fireworks/fireworks_command.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
sound/firewire/fireworks/fireworks_command.c +4 -1
@@ -151,10 +151,13 @@ efw_transaction(struct snd_efw *efw, uns (be32_to_cpu(header->category) != category) || (be32_to_cpu(header->command) != command) || (be32_to_cpu(header->status) != EFR_STATUS_OK)) { +u32 st =be32_to_cpu (header->status); +dev_err (&efw->unit->device,"EFW command failed [%u/%u]: %s\n" ,be32_to_cpu (header->category),be32_to_cpu (header->command), - efr_status_names[be32_to_cpu (header->status)]); + st <ARRAY_SIZE (efr_status_names) ? + efr_status_names[st] :"unknown" ); err = -EIO ; goto end; }
Greg Kroah-Hartman
maintainerPATCH 133/198 fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 8f98b81fe011e1879e6a7b1247e69e06a5e17af2 upstream.
Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide by zero error"), we also need to prevent that same crash from happening in the udlfb driver as it uses pixclock directly when dividing, which will crash.
--- drivers/video/fbdev/tdfxfb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/fbdev/tdfxfb.c +3 -0
@@ -496,6 +496,9 @@ static int tdfxfb_check_var(struct fb_va } } +if (!var->pixclock) +return -EINVAL ; +if (PICOS2KHZ (var->pixclock) > par->max_pixclock) {DPRINTK ("pixclock too high (%ldKHz)\n" ,PICOS2KHZ (var->pixclock));
Greg Kroah-Hartman
maintainerPATCH 134/198 usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 8f993d30b95dc9557a8a96ceca11abed674c8acb upstream.
The block_len read from the host-supplied NTB header is checked against ntb_max but has no lower bound. When block_len is smaller than opts->ndp_size, the bounds check of:
ndp_index > (block_len - opts->ndp_size)
will underflow producing a huge unsigned value that ndp_index can never exceed, defeating the check entirely.
The same underflow occurs in the datagram index checks against block_len
- opts->dpe_size. With those checks neutered, a malicious USB host can choose ndp_index and datagram offsets that point past the actual transfer, and the skb_put_data() copies adjacent kernel memory into the network skb.
Fix this by rejecting block lengths that cannot hold at least the NTB header plus one NDP. This will make block_len - opts->ndp_size and block_len - opts->dpe_size both well-defined.
Commit 8d2b1a1ec9f5 ("CDC-NCM: avoid overflow in sanity checking") fixed a related class of issues on the host side of NCM.
--- drivers/usb/gadget/function/f_ncm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/f_ncm.c +2 -2
@@ -1210,8 +1210,8 @@ parse_ntb: block_len =get_ncm (&tmp, opts->block_length);/* (d)wBlockLength */ -if (block_len > ntb_max) { -INFO (port->func.config->cdev,"OUT size exceeded\n" ); +if ((block_len < opts->nth_size + opts->ndp_size) || (block_len > ntb_max)) { +INFO (port->func.config->cdev,"Bad block length: %#X\n" , block_len); goto err; }
Greg Kroah-Hartman
maintainerPATCH 135/198 usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit c088d5dd2fffb4de1fb8e7f57751c8b82942180a upstream.
A broken/bored/mean USB host can overflow the skb_shared_info->frags[] array on a Linux gadget exposing a Phonet function by sending an unbounded sequence of full-page OUT transfers.
pn_rx_complete() finalizes the skb only when req->actual < req->length, where req->length is set to PAGE_SIZE by the gadget. If the host always sends exactly PAGE_SIZE bytes per transfer, fp->rx.skb will never be reset and each completion will add another fragment via skb_add_rx_frag(). Once nr_frags exceeds MAX_SKB_FRAGS (default 17), subsequent frag stores overwrite memory adjacent to the shinfo on the heap.
Drop the skb and account a length error when the frag limit is reached, matching the fix applied in t7xx by commit f0813bcd2d9d ("net: wwan:
t7xx: fix potential skb->frags overflow in RX path").
--- drivers/usb/gadget/function/f_phonet.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/gadget/function/f_phonet.c +9 -0
@@ -333,6 +333,15 @@ static void pn_rx_complete(struct usb_epif (unlikely (!skb))break ; +if (unlikely (skb_shinfo (skb)->nr_frags >=MAX_SKB_FRAGS )) { +/* Frame count from host exceeds frags[] capacity */ +dev_kfree_skb_any (skb); +if (fp->rx.skb == skb) + fp->rx.skb =NULL ; + dev->stats.rx_length_errors++; +break ; + } +if (skb->len ==0 ) {/* First fragment */ skb->protocol =htons (ETH_P_PHONET );skb_reset_mac_header (skb);
Greg Kroah-Hartman
maintainerPATCH 136/198 usb: gadget: renesas_usb3: validate endpoint index in standard request handlers
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit f880aac8a57ebd92abfa685d45424b2998ac1059 upstream.
The GET_STATUS and SET/CLEAR_FEATURE handlers extract the endpoint number from the host-supplied wIndex without any sort of validation. Fix this up by validating the number of endpoints actually match up with the number the device has before attempting to dereference a pointer based on this math.
This is just like what was done in commit ee0d382feb44 ("usb: gadget:aspeed_udc: validate endpoint index for ast udc") for the aspeed driver.
--- drivers/usb/gadget/udc/renesas_usb3.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/usb/gadget/udc/renesas_usb3.c +6 -1
@@ -1669,6 +1669,10 @@ static bool usb3_std_req_get_status(strubreak ;case USB_RECIP_ENDPOINT : num =le16_to_cpu (ctrl->wIndex) &USB_ENDPOINT_NUMBER_MASK ; +if (num >= usb3->num_usb3_eps) { + stall = true; +break ; + } usb3_ep =usb3_get_ep (usb3, num);if (usb3_ep->halt) status |=1 <<USB_ENDPOINT_HALT ;
@@ -1781,7 +1785,8 @@ static bool usb3_std_req_feature_endpoinstruct renesas_usb3_ep *usb3_ep;struct renesas_usb3_request *usb3_req; -if (le16_to_cpu (ctrl->wValue) !=USB_ENDPOINT_HALT ) +if ((le16_to_cpu (ctrl->wValue) !=USB_ENDPOINT_HALT ) || + (num >= usb3->num_usb3_eps))return true;/* stall */ usb3_ep =usb3_get_ep (usb3, num);
Greg Kroah-Hartman
maintainerPATCH 137/198 smb: client: fix off-by-8 bounds check in check_wsl_eas()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 3d8b9d06bd3ac4c6846f5498800b0f5f8062e53b upstream.
The bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA name and value, but ea_data sits at offset sizeof(struct smb2_file_full_ea_info) = 8 from ea, not at offset 0. The strncmp() later reads ea->ea_data[0..nlen-1] and the value bytes follow at ea_data[nlen+1..nlen+vlen], so the actual end is ea->ea_data + nlen + 1
+ vlen. Isn't pointer math fun?
The earlier check (u8 *)ea > end - sizeof(*ea) only guarantees the 8-byte header is in bounds, but since the last EA is placed within 8 bytes of the end of the response, the name and value bytes are read past the end of iov.
Fix this mess all up by using ea->ea_data as the base for the bounds check.
An "untrusted" server can use this to leak up to 8 bytes of kernel heap into the EA name comparison and influence which WSL xattr the data is interpreted as.
--- fs/smb/client/smb2inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/client/smb2inode.c +1 -1
@@ -125,7 +125,7 @@ static int check_wsl_eas(struct kvec *rs nlen = ea->ea_name_length; vlen =le16_to_cpu (ea->ea_value_length);if (nlen !=SMB2_WSL_XATTR_NAME_LEN || - (u8 *)ea + nlen +1 + vlen > end) + (u8 *)ea->ea_data + nlen +1 + vlen > end)return -EINVAL ;switch (vlen) {
Greg Kroah-Hartman
maintainerPATCH 138/198 smb: client: fix OOB reads parsing symlink error response
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 3df690bba28edec865cf7190be10708ad0ddd67e upstream.
When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns success without any length validation, leaving the symlink parsers as the only defense against an untrusted server.
symlink_data() walks SMB 3.1.1 error contexts with the loop test "p < end", but reads p->ErrorId at offset 4 and p->ErrorDataLength at offset
0. When the server-controlled ErrorDataLength advances p to within 1-7 bytes of end, the next iteration will read past it. When the matching context is found, sym->SymLinkErrorTag is read at offset 4 from p->ErrorContextData with no check that the symlink header itself fits.
smb2_parse_symlink_response() then bounds-checks the substitute name using SMB2_SYMLINK_STRUCT_SIZE as the offset of PathBuffer from iov_base. That value is computed as sizeof(smb2_err_rsp) + sizeof(smb2_symlink_err_rsp), which is correct only when ErrorContextCount == 0.
