7.0.7-rc1 review
Greg Kroah-Hartman
maintainercover 7.0.7-rc1 review
This is the start of the stable review cycle for the 7.0.7 release. There are 307 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 14 May 2026 17:38:03 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.7-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 7.0.7-rc1
Prathyushi Nangia <[email protected]>
x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache
Gary Guo <[email protected]>
rust: pin-init: fix incorrect accessor reference lifetime
Sam Edwards <[email protected]>
net: stmmac: Prevent NULL deref when RX memory exhausted
Russell King (Oracle) <[email protected]>
net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
Thorsten Blum <[email protected]>
crypto: caam - guard HMAC key hex dumps in hash_digest_key
Thorsten Blum <[email protected]>
printk: add print_hex_dump_devel()
Longxuan Yu <[email protected]>
8021q: delete cleared egress QoS mappings
Longxuan Yu <[email protected]>
8021q: use RCU for egress QoS mappings
Zilin Guan <[email protected]>
hfsplus: fix held lock freed on hfsplus_fill_super()
Deepanshu Kartikey <[email protected]>
hfsplus: fix uninit-value by validating catalog record size
Suman Kumar Chakraborty <[email protected]>
crypto: qat - fix firmware loading failure for GEN6 devices
Suman Kumar Chakraborty <[email protected]>
crypto: qat - fix indentation of macros in qat_hal.c
Luke Wang <[email protected]>
mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs
Avri Altman <[email protected]>
mmc: core: Add quirk for incorrect manufacturing date
Avri Altman <[email protected]>
mmc: core: Adjust MDT beyond 2025
David Carlier <[email protected]>
octeon_ep_vf: add NULL check for napi_build_skb()
Alexei Starovoitov <[email protected]>
bpf: Fix use-after-free in arena_vm_close on fork
Huacai Chen <[email protected]>
LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup
Tao Cui <[email protected]>
LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte()
Bibo Mao <[email protected]>
LoongArch: KVM: Move unconditional delay into timer clear scenery
Bibo Mao <[email protected]>
LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software
Xianglai Li <[email protected]>
LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry
Qiang Ma <[email protected]>
LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS
Wentao Guan <[email protected]>
LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()
Fuad Tabba <[email protected]>
KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()
Fuad Tabba <[email protected]>
KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer
Fuad Tabba <[email protected]>
KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer
Quentin Perret <[email protected]>
KVM: arm64: Fix initialisation order in __pkvm_init_finalise()
David Woodhouse <[email protected]>
KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value
Marc Zyngier <[email protected]>
KVM: arm64: Wake-up from WFI when iqrchip is in userspace
Yongpeng Yang <[email protected]>
f2fs: fix fsck inconsistency caused by FGGC of node block
Yongpeng Yang <[email protected]>
f2fs: fix inline data not being written to disk in writeback path
Yongpeng Yang <[email protected]>
f2fs: refactor f2fs_move_node_folio function
Guangshuo Li <[email protected]>
f2fs: fix uninitialized kobject put in f2fs_init_sysfs()
Yongpeng Yang <[email protected]>
f2fs: fix node_cnt race between extent node destroy and writeback
Yongpeng Yang <[email protected]>
f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()
Yongpeng Yang <[email protected]>
f2fs: fix incorrect file address mapping when inline inode is unwritten
Yongpeng Yang <[email protected]>
f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage
Yongpeng Yang <[email protected]>
f2fs: fix fiemap boundary handling when read extent cache is incomplete
Chao Yu <[email protected]>
f2fs: fix false alarm of lockdep on cp_global_sem lock
Cen Zhang <[email protected]>
f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ADD_ADDR rtx: return early if no retrans
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ADD_ADDR rtx: free sk if last
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ADD_ADDR rtx: always decrease sk refcount
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ADD_ADDR rtx: fix potential data-race
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ADD_ADDR rtx: allow ID 0
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: kernel: reset fullmesh counter after flush
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: prio: skip closed subflows
Gang Yan <[email protected]>
mptcp: fix scheduling with atomic in timestamp sockopt
Paolo Abeni <[email protected]>
mptcp: fix rx timestamp corruption on fastopen
Matthieu Baerts (NGI0) <[email protected]>
mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf
Gang Yan <[email protected]>
mptcp: sockopt: set timestamp flags on subflow socket, not msk
Shardul Bankar <[email protected]>
mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
Shardul Bankar <[email protected]>
mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
Matthieu Baerts (NGI0) <[email protected]>
mptcp: fastclose msk when linger time is 0
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: check output: catch cmd errors
Tejun Heo <[email protected]>
sched_ext: Use dsq->first_task instead of list_empty() in dispatch_enqueue() FIFO-tail
Tejun Heo <[email protected]>
sched_ext: Skip tasks with stale task_rq in bypass_lb_cpu()
David Carlier <[email protected]>
sched_ext: idle: Recheck prev_cpu after narrowing allowed mask
Chen Ni <[email protected]>
remoteproc: k3: Fix NULL vs IS_ERR() bug in k3_reserved_mem_init()
Chen Ni <[email protected]>
remoteproc: imx_rproc: Fix NULL vs IS_ERR() bug in imx_rproc_addr_init()
Jason Gunthorpe <[email protected]>
RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
Michael Bommarito <[email protected]>
RDMA/rxe: Reject unknown opcodes before ICRC processing
Michael Bommarito <[email protected]>
RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
Jason Gunthorpe <[email protected]>
RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
Junrui Luo <[email protected]>
RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
Jason Gunthorpe <[email protected]>
RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
Jason Gunthorpe <[email protected]>
RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
Jason Gunthorpe <[email protected]>
RDMA/mana: Validate rx_hash_key_len
Jason Gunthorpe <[email protected]>
RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
Jason Gunthorpe <[email protected]>
RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
Jason Gunthorpe <[email protected]>
RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
Jason Gunthorpe <[email protected]>
RDMA/ionic: Fix typo in format string
Kai Zen <[email protected]>
RDMA/ionic: bound node_desc sysfs read with %.64s
Dapeng Mi <[email protected]>
perf/x86/intel: Enable auto counter reload for DMR
Dapeng Mi <[email protected]>
perf/x86/intel: Disable PMI for self-reloaded ACR events
Dapeng Mi <[email protected]>
perf/x86/intel: Always reprogram ACR events to prevent stale masks
Nilay Shroff <[email protected]>
powerpc/xive: fix kmemleak caused by incorrect chip_data lookup
André Draszik <[email protected]>
power: supply: max17042: avoid overflow when determining health
Lukas Wunner <[email protected]>
PCI/ASPM: Fix pci_clear_and_set_config_dword() usage
Lukas Wunner <[email protected]>
PCI/AER: Stop ruling out unbound devices as error source
Shuai Xue <[email protected]>
PCI/AER: Clear only error bits in PCIe Device Status
Lukas Wunner <[email protected]>
PCI: Update saved_config_space upon resource assignment
SeongJae Park <[email protected]>
mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock
SeongJae Park <[email protected]>
mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
SeongJae Park <[email protected]>
mm/damon/stat: detect and use fresh enabled value
SeongJae Park <[email protected]>
mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
SeongJae Park <[email protected]>
mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
Paolo Bonzini <[email protected]>
KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty
Paolo Bonzini <[email protected]>
KVM: x86: check for nEPT/nNPT in slow flush hypercalls
Michael Bommarito <[email protected]>
smb: client: validate dacloffset before building DACL pointers
Bjoern Doebel <[email protected]>
smb: client: use kzalloc to zero-initialize security descriptor buffer
Zisen Ye <[email protected]>
smb/client: fix out-of-bounds read in symlink_data()
Zisen Ye <[email protected]>
smb/client: fix out-of-bounds read in smb2_compound_op()
Ranjan Kumar <[email protected]>
scsi: mpt3sas: Limit NVMe request size to 2 MiB
Pengpeng Hou <[email protected]>
s390/debug: Reject zero-length input before trimming a newline
Vasily Gorbik <[email protected]>
s390/debug: Reject zero-length input in debug_input_flush_fn()
Osama Abdelkader <[email protected]>
riscv: kvm: fix vector context allocation leak
Jason Gunthorpe <[email protected]>
RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
David Carlier <[email protected]>
psp: strip variable-length PSP header in psp_dev_rcv()
Ulf Hansson <[email protected]>
pmdomain: core: Fix detach procedure for virtual devices in genpd
Ilya Maximets <[email protected]>
openvswitch: vport: fix self-deadlock on release of tunnel ports
Chaitanya Kulkarni <[email protected]>
nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
Chaitanya Kulkarni <[email protected]>
nvmet-tcp: fix race between ICReq handling and queue teardown
Fedor Pchelkin <[email protected]>
nvme-apple: drop invalid put of admin queue reference count
Junrui Luo <[email protected]>
md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
Raphael Zimmer <[email protected]>
libceph: Fix slab-out-of-bounds access in auth message processing
Christian A. Ehrhardt <[email protected]>
lib/scatterlist: fix temp buffer in extract_user_to_sg()
Christian A. Ehrhardt <[email protected]>
lib/scatterlist: fix length calculations in extract_kvec_to_sg
Eric Biggers <[email protected]>
lib/crc: tests: Make crc_kunit test only the enabled CRC variants
Lukas Wunner <[email protected]>
lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
Nicolin Chen <[email protected]>
iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update
Zhenzhong Duan <[email protected]>
iommu/vt-d: Block PASID attachment to nested domain with dirty tracking
Zhenzhong Duan <[email protected]>
iommufd: Fix return value of iommufd_fault_fops_write()
Michael Bommarito <[email protected]>
isofs: validate block number from NFS file handle in isofs_export_iget
Michael Bommarito <[email protected]>
isofs: validate Rock Ridge CE continuation extent against volume size
Eric Biggers <[email protected]>
dm-verity-fec: fix the size of dm_verity_fec_io::erasures
Eric Biggers <[email protected]>
dm-verity-fec: fix reading parity bytes split across blocks (take 3)
Eric Biggers <[email protected]>
dm-verity-fec: fix corrected block count stat
Eric Biggers <[email protected]>
dm-verity-fec: correctly reject too-small hash devices
Eric Biggers <[email protected]>
dm-verity-fec: correctly reject too-small FEC devices
David Carlier <[email protected]>
eventfs: Hold eventfs_mutex and SRCU when remount walks events
Mikulas Patocka <[email protected]>
dm: fix a buffer overflow in ioctl processing
Mikulas Patocka <[email protected]>
dm: don't report warning when doing deferred remove
Mikulas Patocka <[email protected]>
dm-thin: fix metadata refcount underflow
Filipe Manana <[email protected]>
btrfs: fix missing last_unlink_trans update when removing a directory
Guangshuo Li <[email protected]>
btrfs: fix double free in create_space_info_sub_group() error path
Guangshuo Li <[email protected]>
btrfs: fix double free in create_space_info() error path
Yochai Eisenrich <[email protected]>
btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak
Qu Wenruo <[email protected]>
btrfs: do not mark inode incompressible after inline attempt fails
Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6apm: remove child devices when apm is removed
Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop
Cássio Gabriel <[email protected]>
ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error
Joseph Salisbury <[email protected]>
ASoC: fsl_easrc: fix comment typo
Li Jian <[email protected]>
ASoC: ES8389: convert to devm_clk_get_optional() to get clock
Tommaso Soncin <[email protected]>
ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table
Shrikanth Hegde <[email protected]>
cpuidle: powerpc: avoid double clear when breaking snooze
Conor Dooley <[email protected]>
clk: microchip: mpfs-ccc: fix out of bounds access during output registration
Stefan Eichenberger <[email protected]>
clk: imx: imx8-acm: fix flags for acm clocks
Masami Hiramatsu (Google) <[email protected]>
tracing/fprobe: Check the same type fprobe on table as the unregistered one
Steven Rostedt <[email protected]>
tracing/probes: Limit size of event probe to 3K
Masami Hiramatsu (Google) <[email protected]>
tracing/fprobe: Unregister fprobe even if memory allocation fails
Masami Hiramatsu (Google) <[email protected]>
tracing/fprobe: Remove fprobe from hash in failure path
Masami Hiramatsu (Google) <[email protected]>
tracing/fprobe: Avoid kcalloc() in rcu_read_lock section
Johan Hovold <[email protected]>
spi: topcliff-pch: fix use-after-free on unbind
Johan Hovold <[email protected]>
spi: topcliff-pch: fix controller deregistration
Thorsten Blum <[email protected]>
thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp
Thorsten Blum <[email protected]>
thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata
Rafael J. Wysocki <[email protected]>
thermal: core: Free thermal zone ID later during removal
David Gow <[email protected]>
x86/boot/e820: Re-enable BIOS fallback if e820 table is empty
Michael Bommarito <[email protected]>
udf: reject descriptors with oversized CRC length
David Carlier <[email protected]>
tracefs: Fix default permissions not being applied on initial mount
Conor Dooley <[email protected]>
spi: microchip-core-qspi: control built-in cs manually
Conor Dooley <[email protected]>
spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations
Johan Hovold <[email protected]>
spi: microchip-core-spi: fix controller deregistration
Johan Hovold <[email protected]>
spi: microchip-core-qspi: fix controller deregistration
Guangshuo Li <[email protected]>
ice: fix double free in ice_sf_eth_activate() error path
Mingming Cao <[email protected]>
ibmveth: Disable GSO for packets with small MSS
Dexuan Cui <[email protected]>
hv_sock: Return -EIO for malformed/short packets
Dexuan Cui <[email protected]>
hv_sock: Report EOF instead of -EIO for FIN
Hamza Mahfooz <[email protected]>
hv_sock: fix ARM64 support
Thomas Zimmermann <[email protected]>
hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS
Bartosz Golaszewski <[email protected]>
gpio: of: clear OF_POPULATED on hog nodes in remove path
Thomas Zimmermann <[email protected]>
fbcon: Avoid OOB font access if console rotation fails
Xu Yang <[email protected]>
extcon: ptn5150: handle pending IRQ events during system resume
Shyam Prasad N <[email protected]>
cifs: change_conf needs to be called for session setup
Shyam Prasad N <[email protected]>
cifs: abort open_cached_dir if we don't request leases
Jens Axboe <[email protected]>
block: only read from sqe on initial invocation of blkdev_uring_cmd()
Damien Le Moal <[email protected]>
block: fix zone write plug removal
Naman Jain <[email protected]>
block: add pgmap check to biovec_phys_mergeable
Wentao Liang <[email protected]>
pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy()
Breno Leitao <[email protected]>
arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's
Jiexun Wang <[email protected]>
af_unix: Reject SIOCATMARK on non-stream sockets
Myeonghun Pak <[email protected]>
hwmon: (corsair-psu) Close HID device on probe errors
Johan Hovold <[email protected]>
clk: rk808: fix OF node reference imbalance
Sanman Pradhan <[email protected]>
hwmon: (ltc2992) Fix u32 overflow in power read path
Sanman Pradhan <[email protected]>
hwmon: (ltc2992) Clamp threshold writes to hardware range
Ivan Hu <[email protected]>
x86/efi: Fix graceful fault handling after FPU softirq changes
Hongling Zeng <[email protected]>
parisc: Fix IRQ leak in LASI driver
Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration
Colin Walters <[email protected]>
ovl: fix verity lazy-load guard broken by fsverity_active() semantic change
Pavitra Jha <[email protected]>
net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler
Nan Li <[email protected]>
net/rds: handle zerocopy send cleanup before the message is queued
Breno Leitao <[email protected]>
netpoll: pass buffer size to egress_dev() to avoid MAC truncation
Jiawen Wu <[email protected]>
net: libwx: use request_irq for VF misc interrupt
Maoyi Xie <[email protected]>
ip6_gre: Use cached t->net in ip6erspan_changelink().
Jiawen Wu <[email protected]>
net: libwx: fix VF illegal register access
Ritesh Harjani (IBM) <[email protected]>
pseries/papr-hvpipe: Fix the usage of copy_to_user()
Ritesh Harjani (IBM) <[email protected]>
pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init()
Ritesh Harjani (IBM) <[email protected]>
pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle()
Ritesh Harjani (IBM) <[email protected]>
pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace
Ritesh Harjani (IBM) <[email protected]>
pseries/papr-hvpipe: Fix race with interrupt handler
SeungJu Cheon <[email protected]>
sound: ua101: fix division by zero at probe
Karol Wachowski <[email protected]>
accel/ivpu: Disallow re-exporting imported GEM objects
Thomas Gleixner <[email protected]>
selftests/rseq: Expand for optimized RSEQ ABI v2
Thomas Gleixner <[email protected]>
selftests/rseq: Validate legacy behavior
Thomas Gleixner <[email protected]>
selftests/rseq: Skip tests if time slice extensions are not available
Thomas Gleixner <[email protected]>
selftests/rseq: Make registration flexible for legacy and optimized mode
Thomas Gleixner <[email protected]>
rseq: Don't advertise time slice extensions if disabled
Thomas Gleixner <[email protected]>
rseq: Protect rseq_reset() against interrupts
Thomas Gleixner <[email protected]>
rseq: Set rseq::cpu_id_start to 0 on unregistration
Mark Brown <[email protected]>
selftests/rseq: Don't run tests with runner scripts outside of the scripts
Dapeng Mi <[email protected]>
perf/x86/intel: Improve validation and configuration of ACR masks
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ADD_ADDR rtx: skip inactive subflows
Kai Zen <[email protected]>
net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo
Xianglai Li <[email protected]>
LoongArch: KVM: Compile switch.S directly into the kernel
Huacai Chen <[email protected]>
LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT
Sang-Heon Jeon <[email protected]>
mm/hugetlb_cma: round up per_node before logging it
Kevin Brodsky <[email protected]>
arm64: signal: Preserve POR_EL0 if poe_context is missing
Tudor Ambarus <[email protected]>
mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
Fuad Tabba <[email protected]>
KVM: arm64: Fix kvm_vcpu_initialized() macro parameter
Miklos Szeredi <[email protected]>
fanotify: fix false positive on permission events
Johan Hovold <[email protected]>
staging: vme_user: fix root device leak on init failure
Shyam Sunder Reddy Padira <[email protected]>
staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc
Johan Hovold <[email protected]>
spi: s3c64xx: fix NULL-deref on driver unbind
Johan Hovold <[email protected]>
spi: tegra20-sflash: fix controller deregistration
Johan Hovold <[email protected]>
spi: zynqmp-gqspi: fix controller deregistration
Johan Hovold <[email protected]>
spi: tegra114: fix controller deregistration
Johan Hovold <[email protected]>
spi: sun6i: fix controller deregistration
Johan Hovold <[email protected]>
spi: ti-qspi: fix controller deregistration
Johan Hovold <[email protected]>
spi: zynq-qspi: fix controller deregistration
Johan Hovold <[email protected]>
spi: sun4i: fix controller deregistration
Johan Hovold <[email protected]>
spi: syncuacer: fix controller deregistration
Gary Guo <[email protected]>
rust: pin-init: internal: move alignment check to make_field_check
Miguel Ojeda <[email protected]>
rust: allow clippy::collapsible_if globally
Miguel Ojeda <[email protected]>
rust: allow clippy::collapsible_match globally
Eliot Courtney <[email protected]>
rust: drm: gem: clean up GEM state in init failure case
Siwei Zhang <[email protected]>
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
Siwei Zhang <[email protected]>
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
Siwei Zhang <[email protected]>
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
David Carlier <[email protected]>
Bluetooth: hci_conn: fix potential UAF in create_big_sync
Tristan Madani <[email protected]>
Bluetooth: btmtk: validate WMT event SKB length before struct access
Michael Bommarito <[email protected]>
Bluetooth: virtio_bt: validate rx pkt_type header length
Michael Bommarito <[email protected]>
Bluetooth: virtio_bt: clamp rx length before skb_put
Tao Cui <[email protected]>
LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read()
Jens Axboe <[email protected]>
io_uring/tw: serialize ctx->retry_llist with ->uring_lock
Martin Michaelis <[email protected]>
io_uring/kbuf: support min length left for incremental buffers
Stephen Smalley <[email protected]>
selinux: allow multiple opens of /sys/fs/selinux/policy
Stephen Smalley <[email protected]>
selinux: prune /sys/fs/selinux/user
Stephen Smalley <[email protected]>
selinux: prune /sys/fs/selinux/disable
Stephen Smalley <[email protected]>
selinux: prune /sys/fs/selinux/checkreqprot
Stephen Smalley <[email protected]>
selinux: shrink critical section in sel_write_load()
David Windsor <[email protected]>
selinux: don't reserve xattr slot when we won't fill it
Zongyao Chen <[email protected]>
selinux: use sk blob accessor in socket permission helpers
Stephen Smalley <[email protected]>
selinux: fix avdcache auditing
Michael Bommarito <[email protected]>
xfrm: ah: account for ESN high bits in async callbacks
Yilin Zhu <[email protected]>
ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
Michal Kosiorek <[email protected]>
xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
Ruijie Li <[email protected]>
xfrm: provide message size for XFRM_MSG_MAPPING
Tejun Heo <[email protected]>
sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters
Ard Biesheuvel <[email protected]>
x86/efi: Restore IRQ state in EFI page fault handler
Sourabh Jain <[email protected]>
powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o
Cássio Gabriel <[email protected]>
ALSA: seq: Fix UMP group 16 filtering
Cássio Gabriel <[email protected]>
ALSA: core: Serialize deferred fasync state checks
Cássio Gabriel <[email protected]>
ALSA: firewire-tascam: Do not drop unread control events
Yuriy Padlyak <[email protected]>
ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15
Takashi Iwai <[email protected]>
ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
Cássio Gabriel <[email protected]>
ALSA: hda: cs35l56: Propagate ASP TX source control errors
Xu Yang <[email protected]>
usb: typec: tcpm: fix debug accessory mode detection for sink ports
Felix Gu <[email protected]>
usb: ulpi: fix memory leak on ulpi_register() error paths
Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion LE910Cx compositions
Aaro Koskinen <[email protected]>
USB: omap_udc: DMA: Don't enable burst 4 mode
Amit Sunil Dhamne <[email protected]>
usb: typec: tcpm: reset internal port states on soft reset AMS
Selvarasu Ganesan <[email protected]>
usb: dwc3: Move GUID programming after PHY initialization
Cássio Gabriel <[email protected]>
ALSA: usb-audio: Fix UAC3 cluster descriptor size check
Takashi Iwai <[email protected]>
ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
Cássio Gabriel <[email protected]>
ALSA: usb-audio: midi2: Restart output URBs on resume
Greg Kroah-Hartman <[email protected]>
usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
Greg Kroah-Hartman <[email protected]>
usb: usblp: fix heap leak in IEEE 1284 device ID via short response
Marek Szyprowski <[email protected]>
wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
Tristan Madani <[email protected]>
wifi: b43: enforce bounds check on firmware key index in b43_rx()
Johannes Berg <[email protected]>
wifi: mac80211: remove station if connection prep fails
Jiri Slaby (SUSE) <[email protected]>
wifi: ath5k: do not access array OOB
Benjamin Berg <[email protected]>
wifi: mac80211: use safe list iteration in radar detect work
Jeongjun Park <[email protected]>
wifi: rsi: fix kthread lifetime race between self-exit and external-stop
Catherine <[email protected]>
wifi: mac80211: drop stray 'static' from fast-RX rx_result
Tristan Madani <[email protected]>
wifi: b43legacy: enforce bounds check on firmware key index in RX path
Quan Zhou <[email protected]>
wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
Leon Yen <[email protected]>
wifi: mt76: mt7921: fix a potential clc buffer length underflow
Ming Yen Hsieh <[email protected]>
wifi: mt76: mt7925: fix incorrect length field in txpower command
Quan Zhou <[email protected]>
wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr
Jann Horn <[email protected]>
exit: prevent preemption of oopsing TASK_DEAD task
Jamal Hadi Salim <[email protected]>
net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked
Yi Kuo <[email protected]>
smb: client/smbdirect: fix MR registration for coalesced SG lists
Qingfang Deng <[email protected]>
flow_dissector: do not dissect PPPoE PFC frames
Sean Christopherson <[email protected]>
KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
DaeMyung Kang <[email protected]>
ksmbd: rewrite stop_sessions() with restartable iteration
Johan Hovold <[email protected]>
spi: rockchip: fix controller deregistration
Quan Zhou <[email protected]>
wifi: mt76: mt7925: fix incorrect TLV length in CLC command
Mark Brown <[email protected]>
ASoC: SOF: Don't allow pointer operations on unconfigured streams
Sina Hassani <[email protected]>
iommufd: Fix a race with concurrent allocation and unmap
David Carlier <[email protected]>
tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
Shivam Kalra <[email protected]>
ACPI: video: force native backlight on HP OMEN 16 (8A44)
Jinjie Ruan <[email protected]>
ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
Jan Schär <[email protected]>
ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO
Guangshuo Li <[email protected]>
ACPI: scan: Use acpi_dev_put() in object add error paths
Breno Leitao <[email protected]>
ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states
Rajat Gupta <[email protected]>
fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
Corey Minyard <[email protected]>
ipmi:si: Return state to normal if message allocation fails
Corey Minyard <[email protected]>
ipmi: Check event message buffer response for bad data
Corey Minyard <[email protected]>
ipmi: Add limits to event and receive message requests
Greg Kroah-Hartman <[email protected]>
scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
-------------
Diffstat:
.../ABI/{obsolete => removed}/sysfs-selinux-user | 0
Makefile | 6 +-
arch/arm64/include/asm/kvm_host.h | 2 +-
arch/arm64/kernel/ptrace.c | 4 +-
arch/arm64/kernel/signal.c | 54 +++-
arch/arm64/kvm/arm.c | 4 +
arch/arm64/kvm/config.c | 17 +-
arch/arm64/kvm/hyp/nvhe/pkvm.c | 38 ++-
arch/arm64/kvm/hyp/nvhe/setup.c | 8 +-
arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +-
arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +-
arch/loongarch/Kbuild | 2 +-
arch/loongarch/include/asm/asm-prototypes.h | 20 ++
arch/loongarch/include/asm/kvm_host.h | 3 -
arch/loongarch/include/asm/linkage.h | 2 +-
arch/loongarch/kvm/Makefile | 3 +-
arch/loongarch/kvm/exit.c | 1 +
arch/loongarch/kvm/interrupt.c | 14 ++
arch/loongarch/kvm/main.c | 35 +--
arch/loongarch/kvm/mmu.c | 2 +-
arch/loongarch/kvm/switch.S | 22 +-
arch/loongarch/kvm/timer.c | 10 +-
arch/loongarch/kvm/vm.c | 2 +-
arch/loongarch/pci/acpi.c | 5 +
arch/loongarch/pci/pci.c | 3 +
arch/powerpc/kexec/Makefile | 2 +-
arch/powerpc/platforms/pseries/papr-hvpipe.c | 122 +++++----
arch/powerpc/sysdev/xive/common.c | 16 +-
arch/riscv/kvm/vcpu_vector.c | 5 +-
arch/s390/kernel/debug.c | 8 +
arch/x86/events/core.c | 13 +-
arch/x86/events/intel/core.c | 50 +++-
arch/x86/events/perf_event.h | 10 +
arch/x86/include/asm/efi.h | 3 +-
arch/x86/include/asm/msr-index.h | 3 +-
arch/x86/kernel/cpu/amd.c | 3 +
arch/x86/kernel/e820.c | 6 +-
arch/x86/kvm/hyperv.c | 2 +-
arch/x86/kvm/lapic.c | 8 +-
arch/x86/kvm/mmu/mmu.c | 35 ++-
arch/x86/mm/fault.c | 2 +-
arch/x86/platform/efi/quirks.c | 13 +-
block/blk-zoned.c | 151 +++++------
block/blk.h | 2 +
block/ioctl.c | 24 +-
drivers/accel/ivpu/ivpu_drv.c | 21 ++
drivers/acpi/arm64/cpuidle.c | 10 +-
drivers/acpi/cppc_acpi.c | 6 +-
drivers/acpi/power.c | 2 +-
drivers/acpi/scan.c | 2 +-
drivers/acpi/video_detect.c | 16 ++
drivers/android/binder/range_alloc/array.rs | 1 -
drivers/bluetooth/btmtk.c | 15 +-
drivers/bluetooth/virtio_bt.c | 39 ++-
drivers/char/ipmi/ipmi_si_intf.c | 70 ++++--
drivers/char/ipmi/ipmi_ssif.c | 23 +-
drivers/clk/clk-rk808.c | 2 +-
drivers/clk/imx/clk-imx8-acm.c | 3 +-
drivers/clk/microchip/clk-mpfs-ccc.c | 6 +-
drivers/cpuidle/cpuidle-powernv.c | 5 +-
drivers/cpuidle/cpuidle-pseries.c | 5 +-
drivers/crypto/caam/caamalg_qi2.c | 4 +-
drivers/crypto/caam/caamhash.c | 4 +-
.../crypto/intel/qat/qat_common/adf_accel_engine.c | 7 +
.../qat/qat_common/icp_qat_fw_loader_handle.h | 1 +
drivers/crypto/intel/qat/qat_common/qat_hal.c | 27 +-
drivers/extcon/extcon-ptn5150.c | 14 ++
drivers/gpio/gpiolib-of.c | 9 +-
drivers/hv/Kconfig | 2 +-
drivers/hwmon/corsair-psu.c | 4 +-
drivers/hwmon/ltc2992.c | 41 ++-
drivers/infiniband/hw/hns/hns_roce_qp.c | 7 +
drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +-
drivers/infiniband/hw/mana/cq.c | 5 +-
drivers/infiniband/hw/mana/qp.c | 16 +-
drivers/infiniband/hw/mlx4/srq.c | 4 +-
drivers/infiniband/hw/mlx5/main.c | 1 +
drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +-
drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +-
drivers/infiniband/sw/rxe/rxe_recv.c | 11 +
drivers/infiniband/sw/rxe/rxe_resp.c | 14 +-
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 +
drivers/iommu/intel/nested.c | 6 +-
drivers/iommu/iommufd/eventq.c | 5 +-
drivers/iommu/iommufd/io_pagetable.c | 10 +
drivers/md/dm-ioctl.c | 6 +-
drivers/md/dm-verity-fec.c | 113 ++++-----
drivers/md/dm-verity-fec.h | 3 +-
drivers/md/persistent-data/dm-btree-remove.c | 8 +
drivers/md/raid10.c | 2 +
drivers/mmc/core/card.h | 11 +
drivers/mmc/core/mmc.c | 12 +
drivers/mmc/core/queue.c | 9 +-
drivers/mmc/core/quirks.h | 12 +
drivers/mtd/spi-nor/debugfs.c | 4 +-
drivers/net/ethernet/ibm/ibmveth.c | 22 ++
drivers/net/ethernet/ibm/ibmveth.h | 1 +
drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 +
.../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++-
drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +-
drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/common.h | 2 +-
drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 41 +--
drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +-
drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +-
drivers/net/wireless/ath/ath5k/base.c | 3 +-
drivers/net/wireless/broadcom/b43/xmit.c | 3 +-
drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +-
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +-
drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +-
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 +
drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +-
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +-
drivers/net/wireless/rsi/rsi_common.h | 5 +-
drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 +-
drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 +-
drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +-
drivers/nvme/host/apple.c | 6 +-
drivers/nvme/target/core.c | 2 +-
drivers/nvme/target/tcp.c | 26 ++
drivers/parisc/lasi.c | 12 +-
drivers/pci/pci.c | 7 +-
drivers/pci/pcie/aer.c | 2 -
drivers/pci/pcie/aspm.c | 17 +-
drivers/pci/setup-res.c | 2 +
drivers/platform/chrome/cros_typec_altmode.c | 1 +
drivers/pmdomain/core.c | 10 +-
drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +-
drivers/power/supply/max17042_battery.c | 2 +-
drivers/remoteproc/imx_rproc.c | 2 +-
drivers/remoteproc/ti_k3_common.c | 2 +-
drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +-
drivers/spi/spi-microchip-core-qspi.c | 103 ++++++--
drivers/spi/spi-microchip-core-spi.c | 4 +-
drivers/spi/spi-rockchip.c | 4 +-
drivers/spi/spi-s3c64xx.c | 5 -
drivers/spi/spi-sun4i.c | 10 +-
drivers/spi/spi-sun6i.c | 8 +-
drivers/spi/spi-synquacer.c | 8 +-
drivers/spi/spi-tegra114.c | 8 +-
drivers/spi/spi-tegra20-sflash.c | 8 +-
drivers/spi/spi-ti-qspi.c | 14 +-
drivers/spi/spi-topcliff-pch.c | 11 +-
drivers/spi/spi-zynq-qspi.c | 15 +-
drivers/spi/spi-zynqmp-gqspi.c | 4 +-
drivers/staging/rtl8723bs/os_dep/osdep_service.c | 3 +-
drivers/staging/vme_user/vme_fake.c | 2 +
drivers/target/target_core_configfs.c | 2 +-
drivers/thermal/sprd_thermal.c | 4 +-
drivers/thermal/thermal_core.c | 6 +-
drivers/usb/class/usblp.c | 3 +-
drivers/usb/common/ulpi.c | 5 +-
drivers/usb/dwc3/core.c | 12 +-
drivers/usb/gadget/udc/omap_udc.c | 4 -
drivers/usb/serial/option.c | 4 +
drivers/usb/typec/tcpm/tcpm.c | 27 +-
drivers/video/fbdev/core/fbcon_rotate.c | 5 +-
drivers/video/fbdev/udlfb.c | 31 ++-
fs/btrfs/inode.c | 8 +
fs/btrfs/ioctl.c | 5 +-
fs/btrfs/space-info.c | 6 +-
fs/f2fs/data.c | 28 ++-
fs/f2fs/extent_cache.c | 17 +-
fs/f2fs/f2fs.h | 5 +
fs/f2fs/inline.c | 22 +-
fs/f2fs/inode.c | 2 +-
fs/f2fs/node.c | 95 +++----
fs/f2fs/super.c | 11 +
fs/f2fs/sysfs.c | 10 +-
fs/hfsplus/bfind.c | 51 ++++
fs/hfsplus/catalog.c | 4 +-
fs/hfsplus/dir.c | 2 +-
fs/hfsplus/hfsplus_fs.h | 9 +
fs/hfsplus/super.c | 6 +-
fs/isofs/export.c | 2 +-
fs/isofs/rock.c | 9 +
fs/notify/fsnotify.c | 2 +-
fs/notify/mark.c | 18 +-
fs/overlayfs/util.c | 2 +-
fs/smb/client/cached_dir.c | 8 +
fs/smb/client/cifsacl.c | 37 ++-
fs/smb/client/smb2inode.c | 12 +-
fs/smb/client/smb2misc.c | 3 +-
fs/smb/client/smb2ops.c | 11 +
fs/smb/client/smbdirect.c | 21 +-
fs/smb/server/connection.c | 48 +++-
fs/smb/server/connection.h | 1 +
fs/tracefs/event_inode.c | 14 ++
fs/tracefs/inode.c | 6 +-
fs/tracefs/internal.h | 3 +
fs/udf/misc.c | 8 +-
include/linux/fsnotify_backend.h | 1 +
include/linux/if_vlan.h | 25 +-
include/linux/mmc/card.h | 2 +
include/linux/printk.h | 13 +
include/linux/rseq.h | 2 +
include/uapi/linux/io_uring.h | 3 +-
include/uapi/linux/rseq.h | 5 +-
include/video/udlfb.h | 1 +
io_uring/kbuf.c | 8 +-
io_uring/kbuf.h | 7 +
io_uring/tw.c | 12 +-
kernel/bpf/arena.c | 19 +-
kernel/exit.c | 1 +
kernel/rseq.c | 29 ++-
kernel/sched/ext.c | 28 ++-
kernel/sched/ext_idle.c | 12 +-
kernel/trace/fprobe.c | 279 ++++++++++++---------
kernel/trace/trace_probe.c | 6 +
kernel/trace/trace_probe.h | 4 +-
kernel/tracepoint.c | 2 +
lib/crc/Kconfig | 7 +-
lib/crc/tests/crc_kunit.c | 28 ++-
lib/crypto/mpi/mpicoder.c | 2 +-
lib/scatterlist.c | 8 +-
mm/damon/lru_sort.c | 85 ++++---
mm/damon/reclaim.c | 85 ++++---
mm/damon/stat.c | 30 ++-
mm/damon/sysfs-schemes.c | 24 +-
mm/hugetlb_cma.c | 1 +
net/8021q/vlan_dev.c | 45 ++--
net/8021q/vlan_netlink.c | 10 +-
net/8021q/vlanproc.c | 12 +-
net/bluetooth/hci_conn.c | 19 +-
net/bluetooth/hci_event.c | 29 ++-
net/bluetooth/l2cap_sock.c | 9 +
net/ceph/auth.c | 2 +-
net/ceph/mon_client.c | 2 +
net/core/flow_dissector.c | 13 +-
net/core/netpoll.c | 23 +-
net/core/rtnetlink.c | 1 +
net/ipv4/ah4.c | 14 +-
net/ipv6/ah6.c | 14 +-
net/ipv6/ip6_gre.c | 5 +-
net/ipv6/xfrm6_protocol.c | 4 +-
net/mac80211/mlme.c | 9 +-
net/mac80211/rx.c | 2 +-
net/mac80211/util.c | 4 +-
net/mptcp/fastopen.c | 4 +-
net/mptcp/pm.c | 62 +++--
net/mptcp/pm_kernel.c | 14 +-
net/mptcp/protocol.c | 3 +-
net/mptcp/sockopt.c | 16 +-
net/mptcp/subflow.c | 4 +-
net/openvswitch/vport-netdev.c | 6 +-
net/psp/psp_main.c | 42 +++-
net/rds/message.c | 20 +-
net/sched/sch_red.c | 2 +-
net/unix/af_unix.c | 3 +
net/vmw_vsock/hyperv_transport.c | 33 ++-
net/xfrm/xfrm_state.c | 12 +-
net/xfrm/xfrm_user.c | 1 +
rust/kernel/drm/gem/mod.rs | 13 +-
rust/pin-init/internal/src/init.rs | 184 +++++++-------
rust/pin-init/src/__internal.rs | 28 ++-
security/selinux/hooks.c | 38 ++-
security/selinux/include/objsec.h | 4 +-
security/selinux/include/security.h | 2 -
security/selinux/selinuxfs.c | 196 +++------------
security/selinux/ss/services.c | 125 ---------
sound/core/misc.c | 8 +-
sound/core/oss/pcm_oss.c | 29 ++-
sound/core/seq/seq_clientmgr.c | 2 +-
sound/core/seq/seq_clientmgr.h | 5 +-
sound/core/seq/seq_ump_client.c | 2 +-
sound/firewire/tascam/tascam-hwdep.c | 1 +
sound/hda/codecs/realtek/alc269.c | 19 ++
sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 +-
sound/soc/amd/yc/acp6x-mach.c | 14 ++
sound/soc/codecs/es8389.c | 2 +-
sound/soc/fsl/fsl_easrc.c | 2 +-
sound/soc/intel/boards/bytcr_wm5102.c | 1 +
sound/soc/qcom/qdsp6/q6apm-dai.c | 1 +
sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +-
sound/soc/qcom/qdsp6/q6apm.c | 3 +
sound/soc/sof/compress.c | 3 +
sound/usb/midi2.c | 9 +-
sound/usb/misc/ua101.c | 7 +
sound/usb/stream.c | 4 +-
tools/arch/x86/include/asm/msr-index.h | 3 +-
tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +-
tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 +-
tools/testing/selftests/rseq/Makefile | 21 +-
tools/testing/selftests/rseq/check_optimized.c | 17 ++
tools/testing/selftests/rseq/legacy_check.c | 65 +++++
tools/testing/selftests/rseq/param_test.c | 25 +-
tools/testing/selftests/rseq/rseq-abi.h | 7 +-
tools/testing/selftests/rseq/rseq.c | 39 ++-
tools/testing/selftests/rseq/rseq.h | 8 +-
tools/testing/selftests/rseq/run_legacy_check.sh | 4 +
tools/testing/selftests/rseq/run_param_test.sh | 39 +++
tools/testing/selftests/rseq/run_timeslice_test.sh | 14 ++
tools/testing/selftests/rseq/slice_test.c | 12 +-
294 files changed, 3041 insertions(+), 1615 deletions(-)Greg Kroah-Hartman
maintainerPATCH 1/307 scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 772a896a56e0e3ef9424a025cec9176f9d8f4552 upstream.
target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() cur_len bytes from that buffer. snprintf() returns the length the output would have had, which can exceed the buffer size when the fabric WWN is long because iSCSI IQN names can be up to 223 bytes. The check at the memcpy() site only guards the destination page write, not the source read, so memcpy() will read past the stack buffer and copy adjacent stack contents to the sysfs reader, which when CONFIG_FORTIFY_SOURCE is enabled, fortify_panic() will be triggered.
Commit 27e06650a5ea ("scsi: target: target_core_configfs: Add length check to avoid buffer overflow") added the same bound to the target_lu_gp_members_show() but the tg_pt_gp variant was missed so resolve that here.
--- drivers/target/target_core_configfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/target/target_core_configfs.c +1 -1
@@ -3227,7 +3227,7 @@ static ssize_t target_tg_pt_gp_members_s config_item_name(&lun->lun_group.cg_item)); cur_len++;/* Extra byte for NULL terminator */ -if ((cur_len + len) >PAGE_SIZE ) { +if (cur_len >TG_PT_GROUP_NAME_BUF || (cur_len + len) >PAGE_SIZE ) {pr_warn ("Ran out of lu_gp_show_attr" "_members buffer\n" );break ;
Greg Kroah-Hartman
maintainerPATCH 2/307 ipmi: Add limits to event and receive message requests
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corey Minyard <[email protected]>
commit c4cca236968683eb0d59abfb12d5c7e4d8514227 upstream.
The driver would just fetch events and receive messages until the BMC said it was done. To avoid issues with BMCs that never say they are done, add a limit of 10 fetches at a time.
In addition, an si interface has an attn state it can return from the hardware which is supposed to cause a flag fetch to see if the driver needs to fetch events or message or a few other things. If the attn bit gets stuck, it's a similar problem. So allow messages in between flag fetches so the driver itself doesn't get stuck.
This is a more general fix than the previous fix for the specific bad BMC, but should fix the more general issue of a BMC that won't stop saying it has data.
This has been there from the beginning of the driver. It's not a bug per-se, but it is accounting for bugs in BMCs.
--- drivers/char/ipmi/ipmi_si_intf.c | 54 +++++++++++++++++++++++++++++++-------- drivers/char/ipmi/ipmi_ssif.c | 23 +++++++++++++++- 2 files changed, 64 insertions(+), 13 deletions(-)
drivers/char/ipmi/ipmi_si_intf.c +43 -11
@@ -168,6 +168,10 @@ struct smi_info { OEM2_DATA_AVAIL) unsigned char msg_flags; +/* When requesting events and messages, don't do it forever. */ +unsigned int num_requests_in_a_row; +bool last_was_flag_fetch; +/* Does the BMC have an event buffer? */ bool has_event_buffer;
@@ -410,7 +414,10 @@ static void start_getting_msg_queue(strustart_new_msg (smi_info, smi_info->curr_msg->data, smi_info->curr_msg->data_size); - smi_info->si_state =SI_GETTING_MESSAGES ; +if (smi_info->si_state !=SI_GETTING_MESSAGES ) { + smi_info->num_requests_in_a_row =0 ; + smi_info->si_state =SI_GETTING_MESSAGES ; + } }static void start_getting_events (struct smi_info *smi_info)
@@ -421,7 +428,10 @@ static void start_getting_events(structstart_new_msg (smi_info, smi_info->curr_msg->data, smi_info->curr_msg->data_size); - smi_info->si_state =SI_GETTING_EVENTS ; +if (smi_info->si_state !=SI_GETTING_EVENTS ) { + smi_info->num_requests_in_a_row =0 ; + smi_info->si_state =SI_GETTING_EVENTS ; + } }/*
@@ -595,6 +605,7 @@ static void handle_transaction_done(stru smi_info->si_state =SI_NORMAL ; }else { smi_info->msg_flags = msg[3 ]; + smi_info->last_was_flag_fetch = true;handle_flags (smi_info); }break ;
@@ -640,6 +651,11 @@ static void handle_transaction_done(stru }else {smi_inc_stat (smi_info, events); + smi_info->num_requests_in_a_row++; +if (smi_info->num_requests_in_a_row >10 ) +/* Stop if we do this too many times. */ + smi_info->msg_flags &= ~EVENT_MSG_BUFFER_FULL ; +/* * Do this before we deliver the message * because delivering the message releases the
@@ -678,6 +694,11 @@ static void handle_transaction_done(stru }else {smi_inc_stat (smi_info, incoming_messages); + smi_info->num_requests_in_a_row++; +if (smi_info->num_requests_in_a_row >10 ) +/* Stop if we do this too many times. */ + smi_info->msg_flags &= ~RECEIVE_MSG_AVAIL ; +/* * Do this before we deliver the message * because delivering the message releases the
@@ -820,6 +841,26 @@ restart: }/* +* If we are currently idle, or if the last thing that was +* done was a flag fetch and there is a message pending, try +* to start the next message. +* +* We do the waiting message check to avoid a stuck flag +* completely wedging the driver. Let a message through +* in between flag operations if that happens. +*/ +if (si_sm_result ==SI_SM_IDLE || + (si_sm_result ==SI_SM_ATTN && smi_info->waiting_msg && + smi_info->last_was_flag_fetch)) { + smi_info->last_was_flag_fetch = false; +smi_inc_stat (smi_info, idles); + + si_sm_result =start_next_msg (smi_info); +if (si_sm_result !=SI_SM_IDLE ) + goto restart; + } + +/* * We prefer handling attn over new messages. But don't do * this if there is not yet an upper layer to handle anything. */
@@ -846,15 +887,6 @@ restart: } } -/* If we are currently idle, try to start the next message. */ -if (si_sm_result ==SI_SM_IDLE ) { -smi_inc_stat (smi_info, idles); - - si_sm_result =start_next_msg (smi_info); -if (si_sm_result !=SI_SM_IDLE ) - goto restart; - } -if ((si_sm_result ==SI_SM_IDLE ) && (atomic_read (&smi_info->req_events))) {/*
drivers/char/ipmi/ipmi_ssif.c +21 -2
@@ -225,6 +225,9 @@ struct ssif_info {bool has_event_buffer;bool supports_alert; +/* When requesting events and messages, don't do it forever. */ +unsigned int num_requests_in_a_row; +/* * Used to tell what we should do with alerts. If we are * waiting on a response, read the data immediately.
