6.6.142-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 6.6.142-rc1 review
This is the start of the stable review cycle for the 6.6.142 release. There are 186 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 30 May 2026 19:48:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.142-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.142-rc1
Tiezhu Yang <[email protected]>
LoongArch: kprobes: Fix handling of fatal unrecoverable recursions
Sabrina Dubroca <[email protected]>
net: gro: don't merge zcopy skbs
Nikhil P. Rao <[email protected]>
pds_core: ensure null-termination for firmware version strings
Su Hui <[email protected]>
pds_core: add an error code check in pdsc_dl_info_get
Aditya Garg <[email protected]>
net: mana: validate rx_req_idx to prevent out-of-bounds array access
Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
Bartosz Golaszewski <[email protected]>
gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
Andy Shevchenko <[email protected]>
gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)
Jani Nikula <[email protected]>
string: add mem_is_zero() helper to check if memory area is all zeros
Xingwang Xiang <[email protected]>
bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
Rosen Penev <[email protected]>
net: ag71xx: check error for platform_get_irq
Jiajia Liu <[email protected]>
Bluetooth: btmtk: fix urb->setup_packet leak in error paths
Chris Lu <[email protected]>
Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c
Chris Lu <[email protected]>
Bluetooth: btmtk: rename btmediatek_data
Hao Qin <[email protected]>
Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset
Sean Wang <[email protected]>
Bluetooth: btmtk: add the function to get the fw name
David Carlier <[email protected]>
tracing: Avoid NULL return from hist_field_name() on truncation
Zhang Cen <[email protected]>
ALSA: seq: Serialize UMP output teardown with event_input
Takashi Iwai <[email protected]>
ALSA: seq: ump: Use guard() for locking
Peter Zijlstra <[email protected]>
ptrace: Convert ptrace_attach() to use lock guards
Nikhil P. Rao <[email protected]>
pds_core: fix debugfs_lookup dentry leak and error handling
Nikhil P. Rao <[email protected]>
pds_core: fix error handling in pdsc_devcmd_wait
Ido Schimmel <[email protected]>
bridge: mcast: Fix a possible use-after-free when removing a bridge port
Petr Machata <[email protected]>
net: bridge: Flush multicast groups when snooping is disabled
Guangshuo Li <[email protected]>
RDMA/rtrs: Fix use-after-free in path file creation cleanup
Rafael J. Wysocki <[email protected]>
platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
Rafael J. Wysocki <[email protected]>
platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
Rafael J. Wysocki <[email protected]>
platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
Rafael J. Wysocki <[email protected]>
platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
Erni Sri Satya Vennela <[email protected]>
net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
Daniel Golle <[email protected]>
net: dsa: mt7530: preserve VLAN tags on trapped link-local frames
Arınç ÜNAL <[email protected]>
net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw
Daniel Golle <[email protected]>
net: dsa: mt7530: fix FDB entries not aging out with short timeout
Matthew Leach <[email protected]>
wifi: ath11k: fix peer resolution on rx path when peer_id=0
Dmitry Baryshkov <[email protected]>
drm/msm/snapshot: fix dumping of the unaligned regions
Felix Gu <[email protected]>
spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
Jeroen Massar <[email protected]>
net/mlx5: Do not restore destination-less TC rules
Chuck Lever <[email protected]>
tls: Preserve sk_err across recvmsg() when data has been copied
Juergen Gross <[email protected]>
x86/xen: Fix xen_e820_swap_entry_with_ram()
Sven Schuchmann <[email protected]>
net: phy: DP83TC811: add reading of abilities
Oleksij Rempel <[email protected]>
net: phy: c45: add genphy_c45_pma_read_ext_abilities() function
Jakub Kicinski <[email protected]>
net: tls: prevent chain-after-chain in plain text SG
Jakub Kicinski <[email protected]>
net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
Xiang Mei <[email protected]>
net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