With at least one error context the symlink data sits 8 bytes deeper, and each skipped non-matching context shifts it further by 8 + ALIGN(ErrorDataLength, 8). The check is too short, allowing the substitute name read to run past iov_len. The out-of-bound heap bytes are UTF-16-decoded into the symlink target and returned to userspace via readlink(2).
Fix this all up by making the loops test require the full context header to fit, rejecting sym if its header runs past end, and bound the substitute name against the actual position of sym->PathBuffer rather than a fixed offset.
Because sub_offs and sub_len are 16bits, the pointer math will not overflow here with the new greater-than.
--- fs/smb/client/smb2file.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
fs/smb/client/smb2file.c +12 -8
@@ -27,10 +27,11 @@ static struct smb2_symlink_err_rsp *syml {struct smb2_err_rsp *err = iov->iov_base;struct smb2_symlink_err_rsp *sym =ERR_PTR (-EINVAL ); +u8 *end = (u8 *)err + iov->iov_len;u32 len;if (err->ErrorContextCount) { -struct smb2_error_context_rsp *p, *end; +struct smb2_error_context_rsp *p; len = (u32)err->ErrorContextCount * (offsetof(struct smb2_error_context_rsp, ErrorContextData) +
@@ -39,8 +40,7 @@ static struct smb2_symlink_err_rsp *symlreturn ERR_PTR (-EINVAL ); p = (struct smb2_error_context_rsp *)err->ErrorData; - end = (struct smb2_error_context_rsp *)((u8 *)err + iov->iov_len); - do { +while ((u8 *)p +sizeof (*p) <= end) {if (le32_to_cpu (p->ErrorId) ==SMB2_ERROR_ID_DEFAULT ) { sym = (struct smb2_symlink_err_rsp *)p->ErrorContextData;break ;
@@ -50,14 +50,16 @@ static struct smb2_symlink_err_rsp *syml len =ALIGN (le32_to_cpu (p->ErrorDataLength),8 ); p = (struct smb2_error_context_rsp *)(p->ErrorContextData + len); - }while (p < end); + } }else if (le32_to_cpu (err->ByteCount) >=sizeof (*sym) && iov->iov_len >=SMB2_SYMLINK_STRUCT_SIZE ) { sym = (struct smb2_symlink_err_rsp *)err->ErrorData; } -if (!IS_ERR (sym) && (le32_to_cpu (sym->SymLinkErrorTag) !=SYMLINK_ERROR_TAG || -le32_to_cpu (sym->ReparseTag) !=IO_REPARSE_TAG_SYMLINK )) +if (!IS_ERR (sym) && + ((u8 *)sym +sizeof (*sym) > end || +le32_to_cpu (sym->SymLinkErrorTag) !=SYMLINK_ERROR_TAG || +le32_to_cpu (sym->ReparseTag) !=IO_REPARSE_TAG_SYMLINK )) sym =ERR_PTR (-EINVAL );return sym;
@@ -128,8 +130,10 @@ int smb2_parse_symlink_response(struct c print_len =le16_to_cpu (sym->PrintNameLength); print_offs =le16_to_cpu (sym->PrintNameOffset); -if (iov->iov_len <SMB2_SYMLINK_STRUCT_SIZE + sub_offs + sub_len || - iov->iov_len <SMB2_SYMLINK_STRUCT_SIZE + print_offs + print_len) +if ((char *)sym->PathBuffer + sub_offs + sub_len > + (char *)iov->iov_base + iov->iov_len || + (char *)sym->PathBuffer + print_offs + print_len > + (char *)iov->iov_base + iov->iov_len)return -EINVAL ; return smb2_parse_native_symlink(path,
Greg Kroah-Hartman
maintainerPATCH 139/198 ksmbd: validate EaNameLength in smb2_get_ea()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 66751841212c2cc196577453c37f7774ff363f02 upstream.
smb2_get_ea() reads ea_req->EaNameLength from the client request and passes it directly to strncmp() as the comparison length without verifying that the length of the name really is the size of the input buffer received.
Fix this up by properly checking the size of the name based on the value received and the overall size of the request, to prevent a later strncmp() call to use the length as a "trusted" size of the buffer. Without this check, uninitialized heap values might be slowly leaked to the client.
--- fs/smb/server/smb2pdu.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/smb/server/smb2pdu.c +5 -0
@@ -4725,6 +4725,11 @@ static int smb2_get_ea(struct ksmbd_work ea_req = (struct smb2_ea_info_req *)((char *)req +le16_to_cpu (req->InputBufferOffset)); + +if (le32_to_cpu (req->InputBufferLength) < + offsetof(struct smb2_ea_info_req , name) + + ea_req->EaNameLength) +return -EINVAL ; }else {/* need to send all EAs, if no specific EA is requested*/ if (le32_to_cpu (req->Flags) &SL_RETURN_SINGLE_ENTRY )
Greg Kroah-Hartman
maintainerPATCH 140/198 ksmbd: require 3 sub-authorities before reading sub_auth[2]
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 53370cf9090777774e07fd9a8ebce67c6cc333ab upstream.
parse_dacl() compares each ACE SID against sid_unix_NFS_mode and on match reads sid.sub_auth[2] as the file mode. If sid_unix_NFS_mode is the prefix S-1-5-88-3 with num_subauth = 2 then compare_sids() compares only min(num_subauth, 2) sub-authorities so a client SID with num_subauth = 2 and sub_auth = {88, 3} will match.
If num_subauth = 2 and the ACE is placed at the very end of the security descriptor, sub_auth[2] will be 4 bytes past end_of_acl. The out-of-band bytes will then be masked to the low 9 bits and applied as the file's POSIX mode, probably not something that is good to have happen.
Fix this up by forcing the SID to actually carry a third sub-authority before reading it at all.
--- fs/smb/server/smbacl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/smb/server/smbacl.c +2 -1
@@ -451,7 +451,8 @@ static void parse_dacl(struct mnt_idmap ppace[i]->access_req =smb_map_generic_desired_access (ppace[i]->access_req); -if (!(compare_sids (&ppace[i]->sid, &sid_unix_NFS_mode))) { +if (ppace[i]->sid.num_subauth >=3 && + !(compare_sids (&ppace[i]->sid, &sid_unix_NFS_mode))) { fattr->cf_mode =le32_to_cpu (ppace[i]->sid.sub_auth[2 ]);break ;
Greg Kroah-Hartman
maintainerPATCH 141/198 ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit ad0057fb91218914d6c98268718ceb9d59b388e1 upstream.
The kernel ASN.1 BER decoder calls action callbacks incrementally as it walks the input. When ksmbd_decode_negTokenInit() reaches the mechToken
[2] OCTET STRING element, ksmbd_neg_token_alloc() allocates conn->mechToken immediately via kmemdup_nul(). If a later element in the same blob is malformed, then the decoder will return nonzero after the allocation is already live. This could happen if mechListMIC [3] overrunse the enclosing SEQUENCE.
decode_negotiation_token() then sets conn->use_spnego = false because both the negTokenInit and negTokenTarg grammars failed. The cleanup at the bottom of smb2_sess_setup() is gated on use_spnego:
if (conn->use_spnego && conn->mechToken) {
kfree(conn->mechToken);
conn->mechToken = NULL;
}so the kfree is skipped, causing the mechToken to never be freed.
This codepath is reachable pre-authentication, so untrusted clients can cause slow memory leaks on a server without even being properly authenticated.
Fix this up by not checking check for use_spnego, as it's not required, so the memory will always be properly freed. At the same time, always free the memory in ksmbd_conn_free() incase some other failure path forgot to free it.
--- fs/smb/server/connection.c | 1 + fs/smb/server/smb2pdu.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)
fs/smb/server/connection.c +1 -0
@@ -39,6 +39,7 @@ void ksmbd_conn_free(struct ksmbd_conn *xa_destroy (&conn->sessions);kvfree (conn->request_buf);kfree (conn->preauth_info); +kfree (conn->mechToken);if (atomic_dec_and_test (&conn->refcnt)) { conn->transport->ops->free_transport (conn->transport);kfree (conn);
fs/smb/server/smb2pdu.c +1 -1
@@ -1924,7 +1924,7 @@ out_err:else if (rc) rsp->hdr.Status =STATUS_LOGON_FAILURE ; -if (conn->use_spnego && conn->mechToken) { +if (conn->mechToken) {kfree (conn->mechToken); conn->mechToken =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 142/198 smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <[email protected]>
commit 27b7c3e916218b5eb2ee350211140e961bfc49be upstream.
smbd_send_batch_flush() already calls smbd_free_send_io(), so we should not call it again after smbd_post_send() moved it to the batch list.