@@ -413,7 +416,10 @@ static void start_event_fetch(struct ssi } ssif_info->curr_msg = msg; - ssif_info->ssif_state =SSIF_GETTING_EVENTS ; +if (ssif_info->ssif_state !=SSIF_GETTING_EVENTS ) { + ssif_info->num_requests_in_a_row =0 ; + ssif_info->ssif_state =SSIF_GETTING_EVENTS ; + }ipmi_ssif_unlock_cond (ssif_info, flags); msg->data[0 ] = (IPMI_NETFN_APP_REQUEST <<2 );
@@ -436,7 +442,10 @@ static void start_recv_msg_fetch(struct } ssif_info->curr_msg = msg; - ssif_info->ssif_state =SSIF_GETTING_MESSAGES ; +if (ssif_info->ssif_state !=SSIF_GETTING_MESSAGES ) { + ssif_info->num_requests_in_a_row =0 ; + ssif_info->ssif_state =SSIF_GETTING_MESSAGES ; + }ipmi_ssif_unlock_cond (ssif_info, flags); msg->data[0 ] = (IPMI_NETFN_APP_REQUEST <<2 );
@@ -843,6 +852,11 @@ static void msg_done_handler(struct ssif ssif_info->msg_flags &= ~EVENT_MSG_BUFFER_FULL ;handle_flags (ssif_info, flags); }else { + ssif_info->num_requests_in_a_row++; +if (ssif_info->num_requests_in_a_row >10 ) +/* Stop if we do this too many times. */ + ssif_info->msg_flags &= ~EVENT_MSG_BUFFER_FULL ; +handle_flags (ssif_info, flags);ssif_inc_stat (ssif_info, events);deliver_recv_msg (ssif_info, msg);
@@ -876,6 +890,11 @@ static void msg_done_handler(struct ssif ssif_info->msg_flags &= ~RECEIVE_MSG_AVAIL ;handle_flags (ssif_info, flags); }else { + ssif_info->num_requests_in_a_row++; +if (ssif_info->num_requests_in_a_row >10 ) +/* Stop if we do this too many times. */ + ssif_info->msg_flags &= ~RECEIVE_MSG_AVAIL ; +ssif_inc_stat (ssif_info, incoming_messages);handle_flags (ssif_info, flags);deliver_recv_msg (ssif_info, msg);
Greg Kroah-Hartman
maintainerPATCH 3/307 ipmi: Check event message buffer response for bad data
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corey Minyard <[email protected]>
commit 36920f30e78e69df01f9691c470b6f3ba8aebf98 upstream.
The event message buffer response data size got checked later when processing, but check it right after the response comes back. It appears some BMCs may return an empty message instead of an error when fetching events.
There are apparently some new BMCs that make this error, so we need to compensate.
--- drivers/char/ipmi/ipmi_si_intf.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/char/ipmi/ipmi_si_intf.c +7 -1
@@ -641,7 +641,13 @@ static void handle_transaction_done(stru*/ msg = smi_info->curr_msg; smi_info->curr_msg =NULL ; -if (msg->rsp[2 ] !=0 ) { +/* +* It appears some BMCs, with no event data, return no +* data in the message and not a 0x80 error as the +* spec says they should. Shut down processing if +* the data is not the right length. +*/ +if (msg->rsp[2 ] !=0 || msg->rsp_size !=19 ) {/* Error getting event, probably done. */ msg->done (msg);
Greg Kroah-Hartman
maintainerPATCH 4/307 ipmi:si: Return state to normal if message allocation fails
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corey Minyard <[email protected]>
commit 09dd798270ff582d7309f285d4aaf5dbebae01cb upstream.
There were places where nothing would get started if a message allocation failed, so the driver needs to return to normal state.
--- drivers/char/ipmi/ipmi_si_intf.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/char/ipmi/ipmi_si_intf.c +6 -2
@@ -497,15 +497,19 @@ retry: }else if (smi_info->msg_flags &RECEIVE_MSG_AVAIL ) {/* Messages available. */ smi_info->curr_msg =alloc_msg_handle_irq (smi_info); -if (!smi_info->curr_msg) +if (!smi_info->curr_msg) { + smi_info->si_state =SI_NORMAL ;return ; + }start_getting_msg_queue (smi_info); }else if (smi_info->msg_flags &EVENT_MSG_BUFFER_FULL ) {/* Events available. */ smi_info->curr_msg =alloc_msg_handle_irq (smi_info); -if (!smi_info->curr_msg) +if (!smi_info->curr_msg) { + smi_info->si_state =SI_NORMAL ;return ; + }start_getting_events (smi_info); } else if (smi_info->msg_flags & OEM_DATA_AVAIL &&
Greg Kroah-Hartman
maintainerPATCH 5/307 fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajat Gupta <[email protected]>
commit 8de779dc40d35d39fa07387b6f921eb11df0f511 upstream.
dlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages to userspace but sets no vm_ops on the VMA. This means the kernel cannot track active mmaps. When dlfb_realloc_framebuffer() replaces the backing buffer via FBIOPUT_VSCREENINFO, existing mmap PTEs are not invalidated. On USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages while userspace PTEs still reference them, resulting in a use-after-free:
the process retains read/write access to freed kernel pages.
Add vm_operations_struct with open/close callbacks that maintain an atomic mmap_count on struct dlfb_data. In dlfb_realloc_framebuffer(), check mmap_count and return -EBUSY if the buffer is currently mapped, preventing buffer replacement while userspace holds stale PTEs.
Tested with PoC using dummy_hcd + raw_gadget USB device emulation.
--- drivers/video/fbdev/udlfb.c | 31 ++++++++++++++++++++++++++++++- include/video/udlfb.h | 1 + 2 files changed, 31 insertions(+), 1 deletion(-)
drivers/video/fbdev/udlfb.c +30 -1
@@ -321,12 +321,32 @@ static int dlfb_set_video_mode(struct dlreturn retval; } +static void dlfb_vm_open (struct vm_area_struct *vma) +{ +struct dlfb_data *dlfb = vma->vm_private_data; + +atomic_inc (&dlfb->mmap_count); +} + +static void dlfb_vm_close (struct vm_area_struct *vma) +{ +struct dlfb_data *dlfb = vma->vm_private_data; + +atomic_dec (&dlfb->mmap_count); +} + +static const struct vm_operations_struct dlfb_vm_ops = { + .open = dlfb_vm_open, + .close = dlfb_vm_close, +}; +static int dlfb_ops_mmap (struct fb_info *info,struct vm_area_struct *vma) {unsigned long start = vma->vm_start;unsigned long size = vma->vm_end - vma->vm_start;unsigned long offset = vma->vm_pgoff <<PAGE_SHIFT ;unsigned long page, pos; +struct dlfb_data *dlfb = info->par;if (info->fbdefio)return fb_deferred_io_mmap (info, vma);
@@ -358,6 +378,9 @@ static int dlfb_ops_mmap(struct fb_info size =0 ; } + vma->vm_ops = &dlfb_vm_ops; + vma->vm_private_data = dlfb; +atomic_inc (&dlfb->mmap_count);return 0 ; }
@@ -1176,7 +1199,6 @@ static void dlfb_deferred_vfree(struct d/* * Assumes &info->lock held by caller -* Assumes no active clients have framebuffer open */ static int dlfb_realloc_framebuffer (struct dlfb_data *dlfb,struct fb_info *info,u32 new_len) {
@@ -1188,6 +1210,13 @@ static int dlfb_realloc_framebuffer(stru new_len =PAGE_ALIGN (new_len);if (new_len > old_len) { +if (atomic_read (&dlfb->mmap_count) >0 ) { +dev_warn (info->dev, +"refusing realloc: %d active mmaps\n" , +atomic_read (&dlfb->mmap_count)); +return -EBUSY ; + } +/* * Alloc system memory for virtual framebuffer */
include/video/udlfb.h +1 -0
@@ -56,6 +56,7 @@ struct dlfb_data {spinlock_t damage_lock;struct work_struct damage_work;struct fb_ops ops; +atomic_t mmap_count;/* blit-only rendering path metrics, exposed through sysfs */ atomic_t bytes_rendered;/* raw pixel-bytes driver asked to render */ atomic_t bytes_identical;/* saved effort with backbuffer comparison */
Greg Kroah-Hartman
maintainerPATCH 6/307 ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
commit 3ea4415015d690a51a3fb1f98dfc9a02f88f7bc4 upstream.
Commit cac173bea57d ("ACPI: processor: idle: Rework the handling of acpi_processor_ffh_lpi_probe()") moved the acpi_processor_ffh_lpi_probe() call from acpi_processor_setup_cpuidle_dev(), where its return value was ignored, to acpi_processor_get_power_info(), where it is now treated as a hard failure. As a result, platforms where psci_acpi_cpu_init_idle() returned -ENODEV stopped registering any cpuidle states, forcing CPUs to busy-poll when idle.
On NVIDIA Grace (aarch64) systems with PSCIv1.1, pr->power.count is 1 (only WFI, no deep PSCI states beyond it), so the previous "count = pr->power.count - 1; if (count <= 0) return -ENODEV;" check returned -ENODEV for all 72 CPUs and disabled cpuidle entirely.
The lpi_states count is already validated in acpi_processor_get_lpi_info(), so the check here is redundant. Simplify the loop to iterate over lpi_states[1..power.count). When only WFI is present, the loop body simply does not execute and the function returns 0, which is the correct
outcome: there is nothing to validate for FFH and no error to report.
--- drivers/acpi/arm64/cpuidle.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
drivers/acpi/arm64/cpuidle.c +3 -7
@@ -16,7 +16,7 @@static int psci_acpi_cpu_init_idle (unsigned int cpu) { -int i, count; +int i;struct acpi_lpi_state *lpi;struct acpi_processor *pr =per_cpu (processors, cpu);
@@ -30,14 +30,10 @@ static int psci_acpi_cpu_init_idle(unsigned int cpu)if (!psci_ops.cpu_suspend)return -EOPNOTSUPP ; - count = pr->power.count -1 ; -if (count <=0 ) -return -ENODEV ; - -for (i =0 ; i < count; i++) { +for (i =1 ; i < pr->power.count; i++) {u32 state; - lpi = &pr->power.lpi_states[i +1 ]; + lpi = &pr->power.lpi_states[i];/* * Only bits[31:0] represent a PSCI power_state while * bits[63:32] must be 0x0 as per ARM ACPI FFH Specification
Signature · 1 line
2.54.0
Greg Kroah-Hartman
maintainerPATCH 7/307 ACPI: scan: Use acpi_dev_put() in object add error paths
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <[email protected]>
commit 9c0acc169ac71535477caedea8315f7041c5f07c upstream.
After acpi_init_device_object(), the lifetime of struct acpi_device is managed by the driver core through reference counting.
Both acpi_add_power_resource() and acpi_add_single_object() call acpi_init_device_object() and then invoke acpi_device_add(). If that fails, their error paths call the release callback directly instead of dropping the device reference through acpi_dev_put().
This bypasses the normal device lifetime rules and frees the object without releasing the reference acquired by device_initialize(), which may lead to a refcount leak.
The issue was identified by a static analysis tool I developed and confirmed by manual review.
Fix both error paths by using acpi_dev_put() and let the release callback handle the final cleanup.
--- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/acpi/power.c +1 -1
@@ -991,7 +991,7 @@ struct acpi_device *acpi_add_power_resoureturn device; err: -acpi_release_power_resource (&device->dev); +acpi_dev_put (device);return NULL ; }
drivers/acpi/scan.c +1 -1
@@ -1900,7 +1900,7 @@ static int acpi_add_single_object(struct result =acpi_device_add (device);if (result) { -acpi_device_release (&device->dev); +acpi_dev_put (device);return result; }
Greg Kroah-Hartman
maintainerPATCH 8/307 ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Schär <[email protected]>
commit ad7997f5a01af6f711fe6b6a2df578b964109d49 upstream.
The Dell OptiPlex 7770 AIO needs the same quirk as the 7760 AIO. The backlight can be controlled with the native controller, intel_backlight, but not with dell_uart_backlight.
I dumped the DSDT using acpidump, acpixtract and iasl, and confirmed that it contains the DELL0501 device. When loading the dell_uart_backlight driver with rmmod dell_uart_backlight, modprobe dell_uart_backlight dyndbg, it reports "Firmware version: GL_Re_V18".
--- drivers/acpi/video_detect.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/video_detect.c +8 -0
@@ -878,6 +878,14 @@ static const struct dmi_system_id video_ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7760 AIO"), }, }, + { + .callback = video_detect_force_native, + /* Dell OptiPlex 7770 AIO */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7770 AIO"), + }, + },/* * Models which have nvidia-ec-wmi support, but should not use it.
Greg Kroah-Hartman
maintainerPATCH 9/307 ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 75141a770f4f8225d316f6c7e146723a32e9720e upstream.
When concurrently bringing up and down two SMT threads of a physical core, many warning call traces occur as below:
The issue timeline is as follows:
1. When the system starts,
cpufreq: CPU: 220, policy->related_cpus: 220-221, policy->cpus: 220-221
2. Offline CPU 220 and CPU 221.
3. Online CPU 220
- CPU 221 is now offline, as acpi_get_psd_map() use
for_each_online_cpu(), so the cpu_data->shared_cpu_map,
policy->cpus, and related_cpus has only CPU 220.
cpufreq: CPU: 220, policy->related_cpus: 220, policy->cpus: 2204. Offline CPU 220
5. Online CPU 221, the below call trace occurs:
- Since CPU 220 and CPU 221 share one policy, and policy->related_cpus = 220 after step 3, so CPU 221 is not in policy->related_cpus but per_cpu(cpufreq_cpu_data, cpu221) is not NULL.
After reverting commit 56eb0c0ed345 ("ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs"), the issue disappeared.
The _PSD (P-State Dependency) defines the hardware-level dependency of frequency control across CPU cores. Since this relationship is a physical attribute of the hardware topology, it remains constant regardless of the online or offline status of the CPUs.
Using for_each_online_cpu() in acpi_get_psd_map() is problematic. If a CPU is offline, it will be excluded from the shared_cpu_map. Consequently, if that CPU is brought online later, the kernel will fail to recognize it as part of any shared frequency domain.
Switch back to for_each_possible_cpu() to ensure that all cores defined in the ACPI tables are correctly mapped into their respective performance domains from the start. This aligns with the logic of policy->related_cpus, which must encompass all potentially available cores in the domain to prevent logic gaps during CPU hotplug operations.
To resolve the original issue regarding the "nosmt" or "nosmt=force" boot parameter, as send_pcc_cmd() function already does if (!desc) continue, so reverting that loop back to for_each_possible_cpu() is ok, only need to change the match_cpc_ptr NULL case in acpi_get_psd_map() to continue as Sean suggested.
How to reproduce, on arm64 machine with SMT support which use acpi cppc cpufreq driver:
bash test.sh 220 & bash test.sh 221 &
The test.sh is as below:
while true
do
echo 0 > /sys/devices/system/cpu/cpu${1}/online
sleep 0.5
cat /sys/devices/system/cpu/cpu${1}/cpufreq/related_cpus
echo 1 > /sys/devices/system/cpu/cpu${1}/online
cat /sys/devices/system/cpu/cpu${1}/cpufreq/related_cpus
done
CPU: 221 PID: 1119 Comm: cpuhp/221 Kdump: loaded Not tainted 6.6.0debug+ #5
Hardware name: To be filled by O.E.M. S920X20/BC83AMDA01-7270Z, BIOS 20.39 09/04/2024
pstate: a1400009 (NzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : cpufreq_online+0x8ac/0xa90
lr : cpuhp_cpufreq_online+0x18/0x30
sp : ffff80008739bce0
x29: ffff80008739bce0 x28: 0000000000000000 x27: ffff28400ca32200
x26: 0000000000000000 x25: 0000000000000003 x24: ffffd483503ff000
x23: ffffd483504051a0 x22: ffffd48350024a00 x21: 00000000000000dd
x20: 000000000000001d x19: ffff28400ca32000 x18: 0000000000000000
x17: 0000000000000020 x16: ffffd4834e6a3fc8 x15: 0000000000000020
x14: 0000000000000008 x13: 0000000000000001 x12: 00000000ffffffff
x11: 0000000000000040 x10: ffffd48350430728 x9 : ffffd4834f087c78
x8 : 0000000000000001 x7 : ffff2840092bdf00 x6 : ffffd483504264f0
x5 : ffffd48350405000 x4 : ffff283f7f95cc60 x3 : 0000000000000000
x2 : ffff53bc2f94b000 x1 : 00000000000000dd x0 : 0000000000000000
Call trace:
cpufreq_online+0x8ac/0xa90
cpuhp_cpufreq_online+0x18/0x30
cpuhp_invoke_callback+0x128/0x580
cpuhp_thread_fun+0x110/0x1b0
smpboot_thread_fn+0x140/0x190
kthread+0xec/0x100
ret_from_fork+0x10/0x20
---[ end trace 0000000000000000 ]------ drivers/acpi/cppc_acpi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/acpi/cppc_acpi.c +3 -3
@@ -362,7 +362,7 @@ static int send_pcc_cmd(int pcc_ss_id, u end:if (cmd ==CMD_WRITE ) {if (unlikely (ret)) { -for_each_online_cpu (i) { +for_each_possible_cpu (i) {struct cpc_desc *desc =per_cpu (cpc_desc_ptr, i);if (!desc)
@@ -524,13 +524,13 @@ int acpi_get_psd_map(unsigned int cpu, selse if (pdomain->coord_type ==DOMAIN_COORD_TYPE_SW_ANY ) cpu_data->shared_type =CPUFREQ_SHARED_TYPE_ANY ; -for_each_online_cpu (i) { +for_each_possible_cpu (i) {if (i == cpu)continue ; match_cpc_ptr =per_cpu (cpc_desc_ptr, i);if (!match_cpc_ptr) - goto err_fault; +continue ; match_pdomain = &(match_cpc_ptr->domain_info);if (match_pdomain->domain != pdomain->domain)
Greg Kroah-Hartman
maintainerPATCH 10/307 ACPI: video: force native backlight on HP OMEN 16 (8A44)
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shivam Kalra <[email protected]>
commit 4b506ea5351a1f5937ac632a4a5c35f6f796cc41 upstream.
The HP OMEN 16 Gaming Laptop (board name 8A44) has a mux-less hybrid GPU configuration with AMD Rembrandt (Radeon 680M) and NVIDIA GA104 (RTX 3070 Ti). The internal eDP panel is wired to the AMD iGPU.
When Nouveau loads without GSP firmware, the ACPI video backlight device (acpi_video0) gets registered alongside the native AMD backlight (amdgpu_bl2). In this state, writes to amdgpu_bl2 update the software brightness value but fail to change the physical panel brightness.
Force native backlight to prevent acpi_video0 from registering. Confirmed that booting with acpi_backlight=native resolves the issue.
--- drivers/acpi/video_detect.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/video_detect.c +8 -0
@@ -907,6 +907,14 @@ static const struct dmi_system_id video_ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 15 3535"), }, }, + { + .callback = video_detect_force_native, + /* HP OMEN Gaming Laptop 16-n0xxx */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "HP"), + DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16-n0xxx"), + }, + },/* * x86 android tablets which directly control the backlight through
Greg Kroah-Hartman
maintainerPATCH 11/307 tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <[email protected]>
commit fad217e16fded7f3c09f8637b0f6a224d58b5f2e upstream.
When a tracepoint goes through the 0 -> 1 transition, tracepoint_add_func() invokes the subsystem's ext->regfunc() before attempting to install the new probe via func_add(). If func_add() then fails (for example, when allocate_probes() cannot allocate a new probe array under memory pressure and returns -ENOMEM), the function returns the error without calling the matching ext->unregfunc(), leaving the side effects of regfunc() behind with no installed probe to justify them.
For syscall tracepoints this is particularly unpleasant: syscall_regfunc() bumps sys_tracepoint_refcount and sets SYSCALL_TRACEPOINT on every task. After a leaked failure, the refcount is stuck at a non-zero value with no consumer, and every task continues paying the syscall trace entry/exit overhead until reboot. Other subsystems providing regfunc()/unregfunc() pairs exhibit similarly scoped persistent state.
Mirror the existing 1 -> 0 cleanup and call ext->unregfunc() in the func_add() error path, gated on the same condition used there so the unwind is symmetric with the registration.
--- kernel/tracepoint.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/tracepoint.c +2 -0
@@ -300,6 +300,8 @@ static int tracepoint_add_func(struct tr lockdep_is_held(&tracepoints_mutex)); old =func_add (&tp_funcs, func, prio);if (IS_ERR (old)) { +if (tp->ext && tp->ext->unregfunc && !static_key_enabled (&tp->key)) + tp->ext->unregfunc ();WARN_ON_ONCE (warn &&PTR_ERR (old) != -ENOMEM );return PTR_ERR (old); }
Greg Kroah-Hartman
maintainerPATCH 12/307 iommufd: Fix a race with concurrent allocation and unmap
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sina Hassani <[email protected]>
commit 8602018b1f17fbdaa5e5d79f4c8603ad20640c12 upstream.
iopt_unmap_iova_range() releases the lock on iova_rwsem inside the loop body when getting to the more expensive unmap operations. This is fine on its own, except the loop condition is based on the first area that matches the unmap address range. If a concurrent call to map picks an area that was unmapped in previous iterations, the loop mistakenly tries to unmap it.
This is reproducible by having one userspace thread map buffers and pass them to another thread that unmaps them. The problem manifests as EBUSY errors with single page mappings.
Fix this by advancing the start pointer after unmapping an area. This ensures each iteration only examines the IOVA range that remains mapped, which is guaranteed not to have overlaps.
--- drivers/iommu/iommufd/io_pagetable.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/iommu/iommufd/io_pagetable.c +10 -0
@@ -814,6 +814,16 @@ again: unmapped_bytes += area_last - area_first +1 ;down_write (&iopt->iova_rwsem); + +/* +* After releasing the iova_rwsem concurrent allocation could +* place new areas at IOVAs we have already unmapped. Keep +* moving the start of the search forward to ignore the area +* already unmapped. +*/ +if (area_last >= last) +break ; + start = area_last +1 ; } out_unlock_iova:
Greg Kroah-Hartman
maintainerPATCH 13/307 ASoC: SOF: Dont allow pointer operations on unconfigured streams
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
commit c5b6285aae050ff1c3ea824ca3d88ac4be1e69c8 upstream.
When reporting the pointer for a compressed stream we report the current I/O frame position by dividing the position by the number of channels multiplied by the number of container bytes. These values default to 0 and are only configured as part of setting the stream parameters so this allows a divide by zero to be configured. Validate that they are non zero, returning an error if not
--- sound/soc/sof/compress.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/sof/compress.c +3 -0
@@ -379,6 +379,9 @@ static int sof_compr_pointer(struct snd_if (!spcm)return -EINVAL ; +if (!sstream->channels || !sstream->sample_container_bytes) +return -EBUSY ; + tstamp->sampling_rate = sstream->sampling_rate; tstamp->copied_total = sstream->copied_total; tstamp->pcm_io_frames = div_u64(spcm->stream[cstream->direction].posn.dai_posn,
Greg Kroah-Hartman
maintainerPATCH 14/307 wifi: mt76: mt7925: fix incorrect TLV length in CLC command
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quan Zhou <[email protected]>
commit 62e037aa8cf5a69b7ea63336705a35c897b9db2b upstream.
The previous implementation of __mt7925_mcu_set_clc() set the TLV length field (.len) incorrectly during CLC command construction. The length was initialized as sizeof(req) - 4, regardless of the actual segment length. This could cause the WiFi firmware to misinterpret the command payload, resulting in command execution errors.
This patch moves the TLV length assignment to after the segment is selected, and sets .len to sizeof(req) + seg->len - 4, matching the actual command content. This ensures the firmware receives the correct TLV length and parses the command properly.
--- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +1 -1
@@ -3375,7 +3375,6 @@ __mt7925_mcu_set_clc(struct mt792x_dev *u8 rsvd[64 ]; }__packed req = { .tag =cpu_to_le16 (0x3 ), - .len =cpu_to_le16 (sizeof (req) -4 ), .idx = idx, .env = env_cap,
@@ -3404,6 +3403,7 @@ __mt7925_mcu_set_clc(struct mt792x_dev *memcpy (req.type, rule->type,2 ); req.size =cpu_to_le16 (seg->len); + req.len =cpu_to_le16 (sizeof (req) + seg->len -4 ); dev->phy.clc_chan_conf = clc->ver ==1 ?0xff : rule->flag; skb = __mt76_mcu_msg_alloc(&dev->mt76, &req, le16_to_cpu(req.size) + sizeof(req),
Greg Kroah-Hartman
maintainerPATCH 15/307 spi: rockchip: fix controller deregistration
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 53e7a16070feb7d1d4d81a583eaac5e25048b9c3 upstream.
Make sure to deregister the controller before freeing underlying resources like DMA channels during driver unbind.
--- drivers/spi/spi-rockchip.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/spi/spi-rockchip.c +3 -1
@@ -908,7 +908,7 @@ static int rockchip_spi_probe(struct plabreak ; } - ret =devm_spi_register_controller (&pdev->dev, ctlr); + ret =spi_register_controller (ctlr);if (ret <0 ) {dev_err (&pdev->dev,"Failed to register controller\n" ); goto err_free_dma_rx;
@@ -936,6 +936,8 @@ static void rockchip_spi_remove(struct ppm_runtime_get_sync (&pdev->dev); +spi_unregister_controller (ctlr); +pm_runtime_put_noidle (&pdev->dev);pm_runtime_disable (&pdev->dev);pm_runtime_set_suspended (&pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 16/307 ksmbd: rewrite stop_sessions() with restartable iteration
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: DaeMyung Kang <[email protected]>
commit c444139cb747bf6de1922b39900fdf02281490f4 upstream.
stop_sessions() walks conn_list with hash_for_each() and, for every entry, drops conn_list_lock across the transport ->shutdown() call before re-acquiring the read lock to continue the loop. The hash walk relies on cross-iteration state (the current bucket and the hlist position), which is not preserved across unlock/relock: if another thread performs a list mutation during the unlocked window, the ongoing iteration becomes unreliable and can re-visit connections that have already been handled or skip connections that have not. The outer if (!hash_empty(conn_list)) goto again; retry masks the symptom in the common case but does not address the unsafe iteration itself.
Reframe the loop so it never relies on iterator state across unlock/relock. Under conn_list_lock held for read, pick the first connection whose ->shutdown() has not yet been issued by this path, pin it by taking an extra reference, record that fact on the connection and mark it EXITING while still inside the locked walk, then drop the lock. Then call ->shutdown() outside the lock, drop the pin (freeing the connection if the handler already released its reference), and restart from the top.
Use a new per-connection flag, conn->stop_called, as the "shutdown issued from stop_sessions()" marker rather than reusing the status state. ksmbd_conn_set_exiting() is also invoked by ksmbd_sessions_deregister() on sibling channels of a multichannel session without issuing a transport shutdown, so treating KSMBD_SESS_EXITING as "already handled here" would skip connections that still need shutdown() to wake their handler out of recv(), leaving the outer retry waiting indefinitely for the hash to drain. stop_sessions() is serialised by init_lock in ksmbd_conn_transport_destroy(), so writing stop_called under the read lock has no other writer.
Set EXITING inside the locked walk so the selection, the stop_called marker, and the status transition all happen together, and guard against regressing a connection that has already advanced to KSMBD_SESS_RELEASING on its own (for example, if the handler exited its receive loop for an unrelated reason between teardown steps).
When the pin drop is the last put, release the transport and pair ida_destroy(&target->async_ida) with the ida_init() done in ksmbd_conn_alloc(), so stop_sessions() retiring a connection on its own does not leak the xarray backing of the embedded async_ida.
The outer retry with msleep() is kept to wait for handler threads to reach ksmbd_conn_free() and drain the hash.
Observed with an instrumented build that logs one line per visit and widens the unlocked window before ->shutdown() by 200 ms, under five concurrent cifs mounts (nosharesock, one connection each):
* Current code: the same connection address is revisited many times during a single stop_sessions() call and ->shutdown() is invoked well beyond the number of live connections before the hash finally drains.
* Rewritten code: each live connection produces exactly one
->shutdown() call; the function returns as soon as the hash is
empty.Functional teardown via ksmbd.control --shutdown with the same five mounts completes cleanly on the rewritten path.
Performance is observably unchanged. Tearing down N concurrent nosharesock cifs connections with ksmbd.control --shutdown + rmmod ksmbd takes essentially the same wall time before and after the rewrite:
N before after
10 4.93s 5.34s
30 7.34s 7.03s
50 7.31s 7.01s (3-run avg: 7.04s vs 7.25s)
100 6.98s 6.78s
200 6.77s 6.89sand the number of ->shutdown() calls equals the number of live connections on both paths when the race is not widened. The teardown is dominated by the msleep(100)-based outer retry waiting for handler threads to run ksmbd_conn_free(), not by the iteration itself; the restartable loop's worst-case O(N^2) visit cost is in the microseconds even at N=200 and sits far below the msleep(100) granularity.
Applied alone on top of ksmbd-for-next-next, this patch does not introduce a new leak site. Under the same reproducer (10x concurrent-holders + ss -K + ksmbd.control --shutdown + rmmod), the tree still shows the pre-existing per-connection transport leak count that arises when the last refcount drop lands in one of ksmbd_conn_r_count_dec(), __free_opinfo() or session_fd_check() - all of which end with a bare kfree() today. kmemleak backtraces for the unreferenced objects point into the TCP accept path (sk_clone -> inet_csk_clone_lock, sock_alloc_inode) and none involve stop_sessions(). Plugging those bare-kfree sites is the responsibility of the follow-up patch.
--- fs/smb/server/connection.c | 46 +++++++++++++++++++++++++++++++++++++-------- fs/smb/server/connection.h | 1 2 files changed, 39 insertions(+), 8 deletions(-)
fs/smb/server/connection.c +38 -8
@@ -535,24 +535,54 @@ out:static void stop_sessions (void ) { -struct ksmbd_conn *conn; +struct ksmbd_conn *conn, *target;struct ksmbd_transport *t; +bool any;int bkt; +/* +* Serialised via init_lock; no concurrent stop_sessions() can +* touch conn->stop_called, so writing it under the read lock is +* safe. +*/ again: + target =NULL ; + any = false;down_read (&conn_list_lock);hash_for_each (conn_list, bkt, conn, hlist) { - t = conn->transport; -ksmbd_conn_set_exiting (conn); -if (t->ops->shutdown) { -up_read (&conn_list_lock); + any = true; +if (conn->stop_called) +continue ; +atomic_inc (&conn->refcnt); + conn->stop_called = true; +/* +* Mark the connection EXITING while still holding the +* read lock so the selection and the status transition +* happen together. Do not regress a connection that has +* already advanced to RELEASING on its own (e.g. the +* handler exited its receive loop for an unrelated +* reason). +*/ +if (READ_ONCE (conn->status) !=KSMBD_SESS_RELEASING ) +ksmbd_conn_set_exiting (conn); + target = conn; +break ; + } +up_read (&conn_list_lock); + +if (target) { + t = target->transport; +if (t->ops->shutdown) t->ops->shutdown (t); -down_read (&conn_list_lock); +if (atomic_dec_and_test (&target->refcnt)) { +ida_destroy (&target->async_ida); + t->ops->free_transport (t); +kfree (target); } + goto again; } -up_read (&conn_list_lock); -if (!hash_empty (conn_list)) { +if (any) {msleep (100 ); goto again; }
fs/smb/server/connection.h +1 -0
@@ -49,6 +49,7 @@ struct ksmbd_conn {struct mutex srv_mutex;int status;unsigned int cli_cap; +bool stop_called;union {__be32 inet_addr;#if IS_ENABLED (CONFIG_IPV6 )
Greg Kroah-Hartman
maintainerPATCH 17/307 KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 0cb2af2ea66ad8ff195c156ea690f11216285bdf upstream.
The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow paging if the guest page tables are modified between VM entries (similar to commit aad885e77496, "KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE", 2026-03-27). The flow is as follows:
- a PDE is installed for a 2MB mapping, and a page in that area is accessed. KVM creates a kvm_mmu_page consisting of 512 4KB pages; the kvm_mmu_page is marked by FNAME(fetch) as direct-mapped because the guest's mapping is a huge page (and thus contiguous).
- the PDE mapping is changed from outside the guest.
- the guest accesses another page in the same 2MB area. KVM installs a new leaf SPTE and rmap entry; the SPTE uses the "correct" GFN (i.e. based on the new mapping, as changed in the previous step) but that GFN is outside of the [sp->gfn, sp->gfn + 511] range; therefore the rmap entry cannot be found and removed when the kvm_mmu_page is zapped.
- the memslot that covers the first 2MB mapping is deleted, and the kvm_mmu_page for the now-invalid GPA is zapped. However, rmap_remove() only looks at the [sp->gfn, sp->gfn + 511] range established in step 1, and fails to find the rmap entry that was recorded by step 3.
- any operation that causes an rmap walk for the same page accessed by step 3 then walks a stale rmap and dereferences a freed kvm_mmu_page. This includes dirty logging or MMU notifier invalidations (e.g., from MADV_DONTNEED).
The underlying issue is that KVM's walking of shadow PTEs assumes that if a SPTE is present when KVM wants to install a non-leaf SPTE, then the existing kvm_mmu_page must be for the correct gfn. Because the only way for the gfn to be wrong is if KVM messed up and failed to zap a SPTE... which shouldn't happen, but *actually* only happens in response to a guest write.
That bug dates back literally forever, as even the first version of KVM assumes that the GFN matches and walks into the "wrong" shadow page. However, that was only an imprecision until 2032a93d66fa ("KVM: MMU:
Don't allocate gfns page for direct mmu pages") came along.
Fix it by checking for a target gfn mismatch and zapping the existing SPTE. That way the old SP and rmap entries are gone, KVM installs the rmap in the right location, and everyone is happy.
--- arch/x86/kvm/mmu/mmu.c | 35 ++++++++++++++--------------------- 1 file changed, 14 insertions(+), 21 deletions(-)
arch/x86/kvm/mmu/mmu.c +14 -21
@@ -182,6 +182,8 @@ static struct kmem_cache *pte_list_desc_cache;struct kmem_cache *mmu_page_header_cache;static void mmu_spte_set (u64 *sptep,u64 spte); +static int mmu_page_zap_pte (struct kvm *kvm,struct kvm_mmu_page *sp, +u64 *spte,struct list_head *invalid_list);struct kvm_mmu_role_regs {const unsigned long cr0;
@@ -1287,19 +1289,6 @@ static void drop_spte(struct kvm *kvm, u64 *sptep)rmap_remove (kvm, sptep); } -static void drop_large_spte (struct kvm *kvm,u64 *sptep,bool flush) -{ -struct kvm_mmu_page *sp; - - sp =sptep_to_sp (sptep); -WARN_ON_ONCE (sp->role.level ==PG_LEVEL_4K ); - -drop_spte (kvm, sptep); - -if (flush) -kvm_flush_remote_tlbs_sptep (kvm, sptep); -} -/* * Write-protect on the specified @sptep, @pt_protect indicates whether * spte write-protection is caused by protecting shadow page table.
@@ -2466,7 +2455,8 @@ static struct kvm_mmu_page *kvm_mmu_get_child_sp(struct kvm_vcpu *vcpu, {union kvm_mmu_page_role role; -if (is_shadow_present_pte (*sptep) && !is_large_pte (*sptep)) +if (is_shadow_present_pte (*sptep) && !is_large_pte (*sptep) && +spte_to_child_sp (*sptep) &&spte_to_child_sp (*sptep)->gfn == gfn)return ERR_PTR (-EEXIST ); role =kvm_mmu_child_role (sptep, direct, access);
@@ -2544,13 +2534,16 @@ static void __link_shadow_page(struct kvm *kvm,BUILD_BUG_ON (VMX_EPT_WRITABLE_MASK !=PT_WRITABLE_MASK ); -/* -* If an SPTE is present already, it must be a leaf and therefore -* a large one. Drop it, and flush the TLB if needed, before -* installing sp. -*/ -if (is_shadow_present_pte (*sptep)) -drop_large_spte (kvm, sptep, flush); +if (is_shadow_present_pte (*sptep)) { +struct kvm_mmu_page *parent_sp; +LIST_HEAD (invalid_list); + + parent_sp =sptep_to_sp (sptep); +WARN_ON_ONCE (parent_sp->role.level ==PG_LEVEL_4K ); + +mmu_page_zap_pte (kvm, parent_sp, sptep, &invalid_list); +kvm_mmu_remote_flush_or_zap (kvm, &invalid_list, true); + } spte =make_nonleaf_spte (sp->spt,sp_ad_disabled (sp));
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 18/307 flow_dissector: do not dissect PPPoE PFC frames
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingfang Deng <[email protected]>
[ Upstream commit d6c19b31a3c1d519fabdcf0aa239e6b6109b9473 ]
RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the flow dissector driver has assumed an uncompressed frame until the blamed commit.
During the review process of that commit [1], support for PFC is suggested. However, having a compressed (1-byte) protocol field means the subsequent PPP payload is shifted by one byte, causing 4-byte misalignment for the network header and an unaligned access exception on some architectures.
The exception can be reproduced by sending a PPPoE PFC frame to an ethernet interface of a MIPS board, with RPS enabled, even if no PPPoE session is active on that interface:
$ 0 : 00000000 80c40000 00000000 85144817 $ 4 : 00000008 00000100 80a75758 81dc9bb8 $ 8 : 00000010 8087ae2c 0000003d 00000000 $12 : 000000e0 00000039 00000000 00000000 $16 : 85043240 80a75758 81dc9bb8 00006488 $20 : 0000002f 00000007 85144810 80a70000 $24 : 81d1bda0 00000000 $28 : 81dc8000 81dc9aa8 00000000 805ead08 Hi : 00009d51 Lo : 2163358a epc : 805e91f0 __skb_flow_dissect+0x1b0/0x1b50 ra : 805ead08 __skb_get_hash_net+0x74/0x12c Status: 11000403 KERNEL EXL IE Cause : 40800010 (ExcCode 04) BadVA : 85144817 PrId : 0001992f (MIPS 1004Kc) Call Trace: [<805e91f0>] __skb_flow_dissect+0x1b0/0x1b50 [<805ead08>] __skb_get_hash_net+0x74/0x12c [<805ef330>] get_rps_cpu+0x1b8/0x3fc [<805fca70>] netif_receive_skb_list_internal+0x324/0x364 [<805fd120>] napi_complete_done+0x68/0x2a4 [<8058de5c>] mtk_napi_rx+0x228/0xfec [<805fd398>] __napi_poll+0x3c/0x1c4 [<805fd754>] napi_threaded_poll_loop+0x234/0x29c [<805fd848>] napi_threaded_poll+0x8c/0xb0 [<80053544>] kthread+0x104/0x12c [<80002bd8>] ret_from_kernel_thread+0x14/0x1c
Code: 02d51821 1060045b 00000000 <8c640000> 3084000f 2c820005 144001a2 00042080 8e220000
To reduce the attack surface and maintain performance, do not process PPPoE PFC frames.
[1] https://lore.kernel.org/r/[email protected]
--- net/core/flow_dissector.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-)
net/core/flow_dissector.c +5 -8
@@ -1374,16 +1374,13 @@ bool __skb_flow_dissect(const struct net *net,break ; } -/* least significant bit of the most significant octet -* indicates if protocol field was compressed +/* PFC (compressed 1-byte protocol) frames are not processed. +* A compressed protocol field has the least significant bit of +* the most significant octet set, which will fail the following +* ppp_proto_is_valid(), returning FLOW_DISSECT_RET_OUT_BAD. */ ppp_proto =ntohs (hdr->proto); -if (ppp_proto &0x0100 ) { - ppp_proto = ppp_proto >>8 ; - nhoff +=PPPOE_SES_HLEN -1 ; - }else { - nhoff +=PPPOE_SES_HLEN ; - } + nhoff +=PPPOE_SES_HLEN ;if (ppp_proto ==PPP_IP ) { proto =htons (ETH_P_IP );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 19/307 smb: client/smbdirect: fix MR registration for coalesced SG lists
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Kuo <[email protected]>
commit 9900b9fee5a0e0f72d7c744b37c7c851d5785ac6 upstream. The stable backport to < 7.1 patches a different file. Also the Fixes tag below is adjusted for the old code path.
ib_dma_map_sg() modifies the provided scatterlist and returns the number of mapped entries, which can be fewer than the requested mr->sgt.nents if the DMA controller coalesces contiguous memory segments. Passing the original, uncoalesced count to ib_map_mr_sg() causes memory registration failures if coalescing actually occurs.
Capture the actual mapped count returned by ib_dma_map_sg() and pass it to ib_map_mr_sg() to ensure correct MR registration.
Also update the ib_dma_map_sg() error logging to drop the error pointer formatting, since the return value is an integer count rather than an error code.
Ensure a proper error code (-EIO) is assigned when DMA mapping or MR registration fails.
--- fs/smb/client/smbdirect.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
fs/smb/client/smbdirect.c +12 -9
@@ -2920,7 +2920,7 @@ struct smbdirect_mr_io *smbd_register_mr(struct smbd_connection *info,struct smbdirect_socket *sc = &info->socket;struct smbdirect_socket_parameters *sp = &sc->parameters;struct smbdirect_mr_io *mr; -int rc, num_pages; +int rc, num_pages, num_mapped;struct ib_reg_wr *reg_wr; num_pages =iov_iter_npages (iter, sp->max_frmr_depth +1 );
@@ -2948,18 +2948,21 @@ struct smbdirect_mr_io *smbd_register_mr(struct smbd_connection *info, num_pages, iov_iter_count(iter), sp->max_frmr_depth);smbd_iter_to_mr (iter, &mr->sgt, sp->max_frmr_depth); - rc =ib_dma_map_sg (sc->ib.dev, mr->sgt.sgl, mr->sgt.nents, mr->dir); -if (!rc) { -log_rdma_mr (ERR ,"ib_dma_map_sg num_pages=%x dir=%x rc=%x\n" , - num_pages, mr->dir, rc); + num_mapped =ib_dma_map_sg (sc->ib.dev, mr->sgt.sgl, mr->sgt.nents, mr->dir); +if (!num_mapped) { +log_rdma_mr (ERR ,"ib_dma_map_sg num_pages=%x dir=%x num_mapped=%x\n" , + num_pages, mr->dir, num_mapped); + rc = -EIO ; goto dma_map_error; } - rc =ib_map_mr_sg (mr->mr, mr->sgt.sgl, mr->sgt.nents,NULL ,PAGE_SIZE ); -if (rc != mr->sgt.nents) { + rc =ib_map_mr_sg (mr->mr, mr->sgt.sgl, num_mapped,NULL ,PAGE_SIZE ); +if (rc != num_mapped) {log_rdma_mr (ERR , -"ib_map_mr_sg failed rc = %d nents = %x\n" , - rc, mr->sgt.nents); +"ib_map_mr_sg failed rc = %d num_mapped = %x\n" , + rc, num_mapped); +if (rc >=0 ) + rc = -EIO ; goto map_mr_error; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 20/307 net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
commit 458d5615272d3de535748342eb68ca492343048c upstream.
When red qdisc has children (eg qfq qdisc) whose peek() callback is qdisc_peek_dequeued(), we could get a kernel panic. When the parent of such qdiscs (eg illustrated in patch #3 as tbf) wants to retrieve an skb from its child (red in this case), it will do the following:
1a. do a peek() - and when sensing there's an skb the child can offer, then
- the child in this case(red) calls its child's (qfq) peek. qfq does the right thing and will return the gso_skb queue packet.
Note: if there wasnt a gso_skb entry then qfq will store it there.
1b. invoke a dequeue() on the child (red). And herein lies the problem.
- red will call the child's dequeue() which will essentially just try to grab something of qfq's queue.