Sayali Patil <[email protected]>
powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()
Mikko Perttunen <[email protected]>
drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN
Dmitry Baryshkov <[email protected]>
drm/msm/dsi: don't dump registers past the mapped region
Chenguang Zhao <[email protected]>
ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
Xiang Mei <[email protected]>
net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint
Zack McKevitt <[email protected]>
accel/qaic: Add overflow check to remap_pfn_range during mmap
Lukas Bulwahn <[email protected]>
HID: quirks: really enable the intended work around for appledisplay
Nicolas Escande <[email protected]>
wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
Nicolas Escande <[email protected]>
wifi: ath11k: fix error path leaks in some WMI WOW calls
Ethan Nelson-Moore <[email protected]>
net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
Linus Walleij <[email protected]>
net: ethernet: cortina: Carry over frag counter
Andreas Haarmann-Thiemann <[email protected]>
net: ethernet: cortina: Drop half-assembled SKB
Linus Walleij <[email protected]>
net: ethernet: cortina: Make RX SKB per-port
David Howells <[email protected]>
netfs: Fix overrun check in netfs_extract_user_iter()
Johannes Thumshirn <[email protected]>
zonefs: handle integer overflow in zonefs_fname_to_fno
Jiayuan Chen <[email protected]>
irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
Rosen Penev <[email protected]>
irqchip/ath79-cpu: Remove unused function
Gabor Juhos <[email protected]>
phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access
Myeonghun Pak <[email protected]>
net: lan966x: avoid unregistering netdev on register failure
Bart Van Assche <[email protected]>
ice: fix locking in ice_dcb_rebuild()
Kuniyuki Iwashima <[email protected]>
tcp: Fix imbalanced icsk_accept_queue count.
Martin Kaiser <[email protected]>
test_kprobes: clear kprobes between test runs
Jianpeng Chang <[email protected]>
kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()
Florian Westphal <[email protected]>
netfilter: bridge: eb_tables: close module init race
Florian Westphal <[email protected]>
netfilter: x_tables: close dangling table module init race
Florian Westphal <[email protected]>
netfilter: ebtables: close dangling table module init race
Florian Westphal <[email protected]>
netfilter: ebtables: move to two-stage removal scheme
Florian Westphal <[email protected]>
netfilter: x_tables: add and use xtables_unregister_table_exit
Florian Westphal <[email protected]>
netfilter: x_tables: add and use xt_unregister_table_pre_exit
Pablo Neira Ayuso <[email protected]>
netfilter: Exclude LEGACY TABLES on PREEMPT_RT.
Breno Leitao <[email protected]>
netfilter: Make legacy configs user selectable
Kuniyuki Iwashima <[email protected]>
netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp_tables.c
Florian Westphal <[email protected]>
netfilter: xtables: fix up kconfig dependencies
Florian Westphal <[email protected]>
netfilter: ebtables: allow xtables-nft only builds
Florian Westphal <[email protected]>
netfilter: xtables: allow xtables-nft only builds
Florian Westphal <[email protected]>
netfilter: arptables: allow xtables-nft only builds
Florian Westphal <[email protected]>
netfilter: x_tables: unregister the templates first
Filipe Manana <[email protected]>
btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
Shuhao Fu <[email protected]>
ALSA: hda: cs35l56: Put ACPI device after setting companion
Guenter Roeck <[email protected]>
ARM: integrator: Fix early initialization
Maulik Shah <[email protected]>
pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150
David Gow <[email protected]>
kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
David Gow <[email protected]>
kunit: config: Enable KUNIT_DEBUGFS by default
Sudeep Holla <[email protected]>
firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
Sudeep Holla <[email protected]>
firmware: arm_ffa: Check for NULL FF-A ID table while driver registration
Takashi Iwai <[email protected]>
HID: uclogic: Fix regression of input name assignment
Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors
Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()
Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()
Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple
Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer
Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) reject implausible blackbox record_count
Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
Sven Eckelmann <[email protected]>
batman-adv: tt: fix negative tt_buff_len
Sven Eckelmann <[email protected]>
batman-adv: tt: fix negative last_changeset_len
Sven Eckelmann <[email protected]>
batman-adv: tp_meter: fix race condition in send error reporting
Sven Eckelmann <[email protected]>
batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
Sven Eckelmann <[email protected]>
batman-adv: tp_meter: avoid use of uninit sender vars
Sven Eckelmann <[email protected]>
batman-adv: bla: fix report_work leak on backbone_gw purge
Sven Eckelmann <[email protected]>
batman-adv: frag: disallow unicast fragment in fragment
Luxiao Xu <[email protected]>
batman-adv: fix tp_meter counter underflow during shutdown
Ruide Cao <[email protected]>
batman-adv: fix fragment reassembly length accounting
Sven Eckelmann <[email protected]>
batman-adv: dat: handle forward allocation error
Ruijie Li <[email protected]>
batman-adv: clear current gateway during teardown
Sven Eckelmann <[email protected]>
batman-adv: mcast: fix use-after-free in orig_node RCU release
Harry Wentland <[email protected]>
drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async
Harry Wentland <[email protected]>
drm/amd/display: Validate GPIO pin LUT table size before iterating
Harry Wentland <[email protected]>
drm/amd/display: Fix integer overflow in bios_get_image()
Osama Abdelkader <[email protected]>
drm/bridge: megachips: remove bridge when irq request fails
Julien Chauveau <[email protected]>
drm/bridge: it66121: acquire reset GPIO in probe
Deepanshu Kartikey <[email protected]>
drm/virtio: use uninterruptible resv lock for plane updates
Bartosz Golaszewski <[email protected]>
device property: set fwnode->secondary to NULL in fwnode_init()
Huacai Chen <[email protected]>
LoongArch: Remove unused code to avoid build warning
Michael Bommarito <[email protected]>
RDMA/siw: Reject MPA FPDU length underflow before signed receive math
Johan Hovold <[email protected]>
spi: ti-qspi: fix use-after-free after DMA setup failure
Johan Hovold <[email protected]>
spi: sprd: fix error pointer deref after DMA setup failure
Michael Bommarito <[email protected]>
scsi: isci: Fix use-after-free in device removal path
Wayne Chang <[email protected]>
phy: tegra: xusb: Fix per-pad high-speed termination calibration
Johan Hovold <[email protected]>
spi: qup: fix error pointer deref after DMA setup failure
Osama Abdelkader <[email protected]>
drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe
Michael Bommarito <[email protected]>
KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits
Vladimir Murzin <[email protected]>
arm64: probes: Handle probes on hinted conditional branch instructions
Masami Hiramatsu (Google) <[email protected]>
tracing: Do not call map->ops->elt_free() if elt_alloc() fails
Zhihao Cheng <[email protected]>
cifs: Fix busy dentry used after unmounting
John Walker <[email protected]>
wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
Marcin Szycik <[email protected]>
ice: fix setting promisc mode while adding VID filter
Michael Bommarito <[email protected]>
ixgbevf: fix use-after-free in VEPA multicast source pruning
Michael Bommarito <[email protected]>
ipv4: raw: reject IP_HDRINCL packets with ihl < 5
Kyle Farnung <[email protected]>
wifi: ath11k: clear shared SRNG pointer state on restart
Stefano Garzarella <[email protected]>
vsock/virtio: reset connection on receiving queue overflow
Minh Nguyen <[email protected]>
vsock/vmci: fix UAF when peer resets connection during handshake
Steven Rostedt <[email protected]>
ring-buffer: Fix reporting of missed events in iterator
Dawei Feng <[email protected]>
qed: fix double free in qed_cxt_tables_alloc()
Yizhou Zhao <[email protected]>
netfilter: nft_inner: Fix IPv6 inner_thoff desync
Nan Li <[email protected]>
netfilter: ipset: stop hash:* range iteration at end
Haoze Xie <[email protected]>
netfilter: nf_queue: hold bridge skb->dev while queued
Zhengchuan Liang <[email protected]>
netfilter: ip6t_hbh: reject oversized option lists