--- fs/smb/client/smbdirect.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/smb/client/smbdirect.c +8 -0
@@ -1525,17 +1525,25 @@ static int smbd_post_send_iter(struct sm rc =smbd_post_send (sc, batch, request);if (!rc) { +/* +* From here request is moved to batch +* and we should not free it explicitly. +*/ +if (batch != &_batch)return 0 ; rc =smbd_send_batch_flush (sc, batch, true);if (!rc)return 0 ; + + goto err_flush; } err_dma:smbd_free_send_io (request); +err_flush: err_alloc:atomic_inc (&sc->send_io.credits.count);wake_up (&sc->send_io.credits.wait_queue);
Greg Kroah-Hartman
maintainerPATCH 143/198 smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <[email protected]>
commit 84ff995ae826aa6bbcc6c7b9ea569ff67c021d72 upstream.
smb_direct_flush_send_list() already calls smb_direct_free_sendmsg(), so we should not call it again after post_sendmsg()
moved it to the batch list.
--- fs/smb/server/transport_rdma.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/smb/server/transport_rdma.c +7 -1
@@ -1473,15 +1473,21 @@ static int smb_direct_post_send_data(strif (ret) goto err; +/* +* From here msg is moved to send_ctx +* and we should not free it explicitly. +*/ +if (send_ctx == &_send_ctx) { ret =smb_direct_flush_send_list (sc, send_ctx, true);if (ret) - goto err; + goto flush_failed; }return 0 ; err:smb_direct_free_sendmsg (sc, msg); +flush_failed: header_failed:atomic_inc (&sc->send_io.credits.count); credit_failed:
Greg Kroah-Hartman
maintainerPATCH 144/198 usbip: validate number_of_packets in usbip_pack_ret_submit()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Rebello <[email protected]>
commit 2ab833a16a825373aad2ba7d54b572b277e95b71 upstream.
When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets from the network PDU. This value is subsequently used as the loop bound in usbip_recv_iso() and usbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible array whose size was fixed at URB allocation time based on the *original* number_of_packets from the CMD_SUBMIT.
A malicious USB/IP server can set number_of_packets in the response to a value larger than what was originally submitted, causing a heap out-of-bounds write when usbip_recv_iso() writes to urb->iso_frame_desc[i] beyond the allocated region.
KASAN confirmed this with kernel 7.0.0-rc5:
BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640 Write of size 4 at addr ffff888106351d40 by task vhci_rx/69
The buggy address is located 0 bytes to the right of
allocated 320-byte region [ffff888106351c00, ffff888106351d40)
The server side (stub_rx.c) and gadget side (vudc_rx.c) already validate number_of_packets in the CMD_SUBMIT path since commits c6688ef9f297 ("usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input") and b78d830f0049 ("usbip: fix vudc_rx: harden CMD_SUBMIT path to handle malicious input"). The server side validates against USBIP_MAX_ISO_PACKETS because no URB exists yet at that point. On the client side we have the original URB, so we can use the tighter
bound: the response must not exceed the original number_of_packets.
This mirrors the existing validation of actual_length against transfer_buffer_length in usbip_recv_xbuff(), which checks the response value against the original allocation size.
Kelvin Mbogo's series ("usb: usbip: fix integer overflow in usbip_recv_iso()", v2) hardens the receive-side functions themselves; this patch complements that work by catching the bad value at its source -- in usbip_pack_ret_submit() before the overwrite -- and using the tighter per-URB allocation bound rather than the global USBIP_MAX_ISO_PACKETS limit.
Fix this by checking rpdu->number_of_packets against urb->number_of_packets in usbip_pack_ret_submit() before the overwrite. On violation, clamp to zero so that usbip_recv_iso() and usbip_pad_iso() safely return early.
--- drivers/usb/usbip/usbip_common.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/usb/usbip/usbip_common.c +12 -0
@@ -470,6 +470,18 @@ static void usbip_pack_ret_submit(struct urb->status = rpdu->status; urb->actual_length = rpdu->actual_length; urb->start_frame = rpdu->start_frame; +/* +* The number_of_packets field determines the length of +* iso_frame_desc[], which is a flexible array allocated +* at URB creation time. A response must never claim more +* packets than originally submitted; doing so would cause +* an out-of-bounds write in usbip_recv_iso() and +* usbip_pad_iso(). Clamp to zero on violation so both +* functions safely return early. +*/ +if (rpdu->number_of_packets <0 || + rpdu->number_of_packets > urb->number_of_packets) + rpdu->number_of_packets =0 ; urb->number_of_packets = rpdu->number_of_packets; urb->error_count = rpdu->error_count; }
Greg Kroah-Hartman
maintainerPATCH 145/198 usb: typec: fusb302: Switch to threaded IRQ handler
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Charkov <[email protected]>
commit 6b9db53197094f38a18797495df2e3c758ec51dc upstream.
FUSB302 fails to probe with -EINVAL if its interrupt line is connected via an I2C GPIO expander, such as TI TCA6416.
Switch the interrupt handler to a threaded one, which also works behind such GPIO expanders.
--- drivers/usb/typec/tcpm/fusb302.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/typec/tcpm/fusb302.c +3 -2
@@ -1755,8 +1755,9 @@ static int fusb302_probe(struct i2c_clie goto destroy_workqueue; } - ret =request_irq (chip->gpio_int_n_irq, fusb302_irq_intn, -IRQF_TRIGGER_LOW ,"fsc_interrupt_int_n" , chip); + ret =request_threaded_irq (chip->gpio_int_n_irq,NULL , fusb302_irq_intn, +IRQF_ONESHOT |IRQF_TRIGGER_LOW , +"fsc_interrupt_int_n" , chip);if (ret <0 ) {dev_err (dev,"cannot request IRQ for GPIO Int_N, ret=%d" , ret); goto tcpm_unregister_port;
Greg Kroah-Hartman
maintainerPATCH 146/198 usb: storage: Expand range of matched versions for VL817 quirks entry
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Brát <[email protected]>
commit 609865ab3d5d803556f628e221ecd3d06aed9f30 upstream.
Expands range of matched bcdDevice values for the VL817 quirk entry. This is based on experience with Axagon EE35-GTR rev1 3.5" HDD enclosure, which reports its bcdDevice as 0x0843, but presumably other vendors using this IC in their products may set it to any other value.
--- drivers/usb/storage/unusual_devs.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/usb/storage/unusual_devs.h +4 -3
@@ -2350,10 +2350,11 @@ UNUSUAL_DEV( 0x2027, 0xa001, 0x0000, 0x US_FL_SCM_MULT_TARG ),/* -* Reported by DocMAX <[email protected]> -* and Thomas Weißschuh <[email protected]> +* Reported by DocMAX <[email protected]>, +* Thomas Weißschuh <[email protected]> +* and Daniel Brát <[email protected]> */ -UNUSUAL_DEV( 0x2109, 0x0715, 0x9999, 0x9999, +UNUSUAL_DEV( 0x2109, 0x0715, 0x0000, 0x9999, "VIA Labs, Inc.", "VL817 SATA Bridge", USB_SC_DEVICE, USB_PR_DEVICE, NULL,
Greg Kroah-Hartman
maintainerPATCH 147/198 USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Carey <[email protected]>
commit f58752ebcb35e156c85cd1a82d6579c7af3b9023 upstream.
The Lenovo Yoga Book 9 14IAH10 (83KJ) has a composite USB device (17EF:6161) that controls both touchscreens via a CDC ACM interface. Interface 0 is a standard CDC ACM control interface, but interface 1 (the data interface) incorrectly declares vendor-specific class (0xFF) instead of USB_CLASS_CDC_DATA. cdc-acm rejects the device at probe with -EINVAL, leaving interface 0 unbound and EP 0x82 never polled.
With no consumer polling EP 0x82, the firmware's watchdog fires every ~20 seconds and resets the USB bus, producing a continuous disconnect/ reconnect loop that prevents the touchscreens from ever initialising.
Add two new quirk flags:
VENDOR_CLASS_DATA_IFACE: Bypasses the bInterfaceClass check in acm_probe() that would otherwise reject the vendor-class data interface with -EINVAL.
ALWAYS_POLL_CTRL: Submits the notification URB at probe() rather than waiting for a TTY open. This keeps EP 0x82 polled at all times, permanently suppressing the firmware watchdog. The URB is resubmitted after port_shutdown() and on system resume. SET_CONTROL_LINE_STATE (DTR|RTS) is sent at probe and after port_shutdown() to complete firmware handshake.
Note: the firmware performs exactly 4 USB connect/disconnect cycles (~19 s each) on every cold boot before stabilising. This is a fixed firmware property; touch is available ~75-80 s after power-on.