[ 78.667668][ T363] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f] [ 78.667927][ T363] CPU: 1 UID: 0 PID: 363 Comm: ping Not tainted 7.1.0-rc1-00033-g46f74a3f7d57-dirty #790 PREEMPT(full) [ 78.668263][ T363] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 78.668486][ T363] RIP: 0010:qfq_dequeue+0x446/0xc90 [sch_qfq] [ 78.668718][ T363] Code: 54 c0 e8 dd 90 00 f1 48 c7 c7 e0 03 54 c0 48 89 de e8 ce 90 00 f1 48 8d 7b 48 b8 ff ff 37 00 48 89 fa 48 c1 e0 2a 48 c1 ea 03 <80> 3c 02 00 74 05 e8 ef a1 e1 f1 48 8b 7b 48 48 8d 54 24 58 48 8d [ 78.669312][ T363] RSP: 0018:ffff88810de573e0 EFLAGS: 00010216 [ 78.669533][ T363] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 78.669790][ T363] RDX: 0000000000000009 RSI: 0000000000000004 RDI: 0000000000000048 [ 78.670044][ T363] RBP: ffff888110dc4000 R08: ffffffffb1b0885a R09: fffffbfff6ba9078 [ 78.670297][ T363] R10: 0000000000000003 R11: ffff888110e31c80 R12: 0000001880000000 [ 78.670560][ T363] R13: ffff888110dc4150 R14: ffff888110dc42b8 R15: 0000000000000200 [ 78.670814][ T363] FS: 00007f66a8f09c40(0000) GS:ffff888163428000(0000) knlGS:0000000000000000 [ 78.671110][ T363] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 78.671324][ T363] CR2: 000055db4c6a30a8 CR3: 000000010da67000 CR4: 0000000000750ef0 [ 78.671585][ T363] PKRU: 55555554 [ 78.671713][ T363] Call Trace: [ 78.671843][ T363] <TASK> [ 78.671936][ T363] ? __pfx_qfq_dequeue+0x10/0x10 [sch_qfq] [ 78.672148][ T363] ? __pfx__printk+0x10/0x10 [ 78.672322][ T363] ? srso_alias_return_thunk+0x5/0xfbef5 [ 78.672496][ T363] ? lockdep_hardirqs_on_prepare+0xa8/0x1a0 [ 78.672706][ T363] ? srso_alias_return_thunk+0x5/0xfbef5 [ 78.672875][ T363] ? trace_hardirqs_on+0x19/0x1a0 [ 78.673047][ T363] red_dequeue+0x65/0x270 [sch_red] [ 78.673217][ T363] ? srso_alias_return_thunk+0x5/0xfbef5 [ 78.673385][ T363] tbf_dequeue.cold+0xb0/0x70c [sch_tbf] [ 78.673566][ T363] __qdisc_run+0x169/0x1900
The right thing to do in #1b is to grab the skb off gso_skb queue. This patchset fixes that issue by changing #1b to use qdisc_dequeue_peeked() method instead.
--- net/sched/sch_red.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_red.c +1 -1
@@ -155,7 +155,7 @@ static struct sk_buff *red_dequeue(strucstruct red_sched_data *q =qdisc_priv (sch);struct Qdisc *child = q->qdisc; - skb = child->dequeue (child); + skb =qdisc_dequeue_peeked (child);if (skb) {qdisc_bstats_update (sch, skb);qdisc_qstats_backlog_dec (sch, skb);
Greg Kroah-Hartman
maintainerPATCH 21/307 exit: prevent preemption of oopsing TASK_DEAD task
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891 upstream.
When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden:do_task_dead() calls __schedule(), which has a comment saying "WARNING:
must be called with preemption disabled!".
If an oopsing task is preempted in do_task_dead(), between becoming TASK_DEAD and entering the scheduler explicitly, bad things happen:finish_task_switch() assumes that once the scheduler has switched away from a TASK_DEAD task, the task can never run again and its stack is no longer needed; but that assumption apparently doesn't hold if the dead task was preempted (the SM_PREEMPT case).
This means that the scheduler ends up repeatedly dropping references on the dead task's stack, which can lead to use-after-free or double-free of the entire task stack; in other words, two tasks can end up running on the same stack, resulting in various kinds of memory corruption.
(This does not just affect "recursively oopsing" tasks; it is enough to oops once during task exit, for example in a file_operations::release handler)
--- kernel/exit.c | 1 + 1 file changed, 1 insertion(+)
kernel/exit.c +1 -0
@@ -1074,6 +1074,7 @@ void __noreturn make_task_dead(int signrfutex_exit_recursive (tsk); tsk->exit_state =EXIT_DEAD ;refcount_inc (&tsk->rcu_users); +preempt_disable ();do_task_dead (); }
Greg Kroah-Hartman
maintainerPATCH 22/307 wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quan Zhou <[email protected]>
commit bb8e38fcdbf7290d7f0cd572d2d8fdb2b641b492 upstream.
Previously, the AMPDU state bit for a given TID was set before attempting to start a BA session, which could result in the AMPDU state being marked active even if ieee80211_start_tx_ba_session() failed. This patch changes the logic to only set the AMPDU state bit after successfully starting a BA session, ensuring proper synchronization between AMPDU state and BA session status.
This fixes potential issues with aggregation state tracking and improves compatibility with mac80211 BA session management.
--- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7925/mac.c +4 -2
@@ -882,8 +882,10 @@ static void mt7925_tx_check_aggr(structelse mlink = &msta->deflink; -if (!test_and_set_bit (tid, &mlink->wcid.ampdu_state)) -ieee80211_start_tx_ba_session (sta, tid,0 ); +if (!test_and_set_bit (tid, &mlink->wcid.ampdu_state)) { +if (ieee80211_start_tx_ba_session (sta, tid,0 )) +clear_bit (tid, &mlink->wcid.ampdu_state); + } } static bool
Greg Kroah-Hartman
maintainerPATCH 23/307 wifi: mt76: mt7925: fix incorrect length field in txpower command
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Yen Hsieh <[email protected]>
commit ccb186326bb6b7f20d77982f855568e7087ad0d7 upstream.
Set tx_power_tlv->len to msg_len instead of sizeof(*tx_power_tlv) to ensure the correct message length is sent to firmware.
--- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +1 -1
@@ -3727,7 +3727,7 @@ mt7925_mcu_rate_txpower_band(struct mt76memcpy (tx_power_tlv->alpha2, dev->alpha2,sizeof (dev->alpha2)); tx_power_tlv->n_chan = num_ch; tx_power_tlv->tag =cpu_to_le16 (0x1 ); - tx_power_tlv->len =cpu_to_le16 (sizeof (*tx_power_tlv)); + tx_power_tlv->len =cpu_to_le16 (msg_len);switch (band) {case NL80211_BAND_2GHZ :
Greg Kroah-Hartman
maintainerPATCH 24/307 wifi: mt76: mt7921: fix a potential clc buffer length underflow
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Yen <[email protected]>
commit 5373f8b19e568b5c217832b9bbef165bd2b2df14 upstream.
The buf_len is used to limit the iterations for retrieving the country power setting and may underflow under certain conditions due to changes in the power table in CLC.
This underflow leads to an almost infinite loop or an invalid power setting resulting in driver initialization failure.
--- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +3 -0
@@ -1353,6 +1353,9 @@ int __mt7921_mcu_set_clc(struct mt792x_du16 len =le16_to_cpu (rule->len);u16 offset = len +sizeof (*rule); +if (buf_len < offset) +break ; + pos += offset; buf_len -= offset; if (rule->alpha2[0] != alpha2[0] ||
Greg Kroah-Hartman
maintainerPATCH 25/307 wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quan Zhou <[email protected]>
commit fdfa39f9f4fbae532b162da913a67b2410caf38f upstream.
The mt7921_set_roc API may be executed concurrently with mt7921_roc_work, specifically between the following code paths:
- The check and clear of MT76_STATE_ROC in mt7921_roc_work:
if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state))
return;- The execution of ieee80211_iterate_active_interfaces.
This race condition can interrupt the ROC abort flow, resulting in the ROC process failing to abort as expected.
To address this defect, the modification of MT76_STATE_ROC is now protected by mt792x_mutex_acquire(phy->dev). This ensures that changes to the ROC state are properly synchronized, preventing race conditions and ensuring the ROC abort flow is not interrupted.
--- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7921/main.c +4 -3
@@ -387,10 +387,11 @@ void mt7921_roc_work(struct work_struct phy = (struct mt792x_phy *)container_of(work, struct mt792x_phy, roc_work); -if (!test_and_clear_bit (MT76_STATE_ROC , &phy->mt76->state)) -return ; -mt792x_mutex_acquire (phy->dev); +if (!test_and_clear_bit (MT76_STATE_ROC , &phy->mt76->state)) { +mt792x_mutex_release (phy->dev); +return ; + }ieee80211_iterate_active_interfaces (phy->mt76->hw,IEEE80211_IFACE_ITER_RESUME_ALL , mt7921_roc_iter, phy);
Greg Kroah-Hartman
maintainerPATCH 26/307 wifi: b43legacy: enforce bounds check on firmware key index in RX path
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <[email protected]>
commit a035766f970bde2d4298346a31a80685be5c0205 upstream.
Same fix as b43: the firmware-controlled key index in b43legacy_rx() can exceed dev->max_nr_keys. The existing B43legacy_WARN_ON is non-enforcing in production builds, allowing an out-of-bounds read of dev->key[].
Make the check enforcing by dropping the frame for invalid indices.
--- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/broadcom/b43legacy/xmit.c +2 -1
@@ -476,7 +476,8 @@ void b43legacy_rx(struct b43legacy_wldev* key index, but the ucode passed it slightly different. */ keyidx =b43legacy_kidx_to_raw (dev, keyidx); -B43legacy_WARN_ON (keyidx >= dev->max_nr_keys); +if (B43legacy_WARN_ON (keyidx >= dev->max_nr_keys)) + goto drop;if (dev->key[keyidx].algorithm != B43legacy_SEC_ALGO_NONE) {/* Remove PROTECTED flag to mark it as decrypted. */
Greg Kroah-Hartman
maintainerPATCH 27/307 wifi: mac80211: drop stray static from fast-RX rx_result
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catherine <[email protected]>
commit 7a5b81e0c87a075afd572f659d8eb68c9c4cd2ba upstream.
ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent callers then share one instance and can overwrite each other's result between ieee80211_rx_mesh_data() and the switch on res.
That can make a packet that was queued or consumed by ieee80211_rx_mesh_data() fall through into ieee80211_rx_8023(), or make a packet that should continue return as queued.
Make res an automatic variable so each invocation keeps its own result.
--- net/mac80211/rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/rx.c +1 -1
@@ -4928,7 +4928,7 @@ static bool ieee80211_invoke_fast_rx(strstruct sk_buff *skb = rx->skb;struct ieee80211_hdr *hdr = (void *)skb->data;struct ieee80211_rx_status *status =IEEE80211_SKB_RXCB (skb); -static ieee80211_rx_result res; +ieee80211_rx_result res;int orig_len = skb->len;int hdrlen =ieee80211_hdrlen (hdr->frame_control);int snap_offs = hdrlen;
Greg Kroah-Hartman
maintainerPATCH 28/307 wifi: rsi: fix kthread lifetime race between self-exit and external-stop
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
commit db57a1aa54ff68669781976e4edb045e09e2b65b upstream.
RSI driver use both self-exit(kthread_complete_and_exit) and external-stop (kthread_stop) when killing a kthread. Generally, kthread_stop() is called first, and in this case, no particular issues occur.
However, in rare instances where kthread_complete_and_exit() is called first and then kthread_stop() is called, a UAF occurs because the kthread object, which has already exited and been freed, is accessed again.
Therefore, to prevent this with minimal modification, you must remove kthread_stop() and change the code to wait until the self-exit operation is completed.
--- drivers/net/wireless/rsi/rsi_common.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/wireless/rsi/rsi_common.h +2 -3
@@ -70,12 +70,11 @@ static inline int rsi_create_kthread(strreturn 0 ; } -static inline int rsi_kill_thread (struct rsi_thread *handle) +static inline void rsi_kill_thread (struct rsi_thread *handle) {atomic_inc (&handle->thread_done);rsi_set_event (&handle->event); - -return kthread_stop (handle->task); +wait_for_completion (&handle->completion); }void rsi_mac80211_detach (struct rsi_hw *hw);
Greg Kroah-Hartman
maintainerPATCH 29/307 wifi: mac80211: use safe list iteration in radar detect work
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
commit ac8eb3e18f41e2cc8492cc1d358bcb786c850270 upstream.
The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to avoid a slab-use-after-free error.
--- net/mac80211/util.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mac80211/util.c +2 -2
@@ -3623,11 +3623,11 @@ void ieee80211_dfs_radar_detected_work(sstruct ieee80211_local *local = container_of(work, struct ieee80211_local, radar_detected_work);struct cfg80211_chan_def chandef; -struct ieee80211_chanctx *ctx; +struct ieee80211_chanctx *ctx, *tmp;lockdep_assert_wiphy (local->hw.wiphy); -list_for_each_entry (ctx, &local->chanctx_list, list) { +list_for_each_entry_safe (ctx, tmp, &local->chanctx_list, list) {if (ctx->replace_state ==IEEE80211_CHANCTX_REPLACES_OTHER )continue ;
Greg Kroah-Hartman
maintainerPATCH 30/307 wifi: ath5k: do not access array OOB
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <[email protected]>
commit d748603f12baff112caa3ab7d39f50100f010dbd upstream.
Vincent reports:
Quoted 12 lines
The ath5k driver seems to do an array-index-out-of-bounds access as shown by the UBSAN kernel message:
UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20 index 4 is out of range for type 'ieee80211_tx_rate [4]' ... Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 ubsan_epilogue+0x5/0x2b __ubsan_handle_out_of_bounds.cold+0x46/0x4b ath5k_tasklet_tx+0x4e0/0x560 [ath5k] tasklet_action_common+0xb5/0x1c0
It is real. 'ts->ts_final_idx' can be 3 on 5212, so:
info->status.rates[ts->ts_final_idx + 1].idx = -1;
with the array defined as:
struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];
while the size is:
#define IEEE80211_TX_MAX_RATES 4
is indeed bogus.
Set this 'idx = -1' sentinel only if the array index is less than the array size. As mac80211 will not look at rates beyond the size (IEEE80211_TX_MAX_RATES).
Note: The effect of the OOB write is negligible. It just overwrites the next member of info->status, i.e. ack_signal.
--- drivers/net/wireless/ath/ath5k/base.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath5k/base.c +2 -1
@@ -1738,7 +1738,8 @@ ath5k_tx_frame_completed(struct ath5k_hw } info->status.rates[ts->ts_final_idx].count = ts->ts_final_retry; - info->status.rates[ts->ts_final_idx +1 ].idx =-1 ; +if (ts->ts_final_idx +1 <IEEE80211_TX_MAX_RATES ) + info->status.rates[ts->ts_final_idx +1 ].idx =-1 ;if (unlikely (ts->ts_status)) { ah->stats.ack_fail++;
Greg Kroah-Hartman
maintainerPATCH 31/307 wifi: mac80211: remove station if connection prep fails
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit 283fc9e44ff5b5ac967439b4951b80bd4299f4e4 upstream.
If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep the station since it's related to the link of the vif being removed. Delete an existing station. Any "new_sta" is already being removed, so that doesn't need changes.
This fixes a use-after-free/double-free in debugfs if that's enabled, because a vif going from MLD (and to MLD, but that's not relevant here) recreates its entire debugfs.
--- net/mac80211/mlme.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
net/mac80211/mlme.c +4 -5
@@ -9053,7 +9053,7 @@ static int ieee80211_prep_connection(strstruct ieee80211_bss *bss = (void *)cbss->priv;struct sta_info *new_sta =NULL ;struct ieee80211_link_data *link; -bool have_sta = false; +struct sta_info *have_sta =NULL ;bool mlo;int err;u16 new_links;
@@ -9072,11 +9072,8 @@ static int ieee80211_prep_connection(str mlo = false; } -if (assoc) { -rcu_read_lock (); +if (assoc) have_sta =sta_info_get (sdata, ap_mld_addr); -rcu_read_unlock (); - }if (mlo && !have_sta &&WARN_ON (sdata->vif.valid_links || sdata->vif.active_links))
@@ -9239,6 +9236,8 @@ static int ieee80211_prep_connection(str out_release_chan:ieee80211_link_release_channel (link); out_err: +if (mlo && have_sta) +WARN_ON (__sta_info_destroy (have_sta));ieee80211_vif_set_links (sdata,0 ,0 );return err; }
Greg Kroah-Hartman
maintainerPATCH 32/307 wifi: b43: enforce bounds check on firmware key index in b43_rx()
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <[email protected]>
commit 1f4f78bf8549e6ac4f04fba4176854f3a6e0c332 upstream.
The firmware-controlled key index in b43_rx() can exceed the dev->key[] array size (58 entries). The existing B43_WARN_ON is non-enforcing in production builds, allowing an out-of-bounds read.
Make the B43_WARN_ON check enforcing by dropping the frame when the firmware returns an invalid key index.
--- drivers/net/wireless/broadcom/b43/xmit.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/broadcom/b43/xmit.c +2 -1
@@ -702,7 +702,8 @@ void b43_rx(struct b43_wldev *dev, struc* key index, but the ucode passed it slightly different. */ keyidx =b43_kidx_to_raw (dev, keyidx); -B43_WARN_ON (keyidx >=ARRAY_SIZE (dev->key)); +if (B43_WARN_ON (keyidx >=ARRAY_SIZE (dev->key))) + goto drop;if (dev->key[keyidx].algorithm !=B43_SEC_ALGO_NONE ) { wlhdr_len =ieee80211_hdrlen (fctl);
Greg Kroah-Hartman
maintainerPATCH 33/307 wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit c623b63580880cc742255eaed3d79804c1b91143 upstream.
Watchdog task might end between send_sig() and kthread_stop() calls, what results in the use-after-free issue. Fix this by increasing watchdog task reference count before calling send_sig() and dropping it by switching to kthread_stop_put().
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +4 -2
@@ -2476,8 +2476,9 @@ static void brcmf_sdio_bus_stop(struct dbrcmf_dbg (TRACE ,"Enter\n" );if (bus->watchdog_tsk) { +get_task_struct (bus->watchdog_tsk);send_sig (SIGTERM , bus->watchdog_tsk,1 ); -kthread_stop (bus->watchdog_tsk); +kthread_stop_put (bus->watchdog_tsk); bus->watchdog_tsk =NULL ; }
@@ -4567,8 +4568,9 @@ void brcmf_sdio_remove(struct brcmf_sdioif (bus) {/* Stop watchdog task */ if (bus->watchdog_tsk) { +get_task_struct (bus->watchdog_tsk);send_sig (SIGTERM , bus->watchdog_tsk,1 ); -kthread_stop (bus->watchdog_tsk); +kthread_stop_put (bus->watchdog_tsk); bus->watchdog_tsk =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 34/307 usb: usblp: fix heap leak in IEEE 1284 device ID via short response
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 7a400c6fe3617e31e690e3f7ca37bb335e0498f3 upstream.
usblp_ctrl_msg() collapses the usb_control_msg() return value to 0/-errno, discarding the actual number of bytes transferred. A broken printer can complete the GET_DEVICE_ID control transfer short and the driver has no way to know.
usblp_cache_device_id_string() reads the 2-byte big-endian length prefix from the response and trusts it (clamped only to the buffer bounds). The buffer is kmalloc(1024) at probe time. A device that sends exactly two bytes (e.g. 0x03 0xFF, claiming a 1023-byte ID) leaves device_id_string[2..1022] holding stale kmalloc heap.
That stale data is then exposed:
- via the ieee1284_id sysfs attribute (sprintf("%s", buf+2), truncated at the first NUL in the stale heap), and
- via the IOCNR_GET_DEVICE_ID ioctl, which copy_to_user()s the full claimed length regardless of NULs, up to 1021 bytes of uninitialized heap, with the leak size chosen by the device.
Fix this up by just zapping the buffer with zeros before each request sent to the device.
--- drivers/usb/class/usblp.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/class/usblp.c +1 -0
@@ -1377,6 +1377,7 @@ static int usblp_cache_device_id_string( {int err, length; +memset (usblp->device_id_string,0 ,USBLP_DEVICE_ID_SIZE ); err =usblp_get_id (usblp,0 , usblp->device_id_string,USBLP_DEVICE_ID_SIZE -1 );if (err <0 ) { dev_dbg(&usblp->intf->dev,
Greg Kroah-Hartman
maintainerPATCH 35/307 usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit b38e53cbfb9d84732e5984fbd73e128d592415c5 upstream.
Just like in a previous problem in this driver, usblp_ctrl_msg() will collapse the usb_control_msg() return value to 0/-errno, discarding the actual number of bytes transferred.
Ideally that short command should be detected and error out, but many printers are known to send "incorrect" responses back so we can't just do that.
statusbuf is kmalloc(8) at probe time and never filled before the first LPGETSTATUS ioctl.
usblp_read_status() requests 1 byte. If a malicious printer responds with zero bytes, *statusbuf is one byte of stale kmalloc heap, sign-extended into the local int status, which the LPGETSTATUS path then copy_to_user()s directly to the ioctl caller.
Fix this all by just zapping out the memory buffer when allocated at probe time. If a later call does a short read, the data will be identical to what the device sent it the last time, so there is no "leak" of information happening.
--- drivers/usb/class/usblp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/class/usblp.c +1 -1
@@ -1178,7 +1178,7 @@ static int usblp_probe(struct usb_interf }/* Allocate buffer for printer status */ - usblp->statusbuf =kmalloc (STATUS_BUF_SIZE ,GFP_KERNEL ); + usblp->statusbuf =kzalloc (STATUS_BUF_SIZE ,GFP_KERNEL );if (!usblp->statusbuf) { retval = -ENOMEM ; goto abort;
Greg Kroah-Hartman
maintainerPATCH 36/307 ALSA: usb-audio: midi2: Restart output URBs on resume
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
commit f3c57c9c2a49a21d784b7c04a2c883bffc070659 upstream.
USB MIDI 2.0 suspend saves the endpoint running state, clears it and kills all endpoint URBs. Resume restores the running state, but only restarts input endpoints.
For a running output endpoint, this leaves the endpoint marked running with an empty URB queue. Output transfer progress depends on either the rawmidi trigger path starting the queue or an output completion refilling it. After suspend there is no completion left, and output data that remains queued in the raw UMP or legacy rawmidi buffer can stay stalled until userspace happens to trigger the stream again.
Restore the saved state with atomic accessors, keep input endpoints restarted as before, and restart output endpoints that were running before suspend. Clear the saved suspend state after restoring it.
--- sound/usb/midi2.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
sound/usb/midi2.c +5 -4
@@ -227,7 +227,7 @@ static void kill_midi_urbs(struct snd_usif (!ep)return ;if (suspending) - ep->suspended = ep->running; +atomic_set (&ep->suspended,atomic_read (&ep->running));atomic_set (&ep->running,0 );for (i =0 ; i < ep->num_urbs; i++) {if (!ep->urbs[i].urb)
@@ -1190,10 +1190,11 @@ void snd_usb_midi_v2_suspend_all(structstatic void resume_midi2_endpoint (struct snd_usb_midi2_endpoint *ep) { - ep->running = ep->suspended; -if (ep->direction ==STR_IN ) +atomic_set (&ep->running,atomic_read (&ep->suspended)); +atomic_set (&ep->suspended,0 ); + +if (ep->direction ==STR_IN ||atomic_read (&ep->running))submit_io_urbs (ep); -/* FIXME: does it all? */ }void snd_usb_midi_v2_resume_all (struct snd_usb_audio *chip)
Greg Kroah-Hartman
maintainerPATCH 37/307 ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 6e7247d8f5fefeceb0bb9cc80a5388a636b219cd upstream.
The convert_chmap_v3() has a loop with its increment size of cs_desc->wLength, but we forgot to validate cs_desc->wLength itself, which may lead to potential endless loop by a malformed descriptor.
Add a proper size check to abort the loop for plugging the hole.
--- sound/usb/stream.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/stream.c +2 -0
@@ -352,6 +352,8 @@ snd_pcm_chmap_elem *convert_chmap_v3(strif (len <sizeof (*cs_desc))break ; cs_len =le16_to_cpu (cs_desc->wLength); +if (cs_len <sizeof (*cs_desc)) +break ;if (len < cs_len)break ; cs_type = cs_desc->bSegmentType;
Greg Kroah-Hartman
maintainerPATCH 38/307 ALSA: usb-audio: Fix UAC3 cluster descriptor size check
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
commit 26265dd69da32d88a88d21987853cec899d9e21f upstream.
The UAC3 cluster descriptor length check in snd_usb_get_audioformat_uac3()was added to make sure that the buffer is large enough for a struct uac3_cluster_header_descriptor before the returned data is cast and used.
However, the check uses sizeof(cluster), where cluster is a pointer, not the size of the descriptor header. This makes the validation depend on the architecture pointer size and does not match the intended object size.
Check against sizeof(*cluster) instead.
--- sound/usb/stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/stream.c +1 -1
@@ -997,7 +997,7 @@ snd_usb_get_audioformat_uac3(struct snd_* and request Cluster Descriptor */ wLength =le16_to_cpu (hc_header.wLength); -if (wLength <sizeof (cluster)) +if (wLength <sizeof (*cluster))return NULL ; cluster =kzalloc (wLength,GFP_KERNEL );if (!cluster)
Greg Kroah-Hartman
maintainerPATCH 39/307 usb: dwc3: Move GUID programming after PHY initialization
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Selvarasu Ganesan <[email protected]>
commit aad35f9c926ec220b0742af1ada45666ae667956 upstream.
The Linux Version Code is currently written to the GUID register before PHY initialization. Certain PHY implementations (such as Synopsys eUSB PHY performing link_sw_reset) clear the GUID register to its default value during initialization, causing the kernel version information to be lost.
Move the GUID register programming to occur after PHY initialization completes to ensure the Linux version information persists.
--- drivers/usb/dwc3/core.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/usb/dwc3/core.c +6 -6
@@ -1341,12 +1341,6 @@ int dwc3_core_init(struct dwc3 *dwc) hw_mode =DWC3_GHWPARAMS0_MODE (dwc->hwparams.hwparams0); -/* -* Write Linux Version Code to our GUID register so it's easy to figure -* out which kernel version a bug was found. -*/ -dwc3_writel (dwc,DWC3_GUID ,LINUX_VERSION_CODE ); - ret =dwc3_phy_setup (dwc);if (ret)return ret;
@@ -1378,6 +1372,12 @@ int dwc3_core_init(struct dwc3 *dwc)if (ret) goto err_exit_phy; +/* +* Write Linux Version Code to our GUID register so it's easy to figure +* out which kernel version a bug was found. +*/ +dwc3_writel (dwc,DWC3_GUID ,LINUX_VERSION_CODE ); +dwc3_core_setup_global_control (dwc);dwc3_core_num_eps (dwc);
Greg Kroah-Hartman
maintainerPATCH 40/307 usb: typec: tcpm: reset internal port states on soft reset AMS
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Sunil Dhamne <[email protected]>
commit 2909f0d4994fb4306bf116df5ccee797791fce2c upstream.
Reset internal port states (such as vdm_sm_running and explicit_contract) on soft reset AMS as the port needs to negotiate a new contract. The consequence of leaving the states in as-is cond are as follows:
* port is in SRC power role and an explicit contract is negotiated with the port partner (in sink role)
* port partner sends a Soft Reset AMS while VDM State Machine is running
* port accepts the Soft Reset request and the port advertises src caps
* port partner sends a Request message but since the explicit_contract and vdm_sm_running are true from previous negotiation, the port ends up sending Soft Reset instead of Accept msg.
Stub Log:
[ 203.653942] AMS DISCOVER_IDENTITY start [ 203.653947] PD TX, header: 0x176f [ 203.655901] PD TX complete, status: 0 [ 203.657470] PD RX, header: 0x124f [1] [ 203.657477] Rx VDM cmd 0xff008081 type 2 cmd 1 len 1 [ 203.657482] AMS DISCOVER_IDENTITY finished [ 203.657484] cc:=4 [ 204.155698] PD RX, header: 0x144f [1] [ 204.155718] Rx VDM cmd 0xeeee8001 type 0 cmd 1 len 1 [ 204.155741] PD TX, header: 0x196f [ 204.157622] PD TX complete, status: 0 [ 204.160060] PD RX, header: 0x4d [1] [ 204.160066] state change SRC_READY -> SOFT_RESET [rev2 SOFT_RESET_AMS] [ 204.160076] PD TX, header: 0x163 [ 204.162486] PD TX complete, status: 0 [ 204.162832] AMS SOFT_RESET_AMS finished [ 204.162840] cc:=4 [ 204.162891] AMS POWER_NEGOTIATION start [ 204.162896] state change SOFT_RESET -> AMS_START [rev2 POWER_NEGOTIATION] [ 204.162908] state change AMS_START -> SRC_SEND_CAPABILITIES [rev2 POWER_NEGOTIATION] [ 204.162913] PD TX, header: 0x1361 [ 204.165529] PD TX complete, status: 0 [ 204.165571] pending state change SRC_SEND_CAPABILITIES -> SRC_SEND_CAPABILITIES_TIMEOUT @ 60 ms [rev2 POWER_NEGOTIATION] [ 204.166996] PD RX, header: 0x1242 [1] [ 204.167009] state change SRC_SEND_CAPABILITIES -> SRC_SOFT_RESET_WAIT_SNK_TX [rev2 POWER_NEGOTIATION] [ 204.167019] AMS POWER_NEGOTIATION finished [ 204.167020] cc:=4 [ 204.167083] AMS SOFT_RESET_AMS start [ 204.167086] state change SRC_SOFT_RESET_WAIT_SNK_TX -> SOFT_RESET_SEND [rev2 SOFT_RESET_AMS] [ 204.167092] PD TX, header: 0x16d [ 204.168824] PD TX complete, status: 0 [ 204.168854] pending state change SOFT_RESET_SEND -> HARD_RESET_SEND @ 60 ms [rev2 SOFT_RESET_AMS] [ 204.171876] PD RX, header: 0x43 [1] [ 204.171879] AMS SOFT_RESET_AMS finished
This causes COMMON.PROC.PD.11.2 check failure for TEST.PD.VDM.SRC.2_Rev2Src test on the PD compliance tester.
--- drivers/usb/typec/tcpm/tcpm.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/typec/tcpm/tcpm.c +2 -0
@@ -5741,6 +5741,8 @@ static void run_state_machine(struct tcpcase VCONN_SWAP_ACCEPT :tcpm_pd_send_control (port,PD_CTRL_ACCEPT ,TCPC_TX_SOP ); + port->vdm_sm_running = false; + port->explicit_contract = false;tcpm_ams_finish (port);tcpm_set_state (port,VCONN_SWAP_START ,0 );break ;
Re: [PATCH 7.0 040/307] usb: typec: tcpm: reset internal port states on soft reset AMS
Hi Greg,
Quoted 76 lines · Greg Kroah-Hartman
7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Sunil Dhamne <[email protected]>
commit
2909f0d4994fb4306bf116df5ccee797791fce2cupstream.Reset internal port states (such as
vdm_sm_runningandexplicit_contract) on soft reset AMS as the port needs to negotiate a new contract. The consequence of leaving the states in as-is cond are as follows:
* port is in SRC power role and an explicit contract is negotiated with the port partner (in sink role)
* port partner sends a Soft Reset AMS while VDM State Machine is running
* port accepts the Soft Reset request and the port advertises src caps
* port partner sends a Request message but since theexplicit_contractandvdm_sm_runningare true from previous negotiation, the port ends up sending Soft Reset instead of Accept msg.Stub Log:
[ 203.653942] AMS DISCOVER_IDENTITY start [ 203.653947] PD TX, header: 0x176f [ 203.655901] PD TX complete, status: 0 [ 203.657470] PD RX, header: 0x124f [1] [ 203.657477] Rx VDM cmd 0xff008081 type 2 cmd 1 len 1 [ 203.657482] AMS DISCOVER_IDENTITY finished [ 203.657484] cc:=4 [ 204.155698] PD RX, header: 0x144f [1] [ 204.155718] Rx VDM cmd 0xeeee8001 type 0 cmd 1 len 1 [ 204.155741] PD TX, header: 0x196f [ 204.157622] PD TX complete, status: 0 [ 204.160060] PD RX, header: 0x4d [1] [ 204.160066] state change SRC_READY -> SOFT_RESET [rev2 SOFT_RESET_AMS] [ 204.160076] PD TX, header: 0x163 [ 204.162486] PD TX complete, status: 0 [ 204.162832] AMS SOFT_RESET_AMS finished [ 204.162840] cc:=4 [ 204.162891] AMS POWER_NEGOTIATION start [ 204.162896] state change SOFT_RESET -> AMS_START [rev2 POWER_NEGOTIATION] [ 204.162908] state change AMS_START -> SRC_SEND_CAPABILITIES [rev2 POWER_NEGOTIATION] [ 204.162913] PD TX, header: 0x1361 [ 204.165529] PD TX complete, status: 0 [ 204.165571] pending state change SRC_SEND_CAPABILITIES -> SRC_SEND_CAPABILITIES_TIMEOUT @ 60 ms [rev2 POWER_NEGOTIATION] [ 204.166996] PD RX, header: 0x1242 [1] [ 204.167009] state change SRC_SEND_CAPABILITIES -> SRC_SOFT_RESET_WAIT_SNK_TX [rev2 POWER_NEGOTIATION] [ 204.167019] AMS POWER_NEGOTIATION finished [ 204.167020] cc:=4 [ 204.167083] AMS SOFT_RESET_AMS start [ 204.167086] state change SRC_SOFT_RESET_WAIT_SNK_TX -> SOFT_RESET_SEND [rev2 SOFT_RESET_AMS] [ 204.167092] PD TX, header: 0x16d [ 204.168824] PD TX complete, status: 0 [ 204.168854] pending state change SOFT_RESET_SEND -> HARD_RESET_SEND @ 60 ms [rev2 SOFT_RESET_AMS] [ 204.171876] PD RX, header: 0x43 [1] [ 204.171879] AMS SOFT_RESET_AMS finishedThis causes COMMON.PROC.PD.11.2 check failure for TEST.PD.VDM.SRC.2_Rev2Src test on the PD compliance tester.
Signed-off-by Amit Sunil Dhamne <[email protected]>Fixes 8d3a0578ad1a ("usb: typec: tcpm: Respond Wait if VDM state machine is running")Fixes f0690a25a140 ("staging: typec: USB Type-C Port Manager (tcpm)")Cc stable <[email protected]>Reviewed-by Badhri Jagan Sridharan <[email protected]>Acked-by Heikki Krogerus <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- drivers/usb/typec/tcpm/tcpm.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/typec/tcpm/tcpm.c static void run_state_machine(struct tcp · line 5745
Quoted 5 lines
drivers/usb/typec/tcpm/tcpm.c +2
-0@@ -5741,6 +5741,8 @@ static void run_state_machine(struct tcpcase VCONN_SWAP_ACCEPT :tcpm_pd_send_control (port,PD_CTRL_ACCEPT ,TCPC_TX_SOP ); + port->vdm_sm_running = false; + port->explicit_contract = false;
Please drop this patch from the queue. It was incorrectly applied to the VCONN_SWAP_ACCEPT case instead of the soft reset handling due to context fuzz. I will send a proper rebased backport for the 7.0 stable tree shortly.
Thanks,
Amit
Quoted 1 line
Greg Kroah-Hartman
maintainerPATCH 41/307 USB: omap_udc: DMA: Dont enable burst 4 mode
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaro Koskinen <[email protected]>
commit 3f91484f6c13c434bd573ca6b6779c26adb0ddab upstream.
Commit 65111084c63d7 ("USB: more omap_udc updates (dma and omap1710)") added setting for DMA burst 4 mode. But I think this should be undone for two reasons:
- It breaks DMA on 15xx boards - transfers just silently stall.
- On newer OMAP1 boards, like Nokia 770 (omap1710), there is no measurable performance impact when testing TCP throughput with g_ether with large 15000 byte MTU size.
It's also worth noting that when the original change was made, the OMAP_DMA_DATA_BURST_4 handling in arch/arm/plat-omap/dma.c was broken, and actually resulted in the same as the OMAP_DMA_DATA_BURST_DIS i.e. burst disabled. This was fixed not until a couple kernel releases later in an unrelated commit 1a8bfa1eb998a ("[ARM] 3142/1: OMAP 2/5: Update files common to omap1 and omap2").
So based on this it seems there was never really a very good reason to enable this burst mode in omap_udc, so remove it now to allow 15xx DMA to work again (it provides 2x throughput compared to PIO mode).
--- drivers/usb/gadget/udc/omap_udc.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/usb/gadget/udc/omap_udc.c +0 -4
@@ -733,8 +733,6 @@ static void dma_channel_claim(struct omaif (status ==0 ) {omap_writew (reg,UDC_TXDMA_CFG );/* EMIFF or SDRC */ -omap_set_dma_src_burst_mode (ep->lch, -OMAP_DMA_DATA_BURST_4 );omap_set_dma_src_data_pack (ep->lch,1 );/* TIPB */ omap_set_dma_dest_params(ep->lch,
@@ -756,8 +754,6 @@ static void dma_channel_claim(struct omaUDC_DATA_DMA , 0, 0);/* EMIFF or SDRC */ -omap_set_dma_dest_burst_mode (ep->lch, -OMAP_DMA_DATA_BURST_4 );omap_set_dma_dest_data_pack (ep->lch,1 ); } }
Greg Kroah-Hartman
maintainerPATCH 42/307 USB: serial: option: add Telit Cinterion LE910Cx compositions
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit 100201d349edd226ca3470c894c92dccc67ee7a8 upstream.
Add the following Telit Cinterion LE910Cx compositions:
0x1251: RNDIS + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (SAP)
T: Bus=01 Lev=01 Prnt=21 Port=06 Cnt=01 Dev#=108 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1251 Rev=03.18 S: Manufacturer=Android S: Product=LE910C1-EU S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=02 Prot=ff Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
0x1253: ECM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (SAP)
T: Bus=01 Lev=01 Prnt=21 Port=06 Cnt=01 Dev#=121 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1253 Rev=03.18 S: Manufacturer=Android S: Product=LE910C1-EU S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
0x1254: tty (AT) + tty (AT)
T: Bus=01 Lev=01 Prnt=21 Port=06 Cnt=01 Dev#=122 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1254 Rev=03.18 S: Manufacturer=Android S: Product=LE910C1-EU S: SerialNumber=0123456789ABCDEF C: #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
0x1255: tty (AT/NMEA) + tty (AT) + tty (AT) + tty (SAP)
T: Bus=01 Lev=01 Prnt=21 Port=06 Cnt=01 Dev#=123 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1255 Rev=03.18 S: Manufacturer=Android S: Product=LE910C1-EU S: SerialNumber=0123456789ABCDEF C: #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
--- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/serial/option.c +4 -0
@@ -1513,7 +1513,11 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */ .driver_info = NCTRL(2) | RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x1250, 0xff, 0x00, 0x00) }, /* Telit LE910Cx (rmnet) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1251, 0xff) }, /* Telit LE910Cx (RNDIS) */ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1252, 0xff) }, /* Telit LE910Cx (MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1253, 0xff) }, /* Telit LE910Cx (ECM) */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1254, 0xff) }, /* Telit LE910Cx */ + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1255, 0xff) }, /* Telit LE910Cx */ { USB_DEVICE(TELIT_VENDOR_ID, 0x1260), .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE(TELIT_VENDOR_ID, 0x1261),
Greg Kroah-Hartman
maintainerPATCH 43/307 usb: ulpi: fix memory leak on ulpi_register() error paths
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
commit 0b9fcab1b8608d429e5f239afb197de928d4de7d upstream.
Commit 01af542392b5 ("usb: ulpi: fix double free in ulpi_register_interface() error path") removed kfree(ulpi) from ulpi_register_interface() to fix a double-free when device_register() fails.
But when ulpi_of_register() or ulpi_read_id() fail before device_register() is called, the ulpi allocation is leaked.
Add kfree(ulpi) on both error paths to properly clean up the allocation.
--- drivers/usb/common/ulpi.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/common/ulpi.c +4 -1
@@ -286,12 +286,15 @@ static int ulpi_register(struct device *ACPI_COMPANION_SET (&ulpi->dev,ACPI_COMPANION (dev)); ret =ulpi_of_register (ulpi); -if (ret) +if (ret) { +kfree (ulpi);return ret; + } ret =ulpi_read_id (ulpi);if (ret) {of_node_put (ulpi->dev.of_node); +kfree (ulpi);return ret; }
Greg Kroah-Hartman
maintainerPATCH 44/307 usb: typec: tcpm: fix debug accessory mode detection for sink ports
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit f6ec9bb4acc7182b25a793ad094a764e1cb819a7 upstream.
The port in debug accessory mode can be either a source or sink. The previous tcpm_port_is_debug() function only checked for source port.
Commit 8db73e6a42b6 ("usb: typec: tcpm: allow sink (ufp) to toggle into accessory mode debug") changed the detection logic to support both roles, but left some logic in _tcpm_cc_change() unchanged, This causes the state machine to transition to an incorrect state when operating as a sink in debug accessory mode. Log as below:
[ 978.637541] CC1: 0 -> 5, CC2: 0 -> 5 [state TOGGLING, polarity 0, connected] [ 978.637567] state change TOGGLING -> SRC_ATTACH_WAIT [rev1 NONE_AMS] [ 978.637596] pending state change SRC_ATTACH_WAIT -> DEBUG_ACC_ATTACHED @ 180 ms [rev1 NONE_AMS] [ 978.647098] CC1: 5 -> 0, CC2: 5 -> 5 [state SRC_ATTACH_WAIT, polarity 0, connected] [ 978.647115] state change SRC_ATTACH_WAIT -> SRC_ATTACH_WAIT [rev1 NONE_AMS]
It should go to SNK_ATTACH_WAIT instead of SRC_ATTACH_WAIT state.
To fix this, add tcpm_port_is_debug_source() and tcpm_port_is_debug_sink() helper to explicitly identify the power mode in debug accessory mode. Update the state transition logic in _tcpm_cc_change() to ensure the state machine transitions comply with Type-C specification. Also update the logic in run_state_machine() to keep consistency.
--- drivers/usb/typec/tcpm/tcpm.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-)
drivers/usb/typec/tcpm/tcpm.c +16 -9
@@ -634,9 +634,14 @@ static const char * const pd_rev[] = { (tcpm_cc_is_source((port)->cc2) && \ !tcpm_cc_is_source((port)->cc1))) +#define tcpm_port_is_debug_source (port) \ + (tcpm_cc_is_source((port)->cc1) && tcpm_cc_is_source((port)->cc2)) + +#define tcpm_port_is_debug_sink (port) \ + (tcpm_cc_is_sink((port)->cc1) && tcpm_cc_is_sink((port)->cc2)) +#define tcpm_port_is_debug (port) \ - ((tcpm_cc_is_source((port)->cc1) && tcpm_cc_is_source((port)->cc2)) || \ - (tcpm_cc_is_sink((port)->cc1) && tcpm_cc_is_sink((port)->cc2))) + (tcpm_port_is_debug_source(port) || tcpm_port_is_debug_sink(port))#define tcpm_port_is_audio (port) \ (tcpm_cc_is_audio((port)->cc1) && tcpm_cc_is_audio((port)->cc2))
@@ -4812,7 +4817,7 @@ static void run_state_machine(struct tcptcpm_set_state (port,SNK_UNATTACHED ,PD_T_DRP_SNK );break ;case SRC_ATTACH_WAIT : -if (tcpm_port_is_debug (port)) +if (tcpm_port_is_debug_source (port))tcpm_set_state (port,DEBUG_ACC_ATTACHED , port->timings.cc_debounce_time);else if (tcpm_port_is_audio (port))
@@ -5070,7 +5075,7 @@ static void run_state_machine(struct tcptcpm_set_state (port,SRC_UNATTACHED ,PD_T_DRP_SRC );break ;case SNK_ATTACH_WAIT : -if (tcpm_port_is_debug (port)) +if (tcpm_port_is_debug_sink (port))tcpm_set_state (port,DEBUG_ACC_ATTACHED ,PD_T_CC_DEBOUNCE );else if (tcpm_port_is_audio (port))
@@ -5090,7 +5095,7 @@ static void run_state_machine(struct tcpif (tcpm_port_is_disconnected (port))tcpm_set_state (port,SNK_UNATTACHED ,PD_T_PD_DEBOUNCE ); -else if (tcpm_port_is_debug (port)) +else if (tcpm_port_is_debug_sink (port))tcpm_set_state (port,DEBUG_ACC_ATTACHED ,PD_T_CC_DEBOUNCE );else if (tcpm_port_is_audio (port))
@@ -5963,10 +5968,10 @@ static void _tcpm_cc_change(struct tcpm_switch (port->state) {case TOGGLING : -if (tcpm_port_is_debug (port) ||tcpm_port_is_audio (port) || +if (tcpm_port_is_debug_source (port) ||tcpm_port_is_audio (port) ||tcpm_port_is_source (port))tcpm_set_state (port,SRC_ATTACH_WAIT ,0 ); -else if (tcpm_port_is_sink (port)) +else if (tcpm_port_is_debug_sink (port) ||tcpm_port_is_sink (port))tcpm_set_state (port,SNK_ATTACH_WAIT ,0 );break ;case CHECK_CONTAMINANT :
@@ -5974,9 +5979,11 @@ static void _tcpm_cc_change(struct tcpm_break ;case SRC_UNATTACHED :case ACC_UNATTACHED : -if (tcpm_port_is_debug (port) ||tcpm_port_is_audio (port) || +if (tcpm_port_is_debug_source (port) ||tcpm_port_is_audio (port) ||tcpm_port_is_source (port))tcpm_set_state (port,SRC_ATTACH_WAIT ,0 ); +else if (tcpm_port_is_debug_sink (port)) +tcpm_set_state (port,SNK_ATTACH_WAIT ,0 );break ;case SRC_ATTACH_WAIT : if (tcpm_port_is_disconnected(port) ||
@@ -5998,7 +6005,7 @@ static void _tcpm_cc_change(struct tcpm_ }break ;case SNK_UNATTACHED : -if (tcpm_port_is_debug (port) ||tcpm_port_is_audio (port) || +if (tcpm_port_is_debug_sink (port) ||tcpm_port_is_audio (port) ||tcpm_port_is_sink (port))tcpm_set_state (port,SNK_ATTACH_WAIT ,0 );break ;
Greg Kroah-Hartman
maintainerPATCH 45/307 ALSA: hda: cs35l56: Propagate ASP TX source control errors
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
commit 0faacc0841d66f3cf51989c10a83f3a82d52ff2c upstream.
cs35l56_hda_mixer_get() ignores regmap_read() and cs35l56_hda_mixer_put() ignores regmap_update_bits_check().