--- drivers/usb/class/cdc-acm.c | 53 ++++++++++++++++++++++++++++++++++++++------ 1 file changed, 46 insertions(+), 7 deletions(-)
drivers/usb/class/cdc-acm.c +46 -7
@@ -114,6 +114,8 @@ static int acm_ctrl_msg(struct acm *acm,int retval; retval =usb_autopm_get_interface (acm->control); +#define VENDOR_CLASS_DATA_IFACE BIT(9)/* data interface uses vendor-specific class */ +#define ALWAYS_POLL_CTRL BIT(10)/* keep ctrl URB active even without an open TTY */ if (retval)return retval;
@@ -710,12 +712,14 @@ static int acm_port_activate(struct tty_set_bit (TTY_NO_WRITE_SPLIT , &tty->flags); acm->control->needs_remote_wakeup =1 ; - acm->ctrlurb->dev = acm->dev; - retval =usb_submit_urb (acm->ctrlurb,GFP_KERNEL ); -if (retval) { -dev_err (&acm->control->dev, -"%s - usb_submit_urb(ctrl irq) failed\n" , __func__); - goto error_submit_urb; +if (!(acm->quirks &ALWAYS_POLL_CTRL )) { + acm->ctrlurb->dev = acm->dev; + retval =usb_submit_urb (acm->ctrlurb,GFP_KERNEL ); +if (retval) { +dev_err (&acm->control->dev, +"%s - usb_submit_urb(ctrl irq) failed\n" , __func__); + goto error_submit_urb; + } }acm_tty_set_termios (tty,NULL );
@@ -788,6 +792,14 @@ static void acm_port_shutdown(struct ttyacm_unpoison_urbs (acm); +if (acm->quirks &ALWAYS_POLL_CTRL ) { + acm->ctrlurb->dev = acm->dev; +if (usb_submit_urb (acm->ctrlurb,GFP_KERNEL )) +dev_dbg (&acm->control->dev, +"ctrl polling restart failed after port close\n" ); +/* port_shutdown() cleared DTR/RTS; restore them */ +acm_set_control (acm,USB_CDC_CTRL_DTR |USB_CDC_CTRL_RTS ); + } }static void acm_tty_cleanup (struct tty_struct *tty)
@@ -1328,6 +1340,9 @@ skip_normal_probe:dev_dbg (&intf->dev,"Your device has switched interfaces.\n" );swap (control_interface, data_interface); + }else if (quirks &VENDOR_CLASS_DATA_IFACE ) { +dev_dbg (&intf->dev, +"Vendor-specific data interface class, continuing.\n" ); }else {return -EINVAL ; }
@@ -1522,6 +1537,9 @@ skip_countries: acm->line.bDataBits =8 ;acm_set_line (acm, &acm->line); +if (quirks &ALWAYS_POLL_CTRL ) +acm_set_control (acm,USB_CDC_CTRL_DTR |USB_CDC_CTRL_RTS ); +if (!acm->combined_interfaces) { rv =usb_driver_claim_interface (&acm_driver, data_interface, acm);if (rv)
@@ -1543,6 +1561,13 @@ skip_countries:dev_info (&intf->dev,"ttyACM%d: USB ACM device\n" , minor); +if (acm->quirks &ALWAYS_POLL_CTRL ) { + acm->ctrlurb->dev = acm->dev; +if (usb_submit_urb (acm->ctrlurb,GFP_KERNEL )) +dev_warn (&intf->dev, +"failed to start persistent ctrl polling\n" ); + } +return 0 ; err_release_data_interface:
@@ -1669,7 +1694,7 @@ static int acm_resume(struct usb_interfaacm_unpoison_urbs (acm); -if (tty_port_initialized (&acm->port)) { +if (tty_port_initialized (&acm->port) || (acm->quirks &ALWAYS_POLL_CTRL )) { rv =usb_submit_urb (acm->ctrlurb,GFP_ATOMIC );for (;;) {
@@ -2016,6 +2041,20 @@ static const struct usb_device_id acm_id/* CH343 supports CAP_BRK, but doesn't advertise it */ { USB_DEVICE(0x1a86, 0x55d3), .driver_info = MISSING_CAP_BRK, }, + /* + * Lenovo Yoga Book 9 14IAH10 (83KJ) — INGENIC 17EF:6161 touchscreen + * composite device. The CDC ACM control interface (0) uses a standard + * Union descriptor, but the data interface (1) is declared as vendor- + * specific class (0xff) with no CDC data descriptors, so cdc-acm would + * normally reject it. The firmware also requires continuous polling of + * the notification endpoint (EP 0x82) to suppress a 20-second watchdog + * reset; ALWAYS_POLL_CTRL keeps the ctrlurb active even when no TTY is + * open. Match only the control interface by class to avoid probing the + * vendor-specific data interface. + */ + { USB_DEVICE_INTERFACE_CLASS(0x17ef, 0x6161, USB_CLASS_COMM), + .driver_info = VENDOR_CLASS_DATA_IFACE | ALWAYS_POLL_CTRL }, + /* control interfaces without any protocol set */ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, USB_CDC_PROTO_NONE) },
Greg Kroah-Hartman
maintainerPATCH 148/198 usb: gadget: f_hid: dont call cdev_init while cdev in use
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Zimmermann <[email protected]>
commit 81ebd43cc0d6d106ce7b6ccbf7b5e40ca7f5503d upstream.
When calling unbind, then bind again, cdev_init reinitialized the cdev, even though there may still be references to it. That's the case when the /dev/hidg* device is still opened. This obviously unsafe behavior like oopes.
This fixes this by using cdev_alloc to put the cdev on the heap. That way, we can simply allocate a new one in hidg_bind.
--- drivers/usb/gadget/function/f_hid.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/usb/gadget/function/f_hid.c +10 -5
@@ -106,7 +106,7 @@ struct f_hidg {struct list_head report_list;struct device dev; -struct cdev cdev; +struct cdev *cdev;struct usb_function func;struct usb_ep *in_ep;
@@ -749,8 +749,9 @@ static int f_hidg_release(struct inode *static int f_hidg_open (struct inode *inode,struct file *fd) { +struct kobject *parent = inode->i_cdev->kobj.parent;struct f_hidg *hidg = - container_of(inode->i_cdev, struct f_hidg, cdev); + container_of(parent, struct f_hidg, dev.kobj); fd->private_data = hidg;
@@ -1277,8 +1278,12 @@ static int hidg_bind(struct usb_configur }/* create char device */ -cdev_init (&hidg->cdev, &f_hidg_fops); - status =cdev_device_add (&hidg->cdev, &hidg->dev); + hidg->cdev =cdev_alloc (); +if (!hidg->cdev) + goto fail_free_all; + hidg->cdev->ops = &f_hidg_fops; + + status =cdev_device_add (hidg->cdev, &hidg->dev);if (status) goto fail_free_all;
@@ -1580,7 +1585,7 @@ static void hidg_unbind(struct usb_confi {struct f_hidg *hidg =func_to_hidg (f); -cdev_device_del (&hidg->cdev, &hidg->dev); +cdev_device_del (hidg->cdev, &hidg->dev);destroy_workqueue (hidg->workqueue);usb_free_all_descriptors (f); }
Greg Kroah-Hartman
maintainerPATCH 149/198 usb: port: add delay after usb_hub_set_port_power()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit b84cc80610a8ce036deb987f056ce3196ead7f1e upstream.
When a port is disabled, an attached device will be disconnected. This causes a port-status-change event, which will race with hub autosuspend (if the disabled port was the only connected port on its hub), causing an immediate resume and a second autosuspend. Both of these can be avoided by adding a short delay after the call to usb_hub_set_port_power().
Below log shows what is happening:
$ echo 1 > usb1-port1/disable [ 37.958239] usb 1-1: USB disconnect, device number 2 [ 37.964101] usb 1-1: unregistering device [ 37.970070] hub 1-0:1.0: hub_suspend [ 37.971305] hub 1-0:1.0: state 7 ports 1 chg 0000 evt 0002 [ 37.974412] usb usb1: bus auto-suspend, wakeup 1 [ 37.988175] usb usb1: suspend raced with wakeup event <--- [ 37.993947] usb usb1: usb auto-resume [ 37.998401] hub 1-0:1.0: hub_resume [ 38.105688] usb usb1-port1: status 0000, change 0000, 12 Mb/s [ 38.112399] hub 1-0:1.0: state 7 ports 1 chg 0000 evt 0000 [ 38.118645] hub 1-0:1.0: hub_suspend [ 38.122963] usb usb1: bus auto-suspend, wakeup 1 [ 38.200368] usb usb1: usb wakeup-resume [ 38.204982] usb usb1: usb auto-resume [ 38.209376] hub 1-0:1.0: hub_resume [ 38.213676] usb usb1-port1: status 0101 change 0001 [ 38.321552] hub 1-0:1.0: state 7 ports 1 chg 0002 evt 0000 [ 38.327978] usb usb1-port1: status 0101, change 0000, 12 Mb/s [ 38.457429] usb 1-1: new high-speed USB device number 3 using ci_hdrc
Then, port change bit will be fixed to the final state and usb_clear_port_feature() can correctly clear it after this period. This will also avoid usb runtime suspend routine to run because usb_autopm_put_interface() not run yet.