This makes the ASP TX source controls report success when a regmap access fails. The write path returns no change instead of an error, and the read path continues after a failed read instead of aborting the control callback.
Propagate the regmap errors, matching the posture and volume controls in this driver.
--- sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
sound/hda/codecs/side-codecs/cs35l56_hda.c +14 -5
@@ -180,11 +180,15 @@ static int cs35l56_hda_mixer_get(struct {struct cs35l56_hda *cs35l56 =snd_kcontrol_chip (kcontrol);unsigned int reg_val; -int i; +int i, ret;cs35l56_hda_wait_dsp_ready (cs35l56); -regmap_read (cs35l56->base.regmap, kcontrol->private_value, ®_val); + ret =regmap_read (cs35l56->base.regmap, kcontrol->private_value, + ®_val); +if (ret) +return ret; + reg_val &= CS35L56_ASP_TXn_SRC_MASK;for (i =0 ; i <CS35L56_NUM_INPUT_SRC ; ++i) {
@@ -203,15 +207,20 @@ static int cs35l56_hda_mixer_put(structstruct cs35l56_hda *cs35l56 =snd_kcontrol_chip (kcontrol);unsigned int item = ucontrol->value.enumerated.item[0 ];bool changed; +int ret;if (item >=CS35L56_NUM_INPUT_SRC )return -EINVAL ;cs35l56_hda_wait_dsp_ready (cs35l56); -regmap_update_bits_check (cs35l56->base.regmap, kcontrol->private_value, -CS35L56_INPUT_MASK , cs35l56_tx_input_values[item], - &changed); + ret =regmap_update_bits_check (cs35l56->base.regmap, + kcontrol->private_value, +CS35L56_INPUT_MASK , + cs35l56_tx_input_values[item], + &changed); +if (ret) +return ret;return changed; }
Greg Kroah-Hartman
maintainerPATCH 46/307 ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 901ac0ff15edf9503162e2cf6579bd11a30f1ed4 upstream.
Currently the runtime.oss.trigger field may be accessed concurrently without protection, which may lead to the data race. And, in this case, it may lead to more severe problem because it's a bit field; as writing the data, it may overwrite other bit fields as well, which confuses the operation completely, as spotted by fuzzing.
Fix it by covering runtime.oss.trigger bit fled also with the existing params_lock mutex in both snd_pcm_oss_get_trigger() and snd_pcm_oss_poll().
--- sound/core/oss/pcm_oss.c | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-)
sound/core/oss/pcm_oss.c +23 -6
@@ -2149,10 +2149,16 @@ static int snd_pcm_oss_get_trigger(struc psubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK ]; csubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE ]; -if (psubstream && psubstream->runtime && psubstream->runtime->oss.trigger) - result |=PCM_ENABLE_OUTPUT ; -if (csubstream && csubstream->runtime && csubstream->runtime->oss.trigger) - result |=PCM_ENABLE_INPUT ; +if (psubstream && psubstream->runtime) { +guard (mutex)(&psubstream->runtime->oss.params_lock); +if (psubstream->runtime->oss.trigger) + result |=PCM_ENABLE_OUTPUT ; + } +if (csubstream && csubstream->runtime) { +guard (mutex)(&csubstream->runtime->oss.params_lock); +if (csubstream->runtime->oss.trigger) + result |=PCM_ENABLE_INPUT ; + }return result; }
@@ -2826,6 +2832,17 @@ static int snd_pcm_oss_capture_ready(str runtime->oss.period_frames; } +static bool need_input_retrigger (struct snd_pcm_runtime *runtime) +{ +bool ret; + +guard (mutex)(&runtime->oss.params_lock); + ret = runtime->oss.trigger; +if (ret) + runtime->oss.trigger =0 ; +return ret; +} +static __poll_t snd_pcm_oss_poll (struct file *file,poll_table * wait) {struct snd_pcm_oss_file *pcm_oss_file;
@@ -2858,11 +2875,11 @@ static __poll_t snd_pcm_oss_poll(struct snd_pcm_oss_capture_ready(csubstream)) mask |=EPOLLIN |EPOLLRDNORM ; } -if (ostate !=SNDRV_PCM_STATE_RUNNING && runtime->oss.trigger) { +if (ostate !=SNDRV_PCM_STATE_RUNNING && +need_input_retrigger (runtime)) {struct snd_pcm_oss_file ofile;memset (&ofile,0 ,sizeof (ofile)); ofile.streams[SNDRV_PCM_STREAM_CAPTURE ] = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE ]; - runtime->oss.trigger =0 ;snd_pcm_oss_set_trigger (&ofile,PCM_ENABLE_INPUT ); } }
Greg Kroah-Hartman
maintainerPATCH 47/307 ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuriy Padlyak <[email protected]>
commit 92a8b5e2eff6920bf815cd6a80b088ec3fdf01a3 upstream.
The Xiaomi Mi Laptop Pro 15 (TM1905, subsystem 1d72:1905) ships with the Realtek ALC256 codec on Intel Comet Lake PCH-LP. After S3 resume the codec sets coefficient register 0x10 to 0x0220 instead of 0x0020 — bit 9 is erroneously set, which silences the internal speaker. Bluetooth and HDMI audio are unaffected because they use different paths.
This is the same mechanism fixed for Clevo NJ51CU by commit edca7cc4b0ac ("ALSA: hda/realtek: Fix quirk for Clevo NJ51CU"), but the existing ALC256_FIXUP_MIC_NO_PRESENCE_AND_RESUME also reconfigures pin 0x19 as a front mic, which is wrong for this Xiaomi where pin 0x19 default is 0x411111f0 (disabled). Add a minimal fixup that only clears the stuck coef bit, and add the Xiaomi SSID to the quirk table.
Verified by reading coef 0x10 with hda-verb after resume (returns 0x0220), writing 0x0020, and confirming the internal speaker resumes output. With this fixup applied the bit is cleared on every codec init, including post-resume.
--- sound/hda/codecs/realtek/alc269.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
sound/hda/codecs/realtek/alc269.c +19 -0
@@ -3397,6 +3397,19 @@ static void alc256_fixup_mic_no_presence } } +static void alc256_fixup_xiaomi_pro15_resume (struct hda_codec *codec, +const struct hda_fixup *fix, +int action) +{ +/* +* On the Xiaomi Mi Laptop Pro 15 (TM1905, SSID 1d72:1905) the ALC256 +* codec sets coefficient 0x10 bit 9 to 1 after S3 resume, silencing +* the internal speaker. Bluetooth and HDMI audio are unaffected. +* Clear the bit so the speaker keeps working across suspend cycles. +*/ +alc_update_coef_idx (codec,0x10 ,1 <<9 ,0 ); +} +static void alc256_decrease_headphone_amp_val (struct hda_codec *codec,const struct hda_fixup *fix,int action) {
@@ -4054,6 +4067,7 @@ enum {ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE ,ALC233_FIXUP_NO_AUDIO_JACK ,ALC256_FIXUP_MIC_NO_PRESENCE_AND_RESUME , +ALC256_FIXUP_XIAOMI_PRO15_RESUME ,ALC285_FIXUP_LEGION_Y9000X_SPEAKERS ,ALC285_FIXUP_LEGION_Y9000X_AUTOMUTE , ALC287_FIXUP_LEGION_16ACHG6,
@@ -6241,6 +6255,10 @@ static const struct hda_fixup alc269_fix .chained = true, .chain_id =ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC }, + [ALC256_FIXUP_XIAOMI_PRO15_RESUME] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc256_fixup_xiaomi_pro15_resume, + }, [ALC287_FIXUP_LEGION_16ACHG6] = { .type = HDA_FIXUP_FUNC, .v.func = alc287_fixup_legion_16achg6_speakers,
@@ -7751,6 +7769,7 @@ static const struct hda_quirk alc269_fixSND_PCI_QUIRK (0x1d72 ,0x1602 ,"RedmiBook" ,ALC255_FIXUP_XIAOMI_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1701 ,"XiaomiNotebook Pro" ,ALC298_FIXUP_DELL1_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1d72 ,0x1901 ,"RedmiBook 14" ,ALC256_FIXUP_ASUS_HEADSET_MIC ), +SND_PCI_QUIRK (0x1d72 ,0x1905 ,"Xiaomi Mi Laptop Pro 15" ,ALC256_FIXUP_XIAOMI_PRO15_RESUME ),SND_PCI_QUIRK (0x1d72 ,0x1945 ,"Redmi G" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1947 ,"RedmiBook Air" ,ALC255_FIXUP_XIAOMI_HEADSET_MIC ), SND_PCI_QUIRK(0x1e39, 0xca14, "MEDION NM14LNL", ALC233_FIXUP_MEDION_MTL_SPK),
Greg Kroah-Hartman
maintainerPATCH 48/307 ALSA: firewire-tascam: Do not drop unread control events
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
commit 0749daa8eb5ab90334aaad3b0671efd7150d43b1 upstream.
tscm_hwdep_read_queue() copies as many queued control events as fit in the userspace buffer. When the buffer is smaller than the current contiguous queue segment, length is rounded down to the number of bytes that can be copied.
However, after copying that shortened length, the code advances pull_pos to the original tail_pos, marking the whole contiguous segment as consumed. Any events between the copied portion and tail_pos are lost.
Limit tail_pos to the position after the entries actually copied before updating pull_pos. When the whole segment fits, this is equivalent to the old tail_pos update; when the buffer is smaller, the remaining events stay queued for the next read.
--- sound/firewire/tascam/tascam-hwdep.c | 1 + 1 file changed, 1 insertion(+)
sound/firewire/tascam/tascam-hwdep.c +1 -0
@@ -73,6 +73,7 @@ static long tscm_hwdep_read_queue(struct length =rounddown (remained,sizeof (*entries));if (length ==0 )break ; + tail_pos = head_pos + length /sizeof (*entries);spin_unlock_irq (&tscm->lock);if (copy_to_user (pos, &entries[head_pos], length))
Greg Kroah-Hartman
maintainerPATCH 49/307 ALSA: core: Serialize deferred fasync state checks
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
commit 5337213381df578058e2e41da93cbd0e4639935f upstream.
snd_fasync_helper() updates fasync->on under snd_fasync_lock, and snd_fasync_work_fn() now also evaluates fasync->on under the same lock. snd_kill_fasync() still tests the flag before taking the lock, leaving an unsynchronized read against FASYNC enable/disable updates.
Move the enabled-state check into the locked section.
Also clear fasync->on under snd_fasync_lock in snd_fasync_free() before unlinking the pending entry. Together with the locked sender-side check, this publishes teardown before flushing the deferred work and prevents a racing sender from requeueing the entry after free has started.
--- sound/core/misc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
sound/core/misc.c +6 -2
@@ -148,9 +148,11 @@ EXPORT_SYMBOL_GPL(snd_fasync_helper);void snd_kill_fasync (struct snd_fasync *fasync,int signal,int poll) { -if (!fasync || !fasync->on) +if (!fasync)return ;guard (spinlock_irqsave)(&snd_fasync_lock); +if (!fasync->on) +return ; fasync->signal = signal; fasync->poll = poll;list_move (&fasync->list, &snd_fasync_list);
@@ -163,8 +165,10 @@ void snd_fasync_free(struct snd_fasync *if (!fasync)return ; - scoped_guard(spinlock_irq, &snd_fasync_lock) + scoped_guard(spinlock_irq, &snd_fasync_lock) { + fasync->on =0 ;list_del_init (&fasync->list); + }flush_work (&snd_fasync_work);kfree (fasync);
Greg Kroah-Hartman
maintainerPATCH 50/307 ALSA: seq: Fix UMP group 16 filtering
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
commit 92429ca999db99febced82f23362a71b2ba4c1d8 upstream.
The sequencer UAPI defines group_filter as an unsigned int bitmap. Bit 0 filters groupless messages and bits 1-16 filter UMP groups 1-16.
The internal snd_seq_client storage is only unsigned short, so bit 16 is truncated when userspace sets the filter. The same truncation affects the automatic UMP client filter used to avoid delivery to inactive groups, so events for group 16 cannot be filtered.
Store the internal bitmap as unsigned int and keep both userspace-provided and automatically generated values limited to the defined UAPI bits.
--- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_clientmgr.h | 5 ++++- sound/core/seq/seq_ump_client.c | 2 +- 3 files changed, 6 insertions(+), 3 deletions(-)
sound/core/seq/seq_clientmgr.c +1 -1
@@ -1253,7 +1253,7 @@ static int snd_seq_ioctl_set_client_infoif (client->user_pversion >=SNDRV_PROTOCOL_VERSION (1 ,0 ,3 )) client->midi_version = client_info->midi_version;memcpy (client->event_filter, client_info->event_filter,32 ); - client->group_filter = client_info->group_filter; + client->group_filter = client_info->group_filter &SND_SEQ_GROUP_FILTER_MASK ;/* notify the change */ snd_seq_system_client_ev_client_change (client->number);
sound/core/seq/seq_clientmgr.h +4 -1
@@ -14,6 +14,9 @@/* client manager */ +#define SND_SEQ_GROUP_FILTER_MASK GENMASK(SNDRV_UMP_MAX_GROUPS, 0) +#define SND_SEQ_GROUP_FILTER_GROUPS GENMASK(SNDRV_UMP_MAX_GROUPS, 1) +struct snd_seq_user_client {struct file *file;/* file struct of client */ /* ... */
@@ -40,7 +43,7 @@ struct snd_seq_client {int number;/* client number */ unsigned int filter;/* filter flags */ DECLARE_BITMAP (event_filter,256 ); -unsigned short group_filter; +unsigned int group_filter;snd_use_lock_t use_lock;int event_lost;/* ports */
sound/core/seq/seq_ump_client.c +1 -1
@@ -369,7 +369,7 @@ static void setup_client_group_filter(st cptr =snd_seq_kernel_client_get (client->seq_client);if (!cptr)return ; - filter = ~(1U <<0 );/* always allow groupless messages */ + filter =SND_SEQ_GROUP_FILTER_GROUPS ;/* always allow groupless messages */ for (p =0 ; p <SNDRV_UMP_MAX_GROUPS ; p++) {if (client->ump->groups[p].active) filter &= ~(1U << (p +1 ));
Greg Kroah-Hartman
maintainerPATCH 51/307 powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sourabh Jain <[email protected]>
commit b3a97f9484080c6e71db9e803e3cc1bb372a9bc7 upstream.
KASAN instrumentation is intended to be disabled for the kexec core code, but the existing Makefile entry misses the object suffix. As a result, the flag is not applied correctly to core_$(BITS).o.
So when KASAN is enabled, kexec_copy_flush and copy_segments in kexec/core_64.c are instrumented, which can result in accesses to shadow memory via normal address translation paths. Since these run with the MMU disabled, such accesses may trigger page faults (bad_page_fault) that cannot be handled in the kdump path, ultimately causing a hang and preventing the kdump kernel from booting. The same is true for kexec as well, since the same functions are used there.
Update the entry to include the “.o” suffix so that KASAN instrumentation is properly disabled for this object file.
--- arch/powerpc/kexec/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kexec/Makefile +1 -1
@@ -16,4 +16,4 @@ GCOV_PROFILE_core_$(BITS).o := n KCOV_INSTRUMENT_core_$(BITS).o := n UBSAN_SANITIZE_core_$(BITS).o := n KASAN_SANITIZE_core.o := n -KASAN_SANITIZE_core_$(BITS) := n +KASAN_SANITIZE_core_$(BITS).o := n
Greg Kroah-Hartman
maintainerPATCH 52/307 x86/efi: Restore IRQ state in EFI page fault handler
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit 2c340aab5485ebe9e33c01437dd4815ef33c8df5 upstream.
The kernel's softirq API does not permit re-enabling softirqs while IRQs are disabled. The reason for this is that local_bh_enable() will not only re-enable delivery of softirqs over the back of IRQs, it will also handle any pending softirqs immediately, regardless of whether IRQs are enabled at that point.
For this reason, commit
d02198550423 ("x86/fpu: Improve crypto performance by making kernel-mode FPU reliably usable in softirqs")
disables softirqs only when IRQs are enabled, as it is not permitted otherwise, but also unnecessary, given that asynchronous softirq delivery never happens to begin with while IRQs are disabled.
However, this does mean that entering a kernel mode FPU section with IRQs enabled and leaving it with IRQs disabled leads to problems, as identified by Sashiko [0]: the EFI page fault handler is called from page_fault_oops() with IRQs disabled, and thus ends the kernel mode FPU section with IRQs disabled as well, regardless of whether IRQs were enabled when it was started. This may result in schedule() being called with a non-zero preempt_count, causing a BUG().
So take care to re-enable IRQs when handling any EFI page faults if they were taken with IRQs enabled.
[0] https://sashiko.dev/#/patchset/20260430074107.27051-1-ivan.hu%40canonical.com
--- arch/x86/include/asm/efi.h | 3 ++- arch/x86/mm/fault.c | 2 +- arch/x86/platform/efi/quirks.c | 11 ++++++++++- 3 files changed, 13 insertions(+), 3 deletions(-)
arch/x86/include/asm/efi.h +2 -1
@@ -137,7 +137,8 @@ extern void __init efi_dump_pagetable(voextern void __init efi_apply_memmap_quirks (void );extern int __init efi_reuse_config (u64 tables,int nr_tables);extern void efi_delete_dummy_variable (void ); -extern void efi_crash_gracefully_on_page_fault (unsigned long phys_addr); +extern void efi_crash_gracefully_on_page_fault (unsigned long phys_addr, +const struct pt_regs *regs);extern void efi_unmap_boot_services (void );void arch_efi_call_virt_setup (void );
arch/x86/mm/fault.c +1 -1
@@ -686,7 +686,7 @@ page_fault_oops(struct pt_regs *regs, un* avoid hanging the system. */ if (IS_ENABLED (CONFIG_EFI )) -efi_crash_gracefully_on_page_fault (address); +efi_crash_gracefully_on_page_fault (address, regs);/* Only not-present faults should be handled by KFENCE. */ if (!(error_code & X86_PF_PROT) &&
arch/x86/platform/efi/quirks.c +10 -1
@@ -761,7 +761,8 @@ int efi_capsule_setup_info(struct capsul* @return: Returns, if the page fault is not handled. This function * will never return if the page fault is handled successfully. */ -void efi_crash_gracefully_on_page_fault (unsigned long phys_addr) +void efi_crash_gracefully_on_page_fault (unsigned long phys_addr, +const struct pt_regs *regs) {if (!IS_ENABLED (CONFIG_X86_64 ))return ;
@@ -811,6 +812,14 @@ void efi_crash_gracefully_on_page_fault( }/* +* The API does not permit entering a kernel mode FPU section with +* interrupts enabled and leaving it with interrupts disabled. So +* re-enable interrupts now if they were enabled when the page fault +* occurred. +*/ +local_irq_restore (regs->flags); + +/* * Before calling EFI Runtime Service, the kernel has switched the * calling process to efi_mm. Hence, switch back to task_mm. */
Greg Kroah-Hartman
maintainerPATCH 53/307 sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 80afd4c84bc8f5e80145ce35279f5ce53f6043db upstream.
scx_group_set_{weight,idle,bandwidth}() cache scx_root before acquiring scx_cgroup_ops_rwsem, so the pointer can be stale by the time the op runs. If the loaded scheduler is disabled and freed (via RCU work) and another is enabled between the naked load and the rwsem acquire, the reader sees scx_cgroup_enabled=true (the new scheduler's) but dereferences the freed one
- UAF on SCX_HAS_OP(sch, ...) / SCX_CALL_OP(sch, ...).
scx_cgroup_enabled is toggled only under scx_cgroup_ops_rwsem write (scx_cgroup_{init,exit}), so reading scx_root inside the rwsem read section correlates @sch with the enabled snapshot.
--- kernel/sched/ext.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
kernel/sched/ext.c +6 -3
@@ -3430,9 +3430,10 @@ void scx_cgroup_cancel_attach(struct cgrvoid scx_group_set_weight (struct task_group *tg,unsigned long weight) { -struct scx_sched *sch = scx_root; +struct scx_sched *sch;percpu_down_read (&scx_cgroup_ops_rwsem); + sch = scx_root;if (scx_cgroup_enabled &&SCX_HAS_OP (sch, cgroup_set_weight) && tg->scx.weight != weight)
@@ -3446,9 +3447,10 @@ void scx_group_set_weight(struct task_grvoid scx_group_set_idle (struct task_group *tg,bool idle) { -struct scx_sched *sch = scx_root; +struct scx_sched *sch;percpu_down_read (&scx_cgroup_ops_rwsem); + sch = scx_root;if (scx_cgroup_enabled &&SCX_HAS_OP (sch, cgroup_set_idle)) SCX_CALL_OP(sch, SCX_KF_UNLOCKED, cgroup_set_idle, NULL,
@@ -3463,9 +3465,10 @@ void scx_group_set_idle(struct task_grouvoid scx_group_set_bandwidth (struct task_group *tg,u64 period_us,u64 quota_us,u64 burst_us) { -struct scx_sched *sch = scx_root; +struct scx_sched *sch;percpu_down_read (&scx_cgroup_ops_rwsem); + sch = scx_root; if (scx_cgroup_enabled && SCX_HAS_OP(sch, cgroup_set_bandwidth) && (tg->scx.bw_period_us != period_us ||
Greg Kroah-Hartman
maintainerPATCH 54/307 xfrm: provide message size for XFRM_MSG_MAPPING
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruijie Li <[email protected]>
commit 28465227c80fe417b4013c432be1f3737cb9f9a3 upstream.
The compat 64=>32 translation path handles XFRM_MSG_MAPPING, but xfrm_msg_min[] does not provide the native payload size for this message type.
Add the missing XFRM_MSG_MAPPING entry so compat translation can size and translate mapping notifications correctly.
--- net/xfrm/xfrm_user.c | 1 + 1 file changed, 1 insertion(+)
net/xfrm/xfrm_user.c +1 -0
@@ -3323,6 +3323,7 @@ const int xfrm_msg_min[XFRM_NR_MSGTYPES] [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = sizeof(u32), [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = sizeof(u32), [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32), + [XFRM_MSG_MAPPING - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_mapping), [XFRM_MSG_SETDEFAULT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_default), [XFRM_MSG_GETDEFAULT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_default), };
Greg Kroah-Hartman
maintainerPATCH 55/307 xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kosiorek <[email protected]>
commit 14acf9652e5690de3c7486c6db5fb8dafd0a32a3 upstream.
KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y stable (reproduced on 6.12.47, also reachable via the same code path on torvalds/master and on the ipsec tree). Nine unique signatures cluster in the xfrm_state lifecycle, the load-bearing one being:
BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline] BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline] BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435 Workqueue: netns cleanup_net Call Trace: __hlist_del / hlist_del_rcu __xfrm_state_delete xfrm_state_delete xfrm_state_flush xfrm_state_fini ops_exit_list cleanup_net
The other observed signatures hit the same slab object from __xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB write variant of __xfrm_state_delete, all on the byseq/byspi hash chains.
__xfrm_state_delete() guards its byseq and byspi unhashes with value-based predicates:
if (x->km.seq) hlist_del_rcu(&x->byseq); if (x->id.spi) hlist_del_rcu(&x->byspi);
while everywhere else in the file (e.g. state_cache, state_cache_input) the safer hlist_unhashed() check is used. xfrm_alloc_spi() sets x->id.spi = newspi inside xfrm_state_lock and then immediately inserts into byspi, but a path that observes x->id.spi != 0 outside of xfrm_state_lock can still skip-or-hit the byspi unhash inconsistently with whether x is actually on the list. The same holds for x->km.seq versus byseq, and the bydst/bysrc unhashes have no predicate at all, so a second __xfrm_state_delete() on the same object writes through LIST_POISON pprev.
The defensive change here:
- Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst, bysrc, byseq and byspi so a second deletion is a no-op rather than a write through LIST_POISON pprev. The byseq/byspi nodes are already initialised in xfrm_state_alloc().
- Test hlist_unhashed() rather than the value predicate for byseq/byspi, so the unhash decision tracks list state rather than mutable scalar fields.
Empirical verification: applied this patch on top of v6.12.47, rebuilt, and re-ran the same syzkaller harness for 1h16m on a previously-crashy configuration that produced ~100 hits each of slab-use-after-free Read in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in __xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at ~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo confirms the xfrm_state slab is actively allocated and freed during the run (~143 KiB resident), so the fuzzer is still exercising those code paths -- they just no longer crash.
Reproduction:
- Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV
- syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db
- 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal
- 9 unique signatures collected in ~9h, all within xfrm_state lifecycle
--- net/xfrm/xfrm_state.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
net/xfrm/xfrm_state.c +6 -6
@@ -818,17 +818,17 @@ int __xfrm_state_delete(struct xfrm_statspin_lock (&net->xfrm.xfrm_state_lock);list_del (&x->km.all); -hlist_del_rcu (&x->bydst); -hlist_del_rcu (&x->bysrc); -if (x->km.seq) -hlist_del_rcu (&x->byseq); +hlist_del_init_rcu (&x->bydst); +hlist_del_init_rcu (&x->bysrc); +if (!hlist_unhashed (&x->byseq)) +hlist_del_init_rcu (&x->byseq);if (!hlist_unhashed (&x->state_cache))hlist_del_rcu (&x->state_cache);if (!hlist_unhashed (&x->state_cache_input))hlist_del_rcu (&x->state_cache_input); -if (x->id.spi) -hlist_del_rcu (&x->byspi); +if (!hlist_unhashed (&x->byspi)) +hlist_del_init_rcu (&x->byspi); net->xfrm.state_num--;xfrm_nat_keepalive_state_updated (x);spin_unlock (&net->xfrm.xfrm_state_lock);
Greg Kroah-Hartman
maintainerPATCH 56/307 ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yilin Zhu <[email protected]>
commit bc0fcb9823cd0894934cf968b525c575833d7078 upstream.
xfrm6_rcv_encap() performs an IPv6 route lookup when the skb does not already have a dst attached. ip6_route_input_lookup() returns a referenced dst entry even when the lookup resolves to an error route.
If dst->error is set, xfrm6_rcv_encap() drops the skb without attaching the dst to the skb and without releasing the reference returned by the lookup. Repeated packets hitting this path therefore leak dst entries.
Release the dst before jumping to the drop path.
--- net/ipv6/xfrm6_protocol.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv6/xfrm6_protocol.c +3 -1
@@ -88,8 +88,10 @@ int xfrm6_rcv_encap(struct sk_buff *skb, dst =ip6_route_input_lookup (dev_net (skb->dev), skb->dev, &fl6, skb, flags); -if (dst->error) +if (dst->error) { +dst_release (dst); goto drop; + }skb_dst_set (skb, dst); }
Greg Kroah-Hartman
maintainerPATCH 57/307 xfrm: ah: account for ESN high bits in async callbacks
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
commit ec54093e6a8f87e800bb6aa15eb7fc1e33faa524 upstream.
AH allocates its temporary auth/ICV layout differently when ESN is enabled:
the async ahash setup appends a 4-byte seqhi slot before the ICV or auth_data area, but the async completion callbacks still reconstruct the temporary layout as if seqhi were absent.
With an async AH implementation selected, that makes AH copy or compare the wrong bytes on both the IPv4 and IPv6 paths. In UML repro on IPv4 AH with ESN and forced async hmac(sha1), ping fails with 100% packet loss, and the callback logs show the pre-fix drift:
ah4 output_done: esn=1 err=0 icv_off=20 expected_off=24
ah4 input_done: esn=1 auth_off=20 expected_auth_off=24 icv_off=32 expected_icv_off=36
Reconstruct the callback-side layout the same way the setup path built it by skipping the ESN seqhi slot before locating the saved auth_data or ICV. Per RFC 4302, the ESN high-order 32 bits participate in the AH ICV computation, so the async callbacks must account for the seqhi slot.
Post-fix, the same IPv4 AH+ESN+forced-async-hmac(sha1) UML repro shows the corrected offset (ah4 output_done: esn=1 err=0 icv_off=24 expected_off=24) and ping succeeds; net/ipv4/ah4.o and net/ipv6/ah6.o build clean at W=1. IPv6 AH+ESN was not exercised at runtime, and the change has not been tested against a real async hardware AH engine.
--- net/ipv4/ah4.c | 14 ++++++++++++-- net/ipv6/ah6.c | 14 ++++++++++++-- 2 files changed, 24 insertions(+), 4 deletions(-)
net/ipv4/ah4.c +12 -2
@@ -124,9 +124,14 @@ static void ah_output_done(void *data, istruct iphdr *top_iph =ip_hdr (skb);struct ip_auth_hdr *ah =ip_auth_hdr (skb);int ihl =ip_hdrlen (skb); +int seqhi_len =0 ; +__be32 *seqhi; +if (x->props.flags &XFRM_STATE_ESN ) + seqhi_len =sizeof (*seqhi); iph =AH_SKB_CB (skb)->tmp; - icv =ah_tmp_icv (iph, ihl); + seqhi = (__be32 *)((char *)iph + ihl); + icv =ah_tmp_icv (seqhi, seqhi_len);memcpy (ah->auth_data, icv, ahp->icv_trunc_len); top_iph->tos = iph->tos;
@@ -270,12 +275,17 @@ static void ah_input_done(void *data, instruct ip_auth_hdr *ah =ip_auth_hdr (skb);int ihl =ip_hdrlen (skb);int ah_hlen = (ah->hdrlen +2 ) <<2 ; +int seqhi_len =0 ; +__be32 *seqhi;if (err) goto out; +if (x->props.flags &XFRM_STATE_ESN ) + seqhi_len =sizeof (*seqhi); work_iph =AH_SKB_CB (skb)->tmp; - auth_data =ah_tmp_auth (work_iph, ihl); + seqhi = (__be32 *)((char *)work_iph + ihl); + auth_data =ah_tmp_auth (seqhi, seqhi_len); icv =ah_tmp_icv (auth_data, ahp->icv_trunc_len); err =crypto_memneq (icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG :0 ;
net/ipv6/ah6.c +12 -2
@@ -317,14 +317,19 @@ static void ah6_output_done(void *data,struct ipv6hdr *top_iph =ipv6_hdr (skb);struct ip_auth_hdr *ah =ip_auth_hdr (skb);struct tmp_ext *iph_ext; +int seqhi_len =0 ; +__be32 *seqhi; extlen =skb_network_header_len (skb) -sizeof (struct ipv6hdr );if (extlen) extlen +=sizeof (*iph_ext); +if (x->props.flags &XFRM_STATE_ESN ) + seqhi_len =sizeof (*seqhi); iph_base =AH_SKB_CB (skb)->tmp; iph_ext =ah_tmp_ext (iph_base); - icv =ah_tmp_icv (iph_ext, extlen); + seqhi = (__be32 *)((char *)iph_ext + extlen); + icv =ah_tmp_icv (seqhi, seqhi_len);memcpy (ah->auth_data, icv, ahp->icv_trunc_len);memcpy (top_iph, iph_base,IPV6HDR_BASELEN );
@@ -471,13 +476,18 @@ static void ah6_input_done(void *data, istruct ip_auth_hdr *ah =ip_auth_hdr (skb);int hdr_len =skb_network_header_len (skb);int ah_hlen =ipv6_authlen (ah); +int seqhi_len =0 ; +__be32 *seqhi;if (err) goto out; +if (x->props.flags &XFRM_STATE_ESN ) + seqhi_len =sizeof (*seqhi); work_iph =AH_SKB_CB (skb)->tmp; auth_data =ah_tmp_auth (work_iph, hdr_len); - icv =ah_tmp_icv (auth_data, ahp->icv_trunc_len); + seqhi = (__be32 *)(auth_data + ahp->icv_trunc_len); + icv =ah_tmp_icv (seqhi, seqhi_len); err =crypto_memneq (icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG :0 ;if (err)
Greg Kroah-Hartman
maintainerPATCH 58/307 selinux: fix avdcache auditing
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Smalley <[email protected]>
commit f92d542577db878acfd21cc18dab23d03023b217 upstream.
The per-task avdcache was incorrectly saving and reusing the audited vector computed by avc_audit_required() rather than recomputing based on the currently requested permissions and distinguishing the denied versus allowed cases. As a result, some permission checks were not being audited, e.g. directory write checks after a previously cached directory search check.
--- security/selinux/hooks.c | 31 +++++++++++++------------------ security/selinux/include/objsec.h | 4 +--- 2 files changed, 14 insertions(+), 21 deletions(-)
security/selinux/hooks.c +13 -18
@@ -3207,15 +3207,13 @@ static inline int task_avdcache_search(s* @tsec: the task's security state * @isec: the inode associated with the cache entry * @avd: the AVD to cache -* @audited: the permission audit bitmask to cache * -* Update the AVD cache in @tsec with the @avdc and @audited info associated +* Update the AVD cache in @tsec with the @avd info associated * with @isec. */ static inline void task_avdcache_update (struct task_security_struct *tsec,struct inode_security_struct *isec, -struct av_decision *avd, -u32 audited) +struct av_decision *avd) {int spot;
@@ -3227,9 +3225,7 @@ static inline void task_avdcache_update( spot = (tsec->avdcache.dir_spot +1 ) & (TSEC_AVDC_DIR_SIZE -1 ); tsec->avdcache.dir_spot = spot; tsec->avdcache.dir[spot].isid = isec->sid; - tsec->avdcache.dir[spot].audited = audited; - tsec->avdcache.dir[spot].allowed = avd->allowed; - tsec->avdcache.dir[spot].permissive = avd->flags &AVD_FLAGS_PERMISSIVE ; + tsec->avdcache.dir[spot].avd = *avd; tsec->avdcache.permissive_neveraudit = (avd->flags == (AVD_FLAGS_PERMISSIVE |AVD_FLAGS_NEVERAUDIT )); }
@@ -3250,6 +3246,7 @@ static int selinux_inode_permission(strustruct task_security_struct *tsec;struct inode_security_struct *isec;struct avdc_entry *avdc; +struct av_decision avd, *avdp = &avd;int rc, rc2;u32 audited, denied;
@@ -3271,23 +3268,21 @@ static int selinux_inode_permission(stru rc =task_avdcache_search (tsec, isec, &avdc);if (likely (!rc)) {/* Cache hit. */ - audited = perms & avdc->audited; - denied = perms & ~avdc->allowed; -if (unlikely (denied &&enforcing_enabled () && - !avdc->permissive)) + avdp = &avdc->avd; + denied = perms & ~avdp->allowed; +if (unlikely (denied) &&enforcing_enabled () && + !(avdp->flags &AVD_FLAGS_PERMISSIVE )) rc = -EACCES ; }else { -struct av_decision avd; -/* Cache miss. */ rc =avc_has_perm_noaudit (sid, isec->sid, isec->sclass, - perms,0 , &avd); - audited =avc_audit_required (perms, &avd, rc, - (requested &MAY_ACCESS ) ?FILE__AUDIT_ACCESS :0 , - &denied); -task_avdcache_update (tsec, isec, &avd, audited); + perms,0 , avdp); +task_avdcache_update (tsec, isec, avdp); } + audited =avc_audit_required (perms, avdp, rc, + (requested &MAY_ACCESS ) ? +FILE__AUDIT_ACCESS :0 , &denied);if (likely (!audited))return rc;
security/selinux/include/objsec.h +1 -3
@@ -32,9 +32,7 @@struct avdc_entry {u32 isid;/* inode SID */ -u32 allowed;/* allowed permission bitmask */ -u32 audited;/* audited permission bitmask */ -bool permissive;/* AVC permissive flag */ +struct av_decision avd;/* av decision */ };struct cred_security_struct {
Greg Kroah-Hartman
maintainerPATCH 59/307 selinux: use sk blob accessor in socket permission helpers
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zongyao Chen <[email protected]>
commit 032e70aff025d7c519af9ab791cd084380619263 upstream.
SELinux socket state lives in the composite LSM socket blob.
sock_has_perm() and nlmsg_sock_has_extended_perms() currently dereference sk->sk_security directly, which assumes the SELinux socket blob is at offset zero.
In stacked configurations that assumption does not hold. If another LSM allocates socket blob storage before SELinux, these helpers may read the wrong blob and feed invalid SID and class values into AVC checks.
Use selinux_sock() instead of accessing sk->sk_security directly.
--- security/selinux/hooks.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
security/selinux/hooks.c +2 -2
@@ -4914,7 +4914,7 @@ static bool sock_skip_has_perm(u32 sid)static int sock_has_perm (struct sock *sk,u32 perms) { -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);struct common_audit_data ad;struct lsm_network_audit net;
@@ -6221,7 +6221,7 @@ static unsigned int selinux_ip_postroutestatic int nlmsg_sock_has_extended_perms (struct sock *sk,u32 perms,u16 nlmsg_type) { -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =selinux_sock (sk);struct common_audit_data ad;u8 driver;u8 xperm;
Greg Kroah-Hartman
maintainerPATCH 60/307 selinux: dont reserve xattr slot when we wont fill it
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Windsor <[email protected]>
commit 1e5a8eed7821e7a43a31b4c1b3675a91be6bc6f6 upstream.
Move lsm_get_xattr_slot() below the SBLABEL_MNT check so we don't leave a NULL-named slot in the array when returning -EOPNOTSUPP; filesystem initxattrs() callbacks stop iterating at the first NULL ->name, silently dropping xattrs installed by later LSMs.
--- security/selinux/hooks.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
security/selinux/hooks.c +2 -1
@@ -2965,7 +2965,7 @@ static int selinux_inode_init_security(s {const struct cred_security_struct *crsec =selinux_cred (current_cred ());struct superblock_security_struct *sbsec; -struct xattr *xattr =lsm_get_xattr_slot (xattrs, xattr_count); +struct xattr *xattr;u32 newsid, clen;u16 newsclass;int rc;
@@ -2991,6 +2991,7 @@ static int selinux_inode_init_security(s !(sbsec->flags & SBLABEL_MNT))return -EOPNOTSUPP ; + xattr =lsm_get_xattr_slot (xattrs, xattr_count);if (xattr) { rc =security_sid_to_context_force (newsid, &context, &clen);
Greg Kroah-Hartman
maintainerPATCH 61/307 selinux: shrink critical section in sel_write_load()
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Smalley <[email protected]>
commit 868f31e4061eca8c3cd607d79d954d5e54f204aa upstream.
Currently sel_write_load() takes the policy mutex earlier than necessary. Move the taking of the mutex later. This avoids holding it unnecessarily across the vmalloc() and copy_from_user() of the policy data.
--- security/selinux/selinuxfs.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-)
security/selinux/selinuxfs.c +8 -10
@@ -594,34 +594,31 @@ static ssize_t sel_write_load(struct filif (!count)return -EINVAL ; -mutex_lock (&selinux_state.policy_mutex); - length =avc_has_perm (current_sid (),SECINITSID_SECURITY ,SECCLASS_SECURITY ,SECURITY__LOAD_POLICY ,NULL );if (length) - goto out; +return length; data =vmalloc (count); -if (!data) { - length = -ENOMEM ; - goto out; - } +if (!data) +return -ENOMEM ;if (copy_from_user (data, buf, count) !=0 ) { length = -EFAULT ; goto out; } +mutex_lock (&selinux_state.policy_mutex); length =security_load_policy (data, count, &load_state);if (length) {pr_warn_ratelimited ("SELinux: failed to load policy\n" ); - goto out; + goto out_unlock; } fsi =file_inode (file)->i_sb->s_fs_info; length =sel_make_policy_nodes (fsi, load_state.policy);if (length) {pr_warn_ratelimited ("SELinux: failed to initialize selinuxfs\n" );selinux_policy_cancel (&load_state); - goto out; + goto out_unlock; }selinux_policy_commit (&load_state);
@@ -631,8 +628,9 @@ static ssize_t sel_write_load(struct filfrom_kuid (&init_user_ns,audit_get_loginuid (current)), audit_get_sessionid(current)); -out: +out_unlock:mutex_unlock (&selinux_state.policy_mutex); +out:vfree (data);return length; }
Greg Kroah-Hartman
maintainerPATCH 62/307 selinux: prune /sys/fs/selinux/checkreqprot
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Smalley <[email protected]>
commit 644132a48f4e28a1d949d162160869286f3e75de upstream.
commit a7e4676e8e2cb ("selinux: remove the 'checkreqprot' functionality") removed the ability to modify the checkreqprot setting but left everything except the updating of the checkreqprot value intact. Aside from unnecessary processing, this could produce a local DoS from log spam and incorrectly calls selinux_ima_measure_state() on each write even though no state has changed. Prune it to just log an error message once and return count (i.e. all bytes written successfully) so that userspace never breaks.
--- security/selinux/selinuxfs.c | 47 ++++++------------------------------------- 1 file changed, 7 insertions(+), 40 deletions(-)
security/selinux/selinuxfs.c +7 -40
@@ -687,46 +687,13 @@ static ssize_t sel_read_checkreqprot(strstatic ssize_t sel_write_checkreqprot (struct file *file,const char __user *buf,size_t count,loff_t *ppos) { -char *page; -ssize_t length; -unsigned int new_value; - - length =avc_has_perm (current_sid (),SECINITSID_SECURITY , -SECCLASS_SECURITY ,SECURITY__SETCHECKREQPROT , -NULL ); -if (length) -return length; - -if (count >=PAGE_SIZE ) -return -ENOMEM ; - -/* No partial writes. */ -if (*ppos !=0 ) -return -EINVAL ; - - page =memdup_user_nul (buf, count); -if (IS_ERR (page)) -return PTR_ERR (page); - -if (sscanf (page,"%u" , &new_value) !=1 ) { - length = -EINVAL ; - goto out; - } - length = count; - -if (new_value) { -char comm[sizeof (current->comm)]; - -strscpy (comm, current->comm); -pr_err ("SELinux: %s (%d) set checkreqprot to 1. This is no longer supported.\n" , - comm, current->pid); - } - -selinux_ima_measure_state (); - -out: -kfree (page); -return length; +/* +* Setting checkreqprot is no longer supported, see +* https://github.com/SELinuxProject/selinux-kernel/wiki/DEPRECATE-checkreqprot +*/ +pr_err_once ("SELinux: %s (%d) wrote to checkreqprot. This is no longer supported.\n" , + current->comm, current->pid); +return count; }static const struct file_operations sel_checkreqprot_ops = { .read = sel_read_checkreqprot,
Greg Kroah-Hartman
maintainerPATCH 63/307 selinux: prune /sys/fs/selinux/disable
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Smalley <[email protected]>
commit 19cfa0099024bb9cd40f6d950caa7f47ff8e77f6 upstream.
Commit f22f9aaf6c3d ("selinux: remove the runtime disable functionality") removed the underlying SELinux runtime disable functionality but left everything else intact and started logging an error message to warn any residual users.
Prune it to just log an error message once and to return count (i.e. all bytes written successfully) to avoid breaking userspace. This also fixes a local DoS from logspam.
--- security/selinux/selinuxfs.c | 36 +++++++----------------------------- 1 file changed, 7 insertions(+), 29 deletions(-)
security/selinux/selinuxfs.c +7 -29
@@ -272,35 +272,13 @@ static ssize_t sel_write_disable(struct size_t count, loff_t *ppos) { - char *page; -ssize_t length; -int new_value; - -if (count >=PAGE_SIZE ) -return -ENOMEM ; - -/* No partial writes. */ -if (*ppos !=0 ) -return -EINVAL ; - - page =memdup_user_nul (buf, count); -if (IS_ERR (page)) -return PTR_ERR (page); - -if (sscanf (page,"%d" , &new_value) !=1 ) { - length = -EINVAL ; - goto out; - } - length = count; - -if (new_value) { -pr_err ("SELinux: https://github.com/SELinuxProject/selinux-kernel/wiki/DEPRECATE-runtime-disable\n" ); -pr_err ("SELinux: Runtime disable is not supported, use selinux=0 on the kernel cmdline.\n" ); - } - -out: -kfree (page); -return length; + /* + * Setting disable is no longer supported, see + * https://github.com/SELinuxProject/selinux-kernel/wiki/DEPRECATE-runtime-disable + */ + pr_err_once("SELinux: %s (%d) wrote to disable. This is no longer supported.\n", + current->comm, current->pid); +return count; } static const struct file_operations sel_disable_ops = {
Greg Kroah-Hartman
maintainerPATCH 64/307 selinux: prune /sys/fs/selinux/user
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Smalley <[email protected]>
commit ad1ac3d740cc6b858a99ab9c45c8c0574be7d1d3 upstream.