--- drivers/usb/core/port.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/core/port.c +1 -0
@@ -141,6 +141,7 @@ static ssize_t disable_store(struct deviusb_disconnect (&port_dev->child); rc =usb_hub_set_port_power (hdev, hub, port1, !disabled); +msleep (2 *hub_power_on_good_delay (hub));if (disabled) {usb_clear_port_feature (hdev, port1,USB_PORT_FEAT_C_CONNECTION );
Greg Kroah-Hartman
maintainerPATCH 150/198 fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit a31e4518bec70333a0a98f2946a12b53b45fe5b9 upstream.
Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide by zero error"), we also need to prevent that same crash from happening in the udlfb driver as it uses pixclock directly when dividing, which will crash.
--- drivers/video/fbdev/udlfb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/fbdev/udlfb.c +3 -0
@@ -1018,6 +1018,9 @@ static int dlfb_ops_check_var(struct fb_struct fb_videomode mode;struct dlfb_data *dlfb = info->par; +if (!var->pixclock) +return -EINVAL ; +/* set device-specific elements of var unrelated to mode */ dlfb_var_color_format (var);
Greg Kroah-Hartman
maintainerPATCH 151/198 scripts: generate_rust_analyzer.py: avoid FD leak
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamir Duberstein <[email protected]>
commit 9b4744d8eda2824041064a5639ccbb079850914d upstream.
Use pathlib.Path.read_text() to avoid leaking file descriptors.
--- scripts/generate_rust_analyzer.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
scripts/generate_rust_analyzer.py +2 -1
@@ -168,9 +168,10 @@ def generate_crates(srctree, objtree, sy def is_root_crate(build_file, target): try: - return f"{target}.o" in open(build_file).read() + contents = build_file.read_text() except FileNotFoundError: return False + return f"{target}.o" in contents # Then, the rest outside of `rust/`. #
Greg Kroah-Hartman
maintainerPATCH 152/198 wifi: rtw88: fix device leak on probe failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit bbb15e71156cd9f5e1869eee7207a06ea8e96c39 upstream.
Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect.
This driver takes a reference to the USB device during probe but does not to release it on all probe errors (e.g. when descriptor parsing fails).
Drop the redundant device reference to fix the leak, reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of further memory leaks.
--- drivers/net/wireless/realtek/rtw88/usb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/realtek/rtw88/usb.c +1 -2
@@ -1040,7 +1040,7 @@ static int rtw_usb_intf_init(struct rtw_ struct usb_interface *intf) {struct rtw_usb *rtwusb =rtw_get_usb_priv (rtwdev); -struct usb_device *udev =usb_get_dev (interface_to_usbdev (intf)); +struct usb_device *udev =interface_to_usbdev (intf);int ret; rtwusb->udev = udev;
@@ -1066,7 +1066,6 @@ static void rtw_usb_intf_deinit(struct r {struct rtw_usb *rtwusb =rtw_get_usb_priv (rtwdev); -usb_put_dev (rtwusb->udev);kfree (rtwusb->usb_data);usb_set_intfdata (intf,NULL ); }
Greg Kroah-Hartman
maintainerPATCH 153/198 staging: sm750fb: fix division by zero in ps_to_hz()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <[email protected]>
commit 75a1621e4f91310673c9acbcbb25c2a7ff821cd3 upstream.
ps_to_hz() is called from hw_sm750_crtc_set_mode() without validating that pixclock is non-zero. A zero pixclock passed via FBIOPUT_VSCREENINFO causes a division by zero.
Fix by rejecting zero pixclock in lynxfb_ops_check_var(), consistent with other framebuffer drivers.
--- drivers/staging/sm750fb/sm750.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/staging/sm750fb/sm750.c +3 -0
@@ -481,6 +481,9 @@ static int lynxfb_ops_check_var(struct fstruct lynxfb_crtc *crtc;resource_size_t request; +if (!var->pixclock) +return -EINVAL ; + ret =0 ; par = info->par; crtc = &par->crtc;
Greg Kroah-Hartman
maintainerPATCH 154/198 USB: serial: option: add Telit Cinterion FN990A MBIM composition
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit f8cc59ecc22841be5deb07b549c0c6a2657cd5f9 upstream.
Add the following Telit Cinterion FN990A MBIM composition:
0x1074: MBIM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (diag) +
DPL (Data Packet Logging) + adb
T: Bus=01 Lev=01 Prnt=04 Port=06 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1074 Rev=05.04 S: Manufacturer=Telit Wireless Solutions S: Product=FN990 S: SerialNumber=70628d0c C: #Ifs= 8 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8f(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -1383,6 +1383,8 @@ static const struct usb_device_id option .driver_info = NCTRL(2) | RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN990A (ECM) */ .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1074, 0xff), /* Telit FN990A (MBIM) */ + .driver_info = NCTRL(5) | RSVD(6) | RSVD(7) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990A (PCIe) */ .driver_info = RSVD(0) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1077, 0xff), /* Telit FN990A (rmnet + audio) */
Greg Kroah-Hartman
maintainerPATCH 155/198 Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit 0beba407d4585a15b0dc09f2064b5b3ddcb0e857 upstream.
Patch series "Docs/admin-guide/mm/damon: warn commit_inputs vs other params race".
Writing 'Y' to the commit_inputs parameter of DAMON_RECLAIM and DAMON_LRU_SORT, and writing other parameters before the commit_inputs request is completely processed can cause race conditions. While the consequence can be bad, the documentation is not clearly describing that. Add clear warnings.
The issue was discovered [1,2] by sashiko.
This patch (of 2):
DAMON_RECLAIM handles commit_inputs request inside kdamond thread, reading the module parameters. If the user updates the module parameters while the kdamond thread is reading those, races can happen. To avoid this, the commit_inputs parameter shows whether it is still in the progress, assuming users wouldn't update parameters in the middle of the work. Some users might ignore that. Add a warning about the behavior.
The issue was discovered in [1] by sashiko.
--- Documentation/admin-guide/mm/damon/reclaim.rst | 4 ++++ 1 file changed, 4 insertions(+)
Documentation/admin-guide/mm/damon/reclaim.rst +4 -0
@@ -71,6 +71,10 @@ of parametrs except ``enabled`` again. parameter is set as ``N``. If invalid parameters are found while the re-reading, DAMON_RECLAIM will be disabled. +Once ``Y`` is written to this parameter, the user must not write to any +parameters until reading ``commit_inputs`` again returns ``N``. If users +violate this rule, the kernel may exhibit undefined behavior. + min_age -------
Greg Kroah-Hartman
maintainerPATCH 156/198 ALSA: ctxfi: Limit PTP to a single page
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harin Lee <[email protected]>
commit e9418da50d9e5c496c22fe392e4ad74c038a94eb upstream.
Commit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256 playback streams, but the additional pages are not used by the card correctly. The CT20K2 hardware already has multiple VMEM_PTPAL registers, but using them separately would require refactoring the entire virtual memory allocation logic.
ct_vm_map() always uses PTEs in vm->ptp[0].area regardless of CT_PTP_NUM. On AMD64 systems, a single PTP covers 512 PTEs (2M). When aggregate memory allocations exceed this limit, ct_vm_map() tries to access beyond the allocated space and causes a page fault:
BUG: unable to handle page fault for address: ffffd4ae8a10a000 Oops: Oops: 0002 [#1] SMP PTI RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi] Call Trace: atc_pcm_playback_prepare+0x225/0x3b0 ct_pcm_playback_prepare+0x38/0x60 snd_pcm_do_prepare+0x2f/0x50 snd_pcm_action_single+0x36/0x90 snd_pcm_action_nonatomic+0xbf/0xd0 snd_pcm_ioctl+0x28/0x40 __x64_sys_ioctl+0x97/0xe0 do_syscall_64+0x81/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Revert CT_PTP_NUM to 1. The 256 SRC_RESOURCE_NUM and playback_count remain unchanged.
--- sound/pci/ctxfi/ctvmem.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/ctxfi/ctvmem.h +1 -1
@@ -15,7 +15,7 @@#ifndef CTVMEM_H #define CTVMEM_H -#define CT_PTP_NUM 4/* num of device page table pages */ +#define CT_PTP_NUM 1/* num of device page table pages */ #include <linux/mutex.h> #include <linux/list.h>
Greg Kroah-Hartman
maintainerPATCH 157/198 dcache: Limit the minimal number of bucket to two
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhihao Cheng <[email protected]>
commit f08fe8891c3eeb63b73f9f1f6d97aa629c821579 upstream.