Remove the previously deprecated /sys/fs/selinux/user interface aside from a residual stub for userspace compatibility.
Commit d7b6918e22c7 ("selinux: Deprecate /sys/fs/selinux/user") started the deprecation process for /sys/fs/selinux/user:
The selinuxfs "user" node allows userspace to request a list of security contexts that can be reached for a given SELinux user from a given starting context. This was used by libselinux when various login-style programs requested contexts for users, but libselinux stopped using it in 2020. Kernel support will be removed no sooner than Dec 2025.
A pr_warn() message has been in place since Linux v6.13, and a 5 second sleep was introduced since Linux v6.17 to help make it more noticeable.
We are now past the stated deadline of Dec 2025, so remove the underlying functionality and replace it with a stub that returns a '0\0' buffer to avoid breaking userspace. This also avoids a local DoS from logspam and an uninterruptible sleep delay.
---
.../{obsolete => removed}/sysfs-selinux-user | 0
Documentation/ABI/obsolete/sysfs-selinux-user | 12 --
Documentation/ABI/removed/sysfs-selinux-user | 12 ++
security/selinux/include/security.h | 2
security/selinux/selinuxfs.c | 68 +-------------
security/selinux/ss/services.c | 125 --------------------------
5 files changed, 17 insertions(+), 202 deletions(-)
rename Documentation/ABI/{obsolete => removed}/sysfs-selinux-user (100%)Documentation/ABI/obsolete/sysfs-selinux-user deleted +0 -12
@@ -1,12 +0,0 @@ -What: /sys/fs/selinux/user -Date: April 2005 (predates git) -KernelVersion: 2.6.12-rc2 (predates git) -Contact: [email protected] -Description: - - The selinuxfs "user" node allows userspace to request a list - of security contexts that can be reached for a given SELinux - user from a given starting context. This was used by libselinux - when various login-style programs requested contexts for - users, but libselinux stopped using it in 2020. - Kernel support will be removed no sooner than Dec 2025.
Documentation/ABI/removed/sysfs-selinux-user new file +12 -0
@@ -0,0 +1,12 @@ +What: /sys/fs/selinux/user +Date: April 2005 (predates git) +KernelVersion: 2.6.12-rc2 (predates git) +Contact: [email protected] +Description: + + The selinuxfs "user" node allows userspace to request a list + of security contexts that can be reached for a given SELinux + user from a given starting context. This was used by libselinux + when various login-style programs requested contexts for + users, but libselinux stopped using it in 2020. + Kernel support will be removed no sooner than Dec 2025.
security/selinux/include/security.h +0 -2
@@ -312,8 +312,6 @@ int security_context_to_sid_default(consint security_context_to_sid_force (const char *scontext,u32 scontext_len,u32 *sid); -int security_get_user_sids (u32 fromsid,const char *username,u32 **sids,u32 *nel); -int security_port_sid (u8 protocol,u16 port,u32 *out_sid);int security_ib_pkey_sid (u64 subnet_prefix,u16 pkey_num,u32 *out_sid);
security/selinux/selinuxfs.c +5 -63
74 lines not on this page · raw message
security/selinux/ss/services.c +0 -125
131 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 65/307 selinux: allow multiple opens of /sys/fs/selinux/policy
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Smalley <[email protected]>
commit a02cd6805562305f936e807da83e253b719dd965 upstream.
Currently there can only be a single open of /sys/fs/selinux/policy at any time. This allows any process to block any other process from reading the kernel policy. The original motivation seems to have been a mix of preventing an inconsistent view of the policy size and preventing userspace from allocating kernel memory without bound, but this is arguably equally bad. Eliminate the policy_opened flag and shrink the critical section that the policy mutex is held. While we are making changes here, drop a couple of extraneous BUG_ONs.
--- security/selinux/selinuxfs.c | 27 ++++----------------------- 1 file changed, 4 insertions(+), 23 deletions(-)
security/selinux/selinuxfs.c +4 -23
@@ -76,7 +76,6 @@ struct selinux_fs_info {int *bool_pending_values;struct dentry *class_dir;unsigned long last_class_ino; -bool policy_opened;unsigned long last_ino;struct super_block *sb; };
@@ -340,44 +339,31 @@ struct policy_load_memory {static int sel_open_policy (struct inode *inode,struct file *filp) { -struct selinux_fs_info *fsi = inode->i_sb->s_fs_info;struct policy_load_memory *plm =NULL ;int rc; -BUG_ON (filp->private_data); - -mutex_lock (&selinux_state.policy_mutex); - rc =avc_has_perm (current_sid (),SECINITSID_SECURITY ,SECCLASS_SECURITY ,SECURITY__READ_POLICY ,NULL );if (rc) - goto err; +return rc; - rc = -EBUSY ; -if (fsi->policy_opened) - goto err; - - rc = -ENOMEM ; plm =kzalloc_obj (*plm);if (!plm) - goto err; +return -ENOMEM ; +mutex_lock (&selinux_state.policy_mutex); rc =security_read_policy (&plm->data, &plm->len);if (rc) goto err; -if ((size_t )i_size_read (inode) != plm->len) {inode_lock (inode);i_size_write (inode, plm->len);inode_unlock (inode); } - - fsi->policy_opened =1 ; +mutex_unlock (&selinux_state.policy_mutex); filp->private_data = plm; -mutex_unlock (&selinux_state.policy_mutex); -return 0 ; err:mutex_unlock (&selinux_state.policy_mutex);
@@ -390,13 +376,8 @@ err:static int sel_release_policy (struct inode *inode,struct file *filp) { -struct selinux_fs_info *fsi = inode->i_sb->s_fs_info;struct policy_load_memory *plm = filp->private_data; -BUG_ON (!plm); - - fsi->policy_opened =0 ; -vfree (plm->data);kfree (plm);
Greg Kroah-Hartman
maintainerPATCH 66/307 io_uring/kbuf: support min length left for incremental buffers
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Michaelis <[email protected]>
commit 7deba791ad495ce1d7921683f4f7d1190fa210d1 upstream.
Incrementally consumed buffer rings are generally fully consumed, but it's quite possible that the application has a minimum size it needs to meet to avoid truncation. Currently that minimum limit is 1 byte, but this should be a setting that is the hands of the application. For recvmsg multishot, a prime use case for incrementally consumed buffers, the application may get spurious -EFAULT returned at the end of an incrementally consumed buffer, as less space is available than the headers need.
Grab a u32 field in struct io_uring_buf_reg, which the application can use to inform the kernel of the minimum size that should be available in an incrementally consumed buffer. If less than that is available, the current buffer is fully processed and the next one will be picked.
--- include/uapi/linux/io_uring.h | 3 ++- io_uring/kbuf.c | 8 +++++++- io_uring/kbuf.h | 7 +++++++ 3 files changed, 16 insertions(+), 2 deletions(-)
include/uapi/linux/io_uring.h +2 -1
@@ -898,7 +898,8 @@ struct io_uring_buf_reg {__u32 ring_entries;__u16 bgid;__u16 flags; -__u64 resv[3 ]; +__u32 min_left; +__u32 resv[5 ]; };/* argument for IORING_REGISTER_PBUF_STATUS */
io_uring/kbuf.c +7 -1
@@ -47,7 +47,7 @@ static bool io_kbuf_inc_commit(struct io this_len =min_t (u32, len, buf_len); buf_len -= this_len;/* Stop looping for invalid buffer length of 0 */ -if (buf_len || !this_len) { +if (buf_len > bl->min_left_sub_one || !this_len) {WRITE_ONCE (buf->addr,READ_ONCE (buf->addr) + this_len);WRITE_ONCE (buf->len, buf_len);return false;
@@ -637,6 +637,10 @@ int io_register_pbuf_ring(struct io_ringif (reg.ring_entries >=65536 )return -EINVAL ; +/* minimum left byte count is a property of incremental buffers */ +if (!(reg.flags &IOU_PBUF_RING_INC ) && reg.min_left) +return -EINVAL ; + bl =io_buffer_get_list (ctx, reg.bgid);if (bl) {/* if mapped buffer ring OR classic exists, don't allow */
@@ -684,6 +688,8 @@ int io_register_pbuf_ring(struct io_ring bl->mask = reg.ring_entries -1 ; bl->flags |=IOBL_BUF_RING ; bl->buf_ring = br; +if (reg.min_left) + bl->min_left_sub_one = reg.min_left -1 ;if (reg.flags &IOU_PBUF_RING_INC ) bl->flags |=IOBL_INC ; ret =io_buffer_add_list (ctx, bl, reg.bgid);
io_uring/kbuf.h +7 -0
@@ -33,6 +33,13 @@ struct io_buffer_list {__u16 flags; +/* +* minimum required amount to be left to reuse an incrementally +* consumed buffer. If less than this is left at consumption time, +* buffer is done and head is incremented to the next buffer. +*/ +__u32 min_left_sub_one; +struct io_mapped_region region; };
Greg Kroah-Hartman
maintainerPATCH 67/307 io_uring/tw: serialize ctx->retry_llist with ->uring_lock
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
commit 17666e2d7592c3e85260cafd3950121524acc2c5 upstream.
The DEFER_TASKRUN local task work paths all run under ctx->uring_lock, which serializes them with each other and with the rest of the ring's hot paths. io_move_task_work_from_local() is the exception - it's called from io_ring_exit_work() on a kworker without holding the lock and from the iopoll cancelation side right after dropping it.
->work_llist is fine with this, as it's only ever updated via the expected paths. But the ->retry_llist is updated while runing, and hence it could potentially race between normal task_work running and the task-has-exited shutdown path.
Simply grab ->uring_lock while moving the local work to the fallback list for exit purposes, which nicely serializes it across both the normal additions and the exit prune path.
--- io_uring/tw.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
io_uring/tw.c +11 -1
@@ -273,8 +273,18 @@ void io_req_task_work_add_remote(structvoid __cold io_move_task_work_from_local (struct io_ring_ctx *ctx) { -struct llist_node *node =llist_del_all (&ctx->work_llist); +struct llist_node *node; +/* +* Running the work items may utilize ->retry_llist as a means +* for capping the number of task_work entries run at the same +* time. But that list can potentially race with moving the work +* from here, if the task is exiting. As any normal task_work +* running holds ->uring_lock already, just guard this slow path +* with ->uring_lock to avoid racing on ->retry_llist. +*/ +guard (mutex)(&ctx->uring_lock); + node =llist_del_all (&ctx->work_llist);__io_fallback_tw (node, false); node =llist_del_all (&ctx->retry_llist);__io_fallback_tw (node, false);
Greg Kroah-Hartman
maintainerPATCH 68/307 LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read()
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Cui <[email protected]>
commit f26faae96c411a70641e4d21b759475caa6122d5 upstream.
In the ldptr (0x24...0x27) opcode decoding path, the default case only breaks out but without setting "ret" value to EMULATE_FAIL. This leaves run->mmio.len uninitialized (stale from a previous MMIO operation) while "ret" value remains EMULATE_DO_MMIO, causing the code to proceed with an incorrect MMIO length.
Add "ret = EMULATE_FAIL" to match the other default branches in the same function (e.g. the 0x28...0x2e and 0x38 cases).
--- arch/loongarch/kvm/exit.c | 1 + 1 file changed, 1 insertion(+)
arch/loongarch/kvm/exit.c +1 -0
@@ -390,6 +390,7 @@ int kvm_emu_mmio_read(struct kvm_vcpu *v run->mmio.len =8 ;break ;default : + ret =EMULATE_FAIL ;break ; }break ;
Greg Kroah-Hartman
maintainerPATCH 69/307 Bluetooth: virtio_bt: clamp rx length before skb_put
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
commit 21bd244b6de5d2fe1063c23acc93fbdd2b20d112 upstream.
virtbt_rx_work() calls skb_put(skb, len) where len comes directly from virtqueue_get_buf() with no validation against the buffer we posted to the device. The RX skb is allocated in virtbt_add_inbuf() and exposed to virtio as exactly 1000 bytes via sg_init_one().
Checking len against skb_tailroom(skb) is not sufficient because alloc_skb() can leave more tailroom than the 1000 bytes actually handed to the device. A malicious or buggy backend can therefore report used.len between 1001 and skb_tailroom(skb), causing skb_put() to include uninitialized kernel heap bytes that were never written by the device.
The same path also accepts len == 0, in which case skb_put(skb, 0) leaves the skb empty but virtbt_rx_handle() still reads the pkt_type byte from skb->data, consuming uninitialized memory.
Define VIRTBT_RX_BUF_SIZE once and reuse it in alloc_skb() and sg_init_one(), and gate virtbt_rx_work() on that same constant so the bound checked matches the buffer actually exposed to the device. Reject used.len == 0 in the same gate so an empty completion can no longer reach virtbt_rx_handle().
Use bt_dev_err_ratelimited() because the length value comes from an untrusted backend that can otherwise flood the kernel log.
Same class of bug as commit c04db81cd028 ("net/9p: Fix buffer overflow in USB transport layer"), which hardened the USB 9p transport against unchecked device-reported length.
--- drivers/bluetooth/virtio_bt.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/bluetooth/virtio_bt.c +12 -4
@@ -12,6 +12,7 @@#include <net/bluetooth/hci_core.h> #define VERSION "0.1" +#define VIRTBT_RX_BUF_SIZE 1000enum {VIRTBT_VQ_TX ,
@@ -33,11 +34,11 @@ static int virtbt_add_inbuf(struct virtistruct sk_buff *skb;int err; - skb =alloc_skb (1000 ,GFP_KERNEL ); + skb =alloc_skb (VIRTBT_RX_BUF_SIZE ,GFP_KERNEL );if (!skb)return -ENOMEM ; -sg_init_one (sg, skb->data,1000 ); +sg_init_one (sg, skb->data,VIRTBT_RX_BUF_SIZE ); err =virtqueue_add_inbuf (vq, sg,1 , skb,GFP_KERNEL );if (err <0 ) {
@@ -227,8 +228,15 @@ static void virtbt_rx_work(struct work_sif (!skb)return ; -skb_put (skb, len); -virtbt_rx_handle (vbt, skb); +if (!len || len >VIRTBT_RX_BUF_SIZE ) { +bt_dev_err_ratelimited (vbt->hdev, +"rx reply len %u outside [1, %u]\n" , + len,VIRTBT_RX_BUF_SIZE ); +kfree_skb (skb); + }else { +skb_put (skb, len); +virtbt_rx_handle (vbt, skb); + }if (virtbt_add_inbuf (vbt) <0 )return ;
Greg Kroah-Hartman
maintainerPATCH 70/307 Bluetooth: virtio_bt: validate rx pkt_type header length
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
commit daf23014e5d975e72ea9c02b5160d3fcf070ea47 upstream.
virtbt_rx_handle() reads the leading pkt_type byte from the RX skb and forwards the remainder to hci_recv_frame() for every event/ACL/SCO/ISO type, without checking that the remaining payload is at least the fixed HCI header for that type.
After the preceding patch bounds the backend-supplied used.len to [1, VIRTBT_RX_BUF_SIZE], a one-byte completion still reaches hci_recv_frame() with skb->len already pulled to 0. If the byte happened to be HCI_ACLDATA_PKT, the ACL-vs-ISO classification fast-path in hci_dev_classify_pkt_type() dereferences hci_acl_hdr(skb)->handle whenever the HCI device has an active CIS_LINK, BIS_LINK, or PA_LINK connection, reading two bytes of uninitialized RX-buffer data. The same hazard exists for every packet type the driver accepts because none of the switch cases in virtbt_rx_handle() check skb->len against the per-type minimum HCI header size before handing the frame to the core.
After stripping pkt_type, require skb->len to cover the fixed header size for the selected type (event 2, ACL 4, SCO 3, ISO 4) before calling hci_recv_frame(); drop ratelimited otherwise. Unknown pkt_type values still take the original kfree_skb() default path.
Use bt_dev_err_ratelimited() because both the length and pkt_type values come from an untrusted backend that can otherwise flood the kernel log.
--- drivers/bluetooth/virtio_bt.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-)
drivers/bluetooth/virtio_bt.c +20 -3
@@ -198,6 +198,7 @@ static int virtbt_shutdown_generic(strucstatic void virtbt_rx_handle (struct virtio_bluetooth *vbt,struct sk_buff *skb) { +size_t min_hdr;__u8 pkt_type; pkt_type = *((__u8 *) skb->data);
@@ -205,16 +206,32 @@ static void virtbt_rx_handle(struct virtswitch (pkt_type) {case HCI_EVENT_PKT : + min_hdr =sizeof (struct hci_event_hdr ); +break ;case HCI_ACLDATA_PKT : + min_hdr =sizeof (struct hci_acl_hdr ); +break ;case HCI_SCODATA_PKT : + min_hdr =sizeof (struct hci_sco_hdr ); +break ;case HCI_ISODATA_PKT : -hci_skb_pkt_type (skb) = pkt_type; -hci_recv_frame (vbt->hdev, skb); + min_hdr =sizeof (struct hci_iso_hdr );break ;default :kfree_skb (skb); -break ; +return ; } + +if (skb->len < min_hdr) { +bt_dev_err_ratelimited (vbt->hdev, +"rx pkt_type 0x%02x payload %u < hdr %zu\n" , + pkt_type, skb->len, min_hdr); +kfree_skb (skb); +return ; + } + +hci_skb_pkt_type (skb) = pkt_type; +hci_recv_frame (vbt->hdev, skb); }static void virtbt_rx_work (struct work_struct *work)
Greg Kroah-Hartman
maintainerPATCH 71/307 Bluetooth: btmtk: validate WMT event SKB length before struct access
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <[email protected]>
commit 634a4408c0615c523cf7531790f4f14a422b9206 upstream.
btmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to struct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc (9 bytes) without first checking that the SKB contains enough data. A short firmware response causes out-of-bounds reads from SKB tailroom.
Use skb_pull_data() to validate and advance past the base WMT event header. For the FUNC_CTRL case, pull the additional status field bytes before accessing them.
--- drivers/bluetooth/btmtk.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/bluetooth/btmtk.c +13 -2
@@ -654,8 +654,13 @@ static int btmtk_usb_hci_wmt_sync(structif (data->evt_skb ==NULL ) goto err_free_wc; -/* Parse and handle the return WMT event */ - wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data; + wmt_evt =skb_pull_data (data->evt_skb,sizeof (*wmt_evt)); +if (!wmt_evt) { +bt_dev_err (hdev,"WMT event too short (%u bytes)" , + data->evt_skb->len); + err = -EINVAL ; + goto err_free_skb; + }if (wmt_evt->whdr.op != hdr->op) {bt_dev_err (hdev,"Wrong op received %d expected %d" , wmt_evt->whdr.op, hdr->op);
@@ -671,6 +676,12 @@ static int btmtk_usb_hci_wmt_sync(struct status =BTMTK_WMT_PATCH_DONE ;break ;case BTMTK_WMT_FUNC_CTRL : +if (!skb_pull_data (data->evt_skb, +sizeof (wmt_evt_funcc->status))) { + err = -EINVAL ; + goto err_free_skb; + } + wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;if (be16_to_cpu (wmt_evt_funcc->status) ==0x404 ) status =BTMTK_WMT_ON_DONE ;
Greg Kroah-Hartman
maintainerPATCH 72/307 Bluetooth: hci_conn: fix potential UAF in create_big_sync
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <[email protected]>
commit 0beddb0c380bed5f5b8e61ddbe14635bb73d0b41 upstream.
Add hci_conn_valid() check in create_big_sync() to detect stale connections before proceeding with BIG creation. Handle the resulting -ECANCELED in create_big_complete() and re-validate the connection under hci_dev_lock() before dereferencing, matching the pattern used by create_le_conn_complete() and create_pa_complete().
Keep the hci_conn object alive across the async boundary by taking a reference via hci_conn_get() when queueing create_big_sync(), and dropping it in the completion callback. The refcount and the lock are complementary: the refcount keeps the object allocated, while hci_dev_lock() serializes hci_conn_hash_del()'s list_del_rcu() on hdev->conn_hash, as required by hci_conn_del().
hci_conn_put() is called outside hci_dev_unlock() so the final put (which resolves to kfree() via bt_link_release) does not run under hdev->lock, though the release path would be safe either way.
Without this, create_big_complete() would unconditionally dereference the conn pointer on error, causing a use-after-free via hci_connect_cfm() and hci_conn_del().
--- net/bluetooth/hci_conn.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
net/bluetooth/hci_conn.c +18 -1
@@ -2130,6 +2130,9 @@ static int create_big_sync(struct hci_deu32 flags =0 ;int err; +if (!hci_conn_valid (hdev, conn)) +return -ECANCELED ; +if (qos->bcast.out.phys ==BIT (1 )) flags |=MGMT_ADV_FLAG_SEC_2M ;
@@ -2204,11 +2207,24 @@ static void create_big_complete(struct hbt_dev_dbg (hdev,"conn %p" , conn); +if (err == -ECANCELED ) + goto done; + +hci_dev_lock (hdev); + +if (!hci_conn_valid (hdev, conn)) + goto unlock; +if (err) {bt_dev_err (hdev,"Unable to create BIG: %d" , err);hci_connect_cfm (conn, err);hci_conn_del (conn); } + +unlock: +hci_dev_unlock (hdev); +done: +hci_conn_put (conn); } struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, __u8 sid,
@@ -2336,10 +2352,11 @@ struct hci_conn *hci_connect_bis(struct BT_BOUND, &data);/* Queue start periodic advertising and create BIG */ - err =hci_cmd_sync_queue (hdev, create_big_sync, conn, + err =hci_cmd_sync_queue (hdev, create_big_sync,hci_conn_get (conn), create_big_complete);if (err <0 ) {hci_conn_drop (conn); +hci_conn_put (conn);return ERR_PTR (err); }
Greg Kroah-Hartman
maintainerPATCH 73/307 Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
commit 5ddb8014261137cadaf83ab5617a588d80a22586 upstream.
hci_le_create_big_complete_evt() iterates over BT_BOUND connections for a BIG handle using a while loop, accessing ev->bis_handle[i++] on each iteration. However, there is no check that i stays within ev->num_bis before the array access.
When a controller sends a LE_Create_BIG_Complete event with fewer bis_handle entries than there are BT_BOUND connections for that BIG, or with num_bis=0, the loop reads beyond the valid bis_handle[] flex array into adjacent heap memory. Since the out-of-bounds values typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle() rejects them and the connection remains in BT_BOUND state. The same connection is then found again by hci_conn_hash_lookup_big_state(), creating an infinite loop with hci_dev_lock held.
Fix this by terminating the BIG if in case not all BIS could be setup properly.
--- net/bluetooth/hci_event.c | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-)
net/bluetooth/hci_event.c +25 -2
@@ -7121,9 +7121,29 @@ static void hci_le_create_big_complete_econtinue ; } +if (ev->num_bis <= i) { +bt_dev_err (hdev, +"Not enough BIS handles for BIG 0x%2.2x" , + ev->handle); + ev->status =HCI_ERROR_UNSPECIFIED ; +hci_connect_cfm (conn, ev->status); +hci_conn_del (conn); +continue ; + } +if (hci_conn_set_handle (conn, -__le16_to_cpu (ev->bis_handle[i++]))) +__le16_to_cpu (ev->bis_handle[i++]))) { +bt_dev_err (hdev, +"Failed to set BIS handle for BIG 0x%2.2x" , + ev->handle); +/* Force error so BIG gets terminated as not all BIS +* could be connected. +*/ + ev->status =HCI_ERROR_UNSPECIFIED ; +hci_connect_cfm (conn, ev->status); +hci_conn_del (conn);continue ; + } conn->state =BT_CONNECTED ;set_bit (HCI_CONN_BIG_CREATED , &conn->flags);
@@ -7132,7 +7152,10 @@ static void hci_le_create_big_complete_ehci_iso_setup_path (conn); } -if (!ev->status && !i) +/* If there is an unexpected error or if no BISes have been connected +* for the BIG, terminate it. +*/ +if (ev->status ==HCI_ERROR_UNSPECIFIED || (!ev->status && !i))/* If no BISes have been connected for the BIG, * terminate. This is in case all bound connections * have been closed before the BIG creation
Greg Kroah-Hartman
maintainerPATCH 74/307 Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siwei Zhang <[email protected]>
commit 0a120d96166301d7a95be75b52f843837dbd1219 upstream.
Add the same NULL guard already present inl2cap_sock_resume_cb() and l2cap_sock_ready_cb().
--- net/bluetooth/l2cap_sock.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/l2cap_sock.c +3 -0
@@ -1498,6 +1498,9 @@ static struct l2cap_chan *l2cap_sock_new {struct sock *sk, *parent = chan->data; +if (!parent) +return NULL ; +lock_sock (parent);/* Check for backlog size */
Greg Kroah-Hartman
maintainerPATCH 75/307 Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siwei Zhang <[email protected]>
commit 2ff1a41a912de8517b4482e946dd951b7d80edbf upstream.
Add the same NULL guard already present inl2cap_sock_resume_cb() and l2cap_sock_ready_cb().
--- net/bluetooth/l2cap_sock.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/l2cap_sock.c +3 -0
@@ -1660,6 +1660,9 @@ static void l2cap_sock_state_change_cb(s {struct sock *sk = chan->data; +if (!sk) +return ; + sk->sk_state = state;if (err)
Greg Kroah-Hartman
maintainerPATCH 76/307 Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siwei Zhang <[email protected]>
commit 78a88d43dab8d23aeef934ed8ce34d40e6b3d613 upstream.
Add the same NULL guard already present inl2cap_sock_resume_cb() and l2cap_sock_ready_cb().
--- net/bluetooth/l2cap_sock.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/l2cap_sock.c +3 -0
@@ -1764,6 +1764,9 @@ static long l2cap_sock_get_sndtimeo_cb(s {struct sock *sk = chan->data; +if (!sk) +return 0 ; +return READ_ONCE (sk->sk_sndtimeo); }
Greg Kroah-Hartman
maintainerPATCH 77/307 rust: drm: gem: clean up GEM state in init failure case
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eliot Courtney <[email protected]>
commit 2e42a17b8f6bc3c0cd69d7556b588011d3ec2394 upstream.
Currently, if drm_gem_object_init fails, the object is freed without any cleanup. Perform the cleanup in that case.
[ Move safety comment closer to unsafe block to avoid a clippy warning.
- Danilo ]
--- rust/kernel/drm/gem/mod.rs | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
rust/kernel/drm/gem/mod.rs +11 -2
@@ -207,8 +207,17 @@ impl<T: DriverObject> Object<T> {// SAFETY: `obj.as_raw()` is guaranteed to be valid by the initialization above. unsafe { (*obj.as_raw ()).funcs = &Self ::OBJECT_FUNCS }; -// SAFETY: The arguments are all valid per the type invariants. -to_result (unsafe { bindings::drm_gem_object_init (dev.as_raw (), obj.obj.get (), size) })?; +if let Err (err) = +// SAFETY: The arguments are all valid per the type invariants. +to_result (unsafe { + bindings::drm_gem_object_init (dev.as_raw (), obj.obj.get (), size) + }) + { +// SAFETY: `drm_gem_object_init()` initializes the private GEM object state before +// failing, so `drm_gem_private_object_fini()` is the matching cleanup. +unsafe { bindings::drm_gem_private_object_fini (obj.obj.get ()) }; +return Err (err); + }// SAFETY: We will never move out of `Self` as `ARef<Self>` is always treated as pinned. let ptr =KBox ::into_raw (unsafe {Pin ::into_inner_unchecked (obj) });
Greg Kroah-Hartman
maintainerPATCH 78/307 rust: allow `clippy::collapsible_match` globally
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit 838d852da8503372f3a1779bfbd1ccb93153ab4e upstream.
The clippy::collapsible_match lint [1] can make code harder to read in certain cases [2], e.g.
CLIPPY P rust/libmacros.so - due to command line change
warning: this `if` can be collapsed into the outer `match`
--> rust/pin-init/internal/src/helpers.rs:91:17
|
91 | / if nesting == 1 {
92 | | impl_generics.push(tt.clone());
93 | | impl_generics.push(tt);
94 | | skip_until_comma = false;
95 | | }
| |_________________^
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#collapsible_match
= note: `-W clippy::collapsible-match` implied by `-W clippy::all`
= help: to override `-W clippy::all` add `#[allow(clippy::collapsible_match)]`
help: collapse nested if block
|
90 ~ TokenTree::Punct(p) if skip_until_comma && p.as_char() == ','
91 ~ && nesting == 1 => {
92 | impl_generics.push(tt.clone());
93 | impl_generics.push(tt);
94 | skip_until_comma = false;
95 ~ }
|The lint does not have much upside -- when the suggestion may be a good one, it would still read fine when nested anyway. And it is the kind of lint that may easily bias people to just apply the suggestion instead of allowing it.
[ In addition, as Gary points out [3], the suggestion is also wrong [4] and
in the process of being fixed [5], possibly for Rust 1.97.0:
- Miguel ]
Thus just let developers decide on their own.
--- Makefile | 1 + 1 file changed, 1 insertion(+)
Makefile +1 -0
@@ -486,6 +486,7 @@ export rust_common_flags := --edition=20 -Wclippy::as_ptr_cast_mut \ -Wclippy::as_underscore \ -Wclippy::cast_lossless \ + -Aclippy::collapsible_match \ -Wclippy::ignored_unit_patterns \ -Wclippy::mut_mut \ -Wclippy::needless_bitwise_bool \
Greg Kroah-Hartman
maintainerPATCH 79/307 rust: allow `clippy::collapsible_if` globally
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit 2adc8664018c1cc595c7c0c98474a33c7fe32a85 upstream.
Similar to clippy::collapsible_match (globally allowed in the previous commit), the clippy::collapsible_if lint [1] can make code harder to read in certain cases.
Thus just let developers decide on their own.
In addition, remove the existing expect we had.
--- Makefile | 1 + drivers/android/binder/range_alloc/array.rs | 1 - 2 files changed, 1 insertion(+), 1 deletion(-)
Makefile +1 -0
@@ -486,6 +486,7 @@ export rust_common_flags := --edition=20 -Wclippy::as_ptr_cast_mut \ -Wclippy::as_underscore \ -Wclippy::cast_lossless \ + -Aclippy::collapsible_if \ -Aclippy::collapsible_match \ -Wclippy::ignored_unit_patterns \ -Wclippy::mut_mut \
drivers/android/binder/range_alloc/array.rs +0 -1
@@ -204,7 +204,6 @@ impl<T> ArrayRangeAllocator<T> {// caller will mark them as unused, which means that they can be freed if the system comes // under memory pressure. let mut freed_range =FreedRange ::interior_pages (offset, size); -#[expect(clippy::collapsible_if)] // reads better like this if offset %PAGE_SIZE !=0 {if i ==0 || self.ranges[i -1 ].endpoint () <= (offset &PAGE_MASK ) { freed_range.start_page_idx -=1 ;
Greg Kroah-Hartman
maintainerPATCH 80/307 rust: pin-init: internal: move alignment check to `make_field_check`
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gary Guo <[email protected]>
commit 83ac2870310b694775ab7e8f0244fdd94fc21926 upstream.
Instead of having the reference creation serving dual-purpose as both for let bindings and alignment check, detangle them so that the alignment check is done explicitly in make_field_check. This is more robust against refactors that may change the way let bindings are created.
--- rust/pin-init/internal/src/init.rs | 78 +++++++++++++++++-------------------- 1 file changed, 37 insertions(+), 41 deletions(-)
rust/pin-init/internal/src/init.rs +37 -41
@@ -243,10 +243,6 @@ fn init_fields( });// Again span for better diagnostics let write =quote_spanned! (ident.span ()=> ::core::ptr::write); -// NOTE: the field accessor ensures that the initialized field is properly aligned. -// Unaligned fields will cause the compiler to emit E0793. We do not support -// unaligned fields since `Init::__init` requires an aligned pointer; the call to -// `ptr::write` below has the same requirement. let accessor =if pinned {let project_ident =format_ident! ("__project_{ident}" );quote! {
@@ -361,49 +357,49 @@ fn init_fields( } } -/// Generate the check for ensuring that every field has been initialized. +/// Generate the check for ensuring that every field has been initialized and aligned. fn make_field_check ( fields: &Punctuated <InitializerField ,Token! [,]>, init_kind:InitKind , path: &Path , ) ->TokenStream { -let field_attrs = fields +let field_attrs:Vec <_ > = fields .iter () - .filter_map (|f| f.kind.ident ().map (|_| &f.attrs)); -let field_name = fields.iter ().filter_map (|f| f.kind.ident ()); -match init_kind { -InitKind ::Normal =>quote! { -// We use unreachable code to ensure that all fields have been mentioned exactly once, -// this struct initializer will still be type-checked and complain with a very natural -// error message if a field is forgotten/mentioned more than once. -#[allow(unreachable_code, clippy::diverging_sub_expression)] -// SAFETY: this code is never executed. -let _ = ||unsafe { - ::core::ptr::write (slot, #path { - #( - #(#field_attrs)* - #field_name: ::core::panic!(), - )* - }) - }; - }, -InitKind ::Zeroing =>quote! { -// We use unreachable code to ensure that all fields have been mentioned at most once. -// Since the user specified `..Zeroable::zeroed()` at the end, all missing fields will -// be zeroed. This struct initializer will still be type-checked and complain with a -// very natural error message if a field is mentioned more than once, or doesn't exist. -#[allow(unreachable_code, clippy::diverging_sub_expression, unused_assignments)] -// SAFETY: this code is never executed. -let _ = ||unsafe { - ::core::ptr::write (slot, #path { - #( - #(#field_attrs)* - #field_name: ::core::panic!(), - )* - ..::core::mem::zeroed () - }) - }; - }, + .filter_map (|f| f.kind.ident ().map (|_| &f.attrs)) + .collect (); +let field_name:Vec <_ > = fields.iter ().filter_map (|f| f.kind.ident ()).collect (); +let zeroing_trailer =match init_kind { +InitKind ::Normal =>None , +InitKind ::Zeroing =>Some (quote! { + ..::core::mem::zeroed () + }), + }; +quote! { +#[allow(unreachable_code, clippy::diverging_sub_expression)] +// We use unreachable code to perform field checks. They're still checked by the compiler. +// SAFETY: this code is never executed. +let _ = ||unsafe { +// Create references to ensure that the initialized field is properly aligned. +// Unaligned fields will cause the compiler to emit E0793. We do not support +// unaligned fields since `Init::__init` requires an aligned pointer; the call to +// `ptr::write` for value-initialization case has the same requirement. + #( + #(#field_attrs)* +let _ = &(*slot).#field_name; + )* + +// If the zeroing trailer is not present, this checks that all fields have been +// mentioned exactly once. If the zeroing trailer is present, all missing fields will be +// zeroed, so this checks that all fields have been mentioned at most once. The use of +// struct initializer will still generate very natural error messages for any misuse. + ::core::ptr::write (slot, #path { + #( + #(#field_attrs)* + #field_name: ::core::panic!(), + )* + #zeroing_trailer + }) + }; } }
Greg Kroah-Hartman
maintainerPATCH 81/307 spi: syncuacer: fix controller deregistration
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 75d849c3452e9611de031db45b3149ba9a99035f upstream.
Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind.
--- drivers/spi/spi-synquacer.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/spi/spi-synquacer.c +7 -1
@@ -716,7 +716,7 @@ static int synquacer_spi_probe(struct plpm_runtime_set_active (sspi->dev);pm_runtime_enable (sspi->dev); - ret =devm_spi_register_controller (sspi->dev, host); + ret =spi_register_controller (host);if (ret) goto disable_pm;
@@ -737,9 +737,15 @@ static void synquacer_spi_remove(structstruct spi_controller *host =platform_get_drvdata (pdev);struct synquacer_spi *sspi =spi_controller_get_devdata (host); +spi_controller_get (host); + +spi_unregister_controller (host); +pm_runtime_disable (sspi->dev);clk_disable_unprepare (sspi->clk); + +spi_controller_put (host); }static int __maybe_unused synquacer_spi_suspend (struct device *dev)
Greg Kroah-Hartman
maintainerPATCH 82/307 spi: sun4i: fix controller deregistration
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 42108a2f03e0fdeabe9d02d085bdb058baa1189f upstream.
Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind.
--- drivers/spi/spi-sun4i.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/spi/spi-sun4i.c +9 -1
@@ -504,7 +504,7 @@ static int sun4i_spi_probe(struct platfopm_runtime_enable (&pdev->dev);pm_runtime_idle (&pdev->dev); - ret =devm_spi_register_controller (&pdev->dev, host); + ret =spi_register_controller (host);if (ret) {dev_err (&pdev->dev,"cannot register SPI host\n" ); goto err_pm_disable;
@@ -522,7 +522,15 @@ err_free_host:static void sun4i_spi_remove (struct platform_device *pdev) { +struct spi_controller *host =platform_get_drvdata (pdev); + +spi_controller_get (host); + +spi_unregister_controller (host); +pm_runtime_force_suspend (&pdev->dev); + +spi_controller_put (host); }static const struct of_device_id sun4i_spi_match[] = {
Greg Kroah-Hartman
maintainerPATCH 83/307 spi: zynq-qspi: fix controller deregistration
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit c9c012706c9fa8ca6d129a9161caf92ab625a3fd upstream.
Make sure to deregister the controller before disabling it during driver unbind.
Note that clocks were also disabled before the recent commit 1f8fd9490e31 ("spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled()").
--- drivers/spi/spi-zynq-qspi.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/spi/spi-zynq-qspi.c +11 -4
@@ -643,7 +643,7 @@ static int zynq_qspi_probe(struct platfo xqspi =spi_controller_get_devdata (ctlr); xqspi->dev = dev; -platform_set_drvdata (pdev, xqspi); +platform_set_drvdata (pdev, ctlr); xqspi->regs =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (xqspi->regs)) { ret =PTR_ERR (xqspi->regs);
@@ -702,9 +702,9 @@ static int zynq_qspi_probe(struct platfo/* QSPI controller initializations */ zynq_qspi_init_hw (xqspi, ctlr->num_chipselect); - ret =devm_spi_register_controller (&pdev->dev, ctlr); + ret =spi_register_controller (ctlr);if (ret) { -dev_err (&pdev->dev,"devm_spi_register_controller failed\n" ); +dev_err (&pdev->dev,"failed to register controller\n" ); goto remove_ctlr; }
@@ -728,9 +728,16 @@ remove_ctlr:*/ static void zynq_qspi_remove (struct platform_device *pdev) { -struct zynq_qspi *xqspi =platform_get_drvdata (pdev); +struct spi_controller *ctlr =platform_get_drvdata (pdev); +struct zynq_qspi *xqspi =spi_controller_get_devdata (ctlr); + +spi_controller_get (ctlr); + +spi_unregister_controller (ctlr);zynq_qspi_write (xqspi,ZYNQ_QSPI_ENABLE_OFFSET ,0 ); + +spi_controller_put (ctlr); }static const struct of_device_id zynq_qspi_of_match[] = {
Greg Kroah-Hartman
maintainerPATCH 84/307 spi: ti-qspi: fix controller deregistration
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 0c18a1bacbb1d8b8aa34d3d004a2cb8226c8b1ea upstream.
Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind.
Note that the controller is suspended before disabling and releasing resources since commit 3ac066e2227c ("spi: spi-ti-qspi: Suspend the queue before removing the device") which avoids issues like unclocked accesses but prevents SPI device drivers from doing I/O during deregistration.
--- drivers/spi/spi-ti-qspi.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/spi/spi-ti-qspi.c +6 -8
@@ -888,7 +888,7 @@ no_dma: qspi->mmap_enabled = false; qspi->current_cs =-1 ; - ret =devm_spi_register_controller (&pdev->dev, host); + ret =spi_register_controller (host);if (!ret)return 0 ;
@@ -903,19 +903,17 @@ free_host:static void ti_qspi_remove (struct platform_device *pdev) {struct ti_qspi *qspi =platform_get_drvdata (pdev); -int rc; - rc =spi_controller_suspend (qspi->host); -if (rc) { -dev_alert (&pdev->dev,"spi_controller_suspend() failed (%pe)\n" , -ERR_PTR (rc)); -return ; - } +spi_controller_get (qspi->host); + +spi_unregister_controller (qspi->host);pm_runtime_put_sync (&pdev->dev);pm_runtime_disable (&pdev->dev);ti_qspi_dma_cleanup (qspi); + +spi_controller_put (qspi->host); }static const struct dev_pm_ops ti_qspi_pm_ops = {
Greg Kroah-Hartman
maintainerPATCH 85/307 spi: sun6i: fix controller deregistration
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit d874a1c33aee0d88fb4ba2f8aeadaa9f1965209a upstream.
Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind.
--- drivers/spi/spi-sun6i.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/spi/spi-sun6i.c +7 -1
@@ -742,7 +742,7 @@ static int sun6i_spi_probe(struct platfopm_runtime_set_active (&pdev->dev);pm_runtime_enable (&pdev->dev); - ret =devm_spi_register_controller (&pdev->dev, host); + ret =spi_register_controller (host);if (ret) {dev_err (&pdev->dev,"cannot register SPI host\n" ); goto err_pm_disable;
@@ -768,12 +768,18 @@ static void sun6i_spi_remove(struct plat {struct spi_controller *host =platform_get_drvdata (pdev); +spi_controller_get (host); + +spi_unregister_controller (host); +pm_runtime_force_suspend (&pdev->dev);if (host->dma_tx)dma_release_channel (host->dma_tx);if (host->dma_rx)dma_release_channel (host->dma_rx); + +spi_controller_put (host); }static const struct sun6i_spi_cfg sun6i_a31_spi_cfg = {
Greg Kroah-Hartman
maintainerPATCH 86/307 spi: tegra114: fix controller deregistration
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 9c9c27ff2058142d8f800de3186d6864184958de upstream.
Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind.
--- drivers/spi/spi-tegra114.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/spi/spi-tegra114.c +7 -1
@@ -1415,7 +1415,7 @@ static int tegra_spi_probe(struct platfo goto exit_pm_disable; } - ret =devm_spi_register_controller (&pdev->dev, host); + ret =spi_register_controller (host);if (ret <0 ) {dev_err (&pdev->dev,"can not register to host err %d\n" , ret); goto exit_free_irq;
@@ -1441,6 +1441,10 @@ static void tegra_spi_remove(struct platstruct spi_controller *host =platform_get_drvdata (pdev);struct tegra_spi_data *tspi =spi_controller_get_devdata (host); +spi_controller_get (host); + +spi_unregister_controller (host); +free_irq (tspi->irq, tspi);if (tspi->tx_dma_chan)
@@ -1452,6 +1456,8 @@ static void tegra_spi_remove(struct platpm_runtime_disable (&pdev->dev);if (!pm_runtime_status_suspended (&pdev->dev))tegra_spi_runtime_suspend (&pdev->dev); + +spi_controller_put (host); }#ifdef CONFIG_PM_SLEEP
Greg Kroah-Hartman
maintainerPATCH 87/307 spi: zynqmp-gqspi: fix controller deregistration
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 6895fc4faafc9082e15e4e624b23dd5f0c98feb5 upstream.
Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind.
--- drivers/spi/spi-zynqmp-gqspi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/spi/spi-zynqmp-gqspi.c +3 -1
@@ -1324,7 +1324,7 @@ static int zynqmp_qspi_probe(struct plat ctlr->dev.of_node = np; ctlr->auto_runtime_pm = true; - ret =devm_spi_register_controller (&pdev->dev, ctlr); + ret =spi_register_controller (ctlr);if (ret) {dev_err (&pdev->dev,"spi_register_controller failed\n" ); goto clk_dis_all;
@@ -1362,6 +1362,8 @@ static void zynqmp_qspi_remove(struct plpm_runtime_get_sync (&pdev->dev); +spi_unregister_controller (xqspi->ctlr); +zynqmp_gqspi_write (xqspi,GQSPI_EN_OFST ,0x0 );pm_runtime_disable (&pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 88/307 spi: tegra20-sflash: fix controller deregistration
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit ad7310e983327f939dd6c4e801eab13238992572 upstream.
Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind.
--- drivers/spi/spi-tegra20-sflash.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/spi/spi-tegra20-sflash.c +7 -1
@@ -505,7 +505,7 @@ static int tegra_sflash_probe(struct plategra_sflash_writel (tsd, tsd->def_command_reg,SPI_COMMAND );pm_runtime_put (&pdev->dev); - ret =devm_spi_register_controller (&pdev->dev, host); + ret =spi_register_controller (host);if (ret <0 ) {dev_err (&pdev->dev,"can not register to host err %d\n" , ret); goto exit_pm_disable;
@@ -528,11 +528,17 @@ static void tegra_sflash_remove(struct pstruct spi_controller *host =platform_get_drvdata (pdev);struct tegra_sflash_data *tsd =spi_controller_get_devdata (host); +spi_controller_get (host); + +spi_unregister_controller (host); +free_irq (tsd->irq, tsd);pm_runtime_disable (&pdev->dev);if (!pm_runtime_status_suspended (&pdev->dev))tegra_sflash_runtime_suspend (&pdev->dev); + +spi_controller_put (host); }#ifdef CONFIG_PM_SLEEP
Greg Kroah-Hartman
maintainerPATCH 89/307 spi: s3c64xx: fix NULL-deref on driver unbind
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 45daacbead8a009844bd5dba6cfa731332184d17 upstream.