There is an OOB read problem on dentry_hashtable when user sets 'dhash_entries=1':
BUG: unable to handle page fault for address: ffff888b30b774b0
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
Oops: Oops: 0000 [#1] SMP PTI
RIP: 0010:__d_lookup+0x56/0x120
Call Trace:
d_lookup.cold+0x16/0x5d
lookup_dcache+0x27/0xf0
lookup_one_qstr_excl+0x2a/0x180
start_dirop+0x55/0xa0
simple_start_creating+0x8d/0xa0
debugfs_start_creating+0x8c/0x180
debugfs_create_dir+0x1d/0x1c0
pinctrl_init+0x6d/0x140
do_one_initcall+0x6d/0x3d0
kernel_init_freeable+0x39f/0x460
kernel_init+0x2a/0x260There will be only one bucket in dentry_hashtable when dhash_entries is set as one, and d_hash_shift is calculated as 32 by dcache_init(). Then, following process will access more than one buckets(which memory region is not allocated) in dentry_hashtable:
d_lookup
b = d_hash(hash)
dentry_hashtable + ((u32)hashlen >> d_hash_shift)
// The C standard defines the behavior of right shift amounts
// exceeding the bit width of the operand as undefined. The
// result of '(u32)hashlen >> d_hash_shift' becomes 'hashlen',
// so 'b' will point to an unallocated memory region.
hlist_bl_for_each_entry_rcu(b)
hlist_bl_first_rcu(head)
h->first // read OOB!Fix it by limiting the minimal number of dentry_hashtable bucket to two, so that 'd_hash_shift' won't exceeds the bit width of type u32.
--- fs/dcache.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/dcache.c +2 -2
@@ -3207,7 +3207,7 @@ static void __init dcache_init_early(voiHASH_EARLY |HASH_ZERO , &d_hash_shift,NULL , -0 , +2 , 0); d_hash_shift =32 - d_hash_shift;
@@ -3238,7 +3238,7 @@ static void __init dcache_init(void)HASH_ZERO , &d_hash_shift,NULL , -0 , +2 , 0); d_hash_shift =32 - d_hash_shift;
Greg Kroah-Hartman
maintainerPATCH 158/198 arm64: mm: Handle invalid large leaf mappings correctly
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Roberts <[email protected]>
commit 15bfba1ad77fad8e45a37aae54b3c813b33fe27c upstream.
It has been possible for a long time to mark ptes in the linear map as invalid. This is done for secretmem, kfence, realm dma memory un/share, and others, by simply clearing the PTE_VALID bit. But until commit a166563e7ec37 ("arm64: mm: support large block mapping when rodata=full") large leaf mappings were never made invalid in this way.
It turns out various parts of the code base are not equipped to handle invalid large leaf mappings (in the way they are currently encoded) and I've observed a kernel panic while booting a realm guest on a BBML2_NOABORT system as a result:
[ 15.432706] software IO TLB: Memory encryption is active and system is using DMA bounce buffers [ 15.476896] Unable to handle kernel paging request at virtual address ffff000019600000 [ 15.513762] Mem abort info: [ 15.527245] ESR = 0x0000000096000046 [ 15.548553] EC = 0x25: DABT (current EL), IL = 32 bits [ 15.572146] SET = 0, FnV = 0 [ 15.592141] EA = 0, S1PTW = 0 [ 15.612694] FSC = 0x06: level 2 translation fault [ 15.640644] Data abort info: [ 15.661983] ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000 [ 15.694875] CM = 0, WnR = 1, TnD = 0, TagAccess = 0 [ 15.723740] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 15.755776] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000081f3f000 [ 15.800410] [ffff000019600000] pgd=0000000000000000, p4d=180000009ffff403, pud=180000009fffe403, pmd=00e8000199600704 [ 15.855046] Internal error: Oops: 0000000096000046 [#1] SMP [ 15.886394] Modules linked in: [ 15.900029] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.0.0-rc4-dirty #4 PREEMPT [ 15.935258] Hardware name: linux,dummy-virt (DT) [ 15.955612] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 15.986009] pc : __pi_memcpy_generic+0x128/0x22c [ 16.006163] lr : swiotlb_bounce+0xf4/0x158 [ 16.024145] sp : ffff80008000b8f0 [ 16.038896] x29: ffff80008000b8f0 x28: 0000000000000000 x27: 0000000000000000 [ 16.069953] x26: ffffb3976d261ba8 x25: 0000000000000000 x24: ffff000019600000 [ 16.100876] x23: 0000000000000001 x22: ffff0000043430d0 x21: 0000000000007ff0 [ 16.131946] x20: 0000000084570010 x19: 0000000000000000 x18: ffff00001ffe3fcc [ 16.163073] x17: 0000000000000000 x16: 00000000003fffff x15: 646e612065766974 [ 16.194131] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 16.225059] x11: 0000000000000000 x10: 0000000000000010 x9 : 0000000000000018 [ 16.256113] x8 : 0000000000000018 x7 : 0000000000000000 x6 : 0000000000000000 [ 16.287203] x5 : ffff000019607ff0 x4 : ffff000004578000 x3 : ffff000019600000 [ 16.318145] x2 : 0000000000007ff0 x1 : ffff000004570010 x0 : ffff000019600000 [ 16.349071] Call trace: [ 16.360143] __pi_memcpy_generic+0x128/0x22c (P) [ 16.380310] swiotlb_tbl_map_single+0x154/0x2b4 [ 16.400282] swiotlb_map+0x5c/0x228 [ 16.415984] dma_map_phys+0x244/0x2b8 [ 16.432199] dma_map_page_attrs+0x44/0x58 [ 16.449782] virtqueue_map_page_attrs+0x38/0x44 [ 16.469596] virtqueue_map_single_attrs+0xc0/0x130 [ 16.490509] virtnet_rq_alloc.isra.0+0xa4/0x1fc [ 16.510355] try_fill_recv+0x2a4/0x584 [ 16.526989] virtnet_open+0xd4/0x238 [ 16.542775] __dev_open+0x110/0x24c [ 16.558280] __dev_change_flags+0x194/0x20c [ 16.576879] netif_change_flags+0x24/0x6c [ 16.594489] dev_change_flags+0x48/0x7c [ 16.611462] ip_auto_config+0x258/0x1114 [ 16.628727] do_one_initcall+0x80/0x1c8 [ 16.645590] kernel_init_freeable+0x208/0x2f0 [ 16.664917] kernel_init+0x24/0x1e0 [ 16.680295] ret_from_fork+0x10/0x20 [ 16.696369] Code: 927cec03 cb0e0021 8b0e0042 a9411c26 (a900340c) [ 16.723106] ---[ end trace 0000000000000000 ]--- [ 16.752866] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b [ 16.792556] Kernel Offset: 0x3396ea200000 from 0xffff800080000000 [ 16.818966] PHYS_OFFSET: 0xfff1000080000000 [ 16.837237] CPU features: 0x0000000,00060005,13e38581,957e772f [ 16.862904] Memory Limit: none [ 16.876526] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---
This panic occurs because the swiotlb memory was previously shared to the host (__set_memory_enc_dec()), which involves transitioning the (large) leaf mappings to invalid, sharing to the host, then marking the mappings valid again. But pageattr_p[mu]d_entry() would only update the entry if it is a section mapping, since otherwise it concluded it must be a table entry so shouldn't be modified. But p[mu]d_sect() only returns true if the entry is valid. So the result was that the large leaf entry was made invalid in the first pass then ignored in the second pass. It remains invalid until the above code tries to access it and blows up.
The simple fix would be to update pageattr_pmd_entry() to use !pmd_table() instead of pmd_sect(). That would solve this problem.
But the ptdump code also suffers from a similar issue. It checks pmd_leaf() and doesn't call into the arch-specific note_page() machinery if it returns false. As a result of this, ptdump wasn't even able to show the invalid large leaf mappings; it looked like they were valid which made this super fun to debug. the ptdump code is core-mm and pmd_table() is arm64-specific so we can't use the same trick to solve that.
But we already support the concept of "present-invalid" for user space entries. And even better, pmd_leaf() will return true for a leaf mapping that is marked present-invalid. So let's just use that encoding for present-invalid kernel mappings too. Then we can use pmd_leaf() where we previously used pmd_sect() and everything is magically fixed.
Additionally, from inspection kernel_page_present() was broken in a similar way, so I'm also updating that to use pmd_leaf().
The transitional page tables component was also similarly broken; it creates a copy of the kernel page tables, making RO leaf mappings RW in the process. It also makes invalid (but-not-none) pte mappings valid. But it was not doing this for large leaf mappings. This could have resulted in crashes at kexec- or hibernate-time. This code is fixed to flip "present-invalid" mappings back to "present-valid" at all levels.
Finally, I have hardened split_pmd()/split_pud() so that if it is passed a "present-invalid" leaf, it will maintain that property in the split leaves, since I wasn't able to convince myself that it would only ever be called for "present-valid" leaves.