A change moving DMA channel allocation from probe() back to s3c64xx_spi_prepare_transfer() failed to remove the corresponding deallocation from remove().
Drop the bogus DMA channel release from remove() to avoid triggering a NULL-pointer dereference on driver unbind.
This issue was flagged by Sashiko when reviewing a controller deregistration fix.
--- drivers/spi/spi-s3c64xx.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/spi/spi-s3c64xx.c +0 -5
@@ -1401,11 +1401,6 @@ static void s3c64xx_spi_remove(struct plwritel (0 , sdd->regs +S3C64XX_SPI_INT_EN ); -if (!is_polling (sdd)) { -dma_release_channel (sdd->rx_dma.ch); -dma_release_channel (sdd->tx_dma.ch); - } -pm_runtime_put_noidle (&pdev->dev);pm_runtime_disable (&pdev->dev);pm_runtime_set_suspended (&pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 90/307 staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Sunder Reddy Padira <[email protected]>
commit bc851db06045a40c18233dd76ef0562d7f8bb6db upstream.
The return value of kzalloc_flex() is used without ensuring that the allocation succeeded, and the pointer is dereferenced unconditionally.
Guard the access to the allocated structure to
avoid a potential NULL pointer dereference if the
allocation fails.
--- drivers/staging/rtl8723bs/os_dep/osdep_service.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/staging/rtl8723bs/os_dep/osdep_service.c +2 -1
@@ -194,7 +194,8 @@ struct rtw_cbuf *rtw_cbuf_alloc(u32 sizestruct rtw_cbuf *cbuf; cbuf =kzalloc_flex (*cbuf, bufs, size); - cbuf->size = size; +if (cbuf) + cbuf->size = size;return cbuf; }
Greg Kroah-Hartman
maintainerPATCH 91/307 staging: vme_user: fix root device leak on init failure
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 32c91e8ee039777d0b95b914633fc6a42607959c upstream.
Make sure to deregister and free the root device in case module initialisation fails.
--- drivers/staging/vme_user/vme_fake.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/staging/vme_user/vme_fake.c +2 -0
@@ -1230,6 +1230,8 @@ err_master: err_driver:kfree (fake_bridge); err_struct: +root_device_unregister (vme_root); +return retval; }
Greg Kroah-Hartman
maintainerPATCH 92/307 fanotify: fix false positive on permission events
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit 7746e3bd4cc19b5092e00d32d676e329bfcb6900 upstream.
fsnotify_get_mark_safe() may return false for a mark on an unrelated group, which results in bypassing the permission check.
Fix by skipping over detached marks that are not in the current group.
--- fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 +++++++++++------- include/linux/fsnotify_backend.h | 1 + 3 files changed, 13 insertions(+), 8 deletions(-)
fs/notify/fsnotify.c +1 -1
@@ -388,7 +388,7 @@ static struct fsnotify_mark *fsnotify_fi return hlist_entry_safe(node, struct fsnotify_mark, obj_list); } -static struct fsnotify_mark *fsnotify_next_mark (struct fsnotify_mark *mark) +struct fsnotify_mark *fsnotify_next_mark (struct fsnotify_mark *mark) {struct hlist_node *node =NULL ;
fs/notify/mark.c +11 -7
@@ -457,9 +457,6 @@ EXPORT_SYMBOL_GPL(fsnotify_put_mark);*/ static bool fsnotify_get_mark_safe (struct fsnotify_mark *mark) { -if (!mark) -return true; -if (refcount_inc_not_zero (&mark->refcnt)) {spin_lock (&mark->lock);if (mark->flags &FSNOTIFY_MARK_FLAG_ATTACHED ) {
@@ -500,15 +497,22 @@ bool fsnotify_prepare_user_wait(struct fint type;fsnotify_foreach_iter_type (type) { +struct fsnotify_mark *mark = iter_info->marks[type]; +/* This can fail if mark is being removed */ -if (!fsnotify_get_mark_safe (iter_info->marks[type])) { -__release (&fsnotify_mark_srcu); - goto fail; +while (mark && !fsnotify_get_mark_safe (mark)) { +if (mark->group == iter_info->current_group) { +__release (&fsnotify_mark_srcu); + goto fail; + } +/* This is a mark in an unrelated group, skip */ + mark =fsnotify_next_mark (mark); + iter_info->marks[type] = mark; } }/* -* Now that both marks are pinned by refcount in the inode / vfsmount +* Now that all marks are pinned by refcount in the inode / vfsmount / etc * lists, we can drop SRCU lock, and safely resume the list iteration * once userspace returns. */
include/linux/fsnotify_backend.h +1 -0
@@ -915,6 +915,7 @@ extern void fsnotify_clear_marks_by_grou unsigned int obj_type);extern void fsnotify_get_mark (struct fsnotify_mark *mark);extern void fsnotify_put_mark (struct fsnotify_mark *mark); +struct fsnotify_mark *fsnotify_next_mark (struct fsnotify_mark *mark);extern void fsnotify_finish_user_wait (struct fsnotify_iter_info *iter_info);extern bool fsnotify_prepare_user_wait (struct fsnotify_iter_info *iter_info);
Greg Kroah-Hartman
maintainerPATCH 93/307 KVM: arm64: Fix kvm_vcpu_initialized() macro parameter
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fuad Tabba <[email protected]>
commit d89fdda7dd8a488f922e1175e6782f781ba8a23b upstream.
The macro is defined with parameter 'v' but the body references the literal token 'vcpu' instead, causing it to silently operate on whatever 'vcpu' resolves to in the caller's scope rather than the value passed by the caller. All current call sites happen to use a variable named 'vcpu', so the bug is latent.
--- arch/arm64/include/asm/kvm_host.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/include/asm/kvm_host.h +1 -1
@@ -1506,7 +1506,7 @@ static inline bool __vcpu_has_feature(co#define kvm_vcpu_has_feature (k, f) __vcpu_has_feature(&(k)->arch, (f))#define vcpu_has_feature (v, f) __vcpu_has_feature(&(v)->kvm->arch, (f)) -#define kvm_vcpu_initialized (v) vcpu_get_flag(vcpu, VCPU_INITIALIZED) +#define kvm_vcpu_initialized (v) vcpu_get_flag(v, VCPU_INITIALIZED)int kvm_trng_call (struct kvm_vcpu *vcpu);#ifdef CONFIG_KVM
Greg Kroah-Hartman
maintainerPATCH 94/307 mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tudor Ambarus <[email protected]>
commit e47029b977e747cb3a9174308fd55762cce70147 upstream.
Sashiko noticed an out-of-bounds read [1].
In spi_nor_params_show(), the snor_f_names array is passed to spi_nor_print_flags() using sizeof(snor_f_names).
Since snor_f_names is an array of pointers, sizeof() returns the total number of bytes occupied by the pointers
(element_count * sizeof(void *))
rather than the element count itself. On 64-bit systems, this makes the passed length 8x larger than intended.
Inside spi_nor_print_flags(), the 'names_len' argument is used to bounds-check the 'names' array access. An out-of-bounds read occurs if a flag bit is set that exceeds the array's actual element count but is within the inflated byte-size count.
Correct this by using ARRAY_SIZE() to pass the actual number of string pointers in the array.
--- drivers/mtd/spi-nor/debugfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/mtd/spi-nor/debugfs.c +3 -1
@@ -1,5 +1,6 @@// SPDX-License-Identifier: GPL-2.0 +#include <linux/array_size.h> #include <linux/debugfs.h> #include <linux/mtd/spi-nor.h> #include <linux/spi/spi.h>
@@ -92,7 +93,8 @@ static int spi_nor_params_show(struct seseq_printf (s,"address nbytes\t%u\n" , nor->addr_nbytes);seq_puts (s,"flags\t\t" ); -spi_nor_print_flags (s, nor->flags, snor_f_names,sizeof (snor_f_names)); +spi_nor_print_flags (s, nor->flags, snor_f_names, +ARRAY_SIZE (snor_f_names));seq_puts (s,"\n" );seq_puts (s,"\nopcodes\n" );
Greg Kroah-Hartman
maintainerPATCH 95/307 arm64: signal: Preserve POR_EL0 if poe_context is missing
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Brodsky <[email protected]>
commit 030e8a40fff65ca6ac1c04a4d3c08afe72438922 upstream.
Commit 2e8a1acea859 ("arm64: signal: Improve POR_EL0 handling to avoid uaccess failures") delayed the write to POR_EL0 in rt_sigreturn to avoid spurious uaccess failures. This change however relies on the poe_context frame record being present: on a system supporting POE, calling sigreturn without a poe_context record now results in writing arbitrary data from the kernel stack into POR_EL0.
Fix this by adding a __valid_fields member to struct user_access_state, and zeroing the struct on allocation. restore_poe_context() then indicates that the por_el0 field is valid by setting the corresponding bit in __valid_fields, and restore_user_access_state() only touches POR_EL0 if there is a valid value to set it to. This is in line with how POR_EL0 was originally handled; all frame records are currently optional, except fpsimd_context.
To ensure that __valid_fields is kept in sync, fields (currently just por_el0) are now accessed via accessors and prefixed with __ to discourage direct access.
--- arch/arm64/kernel/signal.c | 54 +++++++++++++++++++++++++++++++++++---------- 1 file changed, 43 insertions(+), 11 deletions(-)
arch/arm64/kernel/signal.c +43 -11
@@ -67,6 +67,9 @@ struct rt_sigframe_user_layout {unsigned long end_offset; }; +#define TERMINATOR_SIZE round_up(sizeof(struct _aarch64_ctx), 16) +#define EXTRA_CONTEXT_SIZE round_up(sizeof(struct extra_context), 16) +/* * Holds any EL0-controlled state that influences unprivileged memory accesses. * This includes both accesses done in userspace and uaccess done in the kernel.
@@ -74,13 +77,35 @@ struct rt_sigframe_user_layout {* This state needs to be carefully managed to ensure that it doesn't cause * uaccess to fail when setting up the signal frame, and the signal handler * itself also expects a well-defined state when entered. +* +* The struct should be zero-initialised. Its members should only be accessed +* via the accessors below. __valid_fields tracks which of the fields are valid +* (have been set to some value). */ struct user_access_state { -u64 por_el0; +unsigned int __valid_fields; +u64 __por_el0; }; -#define TERMINATOR_SIZE round_up(sizeof(struct _aarch64_ctx), 16) -#define EXTRA_CONTEXT_SIZE round_up(sizeof(struct extra_context), 16) +#define UA_STATE_HAS_POR_EL0 BIT(0) + +static void set_ua_state_por_el0 (struct user_access_state *ua_state, +u64 por_el0) +{ + ua_state->__por_el0 = por_el0; + ua_state->__valid_fields |=UA_STATE_HAS_POR_EL0 ; +} + +static int get_ua_state_por_el0 (const struct user_access_state *ua_state, +u64 *por_el0) +{ +if (ua_state->__valid_fields &UA_STATE_HAS_POR_EL0 ) { + *por_el0 = ua_state->__por_el0; +return 0 ; + } + +return -ENOENT ; +}/* * Save the user access state into ua_state and reset it to disable any
@@ -94,7 +119,7 @@ static void save_reset_user_access_statefor (int pkey =0 ; pkey <arch_max_pkey (); pkey++) por_enable_all |=POR_ELx_PERM_PREP (pkey,POE_RWX ); - ua_state->por_el0 =read_sysreg_s (SYS_POR_EL0 ); +set_ua_state_por_el0 (ua_state,read_sysreg_s (SYS_POR_EL0 ));write_sysreg_s (por_enable_all,SYS_POR_EL0 );/* * No ISB required as we can tolerate spurious Overlay faults -
@@ -122,8 +147,10 @@ static void set_handler_user_access_stat*/ static void restore_user_access_state (const struct user_access_state *ua_state) { -if (system_supports_poe ()) -write_sysreg_s (ua_state->por_el0,SYS_POR_EL0 ); +u64 por_el0; + +if (get_ua_state_por_el0 (ua_state, &por_el0) ==0 ) +write_sysreg_s (por_el0,SYS_POR_EL0 ); }static void init_user_layout (struct rt_sigframe_user_layout *user)
@@ -333,11 +360,16 @@ static int restore_fpmr_context(struct ustatic int preserve_poe_context (struct poe_context __user *ctx,const struct user_access_state *ua_state) { -int err =0 ; +int err; +u64 por_el0; + + err =get_ua_state_por_el0 (ua_state, &por_el0); +if (WARN_ON_ONCE (err)) +return err;__put_user_error (POE_MAGIC , &ctx->head.magic, err);__put_user_error (sizeof (*ctx), &ctx->head.size, err); -__put_user_error (ua_state->por_el0, &ctx->por_el0, err); +__put_user_error (por_el0, &ctx->por_el0, err);return err; }
@@ -353,7 +385,7 @@ static int restore_poe_context(struct us__get_user_error (por_el0, &(user->poe->por_el0), err);if (!err) - ua_state->por_el0 = por_el0; +set_ua_state_por_el0 (ua_state, por_el0);return err; }
@@ -1095,7 +1127,7 @@ SYSCALL_DEFINE0(rt_sigreturn) {struct pt_regs *regs =current_pt_regs ();struct rt_sigframe __user *frame; -struct user_access_state ua_state; +struct user_access_state ua_state = {};/* Always make any pending restarted system calls return -EINTR */ current->restart_block.fn = do_no_restart_syscall;
@@ -1507,7 +1539,7 @@ static int setup_rt_frame(int usig, stru {struct rt_sigframe_user_layout user;struct rt_sigframe __user *frame; -struct user_access_state ua_state; +struct user_access_state ua_state = {};int err =0 ;fpsimd_save_and_flush_current_state ();
Greg Kroah-Hartman
maintainerPATCH 96/307 mm/hugetlb_cma: round up per_node before logging it
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sang-Heon Jeon <[email protected]>
commit 8f5ce56b76303c55b78a87af996e2e0f8535f979 upstream.
When the user requests a total hugetlb CMA size without per-node specification, hugetlb_cma_reserve() computes per_node from hugetlb_cma_size and the number of nodes that have memory
per_node = DIV_ROUND_UP(hugetlb_cma_size,
nodes_weight(hugetlb_bootmem_nodes));
The reservation loop later computes
size = round_up(min(per_node, hugetlb_cma_size - reserved),
PAGE_SIZE << order);
So the actually reserved per_node size is multiple of (PAGE_SIZE << order), but the logged per_node is not rounded up, so it may be smaller than the actual reserved size.
For example, as the existing comment describes, if a 3 GB area is requested on a machine with 4 NUMA nodes that have memory, 1 GB is allocated on the first three nodes, but the printed log is
hugetlb_cma: reserve 3072 MiB, up to 768 MiB per node
Round per_node up to (PAGE_SIZE << order) before logging so that the printed log always matches the actual reserved size. No functional change to the actual reservation size, as the following case analysis shows
1. remaining (hugetlb_cma_size - reserved) >= rounded per_node
- AS-IS: min() picks unrounded per_node;
round_up() returns rounded per_node
- TO-BE: min() picks rounded per_node;
round_up() returns rounded per_node (no-op)
2. remaining < unrounded per_node
- AS-IS: min() picks remaining;
round_up() returns round_up(remaining)
- TO-BE: min() picks remaining;
round_up() returns round_up(remaining)
3. unrounded per_node <= remaining < rounded per_node
- AS-IS: min() picks unrounded per_node;
round_up() returns rounded per_node
- TO-BE: min() picks remaining;
round_up() returns round_up(remaining) equals rounded per_node
--- mm/hugetlb_cma.c | 1 + 1 file changed, 1 insertion(+)
mm/hugetlb_cma.c +1 -0
@@ -204,6 +204,7 @@ void __init hugetlb_cma_reserve(void)*/ per_node =DIV_ROUND_UP (hugetlb_cma_size,nodes_weight (hugetlb_bootmem_nodes)); + per_node =round_up (per_node,PAGE_SIZE << order);pr_info ("hugetlb_cma: reserve %lu MiB, up to %lu MiB per node\n" , hugetlb_cma_size /SZ_1M , per_node /SZ_1M ); }
Greg Kroah-Hartman
maintainerPATCH 97/307 LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 98b8aebb14fdc0133939fd8fe07d0d98333dc976 upstream.
The SYM_SIGFUNC_START definition should match sigcontext that the length of GPRs are 8 bytes for both 32BIT and 64BIT. So replace SZREG with 8 to fix it.
--- arch/loongarch/include/asm/linkage.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/loongarch/include/asm/linkage.h +1 -1
@@ -69,7 +69,7 @@9 ,10 ,11 ,12 ,13 ,14 ,15 ,16 , \17 ,18 ,19 ,20 ,21 ,22 ,23 ,24 , \25 ,26 ,27 ,28 ,29 ,30 ,31 ; \ - .cfi_offset \num, SC_REGS + \num * SZREG; \ + .cfi_offset \num, SC_REGS + \num * 8; \ .endr; \ \ nop; \
Greg Kroah-Hartman
maintainerPATCH 98/307 LoongArch: KVM: Compile switch.S directly into the kernel
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xianglai Li <[email protected]>
commit 5203012fa6045aac4b69d4e7c212e16dcf38ef10 upstream.
If we directly compile the switch.S file into the kernel, the address of the kvm_exc_entry function will definitely be within the DMW memory area. Therefore, we will no longer need to perform a copy relocation of the kvm_exc_entry.
So this patch compiles switch.S directly into the kernel, and then remove the copy relocation execution logic for the kvm_exc_entry function.
--- arch/loongarch/Kbuild | 2 - arch/loongarch/include/asm/asm-prototypes.h | 20 ++++++++++++++++ arch/loongarch/include/asm/kvm_host.h | 3 -- arch/loongarch/kvm/Makefile | 3 +- arch/loongarch/kvm/main.c | 35 ++-------------------------- arch/loongarch/kvm/switch.S | 20 ++++++++++++---- 6 files changed, 41 insertions(+), 42 deletions(-)
arch/loongarch/Kbuild +1 -1
@@ -3,7 +3,7 @@ obj-y += mm/ obj-y += net/ obj-y += vdso/ -obj-$(CONFIG_KVM) += kvm/ +obj-$(subst m,y,$(CONFIG_KVM)) += kvm/ # for cleaning subdir- += boot
arch/loongarch/include/asm/asm-prototypes.h +20 -0
@@ -20,3 +20,23 @@ asmlinkage void noinstr __no_stack_protestruct pt_regs *regs, int (*fn)(void *), void *fn_arg); + +struct kvm_run ; +struct kvm_vcpu ; +struct loongarch_fpu ; + +void kvm_exc_entry (void ); +int kvm_enter_guest (struct kvm_run *run,struct kvm_vcpu *vcpu); + +void kvm_save_fpu (struct loongarch_fpu *fpu); +void kvm_restore_fpu (struct loongarch_fpu *fpu); + +#ifdef CONFIG_CPU_HAS_LSX +void kvm_save_lsx (struct loongarch_fpu *fpu); +void kvm_restore_lsx (struct loongarch_fpu *fpu); +#endif + +#ifdef CONFIG_CPU_HAS_LASX +void kvm_save_lasx (struct loongarch_fpu *fpu); +void kvm_restore_lasx (struct loongarch_fpu *fpu); +#endif
arch/loongarch/include/asm/kvm_host.h +0 -3
@@ -86,7 +86,6 @@ struct kvm_context {struct kvm_world_switch {int (*exc_entry)(void );int (*enter_guest)(struct kvm_run *run,struct kvm_vcpu *vcpu); -unsigned long page_order; };#define MAX_PGTABLE_LEVELS 4
@@ -356,8 +355,6 @@ void kvm_exc_entry(void);int kvm_enter_guest (struct kvm_run *run,struct kvm_vcpu *vcpu);extern unsigned long vpid_mask; -extern const unsigned long kvm_exception_size; -extern const unsigned long kvm_enter_guest_size;extern struct kvm_world_switch *kvm_loongarch_ops;#define SW_GCSR (1 << 0)
arch/loongarch/kvm/Makefile +2 -1
@@ -7,11 +7,12 @@ include $(srctree)/virt/kvm/Makefile.kvm obj-$(CONFIG_KVM) += kvm.o +obj-y += switch.o + kvm-y += exit.o kvm-y += interrupt.o kvm-y += main.o kvm-y += mmu.o -kvm-y += switch.o kvm-y += timer.o kvm-y += tlb.o kvm-y += vcpu.o
arch/loongarch/kvm/main.c +3 -32
@@ -348,8 +348,7 @@ void kvm_arch_disable_virtualization_cpustatic int kvm_loongarch_env_init (void ) { -int cpu, order, ret; -void *addr; +int cpu, ret;struct kvm_context *context; vmcs = alloc_percpu(struct kvm_context);
@@ -365,30 +364,8 @@ static int kvm_loongarch_env_init(void)return -ENOMEM ; } -/* -* PGD register is shared between root kernel and kvm hypervisor. -* So world switch entry should be in DMW area rather than TLB area -* to avoid page fault reenter. -* -* In future if hardware pagetable walking is supported, we won't -* need to copy world switch code to DMW area. -*/ - order =get_order (kvm_exception_size + kvm_enter_guest_size); - addr = (void *)__get_free_pages (GFP_KERNEL , order); -if (!addr) { -free_percpu (vmcs); - vmcs =NULL ; -kfree (kvm_loongarch_ops); - kvm_loongarch_ops =NULL ; -return -ENOMEM ; - } - -memcpy (addr, kvm_exc_entry, kvm_exception_size); -memcpy (addr + kvm_exception_size, kvm_enter_guest, kvm_enter_guest_size); -flush_icache_range ((unsigned long )addr, (unsigned long )addr + kvm_exception_size + kvm_enter_guest_size); - kvm_loongarch_ops->exc_entry = addr; - kvm_loongarch_ops->enter_guest = addr + kvm_exception_size; - kvm_loongarch_ops->page_order = order; + kvm_loongarch_ops->exc_entry = (void *)kvm_exc_entry; + kvm_loongarch_ops->enter_guest = (void *)kvm_enter_guest; vpid_mask =read_csr_gstat (); vpid_mask = (vpid_mask &CSR_GSTAT_GIDBIT ) >>CSR_GSTAT_GIDBIT_SHIFT ;
@@ -422,16 +399,10 @@ static int kvm_loongarch_env_init(void)static void kvm_loongarch_env_exit (void ) { -unsigned long addr; -if (vmcs)free_percpu (vmcs);if (kvm_loongarch_ops) { -if (kvm_loongarch_ops->exc_entry) { - addr = (unsigned long )kvm_loongarch_ops->exc_entry; -free_pages (addr, kvm_loongarch_ops->page_order); - }kfree (kvm_loongarch_ops); }
arch/loongarch/kvm/switch.S +15 -5
@@ -4,9 +4,11 @@ */ #include <linux/linkage.h> +#include <linux/kvm_types.h> #include <asm/asm.h> #include <asm/asmmacro.h> #include <asm/loongarch.h> +#include <asm/page.h> #include <asm/regdef.h> #include <asm/unwind_hints.h>
@@ -100,8 +102,13 @@ * - is still in guest mode, such as pgd table/vmid registers etc, * - will fix with hw page walk enabled in future * load kvm_vcpu from reserved CSR KVM_VCPU_KS, and save a2 to KVM_TEMP_KS + * + * PGD register is shared between root kernel and kvm hypervisor. + * So world switch entry should be in DMW area rather than TLB area + * to avoid page fault re-enter. */ .text + .p2align PAGE_SHIFT .cfi_sections .debug_frame SYM_CODE_START(kvm_exc_entry) UNWIND_HINT_UNDEFINED
@@ -190,8 +197,8 @@ ret_to_host: kvm_restore_host_gpr a2 jr ra -SYM_INNER_LABEL(kvm_exc_entry_end, SYM_L_LOCAL) SYM_CODE_END(kvm_exc_entry) +EXPORT_SYMBOL_FOR_KVM(kvm_exc_entry) /* * int kvm_enter_guest(struct kvm_run *run, struct kvm_vcpu *vcpu)
@@ -215,8 +222,8 @@ SYM_FUNC_START(kvm_enter_guest) /* Save kvm_vcpu to kscratch */ csrwr a1, KVM_VCPU_KS kvm_switch_to_guest -SYM_INNER_LABEL(kvm_enter_guest_end, SYM_L_LOCAL) SYM_FUNC_END(kvm_enter_guest) +EXPORT_SYMBOL_FOR_KVM(kvm_enter_guest) SYM_FUNC_START(kvm_save_fpu) fpu_save_csr a0 t1
@@ -224,6 +231,7 @@ SYM_FUNC_START(kvm_save_fpu) fpu_save_cc a0 t1 t2 jr ra SYM_FUNC_END(kvm_save_fpu) +EXPORT_SYMBOL_FOR_KVM(kvm_save_fpu) SYM_FUNC_START(kvm_restore_fpu) fpu_restore_double a0 t1
@@ -231,6 +239,7 @@ SYM_FUNC_START(kvm_restore_fpu) fpu_restore_cc a0 t1 t2 jr ra SYM_FUNC_END(kvm_restore_fpu) +EXPORT_SYMBOL_FOR_KVM(kvm_restore_fpu) #ifdef CONFIG_CPU_HAS_LSX SYM_FUNC_START(kvm_save_lsx)
@@ -239,6 +248,7 @@ SYM_FUNC_START(kvm_save_lsx) lsx_save_data a0 t1 jr ra SYM_FUNC_END(kvm_save_lsx) +EXPORT_SYMBOL_FOR_KVM(kvm_save_lsx) SYM_FUNC_START(kvm_restore_lsx) lsx_restore_data a0 t1
@@ -246,6 +256,7 @@ SYM_FUNC_START(kvm_restore_lsx) fpu_restore_csr a0 t1 t2 jr ra SYM_FUNC_END(kvm_restore_lsx) +EXPORT_SYMBOL_FOR_KVM(kvm_restore_lsx) #endif #ifdef CONFIG_CPU_HAS_LASX
@@ -255,6 +266,7 @@ SYM_FUNC_START(kvm_save_lasx) lasx_save_data a0 t1 jr ra SYM_FUNC_END(kvm_save_lasx) +EXPORT_SYMBOL_FOR_KVM(kvm_save_lasx) SYM_FUNC_START(kvm_restore_lasx) lasx_restore_data a0 t1
@@ -262,10 +274,8 @@ SYM_FUNC_START(kvm_restore_lasx) fpu_restore_csr a0 t1 t2 jr ra SYM_FUNC_END(kvm_restore_lasx) +EXPORT_SYMBOL_FOR_KVM(kvm_restore_lasx) #endif - .section ".rodata" -SYM_DATA(kvm_exception_size, .quad kvm_exc_entry_end - kvm_exc_entry) -SYM_DATA(kvm_enter_guest_size, .quad kvm_enter_guest_end - kvm_enter_guest) #ifdef CONFIG_CPU_HAS_LBT STACK_FRAME_NON_STANDARD kvm_restore_fpu
Greg Kroah-Hartman
maintainerPATCH 99/307 net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai Zen <[email protected]>
commit 4b9e327991815e128ad3af75c3a04630a63ce3e0 upstream.
rtnl_fill_vfinfo() declares struct ifla_vf_broadcast on the stack without initialisation:
struct ifla_vf_broadcast vf_broadcast;
The struct contains a single fixed 32-byte field:
/* include/uapi/linux/if_link.h */
struct ifla_vf_broadcast {
__u8 broadcast[32];
};The function then copies dev->broadcast into it using dev->addr_len as the length:
memcpy(vf_broadcast.broadcast, dev->broadcast, dev->addr_len);
On Ethernet devices (the overwhelming majority of SR-IOV NICs) dev->addr_len is 6, so only the first 6 bytes of broadcast[] are written. The remaining 26 bytes retain whatever was previously on the kernel stack. The full struct is then handed to userspace via:
nla_put(skb, IFLA_VF_BROADCAST,
sizeof(vf_broadcast), &vf_broadcast)
leaking up to 26 bytes of uninitialised kernel stack per VF per RTM_GETLINK request, repeatable.
The other vf_* structs in the same function are explicitly zeroed for exactly this reason - see the memset() calls for ivi, vf_vlan_info, node_guid and port_guid a few lines above. vf_broadcast was simply missed when it was added.
Reachability: any unprivileged local process can open AF_NETLINK / NETLINK_ROUTE without capabilities and send RTM_GETLINK with an IFLA_EXT_MASK attribute carrying RTEXT_FILTER_VF. The kernel walks each VF and emits IFLA_VF_BROADCAST, leaking 26 bytes of stack per VF per request. Stack residue at this call site can include return addresses and transient sensitive data; KASAN with stack instrumentation, or KMSAN, will flag the nla_put() when reproduced.
Zero the on-stack struct before the partial memcpy, matching the existing pattern used for the other vf_* structs in the same function.
--- net/core/rtnetlink.c | 1 + 1 file changed, 1 insertion(+)
net/core/rtnetlink.c +1 -0
@@ -1572,6 +1572,7 @@ static noinline_for_stack int rtnl_fill_ port_guid.vf = ivi.vf;memcpy (vf_mac.mac, ivi.mac,sizeof (ivi.mac)); +memset (&vf_broadcast,0 ,sizeof (vf_broadcast));memcpy (vf_broadcast.broadcast, dev->broadcast, dev->addr_len); vf_vlan.vlan = ivi.vlan; vf_vlan.qos = ivi.qos;
Greg Kroah-Hartman
maintainerPATCH 100/307 mptcp: pm: ADD_ADDR rtx: skip inactive subflows
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit c6d395e2de1306b5fef0344a3c3835fbbfaa18be upstream.
When looking at the maximum RTO amongst the subflows, inactive subflows were taken into account: that includes stale ones, and the initial one if it has been already been closed.
Unusable subflows are now simply skipped. Stale ones are used as an
alternative: if there are only stale ones, to take their maximum RTO and avoid to eventually fallback to net.mptcp.add_addr_timeout, which is set to 2 minutes by default.
--- net/mptcp/pm.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
net/mptcp/pm.c +14 -4
@@ -305,18 +305,28 @@ static unsigned int mptcp_adjust_add_addconst struct net *net =sock_net ((struct sock *)msk);unsigned int rto =mptcp_get_add_addr_timeout (net);struct mptcp_subflow_context *subflow; -unsigned int max =0 ; +unsigned int max =0 , max_stale =0 ;mptcp_for_each_subflow (msk, subflow) {struct sock *ssk =mptcp_subflow_tcp_sock (subflow);struct inet_connection_sock *icsk =inet_csk (ssk); -if (icsk->icsk_rto > max) +if (!__mptcp_subflow_active (subflow)) +continue ; + +if (unlikely (subflow->stale)) { +if (icsk->icsk_rto > max_stale) + max_stale = icsk->icsk_rto; + }else if (icsk->icsk_rto > max) { max = icsk->icsk_rto; + } } -if (max && max < rto) - rto = max; +if (max) +return min (max, rto); + +if (max_stale) +return min (max_stale, rto);return rto; }
Greg Kroah-Hartman
maintainerPATCH 101/307 perf/x86/intel: Improve validation and configuration of ACR masks
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dapeng Mi <[email protected]>
commit 5ad732a56be46aabf158c16aa0c095291727aaef upstream.
Currently there are several issues on the user space ACR mask validation and configuration.
- The validation for user space ACR mask (attr.config2) is incomplete, e.g., the ACR mask could include the index which belongs to another ACR events group, but it's not validated.
- An early return on an invalid ACR mask caused all subsequent ACR groups to be skipped.
- The stale hardware ACR mask (hw.config1) is not cleared before setting new hardware ACR mask.
The following changes address all of the above issues.
- Figure out the event index group of an ACR group. Any bits in the user-space mask not present in the index group are now dropped.
- Instead of an early return on invalid bits, drop only the invalid portions and continue iterating through all ACR events to ensure full configuration.
- Explicitly clear the stale hardware ACR mask for each event prior to writing the new configuration.
Besides, a non-leader event member of ACR group could be disabled in theory. This could cause bit-shifting errors in the acr_mask of remaining group members. But since ACR sampling requires all events to be active, this should not be a big concern in real use case. Add a "FIXME" comment to notice this risk.
--- arch/x86/events/intel/core.c | 32 +++++++++++++++++++++++++------- 1 file changed, 25 insertions(+), 7 deletions(-)
arch/x86/events/intel/core.c +25 -7
@@ -3332,23 +3332,41 @@ static void intel_pmu_enable_event(strucstatic void intel_pmu_acr_late_setup (struct cpu_hw_events *cpuc) {struct perf_event *event, *leader; -int i, j, idx; +int i, j, k, bit, idx; +/* +* FIXME: ACR mask parsing relies on cpuc->event_list[] (active events only). +* Disabling an ACR event causes bit-shifting errors in the acr_mask of +* remaining group members. As ACR sampling requires all events to be active, +* this limitation is acceptable for now. Revisit if independent event toggling +* is required. +*/ for (i =0 ; i < cpuc->n_events; i++) { leader = cpuc->event_list[i];if (!is_acr_event_group (leader))continue ; -/* The ACR events must be contiguous. */ +/* Find the last event of the ACR group. */ for (j = i; j < cpuc->n_events; j++) { event = cpuc->event_list[j];if (event->group_leader != leader->group_leader)break ; -for_each_set_bit (idx, (unsigned long *)&event->attr.config2,X86_PMC_IDX_MAX ) { -if (i + idx >= cpuc->n_events || - !is_acr_event_group (cpuc->event_list[i + idx])) -return ; -__set_bit (cpuc->assign[i + idx], (unsigned long *)&event->hw.config1); + } + +/* +* Translate the user-space ACR mask (attr.config2) into the physical +* counter bitmask (hw.config1) for each ACR event in the group. +* NOTE: ACR event contiguity is guaranteed by intel_pmu_hw_config(). +*/ +for (k = i; k < j; k++) { + event = cpuc->event_list[k]; + event->hw.config1 =0 ; +for_each_set_bit (bit, (unsigned long *)&event->attr.config2,X86_PMC_IDX_MAX ) { + idx = i + bit; +/* Event index of ACR group must locate in [i, j). */ +if (idx >= j || !is_acr_event_group (cpuc->event_list[idx])) +continue ; +__set_bit (cpuc->assign[idx], (unsigned long *)&event->hw.config1); } } i = j -1 ;
Greg Kroah-Hartman
maintainerPATCH 102/307 selftests/rseq: Dont run tests with runner scripts outside of the scripts
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
commit cb48828f06afa232cc330f0f4d6be101067810b3 upstream.
The rseq selftests include two runner scripts run_param_test.sh and run_syscall_errors_test.sh which set up the environment for test binaries and run them with various parameters. Currently we list these test binaries in TEST_GEN_PROGS but this results in the kselftest framework running them directly as well as via the runners, resulting in duplication and spurious failures when the environment is not correctly set up (eg, if glibc tries to use rseq).
Move the binaries the runners invoke to TEST_GEN_PROGS_EXTENDED, binaries listed there are built but not run by the framework. The param_test benchmarks are not moved since they are not run by run_param_test.sh.
--- tools/testing/selftests/rseq/Makefile | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
tools/testing/selftests/rseq/Makefile +8 -5
@@ -14,12 +14,15 @@ LDLIBS += -lpthread -ldl # still track changes to header files and depend on shared object. OVERRIDE_TARGETS = 1 -TEST_GEN_PROGS = basic_test basic_percpu_ops_test basic_percpu_ops_mm_cid_test param_test \ - param_test_benchmark param_test_compare_twice param_test_mm_cid \ - param_test_mm_cid_benchmark param_test_mm_cid_compare_twice \ - syscall_errors_test slice_test +TEST_GEN_PROGS = basic_test basic_percpu_ops_test basic_percpu_ops_mm_cid_test \ + param_test_benchmark param_test_mm_cid_benchmark slice_test -TEST_GEN_PROGS_EXTENDED = librseq.so +TEST_GEN_PROGS_EXTENDED = librseq.so \ + param_test \ + param_test_compare_twice \ + param_test_mm_cid \ + param_test_mm_cid_compare_twice \ + syscall_errors_test TEST_PROGS = run_param_test.sh run_syscall_errors_test.sh
Signature · 1 line
2.54.0
Greg Kroah-Hartman
maintainerPATCH 103/307 rseq: Set rseq::cpu_id_start to 0 on unregistration
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit 2cb68e45120dfc66404c7547d95b8ac6ff0b25ce upstream.
The RSEQ rework changed that to RSEQ_CPU_UNINITILIZED, which is obviously incompatible. Revert back to the original behavior.
--- kernel/rseq.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-)
kernel/rseq.c +9 -11
@@ -236,11 +236,6 @@ static int __init rseq_debugfs_init(void }__initcall (rseq_debugfs_init); -static bool rseq_set_ids (struct task_struct *t,struct rseq_ids *ids,u32 node_id) -{ -return rseq_set_ids_get_csaddr (t, ids, node_id,NULL ); -} -static bool rseq_handle_cs (struct task_struct *t,struct pt_regs *regs) {struct rseq __user *urseq = t->rseq.usrptr;
@@ -384,19 +379,22 @@ void rseq_syscall(struct pt_regs *regs)static bool rseq_reset_ids (void ) { -struct rseq_ids ids = { - .cpu_id =RSEQ_CPU_ID_UNINITIALIZED , - .mm_cid =0 , - }; +struct rseq __user *rseq = current->rseq.usrptr;/* * If this fails, terminate it because this leaves the kernel in * stupid state as exit to user space will try to fixup the ids * again. */ -if (rseq_set_ids (current, &ids,0 )) -return true; + scoped_user_rw_access(rseq, efault) { +unsafe_put_user (0 , &rseq->cpu_id_start, efault); +unsafe_put_user (RSEQ_CPU_ID_UNINITIALIZED , &rseq->cpu_id, efault); +unsafe_put_user (0 , &rseq->node_id, efault); +unsafe_put_user (0 , &rseq->mm_cid, efault); + } +return true; +efault:force_sig (SIGSEGV );return false; }
Greg Kroah-Hartman
maintainerPATCH 104/307 rseq: Protect rseq_reset() against interrupts
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit e9766e6f7d330dce7530918d8c6e3ec96d6c6e24 upstream.
rseq_reset() uses memset() to clear the tasks rseq data. That's racy against membarrier() and preemption.
Guard it with irqsave to cure this.
--- include/linux/rseq.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/rseq.h +2 -0
@@ -119,6 +119,8 @@ static inline void rseq_virt_userspace_estatic inline void rseq_reset (struct task_struct *t) { +/* Protect against preemption and membarrier IPI */ +guard (irqsave)();memset (&t->rseq,0 ,sizeof (t->rseq)); t->rseq.ids.cpu_id =RSEQ_CPU_ID_UNINITIALIZED ; }
Greg Kroah-Hartman
maintainerPATCH 105/307 rseq: Dont advertise time slice extensions if disabled
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit 010b7723c0a3b9ad58f50b715dbe2e7781d29400 upstream.
If time slice extensions have been disabled on the kernel command line, then advertising them in RSEQ flags is wrong.
Adjust the conditionals to reflect reality, fixup the misleading comments about the gap of these flags and the rseq::flags field.
--- include/uapi/linux/rseq.h | 5 ++++- kernel/rseq.c | 9 +++++---- 2 files changed, 9 insertions(+), 5 deletions(-)
include/uapi/linux/rseq.h +4 -1
@@ -28,7 +28,7 @@ enum rseq_cs_flags_bit {RSEQ_CS_FLAG_NO_RESTART_ON_PREEMPT_BIT =0 ,RSEQ_CS_FLAG_NO_RESTART_ON_SIGNAL_BIT =1 ,RSEQ_CS_FLAG_NO_RESTART_ON_MIGRATE_BIT =2 , -/* (3) Intentional gap to put new bits into a separate byte */ +/* (3) Intentional gap to keep new bits separate */ /* User read only feature flags */ RSEQ_CS_FLAG_SLICE_EXT_AVAILABLE_BIT = 4,
@@ -161,6 +161,9 @@ struct rseq {* - RSEQ_CS_FLAG_NO_RESTART_ON_PREEMPT * - RSEQ_CS_FLAG_NO_RESTART_ON_SIGNAL * - RSEQ_CS_FLAG_NO_RESTART_ON_MIGRATE +* +* It is now used for feature status advertisement by the kernel. +* See: enum rseq_cs_flags_bit for further information. */ __u32 flags;
kernel/rseq.c +5 -4
@@ -462,10 +462,11 @@ SYSCALL_DEFINE4(rseq, struct rseq __userreturn -EFAULT ;if (IS_ENABLED (CONFIG_RSEQ_SLICE_EXTENSION )) { - rseqfl |=RSEQ_CS_FLAG_SLICE_EXT_AVAILABLE ; -if (rseq_slice_extension_enabled () && - (flags &RSEQ_FLAG_SLICE_EXT_DEFAULT_ON )) - rseqfl |=RSEQ_CS_FLAG_SLICE_EXT_ENABLED ; +if (rseq_slice_extension_enabled ()) { + rseqfl |=RSEQ_CS_FLAG_SLICE_EXT_AVAILABLE ; +if (flags &RSEQ_FLAG_SLICE_EXT_DEFAULT_ON ) + rseqfl |=RSEQ_CS_FLAG_SLICE_EXT_ENABLED ; + } } scoped_user_write_access(rseq, efault) {
Greg Kroah-Hartman
maintainerPATCH 106/307 selftests/rseq: Make registration flexible for legacy and optimized mode
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit d97cb2ef0b221b068e90b6058aa97faa0626bdab upstream.
rseq_register_current_thread() either uses the glibc registered RSEQ region or registers it's own region with the legacy size of 32 bytes.
That worked so far, but becomes a problem when the kernel implements a distinction between legacy and performance optimized behavior based on the registration size as that does not allow to test both modes with the self test suite.
Add two arguments to the function. One to enforce that the registration is not using libc provided mode and one to tell the registration to use the legacy size and not the kernel advertised size.
Rename it and make the original one a inline wrapper which preserves the existing behavior.
--- tools/testing/selftests/rseq/rseq-abi.h | 7 ++++- tools/testing/selftests/rseq/rseq.c | 39 ++++++++++++++------------------ tools/testing/selftests/rseq/rseq.h | 8 +++++- 3 files changed, 31 insertions(+), 23 deletions(-)
tools/testing/selftests/rseq/rseq-abi.h +6 -1
@@ -192,9 +192,14 @@ struct rseq_abi {struct rseq_abi_slice_ctrl slice_ctrl;/* +* Place holder to push the size above 32 bytes. +*/ +__u8 __reserved; + +/* * Flexible array member at end of structure, after last feature field. */ char end[]; -} __attribute__((aligned(4 * sizeof(__u64)))); +} __attribute__((aligned(256)));#endif /* _RSEQ_ABI_H */
tools/testing/selftests/rseq/rseq.c +18 -21
@@ -56,6 +56,7 @@ ptrdiff_t rseq_offset;* unsuccessful. */ unsigned int rseq_size =-1U ; +static unsigned int rseq_alloc_size;/* Flags used during rseq registration. */ unsigned int rseq_flags;
@@ -115,29 +116,17 @@ bool rseq_available(void) } } -/* The rseq areas need to be at least 32 bytes. */ -static -unsigned int get_rseq_min_alloc_size (void ) -{ -unsigned int alloc_size = rseq_size; - -if (alloc_size <ORIG_RSEQ_ALLOC_SIZE ) - alloc_size =ORIG_RSEQ_ALLOC_SIZE ; -return alloc_size; -} -/* * Return the feature size supported by the kernel. * * Depending on the value returned by getauxval(AT_RSEQ_FEATURE_SIZE): * -* 0: Return ORIG_RSEQ_FEATURE_SIZE (20) +* 0: Return ORIG_RSEQ_FEATURE_SIZE (20) * > 0: Return the value from getauxval(AT_RSEQ_FEATURE_SIZE). * * It should never return a value below ORIG_RSEQ_FEATURE_SIZE. */ -static -unsigned int get_rseq_kernel_feature_size (void ) +static unsigned int get_rseq_kernel_feature_size (void ) {unsigned long auxv_rseq_feature_size, auxv_rseq_align;
@@ -152,15 +141,24 @@ unsigned int get_rseq_kernel_feature_sizreturn ORIG_RSEQ_FEATURE_SIZE ; } -int rseq_register_current_thread (void ) +int __rseq_register_current_thread (bool nolibc,bool legacy) { +unsigned int size;int rc;if (!rseq_ownership) {/* Treat libc's ownership as a successful registration. */ -return 0 ; +return nolibc ? -EBUSY :0 ; } - rc =sys_rseq (&__rseq.abi,get_rseq_min_alloc_size (),0 ,RSEQ_SIG ); + +/* The minimal allocation size is 32, which is the legacy allocation size */ + size =get_rseq_kernel_feature_size (); +if (legacy || size <ORIG_RSEQ_ALLOC_SIZE ) + rseq_alloc_size =ORIG_RSEQ_ALLOC_SIZE ; +else + rseq_alloc_size = size; + + rc =sys_rseq (&__rseq.abi, rseq_alloc_size,0 ,RSEQ_SIG );if (rc) {/* * After at least one thread has registered successfully
@@ -179,9 +177,8 @@ int rseq_register_current_thread(void)* The first thread to register sets the rseq_size to mimic the libc * behavior. */ -if (RSEQ_READ_ONCE (rseq_size) ==0 ) { -RSEQ_WRITE_ONCE (rseq_size,get_rseq_kernel_feature_size ()); - } +if (RSEQ_READ_ONCE (rseq_size) ==0 ) +RSEQ_WRITE_ONCE (rseq_size, size);return 0 ; }
@@ -194,7 +191,7 @@ int rseq_unregister_current_thread(void)/* Treat libc's ownership as a successful unregistration. */ return 0 ; } - rc =sys_rseq (&__rseq.abi,get_rseq_min_alloc_size (),RSEQ_ABI_FLAG_UNREGISTER ,RSEQ_SIG ); + rc =sys_rseq (&__rseq.abi, rseq_alloc_size,RSEQ_ABI_FLAG_UNREGISTER ,RSEQ_SIG );if (rc)return -1 ;return 0 ;
tools/testing/selftests/rseq/rseq.h +7 -1
@@ -8,6 +8,7 @@#ifndef RSEQ_H #define RSEQ_H +#include <assert.h> #include <stdint.h> #include <stdbool.h> #include <pthread.h>
@@ -142,7 +143,12 @@ static inline struct rseq_abi *rseq_get_* succeed. A restartable sequence executed from a non-registered * thread will always fail. */ -int rseq_register_current_thread (void ); +int __rseq_register_current_thread (bool nolibc,bool legacy); + +static inline int rseq_register_current_thread (void ) +{ +return __rseq_register_current_thread (false, false); +}/* * Unregister rseq for current thread.