--- arch/arm64/include/asm/pgtable-prot.h | 2 + arch/arm64/include/asm/pgtable.h | 9 ++++-- arch/arm64/mm/mmu.c | 4 ++ arch/arm64/mm/pageattr.c | 50 +++++++++++++++++++--------------- arch/arm64/mm/trans_pgd.c | 42 ++++------------------------ 5 files changed, 48 insertions(+), 59 deletions(-)
arch/arm64/include/asm/pgtable-prot.h +2 -0
@@ -25,6 +25,8 @@*/ #define PTE_PRESENT_INVALID (PTE_NG)/* only when !PTE_VALID */ +#define PTE_PRESENT_VALID_KERNEL (PTE_VALID | PTE_MAYBE_NG) +#ifdef CONFIG_HAVE_ARCH_USERFAULTFD_WP #define PTE_UFFD_WP (_AT(pteval_t, 1) << 58)/* uffd-wp tracking */ #define PTE_SWP_UFFD_WP (_AT(pteval_t, 1) << 3)/* only for swp ptes */
arch/arm64/include/asm/pgtable.h +7 -2
@@ -353,9 +353,11 @@ static inline pte_t pte_mknoncont(pte_treturn clear_pte_bit (pte,__pgprot (PTE_CONT )); } -static inline pte_t pte_mkvalid (pte_t pte) +static inline pte_t pte_mkvalid_k (pte_t pte) { -return set_pte_bit (pte,__pgprot (PTE_VALID )); + pte =clear_pte_bit (pte,__pgprot (PTE_PRESENT_INVALID )); + pte =set_pte_bit (pte,__pgprot (PTE_PRESENT_VALID_KERNEL )); +return pte; }static inline pte_t pte_mkinvalid (pte_t pte)
@@ -625,6 +627,7 @@ static inline int pmd_protnone(pmd_t pmd#define pmd_mkclean (pmd) pte_pmd(pte_mkclean(pmd_pte(pmd)))#define pmd_mkdirty (pmd) pte_pmd(pte_mkdirty(pmd_pte(pmd)))#define pmd_mkyoung (pmd) pte_pmd(pte_mkyoung(pmd_pte(pmd))) +#define pmd_mkvalid_k (pmd) pte_pmd(pte_mkvalid_k(pmd_pte(pmd)))#define pmd_mkinvalid (pmd) pte_pmd(pte_mkinvalid(pmd_pte(pmd)))#ifdef CONFIG_HAVE_ARCH_USERFAULTFD_WP #define pmd_uffd_wp (pmd) pte_uffd_wp(pmd_pte(pmd))
@@ -666,6 +669,8 @@ static inline pmd_t pmd_mkspecial(pmd_t#define pud_young (pud) pte_young(pud_pte(pud))#define pud_mkyoung (pud) pte_pud(pte_mkyoung(pud_pte(pud))) +#define pud_mkwrite_novma (pud) pte_pud(pte_mkwrite_novma(pud_pte(pud))) +#define pud_mkvalid_k (pud) pte_pud(pte_mkvalid_k(pud_pte(pud)))#define pud_write (pud) pte_write(pud_pte(pud))static inline pud_t pud_mkhuge (pud_t pud)
arch/arm64/mm/mmu.c +4 -0
@@ -604,6 +604,8 @@ static int split_pmd(pmd_t *pmdp, pmd_t tableprot |=PMD_TABLE_PXN ; prot =__pgprot ((pgprot_val (prot) & ~PTE_TYPE_MASK ) |PTE_TYPE_PAGE ); +if (!pmd_valid (pmd)) + prot =pte_pgprot (pte_mkinvalid (pfn_pte (0 , prot))); prot =__pgprot (pgprot_val (prot) & ~PTE_CONT );if (to_cont) prot =__pgprot (pgprot_val (prot) |PTE_CONT );
@@ -649,6 +651,8 @@ static int split_pud(pud_t *pudp, pud_t tableprot |=PUD_TABLE_PXN ; prot =__pgprot ((pgprot_val (prot) & ~PMD_TYPE_MASK ) |PMD_TYPE_SECT ); +if (!pud_valid (pud)) + prot =pmd_pgprot (pmd_mkinvalid (pfn_pmd (0 , prot))); prot =__pgprot (pgprot_val (prot) & ~PTE_CONT );if (to_cont) prot =__pgprot (pgprot_val (prot) |PTE_CONT );
arch/arm64/mm/pageattr.c +28 -22
116 lines not on this page · raw message
arch/arm64/mm/trans_pgd.c +7 -35
66 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 159/198 media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruslan Valiyev <[email protected]>
commit f8e1fc918a9fe67103bcda01d20d745f264d00a7 upstream.
syzbot reported a general protection fault in vidtv_psi_desc_assign [1].
vidtv_psi_pmt_stream_init() can return NULL on memory allocation failure, but vidtv_channel_pmt_match_sections() does not check for this. When tail is NULL, the subsequent call to vidtv_psi_desc_assign(&tail->descriptor, desc) dereferences a NULL pointer offset, causing a general protection fault.
Add a NULL check after vidtv_psi_pmt_stream_init(). On failure, clean up the already-allocated stream chain and return.
[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:vidtv_psi_desc_assign+0x24/0x90 drivers/media/test-drivers/vidtv/vidtv_psi.c:629 Call Trace: <TASK> vidtv_channel_pmt_match_sections drivers/media/test-drivers/vidtv/vidtv_channel.c:349 [inline] vidtv_channel_si_init+0x1445/0x1a50 drivers/media/test-drivers/vidtv/vidtv_channel.c:479 vidtv_mux_init+0x526/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:519 vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline] vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239
--- drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/media/test-drivers/vidtv/vidtv_channel.c +4 -0
@@ -341,6 +341,10 @@ vidtv_channel_pmt_match_sections(struct tail =vidtv_psi_pmt_stream_init (tail, s->type, e_pid); +if (!tail) { +vidtv_psi_pmt_stream_destroy (head); +return ; + }if (!head) head = tail;
Greg Kroah-Hartman
maintainerPATCH 160/198 ocfs2: fix possible deadlock between unlink and dio_end_io_write
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <[email protected]>
commit b02da26a992db0c0e2559acbda0fc48d4a2fd337 upstream.
ocfs2_unlink takes orphan dir inode_lock first and then ip_alloc_sem, while in ocfs2_dio_end_io_write, it acquires these locks in reverse order. This creates an ABBA lock ordering violation on lock classes ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE] and ocfs2_file_ip_alloc_sem_key.
Lock Chain #0 (orphan dir inode_lock -> ip_alloc_sem):ocfs2_unlink
ocfs2_prepare_orphan_dir
ocfs2_lookup_lock_orphan_dir
inode_lock(orphan_dir_inode) <- lock A
__ocfs2_prepare_orphan_dir
ocfs2_prepare_dir_for_insert
ocfs2_extend_dir
ocfs2_expand_inline_dir
down_write(&oi->ip_alloc_sem) <- Lock B
Lock Chain #1 (ip_alloc_sem -> orphan dir inode_lock):ocfs2_dio_end_io_write
down_write(&oi->ip_alloc_sem) <- Lock B ocfs2_del_inode_from_orphan()
inode_lock(orphan_dir_inode) <- Lock A
Deadlock Scenario:
CPU0 (unlink) CPU1 (dio_end_io_write)
------ ------
inode_lock(orphan_dir_inode)
down_write(ip_alloc_sem)
down_write(ip_alloc_sem)
inode_lock(orphan_dir_inode)
Since ip_alloc_sem is to protect allocation changes, which is unrelated with operations in ocfs2_del_inode_from_orphan. So move ocfs2_del_inode_from_orphan out of ip_alloc_sem to fix the deadlock.
--- fs/ocfs2/aops.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/ocfs2/aops.c +1 -2
@@ -2295,8 +2295,6 @@ static int ocfs2_dio_end_io_write(struct goto out; } -down_write (&oi->ip_alloc_sem); -/* Delete orphan before acquire i_rwsem. */ if (dwc->dw_orphaned) {BUG_ON (dwc->dw_writer_pid !=task_pid_nr (current));
@@ -2309,6 +2307,7 @@ static int ocfs2_dio_end_io_write(structmlog_errno (ret); } +down_write (&oi->ip_alloc_sem); di = (struct ocfs2_dinode *)di_bh->b_data;ocfs2_init_dinode_extent_tree (&et,INODE_CACHE (inode), di_bh);
Greg Kroah-Hartman
maintainerPATCH 161/198 ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejas Bharambe <[email protected]>
commit 7de554cabf160e331e4442e2a9ad874ca9875921 upstream.
filemap_fault() may drop the mmap_lock before returning VM_FAULT_RETRY, as documented in mm/filemap.c:
"If our return value has VM_FAULT_RETRY set, it's because the mmap_lock may be dropped before doing I/O or by lock_folio_maybe_drop_mmap()."
When this happens, a concurrent munmap() can call remove_vma() and free the vm_area_struct via RCU. The saved 'vma' pointer in ocfs2_fault() then becomes a dangling pointer, and the subsequent trace_ocfs2_fault() call dereferences it -- a use-after-free.
Fix this by saving ip_blkno as a plain integer before calling filemap_fault(), and removing vma from the trace event. Since ip_blkno is copied by value before the lock can be dropped, it remains valid regardless of what happens to the vma or inode afterward.
--- fs/ocfs2/mmap.c | 7 +++---- fs/ocfs2/ocfs2_trace.h | 10 ++++------ 2 files changed, 7 insertions(+), 10 deletions(-)
fs/ocfs2/mmap.c +3 -4
@@ -30,7 +30,8 @@static vm_fault_t ocfs2_fault (struct vm_fault *vmf) { -struct vm_area_struct *vma = vmf->vma; +unsigned long long ip_blkno = +OCFS2_I (file_inode (vmf->vma->vm_file))->ip_blkno;sigset_t oldset;vm_fault_t ret;
@@ -38,11 +39,9 @@ static vm_fault_t ocfs2_fault(struct vm_ ret =filemap_fault (vmf);ocfs2_unblock_signals (&oldset); -trace_ocfs2_fault (OCFS2_I (vma->vm_file->f_mapping->host)->ip_blkno, - vma, vmf->page, vmf->pgoff); +trace_ocfs2_fault (ip_blkno, vmf->page, vmf->pgoff);return ret; } -static vm_fault_t __ocfs2_page_mkwrite (struct file *file,struct buffer_head *di_bh,struct folio *folio) {
fs/ocfs2/ocfs2_trace.h +4 -6
@@ -1246,22 +1246,20 @@ TRACE_EVENT(ocfs2_write_end_inline,TRACE_EVENT (ocfs2_fault, TP_PROTO(unsigned long long ino, - void *area, void *page, unsigned long pgoff), -TP_ARGS (ino, area, page, pgoff), + void *page, unsigned long pgoff), +TP_ARGS (ino, page, pgoff),TP_STRUCT__entry ( __field(unsigned long long, ino) - __field(void *, area) __field(void *, page) __field(unsigned long, pgoff) ),TP_fast_assign ( __entry->ino = ino; - __entry->area = area; __entry->page = page; __entry->pgoff = pgoff; ), -TP_printk ("%llu %p %p %lu" , - __entry->ino, __entry->area, __entry->page, __entry->pgoff) +TP_printk ("%llu %p %lu" , + __entry->ino, __entry->page, __entry->pgoff) );/* End of trace events for fs/ocfs2/mmap.c. */
Greg Kroah-Hartman
maintainerPATCH 162/198 ocfs2: handle invalid dinode in ocfs2_group_extend
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhengYuan Huang <[email protected]>
commit 4a1c0ddc6e7bcf2e9db0eeaab9340dcfe97f448f upstream.
[BUG]
kernel BUG at fs/ocfs2/resize.c:308!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ocfs2_group_extend+0x10aa/0x1ae0 fs/ocfs2/resize.c:308 Code: 8b8520ff ffff83f8 860f8580 030000e8 5cc3c1fe Call Trace: ... ocfs2_ioctl+0x175/0x6e0 fs/ocfs2/ioctl.c:869 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e ...
[CAUSE]ocfs2_group_extend() assumes that the global bitmap inode block returned from ocfs2_inode_lock() has already been validated and BUG_ONs when the signature is not a dinode. That assumption is too strong for crafted filesystems because the JBD2-managed buffer path can bypass structural validation and return an invalid dinode to the resize ioctl.
[FIX]
Validate the dinode explicitly in ocfs2_group_extend(). If the global bitmap buffer does not contain a valid dinode, report filesystem corruption with ocfs2_error() and fail the resize operation instead of crashing the kernel.
--- fs/ocfs2/resize.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
fs/ocfs2/resize.c +7 -3
@@ -303,9 +303,13 @@ int ocfs2_group_extend(struct inode * in fe = (struct ocfs2_dinode *)main_bm_bh->b_data; -/* main_bm_bh is validated by inode read inside ocfs2_inode_lock(), -* so any corruption is a code bug. */ -BUG_ON (!OCFS2_IS_VALID_DINODE (fe)); +/* JBD-managed buffers can bypass validation, so treat this as corruption. */ +if (!OCFS2_IS_VALID_DINODE (fe)) { + ret =ocfs2_error (main_bm_inode->i_sb, +"Invalid dinode #%llu\n" , + (unsigned long long )OCFS2_I (main_bm_inode)->ip_blkno); + goto out_unlock; + }if (le16_to_cpu (fe->id2.i_chain.cl_cpg) != ocfs2_group_bitmap_size(osb->sb, 0,
Greg Kroah-Hartman
maintainerPATCH 163/198 PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <[email protected]>
commit d799984233a50abd2667a7d17a9a710a3f10ebe2 upstream.
Disable the delayed work before clearing BAR mappings and doorbells to avoid running the handler after resources have been torn down.
Unable to handle kernel paging request at virtual address ffff800083f46004 [...] Internal error: Oops: 0000000096000007 [#1] SMP [...] Call trace: epf_ntb_cmd_handler+0x54/0x200 [pci_epf_vntb] (P) process_one_work+0x154/0x3b0 worker_thread+0x2c8/0x400 kthread+0x148/0x210 ret_from_fork+0x10/0x20
--- drivers/pci/endpoint/functions/pci-epf-vntb.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/endpoint/functions/pci-epf-vntb.c +1 -0
@@ -836,6 +836,7 @@ err_config_interrupt:*/ static void epf_ntb_epc_cleanup (struct epf_ntb *ntb) { +disable_delayed_work_sync (&ntb->cmd_handler);epf_ntb_mw_bar_clear (ntb, ntb->num_mws);epf_ntb_db_bar_clear (ntb);epf_ntb_config_sspad_bar_clear (ntb);
Greg Kroah-Hartman
maintainerPATCH 164/198 PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <[email protected]>
commit 0da63230d3ec1ec5fcc443a2314233e95bfece54 upstream.
epf_ntb_epc_destroy() duplicates the teardown that the caller is supposed to perform later. This leads to an oops when .allow_link fails or when .drop_link is performed. The following is an example oops of the former case:
Unable to handle kernel paging request at virtual address dead000000000108 [...] [dead000000000108] address between user and kernel address ranges Internal error: Oops: 0000000096000044 [#1] SMP [...] Call trace: pci_epc_remove_epf+0x78/0xe0 (P) pci_primary_epc_epf_link+0x88/0xa8 configfs_symlink+0x1f4/0x5a0 vfs_symlink+0x134/0x1d8 do_symlinkat+0x88/0x138 __arm64_sys_symlinkat+0x74/0xe0 [...]
Remove the helper, and drop pci_epc_put(). EPC device refcounting is tied to the configfs EPC group lifetime, and pci_epc_put() in the .drop_link path is sufficient.
--- drivers/pci/endpoint/functions/pci-epf-vntb.c | 19 +------------------ 1 file changed, 1 insertion(+), 18 deletions(-)
drivers/pci/endpoint/functions/pci-epf-vntb.c +1 -18
@@ -645,19 +645,6 @@ static void epf_ntb_mw_bar_clear(struct }/** -* epf_ntb_epc_destroy() - Cleanup NTB EPC interface -* @ntb: NTB device that facilitates communication between HOST and VHOST -* -* Wrapper for epf_ntb_epc_destroy_interface() to cleanup all the NTB interfaces -*/ -static void epf_ntb_epc_destroy (struct epf_ntb *ntb) -{ -pci_epc_remove_epf (ntb->epf->epc, ntb->epf,0 ); -pci_epc_put (ntb->epf->epc); -} - - -/** * epf_ntb_is_bar_used() - Check if a bar is used in the ntb configuration * @ntb: NTB device that facilitates communication between HOST and VHOST * @barno: Checked bar number
@@ -1407,7 +1394,7 @@ static int epf_ntb_bind(struct pci_epf * ret =epf_ntb_init_epc_bar (ntb);if (ret) {dev_err (dev,"Failed to create NTB EPC\n" ); - goto err_bar_init; +return ret; } ret =epf_ntb_config_spad_bar_alloc (ntb);
@@ -1447,9 +1434,6 @@ err_epc_cleanup: err_bar_alloc:epf_ntb_config_spad_bar_free (ntb); -err_bar_init: -epf_ntb_epc_destroy (ntb); -return ret; }
@@ -1465,7 +1449,6 @@ static void epf_ntb_unbind(struct pci_epepf_ntb_epc_cleanup (ntb);epf_ntb_config_spad_bar_free (ntb); -epf_ntb_epc_destroy (ntb);pci_unregister_driver (&vntb_pci_driver); }