Greg Kroah-Hartman
maintainerPATCH 107/307 selftests/rseq: Skip tests if time slice extensions are not available
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit 02b44d943b3adddc3a15c1da97045e205b7d14c1 upstream.
Don't fail, skip the test if the extensions are not enabled at compile or runtime.
--- tools/testing/selftests/rseq/slice_test.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
tools/testing/selftests/rseq/slice_test.c +7 -5
@@ -124,6 +124,13 @@ FIXTURE_SETUP(slice_ext) {cpu_set_t affinity; +if (rseq_register_current_thread ()) +SKIP (return,"RSEQ not supported\n" ); + +if (prctl (PR_RSEQ_SLICE_EXTENSION ,PR_RSEQ_SLICE_EXTENSION_SET , +PR_RSEQ_SLICE_EXT_ENABLE ,0 ,0 )) +SKIP (return,"Time slice extension not supported\n" ); +ASSERT_EQ (sched_getaffinity (0 ,sizeof (affinity), &affinity),0 );/* Pin it on a single CPU. Avoid CPU 0 */
@@ -137,11 +144,6 @@ FIXTURE_SETUP(slice_ext)break ; } -ASSERT_EQ (rseq_register_current_thread (),0 ); - -ASSERT_EQ (prctl (PR_RSEQ_SLICE_EXTENSION ,PR_RSEQ_SLICE_EXTENSION_SET , -PR_RSEQ_SLICE_EXT_ENABLE ,0 ,0 ),0 ); - self->noise_params.noise_nsecs = variant->noise_nsecs; self->noise_params.sleep_nsecs = variant->sleep_nsecs; self->noise_params.run =1 ;
Greg Kroah-Hartman
maintainerPATCH 108/307 selftests/rseq: Validate legacy behavior
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit fdf4eb632683bfc2840acebe62716cb468d43e10 upstream.
The RSEQ legacy mode behavior requires that the ID fields in the rseq region are unconditionally updated on every context switch and before signal delivery even if not required by the ABI specification.
To ensure that this behavior is preserved for legacy users in the future, add a test which validates that with a sleep() and a signal sent to self.
Provide a run script which prevents GLIBC from registering a RSEQ region, so that the test can register it's own legacy sized region.
--- tools/testing/selftests/rseq/Makefile | 5 +- tools/testing/selftests/rseq/legacy_check.c | 65 +++++++++++++++++++ .../selftests/rseq/run_legacy_check.sh | 4 ++ 3 files changed, 72 insertions(+), 2 deletions(-) create mode 100644 tools/testing/selftests/rseq/legacy_check.c create mode 100755 tools/testing/selftests/rseq/run_legacy_check.sh
tools/testing/selftests/rseq/Makefile +3 -2
@@ -22,9 +22,10 @@ TEST_GEN_PROGS_EXTENDED = librseq.so \ param_test_compare_twice \ param_test_mm_cid \ param_test_mm_cid_compare_twice \ - syscall_errors_test + syscall_errors_test \ + legacy_check -TEST_PROGS = run_param_test.sh run_syscall_errors_test.sh +TEST_PROGS = run_param_test.sh run_syscall_errors_test.sh run_legacy_check.sh TEST_FILES := settings
tools/testing/selftests/rseq/legacy_check.c new file +65 -0
65 lines not on this page · raw message
tools/testing/selftests/rseq/run_legacy_check.sh new file +4 -0
@@ -0,0 +1,4 @@ +#!/bin/bash +# SPDX-License-Identifier: GPL-2.0 + +GLIBC_TUNABLES="${GLIBC_TUNABLES:-}:glibc.pthread.rseq=0" ./legacy_check
Signature · 1 line
2.54.0
Greg Kroah-Hartman
maintainerPATCH 109/307 selftests/rseq: Expand for optimized RSEQ ABI v2
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit e744060076871eebc2647b24420b550ff44b2b65 upstream.
Update the selftests so they are executed for legacy (32 bytes RSEQ region) and optimized RSEQ ABI v2 mode.
--- tools/testing/selftests/rseq/Makefile | 11 ++++-- .../testing/selftests/rseq/check_optimized.c | 17 ++++++++ tools/testing/selftests/rseq/param_test.c | 25 +++++++----- .../testing/selftests/rseq/run_param_test.sh | 39 +++++++++++++++++++ .../selftests/rseq/run_timeslice_test.sh | 14 +++++++ tools/testing/selftests/rseq/slice_test.c | 2 +- 6 files changed, 95 insertions(+), 13 deletions(-) create mode 100644 tools/testing/selftests/rseq/check_optimized.c create mode 100755 tools/testing/selftests/rseq/run_timeslice_test.sh
tools/testing/selftests/rseq/Makefile +8 -3
@@ -15,7 +15,7 @@ LDLIBS += -lpthread -ldl OVERRIDE_TARGETS = 1 TEST_GEN_PROGS = basic_test basic_percpu_ops_test basic_percpu_ops_mm_cid_test \ - param_test_benchmark param_test_mm_cid_benchmark slice_test + param_test_benchmark param_test_mm_cid_benchmark TEST_GEN_PROGS_EXTENDED = librseq.so \ param_test \
@@ -23,9 +23,11 @@ TEST_GEN_PROGS_EXTENDED = librseq.so \ param_test_mm_cid \ param_test_mm_cid_compare_twice \ syscall_errors_test \ - legacy_check + legacy_check \ + slice_test \ + check_optimized -TEST_PROGS = run_param_test.sh run_syscall_errors_test.sh run_legacy_check.sh +TEST_PROGS = run_param_test.sh run_syscall_errors_test.sh run_legacy_check.sh run_timeslice_test.sh TEST_FILES := settings
@@ -66,3 +68,6 @@ $(OUTPUT)/syscall_errors_test: syscall_errors_test.c $(TEST_GEN_PROGS_EXTENDED) $(OUTPUT)/slice_test: slice_test.c $(TEST_GEN_PROGS_EXTENDED) rseq.h rseq-*.h $(CC) $(CFLAGS) $< $(LDLIBS) -lrseq -o $@ + +$(OUTPUT)/check_optimized: check_optimized.c $(TEST_GEN_PROGS_EXTENDED) rseq.h rseq-*.h + $(CC) $(CFLAGS) $< $(LDLIBS) -lrseq -o $@
tools/testing/selftests/rseq/check_optimized.c new file +17 -0
@@ -0,0 +1,17 @@ +// SPDX-License-Identifier: LGPL-2.1 +#define _GNU_SOURCE +#include <assert.h> +#include <sched.h> +#include <signal.h> +#include <stdio.h> +#include <string.h> +#include <sys/time.h> + +#include "rseq.h" + +int main (int argc,char **argv) +{ +if (__rseq_register_current_thread (true, false)) +return -1 ; +return 0 ; +}
tools/testing/selftests/rseq/param_test.c +16 -9
@@ -38,7 +38,7 @@ static int opt_modulo, verbose;static int opt_yield, opt_signal, opt_sleep, opt_disable_rseq, opt_threads =200 , opt_disable_mod =0 , opt_test ='s' ; - +static bool opt_rseq_legacy;static long long opt_reps =5000 ; static __thread __attribute__((tls_model("initial-exec")))
@@ -281,9 +281,12 @@ unsigned int yield_mod_cnt, nr_abort; } \ } +#define rseq_no_glibc true +#else #define printf_verbose (fmt, ...) +#define rseq_no_glibc false#endif /* BENCHMARK */
@@ -481,7 +484,7 @@ void *test_percpu_spinlock_thread(void *arg)long long i, reps;if (!opt_disable_rseq && thread_data->reg && -rseq_register_current_thread ()) +__rseq_register_current_thread (rseq_no_glibc, opt_rseq_legacy))abort (); reps = thread_data->reps;for (i =0 ; i < reps; i++) {
@@ -558,7 +561,7 @@ void *test_percpu_inc_thread(void *arg)long long i, reps;if (!opt_disable_rseq && thread_data->reg && -rseq_register_current_thread ()) +__rseq_register_current_thread (rseq_no_glibc, opt_rseq_legacy))abort (); reps = thread_data->reps;for (i =0 ; i < reps; i++) {
@@ -712,7 +715,7 @@ void *test_percpu_list_thread(void *arg)long long i, reps;struct percpu_list *list = (struct percpu_list *)arg; -if (!opt_disable_rseq &&rseq_register_current_thread ()) +if (!opt_disable_rseq &&__rseq_register_current_thread (rseq_no_glibc, opt_rseq_legacy))abort (); reps = opt_reps;
@@ -895,7 +898,7 @@ void *test_percpu_buffer_thread(void *arg)long long i, reps;struct percpu_buffer *buffer = (struct percpu_buffer *)arg; -if (!opt_disable_rseq &&rseq_register_current_thread ()) +if (!opt_disable_rseq &&__rseq_register_current_thread (rseq_no_glibc, opt_rseq_legacy))abort (); reps = opt_reps;
@@ -1105,7 +1108,7 @@ void *test_percpu_memcpy_buffer_thread(void *arg)long long i, reps;struct percpu_memcpy_buffer *buffer = (struct percpu_memcpy_buffer *)arg; -if (!opt_disable_rseq &&rseq_register_current_thread ()) +if (!opt_disable_rseq &&__rseq_register_current_thread (rseq_no_glibc, opt_rseq_legacy))abort (); reps = opt_reps;
@@ -1258,7 +1261,7 @@ void *test_membarrier_worker_thread(void *arg)const int iters = opt_reps;int i; -if (rseq_register_current_thread ()) { +if (__rseq_register_current_thread (rseq_no_glibc, opt_rseq_legacy)) {fprintf (stderr,"Error: rseq_register_current_thread(...) failed(%d): %s\n" , errno,strerror (errno));abort ();
@@ -1323,7 +1326,7 @@ void *test_membarrier_manager_thread(void *arg)intptr_t expect_a =0 , expect_b =0 ;int cpu_a =0 , cpu_b =0 ; -if (rseq_register_current_thread ()) { +if (__rseq_register_current_thread (rseq_no_glibc, opt_rseq_legacy)) {fprintf (stderr,"Error: rseq_register_current_thread(...) failed(%d): %s\n" , errno,strerror (errno));abort ();
@@ -1475,6 +1478,7 @@ static void show_usage(int argc, char **argv)printf (" [-D M] Disable rseq for each M threads\n" );printf (" [-T test] Choose test: (s)pinlock, (l)ist, (b)uffer, (m)emcpy, (i)ncrement, membarrie(r)\n" );printf (" [-M] Push into buffer and memcpy buffer with memory barriers.\n" ); +printf (" [-O] Test with optimized RSEQ\n" );printf (" [-v] Verbose output.\n" );printf (" [-h] Show this help.\n" );printf ("\n" );
@@ -1602,6 +1606,9 @@ int main(int argc, char **argv)case 'M' : opt_mo =RSEQ_MO_RELEASE ;break ; +case 'L' : + opt_rseq_legacy = true; +break ;default :show_usage (argc, argv); goto error;
@@ -1618,7 +1625,7 @@ int main(int argc, char **argv)if (set_signal_handler ()) goto error; -if (!opt_disable_rseq &&rseq_register_current_thread ()) +if (!opt_disable_rseq &&__rseq_register_current_thread (rseq_no_glibc, opt_rseq_legacy)) goto error;if (!opt_disable_rseq && !rseq_validate_cpu_id ()) {fprintf (stderr,"Error: cpu id getter unavailable\n" );
tools/testing/selftests/rseq/run_param_test.sh +39 -0
@@ -34,6 +34,11 @@ REPS=1000 SLOW_REPS=100 NR_THREADS=$((6*${NR_CPUS})) +# Prevent GLIBC from registering RSEQ so the selftest can run in legacy and +# performance optimized mode. +GLIBC_TUNABLES="${GLIBC_TUNABLES:-}:glibc.pthread.rseq=0" +export GLIBC_TUNABLES + function do_tests() { local i=0
@@ -103,6 +108,40 @@ function inject_blocking() NR_LOOPS= } +echo "Testing in legacy RSEQ mode" +echo "Yield injection (25%)" +inject_blocking -m 4 -y -L + +echo "Yield injection (50%)" +inject_blocking -m 2 -y -L + +echo "Yield injection (100%)" +inject_blocking -m 1 -y -L + +echo "Kill injection (25%)" +inject_blocking -m 4 -k -L + +echo "Kill injection (50%)" +inject_blocking -m 2 -k -L + +echo "Kill injection (100%)" +inject_blocking -m 1 -k -L + +echo "Sleep injection (1ms, 25%)" +inject_blocking -m 4 -s 1 -L + +echo "Sleep injection (1ms, 50%)" +inject_blocking -m 2 -s 1 -L + +echo "Sleep injection (1ms, 100%)" +inject_blocking -m 1 -s 1 -L + +./check_optimized || { + echo "Skipping optimized RSEQ mode test. Not supported"; + exit 0 +} + +echo "Testing in optimized RSEQ mode" echo "Yield injection (25%)" inject_blocking -m 4 -y
tools/testing/selftests/rseq/run_timeslice_test.sh new file +14 -0
@@ -0,0 +1,14 @@ +#!/bin/bash +# SPDX-License-Identifier: GPL-2.0+ + +# Prevent GLIBC from registering RSEQ so the selftest can run in legacy +# and performance optimized mode. +GLIBC_TUNABLES="${GLIBC_TUNABLES:-}:glibc.pthread.rseq=0" +export GLIBC_TUNABLES + +./check_optimized || { + echo "Skipping optimized RSEQ mode test. Not supported"; + exit 0 +} + +./slice_test
tools/testing/selftests/rseq/slice_test.c +1 -1
@@ -124,7 +124,7 @@ FIXTURE_SETUP(slice_ext) {cpu_set_t affinity; -if (rseq_register_current_thread ()) +if (__rseq_register_current_thread (true, false))SKIP (return,"RSEQ not supported\n" ); if (prctl(PR_RSEQ_SLICE_EXTENSION, PR_RSEQ_SLICE_EXTENSION_SET,
Signature · 1 line
2.54.0
Greg Kroah-Hartman
maintainerPATCH 110/307 accel/ivpu: Disallow re-exporting imported GEM objects
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karol Wachowski <[email protected]>
commit 7dd57d7a6350770dfc283287125c409e995200e0 upstream.
Prevent re-exporting of imported GEM buffers by adding a custom prime_handle_to_fd callback that checks if the object is imported and returns -EOPNOTSUPP if so.
Re-exporting imported GEM buffers causes loss of buffer flags settings, leading to incorrect device access and data corruption.
--- drivers/accel/ivpu/ivpu_drv.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/accel/ivpu/ivpu_drv.c +21 -0
@@ -460,6 +460,26 @@ static const struct file_operations ivpu#endif }; +static int ivpu_gem_prime_handle_to_fd (struct drm_device *dev,struct drm_file *file_priv, +u32 handle,u32 flags,int *prime_fd) +{ +struct drm_gem_object *obj; + + obj =drm_gem_object_lookup (file_priv, handle); +if (!obj) +return -ENOENT ; + +if (drm_gem_is_imported (obj)) { +/* Do not allow re-exporting */ +drm_gem_object_put (obj); +return -EOPNOTSUPP ; + } + +drm_gem_object_put (obj); + +return drm_gem_prime_handle_to_fd (dev, file_priv, handle, flags, prime_fd); +} +static const struct drm_driver driver = { .driver_features =DRIVER_GEM |DRIVER_COMPUTE_ACCEL ,
@@ -468,6 +488,7 @@ static const struct drm_driver driver = .gem_create_object = ivpu_gem_create_object, .gem_prime_import = ivpu_gem_prime_import, + .prime_handle_to_fd = ivpu_gem_prime_handle_to_fd, .ioctls = ivpu_drm_ioctls, .num_ioctls = ARRAY_SIZE(ivpu_drm_ioctls),
Greg Kroah-Hartman
maintainerPATCH 111/307 sound: ua101: fix division by zero at probe
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeungJu Cheon <[email protected]>
commit d1f73f169c1014463b5060e3f60813e13ddc7b87 upstream.
Add a missing sanity check for bNrChannels in detect_usb_format() to prevent a division by zero in playback_urb_complete() and capture_urb_complete().
USB core does not validate class-specific descriptor fields such as bNrChannels, so drivers must verify them before use. If a device provides bNrChannels = 0, frame_bytes becomes zero and is later used as a divisor in the URB completion handlers, leading to a kernel crash.
--- sound/usb/misc/ua101.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/usb/misc/ua101.c +7 -0
@@ -974,6 +974,13 @@ static int detect_usb_format(struct ua10 ua->capture.channels = fmt_capture->bNrChannels; ua->playback.channels = fmt_playback->bNrChannels; +if (!ua->capture.channels || !ua->playback.channels) { +dev_err (&ua->dev->dev, +"invalid channel count: capture %u, playback %u\n" , + ua->capture.channels, ua->playback.channels); +return -EINVAL ; + } + ua->capture.frame_bytes = fmt_capture->bSubframeSize * ua->capture.channels; ua->playback.frame_bytes =
Greg Kroah-Hartman
maintainerPATCH 112/307 pseries/papr-hvpipe: Fix race with interrupt handler
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ritesh Harjani (IBM) <[email protected]>
commit 7a4f0846ee6cc8cf44ae0046ed42e3259d1dd45b upstream.
While executing ->ioctl handler or ->release handler, if an interrupt fires on the same cpu, then we can enter into a deadlock.
This patch fixes both these handlers to take spin_lock_irq{save|restore} versions of the lock to prevent this deadlock.
--- arch/powerpc/platforms/pseries/papr-hvpipe.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
arch/powerpc/platforms/pseries/papr-hvpipe.c +11 -9
@@ -444,13 +444,14 @@ static int papr_hvpipe_handle_release(st struct file *file) {struct hvpipe_source_info *src_info; +unsigned long flags;/* * Hold the lock, remove source from src_list, reset the * hvpipe status and release the lock to prevent any race * with message event IRQ. */ -spin_lock (&hvpipe_src_list_lock); +spin_lock_irqsave (&hvpipe_src_list_lock, flags); src_info = file->private_data;list_del (&src_info->list); file->private_data =NULL ;
@@ -461,10 +462,10 @@ static int papr_hvpipe_handle_release(st*/ if (src_info->hvpipe_status &HVPIPE_MSG_AVAILABLE ) { src_info->hvpipe_status =0 ; -spin_unlock (&hvpipe_src_list_lock); +spin_unlock_irqrestore (&hvpipe_src_list_lock, flags);hvpipe_rtas_recv_msg (NULL ,0 ); }else -spin_unlock (&hvpipe_src_list_lock); +spin_unlock_irqrestore (&hvpipe_src_list_lock, flags);kfree (src_info);return 0 ;
@@ -480,20 +481,21 @@ static const struct file_operations paprstatic int papr_hvpipe_dev_create_handle (u32 srcID) { struct hvpipe_source_info *src_info __free(kfree) = NULL; +unsigned long flags; -spin_lock (&hvpipe_src_list_lock); +spin_lock_irqsave (&hvpipe_src_list_lock, flags);/* * Do not allow more than one process communicates with * each source. */ src_info =hvpipe_find_source (srcID);if (src_info) { -spin_unlock (&hvpipe_src_list_lock); +spin_unlock_irqrestore (&hvpipe_src_list_lock, flags);pr_err ("pid(%d) is already using the source(%d)\n" , src_info->tsk->pid, srcID);return -EALREADY ; } -spin_unlock (&hvpipe_src_list_lock); +spin_unlock_irqrestore (&hvpipe_src_list_lock, flags); src_info =kzalloc_obj (*src_info,GFP_KERNEL_ACCOUNT );if (!src_info)
@@ -510,18 +512,18 @@ static int papr_hvpipe_dev_create_handlereturn fdf.err;retain_and_null_ptr (src_info); -spin_lock (&hvpipe_src_list_lock); +spin_lock_irqsave (&hvpipe_src_list_lock, flags);/* * If two processes are executing ioctl() for the same * source ID concurrently, prevent the second process to * acquire FD. */ if (hvpipe_find_source (srcID)) { -spin_unlock (&hvpipe_src_list_lock); +spin_unlock_irqrestore (&hvpipe_src_list_lock, flags);return -EALREADY ; }list_add (&src_info->list, &hvpipe_src_list); -spin_unlock (&hvpipe_src_list_lock); +spin_unlock_irqrestore (&hvpipe_src_list_lock, flags);return fd_publish (fdf); }
Greg Kroah-Hartman
maintainerPATCH 113/307 pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ritesh Harjani (IBM) <[email protected]>
commit cefeed44296261173a806bef988b26bc565da4be upstream.
The hdr variable is allocated on the stack and only hdr.version and hdr.flags are initialized explicitly. Because the struct papr_hvpipe_hdr contains reserved padding bytes (reserved[3] and reserved2[40]), these could leak the uninitialized bytes to userspace after copy_to_user().
This patch fixes that by initializing the whole struct to 0.
--- arch/powerpc/platforms/pseries/papr-hvpipe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/pseries/papr-hvpipe.c +1 -1
@@ -327,7 +327,7 @@ static ssize_t papr_hvpipe_handle_read(s {struct hvpipe_source_info *src_info = file->private_data; -struct papr_hvpipe_hdr hdr; +struct papr_hvpipe_hdr hdr = {};long ret;/*
Greg Kroah-Hartman
maintainerPATCH 114/307 pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle()
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ritesh Harjani (IBM) <[email protected]>
commit 1b9f7aafa44f5ce852c00509104d10fd9eb0f402 upstream.
commit 6d3789d347a7 ("papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()"), changed the create handle to FD_PREPARE(), but it caused kernel
null-ptr-deref because after call to retain_and_null_ptr(src_info),src_info is re-used for adding it to the global list.
Getting the following kernel panic in papr_hvpipe_dev_create_handle() when trying to add src_info to the list.
Kernel attempted to write user page (0) - exploit attempt? (uid: 0)
BUG: Kernel NULL pointer dereference on write at 0x00000000 Faulting instruction address: 0xc0000000001b44a0 Oops: Kernel access of bad area, sig: 11 [#1] ... Call Trace: papr_hvpipe_dev_ioctl+0x1f4/0x48c (unreliable) sys_ioctl+0x528/0x1064 system_call_exception+0x128/0x360 system_call_vectored_common+0x15c/0x2ec
Now, the error handling with FD_PREPARE's file cleanup and __free(kfree) auto cleanup is getting too convoluted. This is mainly because we need to ensure only 1 user get the srcID handle. To simplify this, we allocate prepare the src_info in the beginning and add it to the global list under a spinlock after checking that no duplicates exist.
This simplify the error handling where if the FD_ADD fails, we can simply remove the src_info from the list and consume any pending msg in hvpipe to be cleared, after src_info became visible in the global list.
--- arch/powerpc/platforms/pseries/papr-hvpipe.c | 57 ++++++++++---------- 1 file changed, 30 insertions(+), 27 deletions(-)
arch/powerpc/platforms/pseries/papr-hvpipe.c +30 -27
@@ -480,23 +480,10 @@ static const struct file_operations papr_hvpipe_handle_ops = {static int papr_hvpipe_dev_create_handle (u32 srcID) { - struct hvpipe_source_info *src_info __free(kfree) = NULL; +struct hvpipe_source_info *src_info; +int fd;unsigned long flags; -spin_lock_irqsave (&hvpipe_src_list_lock, flags); -/* -* Do not allow more than one process communicates with -* each source. -*/ - src_info =hvpipe_find_source (srcID); -if (src_info) { -spin_unlock_irqrestore (&hvpipe_src_list_lock, flags); -pr_err ("pid(%d) is already using the source(%d)\n" , - src_info->tsk->pid, srcID); -return -EALREADY ; - } -spin_unlock_irqrestore (&hvpipe_src_list_lock, flags); - src_info =kzalloc_obj (*src_info,GFP_KERNEL_ACCOUNT );if (!src_info)return -ENOMEM ;
@@ -505,26 +492,42 @@ static int papr_hvpipe_dev_create_handle(u32 srcID) src_info->tsk = current;init_waitqueue_head (&src_info->recv_wqh); -FD_PREPARE (fdf,O_RDONLY |O_CLOEXEC , -anon_inode_getfile ("[papr-hvpipe]" , &papr_hvpipe_handle_ops, - (void *)src_info,O_RDWR )); -if (fdf.err) -return fdf.err; - -retain_and_null_ptr (src_info); -spin_lock_irqsave (&hvpipe_src_list_lock, flags);/* -* If two processes are executing ioctl() for the same -* source ID concurrently, prevent the second process to -* acquire FD. +* Do not allow more than one process communicates with +* each source. */ +spin_lock_irqsave (&hvpipe_src_list_lock, flags);if (hvpipe_find_source (srcID)) {spin_unlock_irqrestore (&hvpipe_src_list_lock, flags); +pr_err ("pid(%d) could not get the source(%d)\n" , + src_info->tsk->pid, srcID); +kfree (src_info);return -EALREADY ; }list_add (&src_info->list, &hvpipe_src_list);spin_unlock_irqrestore (&hvpipe_src_list_lock, flags); -return fd_publish (fdf); + + fd =FD_ADD (O_RDONLY |O_CLOEXEC , +anon_inode_getfile ("[papr-hvpipe]" , &papr_hvpipe_handle_ops, + (void *)src_info,O_RDWR )); +if (fd <0 ) { +spin_lock_irqsave (&hvpipe_src_list_lock, flags); +list_del (&src_info->list); +spin_unlock_irqrestore (&hvpipe_src_list_lock, flags); +/* +* if we fail to add FD, that means no userspace program is +* polling. In that case if there is a msg pending because the +* interrupt was fired after the src_info was added to the +* global list, then let's consume it here, to unblock the +* hvpipe +*/ +if (src_info->hvpipe_status &HVPIPE_MSG_AVAILABLE ) +hvpipe_rtas_recv_msg (NULL ,0 ); +kfree (src_info); +return fd; + } + +return fd; }/*
Signature · 1 line
2.54.0
Greg Kroah-Hartman
maintainerPATCH 115/307 pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init()
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ritesh Harjani (IBM) <[email protected]>
commit 713e468cdbc2277db6ce949c32c1acbd83501733 upstream.
Remove such 3 levels of nesting patterns to check success return values from function calls.
ret = enable_hvpipe_IRQ()
if (!ret)
ret = set_hvpipe_sys_param(1)
if (!ret)
ret = misc_register()
Instead just bail out to "out*:" labels, in case of any error. This simplifies the init flow.
While at it let's also fix the following error handling logic:
We have already enabled interrupt sources and enabled hvpipe to received interrupts, if misc_register() fails, we will destroy the workqueue, but the HMC might send us a msg via hvpipe which will call, queue work on the workqueue which might be destroyed.
So instead, let's reverse the order of enabling set_hvpipe_sys_param(1) and in case of an error let's remove the misc dev by calling misc_deregister().
--- arch/powerpc/platforms/pseries/papr-hvpipe.c | 28 ++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-)
arch/powerpc/platforms/pseries/papr-hvpipe.c +17 -11
@@ -780,23 +780,29 @@ static int __init papr_hvpipe_init(void) } ret =enable_hvpipe_IRQ (); -if (!ret) { - ret =set_hvpipe_sys_param (1 ); -if (!ret) - ret =misc_register (&papr_hvpipe_dev); - } +if (ret) + goto out_wq; -if (!ret) { -pr_info ("hvpipe feature is enabled\n" ); - hvpipe_feature = true; -return 0 ; - } + ret =misc_register (&papr_hvpipe_dev); +if (ret) + goto out_wq; -pr_err ("hvpipe feature is not enabled %d\n" , ret); + ret =set_hvpipe_sys_param (1 ); +if (ret) + goto out_misc; + +pr_info ("hvpipe feature is enabled\n" ); + hvpipe_feature = true; +return 0 ; + +out_misc: +misc_deregister (&papr_hvpipe_dev); +out_wq:destroy_workqueue (papr_hvpipe_wq); out:kfree (papr_hvpipe_work); papr_hvpipe_work =NULL ; +pr_err ("hvpipe feature is not enabled %d\n" , ret);return ret; }machine_device_initcall (pseries, papr_hvpipe_init);
Greg Kroah-Hartman
maintainerPATCH 116/307 pseries/papr-hvpipe: Fix the usage of copy_to_user()
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ritesh Harjani (IBM) <[email protected]>
commit d48654bd8b1a75f662e224d257db54de475120dc upstream.
copy_to_user() return bytes_not_copied to the user buffer. If there was an error writing bytes into the user buffer, i.e. if copy_to_user returns a non-zero value, then we should simply return -EFAULT from the ->read() call.
Otherwise, in the non-patched version, we may end up mixing "bytes_not_copied + bytes_copied (HVPIPE_HDR_LEN)" as the return value to the user in ->read() call
Also let's make sure we clear the hvpipe_status flag, if we have consumed the hvpipe msg by making the rtas call. ret = -EFAULT means copy_to_user has failed but that still means that the msg was read from the hvpipe, hence for both cases, success & -EFAULT, we should clear the HVPIPE_MSG_AVAILABLE flag in hvpipe_status.
--- arch/powerpc/platforms/pseries/papr-hvpipe.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
arch/powerpc/platforms/pseries/papr-hvpipe.c +14 -9
@@ -206,10 +206,11 @@ static int hvpipe_rtas_recv_msg(char __u bytes_written, size); bytes_written = size; } - ret =copy_to_user (buf, +if (copy_to_user (buf,rtas_work_area_raw_buf (work_area), - bytes_written); -if (!ret) + bytes_written)) + ret = -EFAULT ; +else ret = bytes_written; } }else {
@@ -328,7 +329,7 @@ static ssize_t papr_hvpipe_handle_read(sstruct hvpipe_source_info *src_info = file->private_data;struct papr_hvpipe_hdr hdr = {}; -long ret; +ssize_t ret =0 ;/* * Return -ENXIO during migration
@@ -376,7 +377,7 @@ static ssize_t papr_hvpipe_handle_read(s ret =copy_to_user (buf, &hdr,HVPIPE_HDR_LEN );if (ret) -return ret; +return -EFAULT ;/* * Message event has payload, so get the payload with
@@ -385,19 +386,23 @@ static ssize_t papr_hvpipe_handle_read(sif (hdr.flags &HVPIPE_MSG_AVAILABLE ) { ret =hvpipe_rtas_recv_msg (buf +HVPIPE_HDR_LEN , size -HVPIPE_HDR_LEN ); -if (ret >0 ) { +/* +* Always clear MSG_AVAILABLE once the RTAS call has drained +* the message, regardless of whether copy_to_user succeeded. +*/ +if (ret >=0 || ret == -EFAULT ) src_info->hvpipe_status &= ~HVPIPE_MSG_AVAILABLE ; - ret +=HVPIPE_HDR_LEN ; - } }else if (hdr.flags &HVPIPE_LOST_CONNECTION ) {/* * Hypervisor is closing the pipe for the specific * source. So notify user space. */ src_info->hvpipe_status &= ~HVPIPE_LOST_CONNECTION ; - ret =HVPIPE_HDR_LEN ; } +if (ret >=0 ) + ret +=HVPIPE_HDR_LEN ; +return ret; }
Greg Kroah-Hartman
maintainerPATCH 117/307 net: libwx: fix VF illegal register access
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Wu <[email protected]>
commit 694de316f607fe2473d52ca0707e3918e72c1562 upstream.
Register WX_CFG_PORT_ST is a PF restricted register. When a VF is initialized, attempting to read this register triggers an illegal register access, which lead to a system hang.
When the device is VF, the bus function ID can be obtained directly from the PCI_FUNC(pdev->devfn).
--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/wangxun/libwx/wx_hw.c +5 -2
@@ -2480,8 +2480,11 @@ int wx_sw_init(struct wx *wx) wx->oem_svid = pdev->subsystem_vendor; wx->oem_ssid = pdev->subsystem_device; wx->bus.device =PCI_SLOT (pdev->devfn); - wx->bus.func =FIELD_GET (WX_CFG_PORT_ST_LANID , -rd32 (wx,WX_CFG_PORT_ST )); +if (pdev->is_virtfn) + wx->bus.func =PCI_FUNC (pdev->devfn); +else + wx->bus.func =FIELD_GET (WX_CFG_PORT_ST_LANID , +rd32 (wx,WX_CFG_PORT_ST ));if (wx->oem_svid ==PCI_VENDOR_ID_WANGXUN || pdev->is_virtfn) {
Greg Kroah-Hartman
maintainerPATCH 118/307 ip6_gre: Use cached t->net in ip6erspan_changelink().
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <[email protected]>
commit 1d324c2f43f70c965f25c58cc3611c779adbe47e upstream.
After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-netns ip6gre hash via link_net. ip6erspan_changelink() was not converted in that series and still uses dev_net(dev), which diverges from the device's creation netns after IFLA_NET_NS_FD migration.
This re-inserts the tunnel into the wrong per-netns hash. The original netns keeps a stale entry. When that netns is later destroyed, ip6gre_exit_rtnl_net() walks the stale entry, producing a slab-use-after-free reported by KASAN, followed by a kernel BUG at net/core/dev.c (LIST_POISON1) in unregister_netdevice_many_notify().
Reachable from an unprivileged user namespace (unshare --user --map-root-user --net).
ip6gre_changelink() earlier in the same file already uses the cached t->net; only ip6erspan_changelink() has the wrong shape.
--- net/ipv6/ip6_gre.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/ipv6/ip6_gre.c +3 -2
@@ -2261,10 +2261,11 @@ static int ip6erspan_changelink(struct nstruct nlattr *data[], struct netlink_ext_ack *extack) { - struct ip6gre_net *ign = net_generic(dev_net(dev), ip6gre_net_id); + struct ip6_tnl *t = netdev_priv(dev);struct __ip6_tnl_parm p; -struct ip6_tnl *t; +struct ip6gre_net *ign; + ign =net_generic (t->net, ip6gre_net_id); t =ip6gre_changelink_common (dev, tb, data, &p, extack);if (IS_ERR (t))return PTR_ERR (t);
Greg Kroah-Hartman
maintainerPATCH 119/307 net: libwx: use request_irq for VF misc interrupt
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Wu <[email protected]>
commit 7a33345153eeeda195c55f15be27074e4c3b5109 upstream.
Currently, request_threaded_irq() is used with a primary handler but a NULL threaded handler, while also setting the IRQF_ONESHOT flag. This specific combination triggers a WARNING since the commit aef30c8d569c ("genirq: Warn about using IRQF_ONESHOT without a threaded handler").
WARNING: kernel/irq/manage.c:1502 at __setup_irq+0x4fa/0x760
Fix the issue by switching to request_irq(), which is the appropriate interface or a non-threaded interrupt handler, and removing the unnecessary IRQF_ONESHOT flag.
--- drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/wangxun/libwx/wx_vf_common.c +2 -2
@@ -98,8 +98,8 @@ int wx_request_msix_irqs_vf(struct wx *w } } - err =request_threaded_irq (wx->msix_entry->vector, wx_msix_misc_vf, -NULL ,IRQF_ONESHOT , netdev->name, wx); + err =request_irq (wx->msix_entry->vector, wx_msix_misc_vf, +0 , netdev->name, wx);if (err) {wx_err (wx,"request_irq for msix_other failed: %d\n" , err); goto free_queue_irqs;
Greg Kroah-Hartman
maintainerPATCH 120/307 netpoll: pass buffer size to egress_dev() to avoid MAC truncation
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
commit 76b93a8107574006b25495664304ea9237494d70 upstream.
egress_dev() formats np->dev_mac via snprintf() but receives buf as a bare char *, so it cannot derive the buffer size from the pointer. The size argument was hardcoded to MAC_ADDR_STR_LEN (3 * ETH_ALEN - 1 = 17), which is silly wrong in two ways:
1) misleading kernel log output on the MAC-selected target path (np->dev_name[0] == '\0'); for example "aa:bb:cc:dd:ee:ff doesn't exist, aborting" was logged as "aa:bb:cc:dd:ee:f doesn't exist, aborting".
2) the second argument of snprintf is the size of the buffer, not the size of what you want to write.
Add a bufsz parameter to egress_dev() and pass sizeof(buf) from each caller, matching the standard snprintf() idiom and removing the hardcoded size from the helper.
Every caller already declares "char buf[MAC_ADDR_STR_LEN + 1]" so the formatted MAC continues to fit.
Tested by booting with
netconsole=6665@/aa:bb:cc:dd:ee:ff,[email protected]/00:11:22:33:44:55
on a kernel without a matching device. Pre-fix dmesg shows "aa:bb:cc:dd:ee:f doesn't exist, aborting"; post-fix shows the full "aa:bb:cc:dd:ee:ff doesn't exist, aborting".
--- net/core/netpoll.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-)
net/core/netpoll.c +13 -10
@@ -608,14 +608,16 @@ EXPORT_SYMBOL_GPL(__netpoll_setup);/* * Returns a pointer to a string representation of the identifier used * to select the egress interface for the given netpoll instance. buf -* must be a buffer of length at least MAC_ADDR_STR_LEN + 1. +* is used to format np->dev_mac when np->dev_name is empty; bufsz must +* be at least MAC_ADDR_STR_LEN + 1 to fit the formatted MAC address +* and its NUL terminator. */ -static char *egress_dev (struct netpoll *np,char *buf) +static char *egress_dev (struct netpoll *np,char *buf,size_t bufsz) {if (np->dev_name[0 ])return np->dev_name; -snprintf (buf,MAC_ADDR_STR_LEN ,"%pM" , np->dev_mac); +snprintf (buf, bufsz,"%pM" , np->dev_mac);return buf; }
@@ -645,7 +647,7 @@ static int netpoll_take_ipv6(struct netpif (!IS_ENABLED (CONFIG_IPV6 )) {np_err (np,"IPv6 is not supported %s, aborting\n" , -egress_dev (np, buf)); +egress_dev (np, buf,sizeof (buf)));return -EINVAL ; }
@@ -667,7 +669,7 @@ static int netpoll_take_ipv6(struct netp }if (err) {np_err (np,"no IPv6 address for %s, aborting\n" , -egress_dev (np, buf)); +egress_dev (np, buf,sizeof (buf)));return err; }
@@ -687,14 +689,14 @@ static int netpoll_take_ipv4(struct netp in_dev =__in_dev_get_rtnl (ndev);if (!in_dev) {np_err (np,"no IP address for %s, aborting\n" , -egress_dev (np, buf)); +egress_dev (np, buf,sizeof (buf)));return -EDESTADDRREQ ; } ifa =rtnl_dereference (in_dev->ifa_list);if (!ifa) {np_err (np,"no IP address for %s, aborting\n" , -egress_dev (np, buf)); +egress_dev (np, buf,sizeof (buf)));return -EDESTADDRREQ ; }
@@ -719,7 +721,8 @@ int netpoll_setup(struct netpoll *np) ndev =dev_getbyhwaddr (net,ARPHRD_ETHER , np->dev_mac);if (!ndev) { -np_err (np,"%s doesn't exist, aborting\n" ,egress_dev (np, buf)); +np_err (np,"%s doesn't exist, aborting\n" , +egress_dev (np, buf,sizeof (buf))); err = -ENODEV ; goto unlock; }
@@ -727,14 +730,14 @@ int netpoll_setup(struct netpoll *np)if (netdev_master_upper_dev_get (ndev)) {np_err (np,"%s is a slave device, aborting\n" , -egress_dev (np, buf)); +egress_dev (np, buf,sizeof (buf))); err = -EBUSY ; goto put; }if (!netif_running (ndev)) {np_info (np,"device %s not up yet, forcing it\n" , -egress_dev (np, buf)); +egress_dev (np, buf,sizeof (buf))); err =dev_open (ndev,NULL );if (err) {
Greg Kroah-Hartman
maintainerPATCH 121/307 net/rds: handle zerocopy send cleanup before the message is queued
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nan Li <[email protected]>
commit 44b550d88b267320459d518c0743a241ab2108fa upstream.
A zerocopy send can fail after user pages have been pinned but before the message is attached to the sending socket.
The purge path currently infers zerocopy state from rm->m_rs, so an unqueued message can be cleaned up as if it owned normal payload pages. However, zerocopy ownership is really determined by the presence of op_mmp_znotifier, regardless of whether the message has reached the socket queue.
Capture op_mmp_znotifier up front in rds_message_purge() and use it as the cleanup discriminator. If the message is already associated with a socket, keep the existing completion path. Otherwise, drop the pinned page accounting directly and release the notifier before putting the payload pages.
This keeps early send failure cleanup consistent with the zerocopy lifetime rules without changing the normal queued completion path.
--- net/rds/message.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
net/rds/message.c +15 -5
@@ -131,24 +131,34 @@ static void rds_rm_zerocopy_callback(str*/ static void rds_message_purge (struct rds_message *rm) { +struct rds_znotifier *znotifier;unsigned long i, flags; -bool zcopy = false; +bool zcopy;if (unlikely (test_bit (RDS_MSG_PAGEVEC , &rm->m_flags)))return ;spin_lock_irqsave (&rm->m_rs_lock, flags); + znotifier = rm->data.op_mmp_znotifier; + rm->data.op_mmp_znotifier =NULL ; + zcopy = !!znotifier; +if (rm->m_rs) {struct rds_sock *rs = rm->m_rs; -if (rm->data.op_mmp_znotifier) { - zcopy = true; -rds_rm_zerocopy_callback (rs, rm->data.op_mmp_znotifier); +if (znotifier) { +rds_rm_zerocopy_callback (rs, znotifier);rds_wake_sk_sleep (rs); - rm->data.op_mmp_znotifier =NULL ; }sock_put (rds_rs_to_sk (rs)); rm->m_rs =NULL ; + }else if (znotifier) { +/* +* Zerocopy can fail before the message is queued on the +* socket, so there is no rs to carry the notification. +*/ +mm_unaccount_pinned_pages (&znotifier->z_mmp); +kfree (rds_info_from_znotifier (znotifier)); }spin_unlock_irqrestore (&rm->m_rs_lock, flags);
Greg Kroah-Hartman
maintainerPATCH 122/307 net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavitra Jha <[email protected]>
commit 0e7c074cfcd9bd93765505f9eb8b42f03ed2a744 upstream.
t7xx_port_enum_msg_handler() uses the modem-supplied port_count field as a loop bound over port_msg->data[] without checking that the message buffer contains sufficient data. A modem sending port_count=65535 in a 12-byte buffer triggers a slab-out-of-bounds read of up to 262140 bytes.
Add a sizeof(*port_msg) check before accessing the port message header fields to guard against undersized messages.
Add a struct_size() check after extracting port_count and before the loop.
In t7xx_parse_host_rt_data(), guard the rt_feature header read with a remaining-buffer check before accessing data_len, validate feat_data_len against the actual remaining buffer to prevent OOB reads and signed integer overflow on offset.
Pass msg_len from both call sites: skb->len at the DPMAIF path after skb_pull(), and the validated feat_data_len at the handshake path.
--- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 +++++++++++++++++--- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++++++++++++++++-- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- 3 files changed, 34 insertions(+), 6 deletions(-)
drivers/net/wwan/t7xx/t7xx_modem_ops.c +17 -3
@@ -457,8 +457,20 @@ static int t7xx_parse_host_rt_data(struc offset =sizeof (struct feature_query );for (i =0 ; i <FEATURE_COUNT && offset < data_length; i++) { +size_t remaining = data_length - offset; +size_t feat_data_len, feat_total; + +if (remaining <sizeof (*rt_feature)) +break ; + rt_feature = data + offset; - offset +=sizeof (*rt_feature) +le32_to_cpu (rt_feature->data_len); + feat_data_len =le32_to_cpu (rt_feature->data_len); + +if (feat_data_len > remaining -sizeof (*rt_feature)) +break ; + + feat_total =sizeof (*rt_feature) + feat_data_len; + offset += feat_total; ft_spt_cfg =FIELD_GET (FEATURE_MSK , core->feature_set[i]);if (ft_spt_cfg !=MTK_FEATURE_MUST_BE_SUPPORTED )
@@ -468,8 +480,10 @@ static int t7xx_parse_host_rt_data(strucif (ft_spt_st !=MTK_FEATURE_MUST_BE_SUPPORTED )return -EINVAL ; -if (i ==RT_ID_MD_PORT_ENUM || i ==RT_ID_AP_PORT_ENUM ) -t7xx_port_enum_msg_handler (ctl->md, rt_feature->data); +if (i ==RT_ID_MD_PORT_ENUM || i ==RT_ID_AP_PORT_ENUM ) { +t7xx_port_enum_msg_handler (ctl->md, rt_feature->data, + feat_data_len); + } }return 0 ;
drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c +16 -2
@@ -117,6 +117,7 @@ static int fsm_ee_message_handler(struct* t7xx_port_enum_msg_handler() - Parse the port enumeration message to create/remove nodes. * @md: Modem context. * @msg: Message. +* @msg_len: Length of @msg in bytes. * * Used to control create/remove device node. *
@@ -124,12 +125,18 @@ static int fsm_ee_message_handler(struct* * 0 - Success. * * -EFAULT - Message check failure. */ -int t7xx_port_enum_msg_handler (struct t7xx_modem *md,void *msg) +int t7xx_port_enum_msg_handler (struct t7xx_modem *md,void *msg,size_t msg_len) {struct device *dev = &md->t7xx_dev->pdev->dev;unsigned int version, port_count, i;struct port_msg *port_msg = msg; +if (msg_len <sizeof (*port_msg)) { +dev_err (dev,"Port enum msg too short for header: need %zu, have %zu\n" , +sizeof (*port_msg), msg_len); +return -EINVAL ; + } + version =FIELD_GET (PORT_MSG_VERSION ,le32_to_cpu (port_msg->info)); if (version != PORT_ENUM_VER || le32_to_cpu(port_msg->head_pattern) != PORT_ENUM_HEAD_PATTERN ||
@@ -141,6 +148,13 @@ int t7xx_port_enum_msg_handler(struct t7 } port_count =FIELD_GET (PORT_MSG_PRT_CNT ,le32_to_cpu (port_msg->info)); + +if (msg_len <struct_size (port_msg, data, port_count)) { +dev_err (dev,"Port enum msg too short: need %zu, have %zu\n" , +struct_size (port_msg, data, port_count), msg_len); +return -EINVAL ; + } +for (i =0 ; i < port_count; i++) {u32 port_info =le32_to_cpu (port_msg->data[i]);unsigned int ch_id;
@@ -191,7 +205,7 @@ static int control_msg_handler(struct t7case CTL_ID_PORT_ENUM :skb_pull (skb,sizeof (*ctrl_msg_h)); - ret =t7xx_port_enum_msg_handler (ctl->md, (struct port_msg *)skb->data); + ret =t7xx_port_enum_msg_handler (ctl->md, (struct port_msg *)skb->data, skb->len);if (!ret) ret =port_ctl_send_msg_to_md (port,CTL_ID_PORT_ENUM ,0 );else
drivers/net/wwan/t7xx/t7xx_port_proxy.h +1 -1
@@ -103,7 +103,7 @@ void t7xx_port_proxy_reset(struct port_pvoid t7xx_port_proxy_uninit (struct port_proxy *port_prox);int t7xx_port_proxy_init (struct t7xx_modem *md);void t7xx_port_proxy_md_status_notify (struct port_proxy *port_prox,unsigned int state); -int t7xx_port_enum_msg_handler (struct t7xx_modem *md,void *msg); +int t7xx_port_enum_msg_handler (struct t7xx_modem *md,void *msg,size_t msg_len);int t7xx_port_proxy_chl_enable_disable (struct port_proxy *port_prox,unsigned int ch_id,bool en_flag);void t7xx_port_proxy_set_cfg (struct t7xx_modem *md,enum port_cfg_id cfg_id);
Greg Kroah-Hartman
maintainerPATCH 123/307 ovl: fix verity lazy-load guard broken by fsverity_active() semantic change
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Walters <[email protected]>
commit 0c8c88b8eb82a2a41bec5f17c076d6312dc40316 upstream.
Commit f77f281b6118 ("fsverity: use a hashtable to find the fsverity_info") made fsverity_active() check whether the inode has the verity flag, rather than whether the inode's fsverity_info is loaded. This broke ovl_ensure_verity_loaded(), which wants to load the fsverity_info for any verity inodes that haven't had it loaded yet.
Therefore, to check that the fsverity_info hasn't yet been loaded, use fsverity_get_info(inode) == NULL instead of !fsverity_active(inode).
Also, since fsverity_get_info() now involves a hash table lookup, put the more lightweight IS_VERITY() flag check first.
--- fs/overlayfs/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/overlayfs/util.c +1 -1
@@ -1379,7 +1379,7 @@ int ovl_ensure_verity_loaded(const strucstruct inode *inode =d_inode (datapath->dentry);struct file *filp; -if (!fsverity_active (inode) &&IS_VERITY (inode)) { +if (IS_VERITY (inode) &&fsverity_get_info (inode) ==NULL ) {/* * If this inode was not yet opened, the verity info hasn't been * loaded yet, so we need to do that here to force it into memory.
Greg Kroah-Hartman
maintainerPATCH 124/307 platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
commit 525cb7ba6661074c1c5cc3772bccc6afab6791ef upstream.
cros_typec_register_thunderbolt() missed initializing the adata->lock mutex. This leads to a NULL dereference when the mutex is later acquired (e.g. in cros_typec_altmode_work()).
Initialize the mutex in cros_typec_register_thunderbolt() to fix the issue.
--- drivers/platform/chrome/cros_typec_altmode.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/chrome/cros_typec_altmode.c +1 -0
@@ -359,6 +359,7 @@ cros_typec_register_thunderbolt(struct c }INIT_WORK (&adata->work, cros_typec_altmode_work); +mutex_init (&adata->lock); adata->alt = alt; adata->port = port; adata->ap_mode_entry = true;
Greg Kroah-Hartman
maintainerPATCH 125/307 parisc: Fix IRQ leak in LASI driver
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongling Zeng <[email protected]>
commit 37b0dc5e279f35036fb638d1e187197b6c05a76d upstream.
When request_irq() succeeds but gsc_common_setup() fails later, the IRQ is never released. Fix this by adding proper error handling with goto labels to ensure resources are released in LIFO order.
Detected by Smatch:
drivers/parisc/lasi.c:216 lasi_init_chip() warn: 'lasi->gsc_irq.irq'
from request_irq() not released on lines: 207.
--- drivers/parisc/lasi.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/parisc/lasi.c +8 -4
@@ -193,8 +193,7 @@ static int __init lasi_init_chip(struct ret =request_irq (lasi->gsc_irq.irq, gsc_asic_intr,0 ,"lasi" , lasi);if (ret <0 ) { -kfree (lasi); -return ret; + goto err_free; }/* enable IRQ's for devices below LASI */
@@ -203,8 +202,7 @@ static int __init lasi_init_chip(struct/* Done init'ing, register this driver */ ret =gsc_common_setup (dev, lasi);if (ret) { -kfree (lasi); -return ret; + goto err_irq; }gsc_fixup_irqs (dev, lasi, lasi_choose_irq);
@@ -214,6 +212,12 @@ static int __init lasi_init_chip(struct SYS_OFF_PRIO_DEFAULT, lasi_power_off, lasi);return ret; + +err_irq: +free_irq (lasi->gsc_irq.irq, lasi); +err_free: +kfree (lasi); +return ret; }static struct parisc_device_id lasi_tbl[]__initdata = {
Greg Kroah-Hartman
maintainerPATCH 126/307 x86/efi: Fix graceful fault handling after FPU softirq changes
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Hu <[email protected]>
commit 088f65e206087bf903743bd18417261d7a4c9644 upstream.
Since commit d02198550423 ("x86/fpu: Improve crypto performance by making kernel-mode FPU reliably usable in softirqs"), kernel_fpu_begin() calls fpregs_lock() which uses local_bh_disable() instead of the previous preempt_disable(). This sets SOFTIRQ_OFFSET in preempt_count during the entire EFI runtime service call, causing in_interrupt() to return true in normal task context.
The graceful page fault handler efi_crash_gracefully_on_page_fault() uses in_interrupt() to bail out for faults in real interrupt context. With SOFTIRQ_OFFSET now set, the handler always bails out, leaving EFI firmware page faults unhandled. This escalates to die() which also sees in_interrupt() as true and calls panic("Fatal exception in interrupt"), resulting in a hard system freeze. On systems with buggy firmware that triggers page faults during EFI runtime calls (e.g., accessing unmapped memory in GetTime()), this causes an unrecoverable hang instead of the expected graceful EFI_ABORTED recovery.
Fix by replacing in_interrupt() with !in_task(). This preserves the original intent of bailing for interrupts or NMI faults, while no longer falsely triggering from the FPU code path's local_bh_disable().
[ardb: Sashiko spotted that using 'in_hardirq() || in_nmi()' leaves a
window where a softirq may be taken before fpregs_lock() is called, but after efi_rts_work.efi_rts_id has been assigned, and any page faults occurring in that window will then be misidentified as having been caused by the firmware. Instead, use !in_task(), which incorporates in_serving_softirq(). ]
--- arch/x86/platform/efi/quirks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/platform/efi/quirks.c +1 -1
@@ -771,7 +771,7 @@ void efi_crash_gracefully_on_page_fault(* If we get an interrupt/NMI while processing an EFI runtime service * then this is a regular OOPS, not an EFI failure. */ -if (in_interrupt ()) +if (!in_task ())return ;/*
Greg Kroah-Hartman
maintainerPATCH 127/307 hwmon: (ltc2992) Clamp threshold writes to hardware range
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
commit d6cc7c99bf1f73eda7d565d224d791d16239bb41 upstream.
ltc2992_set_voltage(), ltc2992_set_current(), and ltc2992_set_power() do not validate the user-supplied value before converting it to a register value. This can result in:
1. Negative input values wrapping to large positive register values. For power, the negative long is implicitly cast to u64 in mul_u64_u32_div(), producing an incorrect value. For voltage and current, the negative converted value wraps when passed to ltc2992_write_reg() as a u32.
2. Intermediate arithmetic exceeding the range representable in u64 on 64-bit platforms. In ltc2992_set_voltage(), (u64)val * 1000 can exceed U64_MAX when val is a large positive long. In ltc2992_set_current(), (u64)val * r_sense_uohm can overflow similarly. In ltc2992_set_power(), the computed value may not fit in u64.
3. Register values exceeding the hardware field width. Voltage and current threshold registers are 12-bit (stored left-justified in 16 bits), and power threshold registers are 24-bit. Without clamping, bits above the field width are truncated in ltc2992_write_reg().
Fix by clamping negative values to zero, clamping positive values to the rounded hardware-representable maximum (the value returned by the read path for a full-scale register) to prevent intermediate overflow, and clamping the converted register value to the hardware field width before writing. The existing conversion formula and rounding behavior are preserved.
In the power write path, cancel the factor of 1000 from both the numerator (r_sense_uohm * 1000) and the denominator (VADC_UV_LSB * IADC_NANOV_LSB) to also eliminate a u32 overflow of r_sense_uohm * 1000 when r_sense_uohm exceeds about 4.29 ohms.
--- drivers/hwmon/ltc2992.c | 35 ++++++++++++++++++++++++++++------- 1 file changed, 28 insertions(+), 7 deletions(-)
drivers/hwmon/ltc2992.c +28 -7
@@ -431,10 +431,16 @@ static int ltc2992_get_voltage(struct ltstatic int ltc2992_set_voltage (struct ltc2992_state *st,u32 reg,u32 scale,long val) { - val =DIV_ROUND_CLOSEST (val *1000 , scale); - val = val <<4 ; +u32 reg_val; +long vmax; + + vmax =DIV_ROUND_CLOSEST_ULL (0xFFFULL * scale,1000 ); + val =max (val,0L ); + val =min (val, vmax); + reg_val =min (DIV_ROUND_CLOSEST_ULL ((u64 )val *1000 , scale), +0xFFFULL ) <<4 ; -return ltc2992_write_reg (st, reg,2 , val); +return ltc2992_write_reg (st, reg,2 , reg_val); }static int ltc2992_read_gpio_alarm (struct ltc2992_state *st,int nr_gpio,u32 attr,long *val)
@@ -559,9 +565,15 @@ static int ltc2992_get_current(struct ltstatic int ltc2992_set_current (struct ltc2992_state *st,u32 reg,u32 channel,long val) {u32 reg_val; +long cmax; - reg_val =DIV_ROUND_CLOSEST (val * st->r_sense_uohm[channel],LTC2992_IADC_NANOV_LSB ); - reg_val = reg_val <<4 ; + cmax =DIV_ROUND_CLOSEST_ULL (0xFFFULL *LTC2992_IADC_NANOV_LSB , + st->r_sense_uohm[channel]); + val =max (val,0L ); + val =min (val, cmax); + reg_val =min (DIV_ROUND_CLOSEST_ULL ((u64 )val * st->r_sense_uohm[channel], +LTC2992_IADC_NANOV_LSB ), +0xFFFULL ) <<4 ;return ltc2992_write_reg (st, reg,2 , reg_val); }
@@ -634,9 +646,18 @@ static int ltc2992_get_power(struct ltc2static int ltc2992_set_power (struct ltc2992_state *st,u32 reg,u32 channel,long val) {u32 reg_val; +u64 pmax, uval; - reg_val =mul_u64_u32_div (val, st->r_sense_uohm[channel] *1000 , -LTC2992_VADC_UV_LSB *LTC2992_IADC_NANOV_LSB ); + uval =max (val,0L ); + pmax =mul_u64_u32_div (0xFFFFFFULL , +LTC2992_VADC_UV_LSB /1000 * +LTC2992_IADC_NANOV_LSB , + st->r_sense_uohm[channel]); + uval =min (uval, pmax); + reg_val =min (mul_u64_u32_div (uval, st->r_sense_uohm[channel], +LTC2992_VADC_UV_LSB /1000 * +LTC2992_IADC_NANOV_LSB ), +0xFFFFFFULL );return ltc2992_write_reg (st, reg,3 , reg_val); }
Greg Kroah-Hartman
maintainerPATCH 128/307 hwmon: (ltc2992) Fix u32 overflow in power read path
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
commit 2da0c1fd01dbd6b22844e8676585153dfc660cbe upstream.
ltc2992_get_power() computes the divisor for mul_u64_u32_div() as r_sense_uohm * 1000. This multiplication overflows u32 when r_sense_uohm exceeds about 4.29 ohms (4294967 micro-ohms), producing a truncated divisor and an incorrect power reading.
Cancel the factor of 1000 from both the numerator (VADC_UV_LSB * IADC_NANOV_LSB = 312500000) and the divisor (r_sense_uohm * 1000), giving (VADC_UV_LSB / 1000) * IADC_NANOV_LSB = 312500 as the numerator and plain r_sense_uohm as the divisor. The cancellation is exact because LTC2992_VADC_UV_LSB (25000) is divisible by 1000.
This is the read-path counterpart of the write-path fix applied in the preceding patch.
--- drivers/hwmon/ltc2992.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/hwmon/ltc2992.c +4 -2
@@ -637,8 +637,10 @@ static int ltc2992_get_power(struct ltc2if (reg_val <0 )return reg_val; - *val =mul_u64_u32_div (reg_val,LTC2992_VADC_UV_LSB *LTC2992_IADC_NANOV_LSB , - st->r_sense_uohm[channel] *1000 ); + *val =mul_u64_u32_div (reg_val, +LTC2992_VADC_UV_LSB /1000 * +LTC2992_IADC_NANOV_LSB , + st->r_sense_uohm[channel]);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 129/307 clk: rk808: fix OF node reference imbalance
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit de019f203b0d472c98ead4081ad4f05d92c9b826 upstream.
The driver reuses the OF node of the parent multi-function device but fails to take another reference to balance the one dropped by the platform bus code when unbinding the MFD and deregistering the child devices.
Fix this by using the intended helper for reusing OF nodes.
--- drivers/clk/clk-rk808.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/clk-rk808.c +1 -1
@@ -153,7 +153,7 @@ static int rk808_clkout_probe(struct plastruct rk808_clkout *rk808_clkout;int ret; - dev->of_node = pdev->dev.parent->of_node; +device_set_of_node_from_dev (dev, dev->parent); rk808_clkout =devm_kzalloc (dev,sizeof (*rk808_clkout),GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 130/307 hwmon: (corsair-psu) Close HID device on probe errors
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <[email protected]>
commit 174606451fbb17db506ebaacdd5e203e57773d5f upstream.
corsairpsu_probe() opens the HID device before sending the device init and firmware-info commands. If either command fails, the error path jumps directly to fail_and_stop and skips hid_hw_close().
Use the existing fail_and_close label for those post-open failures so the open count and low-level close callback are balanced before hid_hw_stop().
--- drivers/hwmon/corsair-psu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/corsair-psu.c +2 -2
@@ -796,13 +796,13 @@ static int corsairpsu_probe(struct hid_d ret =corsairpsu_init (priv);if (ret <0 ) {dev_err (&hdev->dev,"unable to initialize device (%d)\n" , ret); - goto fail_and_stop; + goto fail_and_close; } ret =corsairpsu_fwinfo (priv);if (ret <0 ) {dev_err (&hdev->dev,"unable to query firmware (%d)\n" , ret); - goto fail_and_stop; + goto fail_and_close; }corsairpsu_get_criticals (priv);
Greg Kroah-Hartman
maintainerPATCH 131/307 af_unix: Reject SIOCATMARK on non-stream sockets
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiexun Wang <[email protected]>
commit d119775f2bad827edc28071c061fdd4a91f889a5 upstream.
SIOCATMARK reports whether the receive queue is at the urgent mark for MSG_OOB.
In AF_UNIX, MSG_OOB is supported only for SOCK_STREAM sockets. SOCK_DGRAM and SOCK_SEQPACKET reject MSG_OOB in sendmsg() and recvmsg(), so they should not support SIOCATMARK either.
Return -EOPNOTSUPP for non-stream sockets before checking the receive queue.
--- net/unix/af_unix.c | 3 +++ 1 file changed, 3 insertions(+)
net/unix/af_unix.c +3 -0
@@ -3300,6 +3300,9 @@ static int unix_ioctl(struct socket *socstruct sk_buff *skb;int answ =0 ; +if (sk->sk_type !=SOCK_STREAM ) +return -EOPNOTSUPP ; +mutex_lock (&u->iolock); skb =skb_peek (&sk->sk_receive_queue);
Greg Kroah-Hartman
maintainerPATCH 132/307 arm64/fpsimd: ptrace: zero targets fpsimd_state, not the tracers
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
commit 5cbb61bf4168859d97c068d88d364f4f1f440325 upstream.
sve_set_common() is the backend for PTRACE_SETREGSET(NT_ARM_SVE) and PTRACE_SETREGSET(NT_ARM_SSVE). Every write in the function operates on the tracee (target) - except a single memset that uses current instead, zeroing the tracer's saved V0-V31 / FPSR / FPCR shadow on every ptrace SETREGSET call.
The memset is meant to give the tracee a defined zero register image before the user-supplied payload is copied in (for partial writes, header-only writes, and FPSIMD<->SVE format switches). Aiming it at current both denies the tracee that clean slate and silently corrupts the tracer.
The corruption of the tracer's saved FPSIMD state is not always observable. Where the tracer's state is live on a CPU, this may be reused without loading the corrupted state from memory, and will eventually be written back over the corrupted state. Where the tracer's state is saved in SVE_PT_REGS_SVE format, only the FPSR and FPCR are clobbered, and the effective copy of the vectors is in the task's sve_state.
Reproducible on an arm64 kernel with SVE: a single-threaded tracer that loads a known pattern into V0-V31, issues PTRACE_SETREGSET(NT_ARM_SVE) on a child, and reads V0-V31 back observes them all zeroed within tens of thousands of iterations when a sibling thread keeps stealing the FPSIMD CPU binding.
--- arch/arm64/kernel/ptrace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/kernel/ptrace.c +2 -2
@@ -983,8 +983,8 @@ static int sve_set_common(struct task_st }/* Always zero V regs, FPSR, and FPCR */ -memset (¤t->thread.uw.fpsimd_state,0 , -sizeof (current->thread.uw.fpsimd_state)); +memset (&target->thread.uw.fpsimd_state,0 , +sizeof (target->thread.uw.fpsimd_state));/* Registers: FPSIMD-only case */
Greg Kroah-Hartman
maintainerPATCH 133/307 pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy()
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
commit ec1fcddb3117d9452210e838fd37389ee61e10e8 upstream.
In scpsys_get_bus_protection_legacy(), of_find_node_with_property() returns a device node with its reference count incremented. The function then calls of_node_put(node) before checking whether syscon_regmap_lookup_by_phandle() returns an error. If an error occurs, dev_err_probe() dereferences the node pointer to print diagnostic information, but the node memory may have already been freed due to the earlier of_node_put(), leading to a use-after-free vulnerability.
Fix this by moving the of_node_put() call after the error check, ensuring the node is still valid when accessed in the error path.
--- drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/pmdomain/mediatek/mtk-pm-domains.c +7 -3
@@ -993,6 +993,7 @@ static int scpsys_get_bus_protection_legstruct device_node *node, *smi_np;int num_regmaps =0 , i, j;struct regmap *regmap[3 ]; +int ret =0 ;/* * Legacy code retrieves a maximum of three bus protection handles:
@@ -1043,11 +1044,14 @@ static int scpsys_get_bus_protection_legif (node) { regmap[2 ] =syscon_regmap_lookup_by_phandle (node,"mediatek,infracfg-nao" ); num_regmaps++; -of_node_put (node); -if (IS_ERR (regmap[2 ])) -return dev_err_probe (dev,PTR_ERR (regmap[2 ]), +if (IS_ERR (regmap[2 ])) { + ret =dev_err_probe (dev,PTR_ERR (regmap[2 ]),"%pOF: failed to get infracfg regmap\n" , node); +of_node_put (node); +return ret; + } +of_node_put (node); }else { regmap[2 ] =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 134/307 block: add pgmap check to biovec_phys_mergeable
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naman Jain <[email protected]>
commit 13920e4b7b784b40cf4519ff1f0f3e513476a499 upstream.
biovec_phys_mergeable() is used by the request merge, DMA mapping, and integrity merge paths to decide if two physically contiguous bvec segments can be coalesced into one. It currently has no check for whether the segments belong to different dev_pagemaps.
When zone device memory is registered in multiple chunks, each chunk gets its own dev_pagemap. A single bio can legitimately contain bvecs from different pgmaps -- iov_iter_extract_bvecs() breaks at pgmap boundaries but the outer loop in bio_iov_iter_get_pages() continues filling the same bio. If such bvecs are physically contiguous, biovec_phys_mergeable() will coalesce them, making it impossible to recover the correct pgmap for the merged segment via page_pgmap().
Add a zone_device_pages_have_same_pgmap() check to prevent merging bvec segments that span different pgmaps.
--- block/blk.h | 2 ++ 1 file changed, 2 insertions(+)
block/blk.h +2 -0
@@ -132,6 +132,8 @@ static inline bool biovec_phys_mergeableif (addr1 + vec1->bv_len != addr2)return false; +if (!zone_device_pages_have_same_pgmap (vec1->bv_page, vec2->bv_page)) +return false;if (xen_domain () && !xen_biovec_phys_mergeable (vec1, vec2->bv_page))return false;if ((addr1 | mask) != ((addr2 + vec2->bv_len -1 ) | mask))
Greg Kroah-Hartman
maintainerPATCH 135/307 block: fix zone write plug removal
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit b7d4ffb510373cc6ecf16022dd0e510a023034fb upstream.
Commit 7b295187287e ("block: Do not remove zone write plugs still in use") modified disk_should_remove_zone_wplug() to add a check on the reference count of a zone write plug to prevent removing zone write plugs from a disk hash table when the plugs are still being referenced by BIOs or requests in-flight. However, this check does not take into account that a BIO completion may happen right after its submission by a zone write plug BIO work, and before the zone write plug BIO work releases the zone write plug reference count. This situation leads to disk_should_remove_zone_wplug() returning false as in this case the zone write plug reference count is at least equal to 3. If the BIO that completes in such manner transitioned the zone to the FULL condition, the zone write plug for the FULL zone will remain in the disk hash table.
Furthermore, relying on a particular value of a zone write plug reference count to set the BLK_ZONE_WPLUG_UNHASHED flag is fragile as reading the atomic reference count and doing a comparison with some value is not overall atomic at all.
Address these issues by reworking the reference counting of zone write plugs so that removing plugs from a disk hash table can be done directly from disk_put_zone_wplug() when the last reference on a plug is dropped.
To do so, replace the function disk_remove_zone_wplug() with disk_mark_zone_wplug_dead(). This new function sets the zone write plug flag BLK_ZONE_WPLUG_DEAD (which replaces BLK_ZONE_WPLUG_UNHASHED) and drops the initial reference on the zone write plug taken when the plug was added to the disk hash table. This function is called either for zones that are empty or full, or directly in the case of a forced plug removal (e.g. when the disk hash table is being destroyed on disk removal). With this change, disk_should_remove_zone_wplug() is also removed.
disk_put_zone_wplug() is modified to call the function disk_free_zone_wplug() to remove a zone write plug from a disk hash table and free the plug structure (with a call_rcu()), when the last reference on a zone write plug is dropped. disk_free_zone_wplug() always checks that the BLK_ZONE_WPLUG_DEAD flag is set.
In order to avoid having multiple zone write plugs for the same zone in the disk hash table, disk_get_and_lock_zone_wplug() checked for the BLK_ZONE_WPLUG_UNHASHED flag. This check is removed and a check for the new BLK_ZONE_WPLUG_DEAD flag is added to blk_zone_wplug_handle_write(). With this change, we continue preventing adding multiple zone write plugs for the same zone and at the same time re-inforce checks on the user behavior by failing new incoming write BIOs targeting a zone that is marked as dead. This case can happen only if the user erroneously issues write BIOs to zones that are full, or to zones that are currently being reset or finished.
--- block/blk-zoned.c | 151 ++++++++++++++++++++---------------------------------- 1 file changed, 57 insertions(+), 94 deletions(-)
block/blk-zoned.c +57 -94
@@ -99,17 +99,17 @@ static inline unsigned int disk_zone_wpl* being executed or the zone write plug bio list is not empty. * - BLK_ZONE_WPLUG_NEED_WP_UPDATE: Indicates that we lost track of a zone * write pointer offset and need to update it. -* - BLK_ZONE_WPLUG_UNHASHED: Indicates that the zone write plug was removed -* from the disk hash table and that the initial reference to the zone -* write plug set when the plug was first added to the hash table has been -* dropped. This flag is set when a zone is reset, finished or become full, -* to prevent new references to the zone write plug to be taken for -* newly incoming BIOs. A zone write plug flagged with this flag will be -* freed once all remaining references from BIOs or functions are dropped. +* - BLK_ZONE_WPLUG_DEAD: Indicates that the zone write plug will be +* removed from the disk hash table of zone write plugs when the last +* reference on the zone write plug is dropped. If set, this flag also +* indicates that the initial extra reference on the zone write plug was +* dropped, meaning that the reference count indicates the current number of +* active users (code context or BIOs and requests in flight). This flag is +* set when a zone is reset, finished or becomes full. */ #define BLK_ZONE_WPLUG_PLUGGED (1U << 0)#define BLK_ZONE_WPLUG_NEED_WP_UPDATE (1U << 1) -#define BLK_ZONE_WPLUG_UNHASHED (1U << 2) +#define BLK_ZONE_WPLUG_DEAD (1U << 2)/** * blk_zone_cond_str - Return a zone condition name string
@@ -587,64 +587,15 @@ static void disk_free_zone_wplug_rcu(strmempool_free (zwplug, zwplug->disk->zone_wplugs_pool); } -static inline void disk_put_zone_wplug (struct blk_zone_wplug *zwplug) -{ -if (refcount_dec_and_test (&zwplug->ref)) { -WARN_ON_ONCE (!bio_list_empty (&zwplug->bio_list)); -WARN_ON_ONCE (zwplug->flags &BLK_ZONE_WPLUG_PLUGGED ); -WARN_ON_ONCE (!(zwplug->flags &BLK_ZONE_WPLUG_UNHASHED )); - -call_rcu (&zwplug->rcu_head, disk_free_zone_wplug_rcu); - } -} - -static inline bool disk_should_remove_zone_wplug (struct gendisk *disk, -struct blk_zone_wplug *zwplug) -{ -lockdep_assert_held (&zwplug->lock); - -/* If the zone write plug was already removed, we are done. */ -if (zwplug->flags &BLK_ZONE_WPLUG_UNHASHED ) -return false; - -/* If the zone write plug is still plugged, it cannot be removed. */ -if (zwplug->flags &BLK_ZONE_WPLUG_PLUGGED ) -return false; - -/* -* Completions of BIOs with blk_zone_write_plug_bio_endio() may -* happen after handling a request completion with -* blk_zone_write_plug_finish_request() (e.g. with split BIOs -* that are chained). In such case, disk_zone_wplug_unplug_bio() -* should not attempt to remove the zone write plug until all BIO -* completions are seen. Check by looking at the zone write plug -* reference count, which is 2 when the plug is unused (one reference -* taken when the plug was allocated and another reference taken by the -* caller context). -*/ -if (refcount_read (&zwplug->ref) >2 ) -return false; - -/* We can remove zone write plugs for zones that are empty or full. */ -return !zwplug->wp_offset ||disk_zone_wplug_is_full (disk, zwplug); -} - -static void disk_remove_zone_wplug (struct gendisk *disk, -struct blk_zone_wplug *zwplug) +static void disk_free_zone_wplug (struct blk_zone_wplug *zwplug) { +struct gendisk *disk = zwplug->disk;unsigned long flags; -/* If the zone write plug was already removed, we have nothing to do. */ -if (zwplug->flags &BLK_ZONE_WPLUG_UNHASHED ) -return ; +WARN_ON_ONCE (!(zwplug->flags &BLK_ZONE_WPLUG_DEAD )); +WARN_ON_ONCE (zwplug->flags &BLK_ZONE_WPLUG_PLUGGED ); +WARN_ON_ONCE (!bio_list_empty (&zwplug->bio_list)); -/* -* Mark the zone write plug as unhashed and drop the extra reference we -* took when the plug was inserted in the hash table. Also update the -* disk zone condition array with the current condition of the zone -* write plug. -*/ - zwplug->flags |=BLK_ZONE_WPLUG_UNHASHED ;spin_lock_irqsave (&disk->zone_wplugs_lock, flags); blk_zone_set_cond(rcu_dereference_check(disk->zones_cond, lockdep_is_held(&disk->zone_wplugs_lock)),
@@ -652,7 +603,29 @@ static void disk_remove_zone_wplug(struchlist_del_init_rcu (&zwplug->node);atomic_dec (&disk->nr_zone_wplugs);spin_unlock_irqrestore (&disk->zone_wplugs_lock, flags); -disk_put_zone_wplug (zwplug); + +call_rcu (&zwplug->rcu_head, disk_free_zone_wplug_rcu); +} + +static inline void disk_put_zone_wplug (struct blk_zone_wplug *zwplug) +{ +if (refcount_dec_and_test (&zwplug->ref)) +disk_free_zone_wplug (zwplug); +} + +/* +* Flag the zone write plug as dead and drop the initial reference we got when +* the zone write plug was added to the hash table. The zone write plug will be +* unhashed when its last reference is dropped. +*/ +static void disk_mark_zone_wplug_dead (struct blk_zone_wplug *zwplug) +{ +lockdep_assert_held (&zwplug->lock); + +if (!(zwplug->flags &BLK_ZONE_WPLUG_DEAD )) { + zwplug->flags |=BLK_ZONE_WPLUG_DEAD ; +disk_put_zone_wplug (zwplug); + } }static void blk_zone_wplug_bio_work (struct work_struct *work);
@@ -672,18 +645,7 @@ static struct blk_zone_wplug *disk_get_a again: zwplug =disk_get_zone_wplug (disk, sector);if (zwplug) { -/* -* Check that a BIO completion or a zone reset or finish -* operation has not already removed the zone write plug from -* the hash table and dropped its reference count. In such case, -* we need to get a new plug so start over from the beginning. -*/ spin_lock_irqsave (&zwplug->lock, *flags); -if (zwplug->flags &BLK_ZONE_WPLUG_UNHASHED ) { -spin_unlock_irqrestore (&zwplug->lock, *flags); -disk_put_zone_wplug (zwplug); - goto again; - }return zwplug; }
@@ -788,14 +750,8 @@ static void disk_zone_wplug_set_wp_offsedisk_zone_wplug_update_cond (disk, zwplug);disk_zone_wplug_abort (zwplug); - -/* -* The zone write plug now has no BIO plugged: remove it from the -* hash table so that it cannot be seen. The plug will be freed -* when the last reference is dropped. -*/ -if (disk_should_remove_zone_wplug (disk, zwplug)) -disk_remove_zone_wplug (disk, zwplug); +if (!zwplug->wp_offset ||disk_zone_wplug_is_full (disk, zwplug)) +disk_mark_zone_wplug_dead (zwplug); }static unsigned int blk_zone_wp_offset (struct blk_zone *zone)
@@ -1451,6 +1407,19 @@ static bool blk_zone_wplug_handle_write(return true; } +/* +* If we got a zone write plug marked as dead, then the user is issuing +* writes to a full zone, or without synchronizing with zone reset or +* zone finish operations. In such case, fail the BIO to signal this +* invalid usage. +*/ +if (zwplug->flags &BLK_ZONE_WPLUG_DEAD ) { +spin_unlock_irqrestore (&zwplug->lock, flags); +disk_put_zone_wplug (zwplug); +bio_io_error (bio); +return true; + } +/* Indicate that this BIO is being handled using zone write plugging. */ bio_set_flag (bio,BIO_ZONE_WRITE_PLUGGING );
@@ -1531,7 +1500,7 @@ static void blk_zone_wplug_handle_native disk->disk_name, zwplug->zone_no);disk_zone_wplug_abort (zwplug); } -disk_remove_zone_wplug (disk, zwplug); +disk_mark_zone_wplug_dead (zwplug);spin_unlock_irqrestore (&zwplug->lock, flags);disk_put_zone_wplug (zwplug);
@@ -1634,14 +1603,8 @@ static void disk_zone_wplug_unplug_bio(s } zwplug->flags &= ~BLK_ZONE_WPLUG_PLUGGED ; - -/* -* If the zone is full (it was fully written or finished, or empty -* (it was reset), remove its zone write plug from the hash table. -*/ -if (disk_should_remove_zone_wplug (disk, zwplug)) -disk_remove_zone_wplug (disk, zwplug); - +if (!zwplug->wp_offset ||disk_zone_wplug_is_full (disk, zwplug)) +disk_mark_zone_wplug_dead (zwplug);spin_unlock_irqrestore (&zwplug->lock, flags); }
@@ -1852,9 +1815,9 @@ static void disk_destroy_zone_wplugs_haswhile (!hlist_empty (&disk->zone_wplugs_hash[i])) { zwplug =hlist_entry (disk->zone_wplugs_hash[i].first, struct blk_zone_wplug, node); -refcount_inc (&zwplug->ref); -disk_remove_zone_wplug (disk, zwplug); -disk_put_zone_wplug (zwplug); +spin_lock_irq (&zwplug->lock); +disk_mark_zone_wplug_dead (zwplug); +spin_unlock_irq (&zwplug->lock); } }
Greg Kroah-Hartman
maintainerPATCH 136/307 block: only read from sqe on initial invocation of blkdev_uring_cmd()
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
commit 212ec34e4e726e8cd4af7bea4740db24de8a9dab upstream.
This passthrough helper currently only supports discards. Part of that command is the start and length, which is read from the SQE. It does so on every invocation, where it really should just make it stable on the first invocation. This avoids needing to copy the SQE upfront, as we only really need those two 8b values stored in our per-req payload.
--- block/ioctl.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-)
block/ioctl.c +15 -9
@@ -864,6 +864,8 @@ long compat_blkdev_ioctl(struct file *fi#endif struct blk_iou_cmd { +u64 start; +u64 len;int res;bool nowait; };
@@ -953,23 +955,27 @@ int blkdev_uring_cmd(struct io_uring_cmd {struct block_device *bdev =I_BDEV (cmd->file->f_mapping->host); struct blk_iou_cmd *bic = io_uring_cmd_to_pdu(cmd, struct blk_iou_cmd); -const struct io_uring_sqe *sqe = cmd->sqe;u32 cmd_op = cmd->cmd_op; -uint64_t start, len; -if (unlikely (sqe->ioprio || sqe->__pad1 || sqe->len || - sqe->rw_flags || sqe->file_index)) -return -EINVAL ; +/* Read what we need from the SQE on the first issue */ +if (!(issue_flags &IORING_URING_CMD_REISSUE )) { +const struct io_uring_sqe *sqe = cmd->sqe; + +if (unlikely (sqe->ioprio || sqe->__pad1 || sqe->len || + sqe->rw_flags || sqe->file_index)) +return -EINVAL ; + + bic->start =READ_ONCE (sqe->addr); + bic->len =READ_ONCE (sqe->addr3); + } bic->res =0 ; bic->nowait = issue_flags &IO_URING_F_NONBLOCK ; - start =READ_ONCE (sqe->addr); - len =READ_ONCE (sqe->addr3); -switch (cmd_op) {case BLOCK_URING_CMD_DISCARD : -return blkdev_cmd_discard (cmd, bdev, start, len, bic->nowait); +return blkdev_cmd_discard (cmd, bdev, bic->start, bic->len, + bic->nowait); }return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 137/307 cifs: abort open_cached_dir if we dont request leases
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Prasad N <[email protected]>
commit d68ce834f8cf6cb2e77f3331df65166b35466b53 upstream.
It is possible that SMB2_open_init may not set lease context based on the requested oplock level. This can happen when leases have been temporarily or permanently disabled. When this happens, we will have open_cached_dir making an open without lease context and the response will anyway be rejected by open_cached_dir (thereby forcing a close to discard this open). That's unnecessary two round-trips to the server.
This change adds a check before making the open request to the server to make sure that SMB2_open_init did add the expected lease context to the open in open_cached_dir.
--- fs/smb/client/cached_dir.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/smb/client/cached_dir.c +8 -0
@@ -286,6 +286,14 @@ replay_again: &rqst[0], &oplock, &oparms, utf16_path);if (rc) goto oshr_free; + +if (oplock !=SMB2_OPLOCK_LEVEL_II ) { + rc = -EINVAL ; +cifs_dbg (FYI ,"%s: Oplock level %d not suitable for cached directory\n" , + __func__, oplock); + goto oshr_free; + } +smb2_set_next_command (tcon, &rqst[0 ]);memset (&qi_iov,0 ,sizeof (qi_iov));
Greg Kroah-Hartman
maintainerPATCH 138/307 cifs: change_conf needs to be called for session setup
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Prasad N <[email protected]>
commit c208a2b95811d6e1ebae65d0d2fc13f73707f8e7 upstream.
Today we skip calling change_conf for negotiates and session setup requests. This can be a problem for mchan as the immediate next call after session setup could be due to an I/O that is made on the mount point. For single channel, this is not a problem as there will be several calls after setting up session.
This change enforces calling change_conf when the total credits contain enough for reservations for echoes and oplocks. We expect this to happen during the last session setup response. This way, echoes and oplocks are not disabled before the first request to the server. So if that first request is an open, it does not need to disable requesting leases.
--- fs/smb/client/smb2ops.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
fs/smb/client/smb2ops.c +11 -0
@@ -111,10 +111,21 @@ smb2_add_credits(struct TCP_Server_Info cifs_trace_rw_credits_zero_in_flight); } server->in_flight--; + +/* +* Rebalance credits when an op drains in_flight. For session setup, +* do this only when the total accumulated credits are high enough (>2) +* so that a newly established secondary channel can reserve credits for +* echoes and oplocks. We expect this to happen at the end of the final +* session setup response. +*/ if (server->in_flight ==0 && ((optype &CIFS_OP_MASK ) !=CIFS_NEG_OP ) && ((optype &CIFS_OP_MASK ) !=CIFS_SESS_OP )) rc =change_conf (server); +else if (server->in_flight ==0 && + ((optype &CIFS_OP_MASK ) ==CIFS_SESS_OP ) && *val >2 ) + rc =change_conf (server);/* * Sometimes server returns 0 credits on oplock break ack - we need to * rebalance credits in this case.
Greg Kroah-Hartman
maintainerPATCH 139/307 extcon: ptn5150: handle pending IRQ events during system resume
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit 4652fefcda3c604c83d1ae28ede94544e2142f06 upstream.
When the system is suspended and ptn5150 wakeup interrupt is disabled, any changes on ptn5150 will only be record in interrupt status registers and won't fire an IRQ since its trigger type is falling edge. So the HW interrupt line will keep at low state and any further changes won't trigger IRQ anymore. To fix it, this will schedule a work to check whether any IRQ are pending and handle it accordingly.
--- drivers/extcon/extcon-ptn5150.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/extcon/extcon-ptn5150.c +14 -0
@@ -331,6 +331,19 @@ static int ptn5150_i2c_probe(struct i2c_return 0 ; } +static int ptn5150_resume (struct device *dev) +{ +struct i2c_client *i2c =to_i2c_client (dev); +struct ptn5150_info *info =i2c_get_clientdata (i2c); + +/* Need to check possible pending interrupt events */ +schedule_work (&info->irq_work); + +return 0 ; +} + +static DEFINE_SIMPLE_DEV_PM_OPS(ptn5150_pm_ops, NULL, ptn5150_resume); +static const struct of_device_id ptn5150_dt_match[] = { { .compatible ="nxp,ptn5150" }, { },
@@ -346,6 +359,7 @@ MODULE_DEVICE_TABLE(i2c, ptn5150_i2c_id)static struct i2c_driver ptn5150_i2c_driver = { .driver = { .name ="ptn5150" , + .pm =pm_sleep_ptr (&ptn5150_pm_ops), .of_match_table = ptn5150_dt_match, }, .probe = ptn5150_i2c_probe,
Greg Kroah-Hartman
maintainerPATCH 140/307 fbcon: Avoid OOB font access if console rotation fails
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit e4ef723d8975a2694cc90733a6b888a5e2841842 upstream.
Clear the font buffer if the reallocation during console rotation fails in fbcon_rotate_font(). The putcs implementations for the rotated buffer will return early in this case. See [1] for an example.
Currently, fbcon_rotate_font() keeps the old buffer, which is too small for the rotated font. Printing to the rotated console with a high-enough character code will overflow the font buffer.
v2:
- fix typos in commit message
--- drivers/video/fbdev/core/fbcon_rotate.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/video/fbdev/core/fbcon_rotate.c +4 -1
@@ -46,6 +46,10 @@ int fbcon_rotate_font(struct fb_info *in info->fbops->fb_sync (info);if (par->fd_size < d_cellsize * len) { +kfree (par->fontbuffer); + par->fontbuffer =NULL ; + par->fd_size =0 ; + dst =kmalloc_array (len, d_cellsize,GFP_KERNEL );if (dst ==NULL ) {
@@ -54,7 +58,6 @@ int fbcon_rotate_font(struct fb_info *in } par->fd_size = d_cellsize * len; -kfree (par->fontbuffer); par->fontbuffer = dst; }
Greg Kroah-Hartman
maintainerPATCH 141/307 gpio: of: clear OF_POPULATED on hog nodes in remove path
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
commit bbee90e750262bfb406d66dc65c46d616d2b6673 upstream.
The previously set OF_POPULATED flag should be cleared on the hog nodes when removing the chip.
--- drivers/gpio/gpiolib-of.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/gpio/gpiolib-of.c +8 -1
@@ -1210,7 +1210,14 @@ int of_gpiochip_add(struct gpio_chip *chvoid of_gpiochip_remove (struct gpio_chip *chip) { -of_node_put (dev_of_node (&chip->gpiodev->dev)); +struct device_node *np =dev_of_node (&chip->gpiodev->dev); + +for_each_child_of_node_scoped (np, child) { +if (of_property_present (child,"gpio-hog" )) +of_node_clear_flag (child,OF_POPULATED ); + } + +of_node_put (np); }bool of_gpiochip_instance_match (struct gpio_chip *gc,unsigned int index)
Greg Kroah-Hartman
maintainerPATCH 142/307 hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS
In reply to Greg Kroah-Hartman7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit d33db956c9618e7cb08c2520ce708437914214ec upstream.
Hyperv's sysfb access only exists in the VMBUS support. Therefore only select CONFIG_SYSFB for CONFIG_HYPERV_VMBUS. Avoids sysfb code on systems that don't need it.
--- drivers/hv/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hv/Kconfig +1 -1
@@ -9,7 +9,6 @@ config HYPERV select PARAVIRT select X86_HV_CALLBACK_VECTOR if X86 select OF_EARLY_FLATTREE if OF - select SYSFB if EFI && !HYPERV_VTL_MODE select IRQ_MSI_LIB if X86 help Select this option to run Linux as a Hyper-V client operating
@@ -62,6 +61,7 @@ config HYPERV_VMBUS tristate "Microsoft Hyper-V VMBus driver" depends on HYPERV default HYPERV + select SYSFB if EFI && !HYPERV_VTL_MODE help Select this option to enable Hyper-V Vmbus driver.