Michael Bommarito <[email protected]>
net: ifb: report ethtool stats over num_tx_queues
Nicolai Buchwitz <[email protected]>
net: bcmgenet: keep RBUF EEE/PM disabled
Zijing Yin <[email protected]>
phonet/pep: disable BH around forwarded sk_receive_skb()
Jiexun Wang <[email protected]>
Bluetooth: serialize accept_q access
Michael Bommarito <[email protected]>
Bluetooth: MGMT: validate Add Extended Advertising Data length
Mingyu Wang <[email protected]>
Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
Jann Horn <[email protected]>
Bluetooth: bnep: Fix UAF read of dev->name
David Carlier <[email protected]>
Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
Safa Karakuş <[email protected]>
Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
Abdun Nihaal <[email protected]>
net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
Muchun Song <[email protected]>
drivers/base/memory: fix memory block reference leak in poison accounting
Ard Biesheuvel <[email protected]>
efi: Allocate runtime workqueue before ACPI init
Takashi Iwai <[email protected]>
ALSA: asihpi: Fix potential OOB array access at reading cache
Takashi Iwai <[email protected]>
ALSA: pcm: Don't setup bogus iov_iter for silencing
Cássio Gabriel <[email protected]>
ALSA: ua101: Reject too-short USB descriptors
Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
ChenXiaoSong <[email protected]>
smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
Henrique Carvalho <[email protected]>
smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()
Ferry Meng <[email protected]>
ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
Jeremy Laratro <[email protected]>
ksmbd: fix null pointer dereference in compare_guid_key()
SeongJae Park <[email protected]>
mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
Greg Kroah-Hartman <[email protected]>
sysfs: don't remove existing directory on update failure
Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
Sasha Levin <[email protected]>
Revert "af_unix: Reject SIOCATMARK on non-stream sockets"
Sasha Levin <[email protected]>
Revert "s390/cio: Update purge function to unregister the unused subchannels"
Sasha Levin <[email protected]>
Revert "ice: Remove jumbo_remove step from TX path"
Sasha Levin <[email protected]>
Revert "ice: fix double-free of tx_buf skb"
Asim Viladi Oglu Manizada <[email protected]>
smb: client: reject userspace cifs.spnego descriptions
Kuniyuki Iwashima <[email protected]>
af_unix: Give up GC if MSG_PEEK intervened.
DaeMyung Kang <[email protected]>
ksmbd: close durable scavenger races against m_fp_list lookups
Namjae Jeon <[email protected]>
ksmbd: validate owner of durable handle on reconnect
Namjae Jeon <[email protected]>
ksmbd: add durable scavenger timer
Namjae Jeon <[email protected]>
ksmbd: avoid reclaiming expired durable opens by the client
Sasha Levin <[email protected]>
Revert "x86/vdso: Fix output operand size of RDPID"
Deepanshu Kartikey <[email protected]>
wifi: mac80211: check tdls flag in ieee80211_tdls_oper
Pengpeng Hou <[email protected]>
s390/debug: Reject zero-length input before trimming a newline
Danilo Krummrich <[email protected]>
driver core: platform: use generic driver_override infrastructure
Danilo Krummrich <[email protected]>
driver core: generalize driver_override in struct device
Fabian Godehardt <[email protected]>
spi: spidev: fix lock inversion between spi_lock and buf_lock
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ADD_ADDR rtx: free sk if last
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ADD_ADDR rtx: always decrease sk refcount
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ADD_ADDR rtx: allow ID 0
Gang Yan <[email protected]>
mptcp: sync the msk->sndbuf at accept() time
-------------
Diffstat:
Makefile | 4 +- arch/arm/mach-versatile/integrator_cp.c | 13 +- arch/arm64/include/asm/insn.h | 2 +- arch/arm64/kvm/vgic/vgic-its.c | 4 + arch/loongarch/kernel/kprobes.c | 4 +- arch/loongarch/mm/init.c | 4 - arch/powerpc/kernel/time.c | 6 +- arch/s390/kernel/debug.c | 3 + arch/x86/include/asm/segment.h | 8 +- arch/x86/xen/setup.c | 2 +- drivers/accel/qaic/qaic_data.c | 23 +- drivers/base/bus.c | 43 ++- drivers/base/core.c | 2 + drivers/base/dd.c | 60 ++++ drivers/base/memory.c | 8 +- drivers/base/platform.c | 37 +-- drivers/bluetooth/btmtk.c | 295 +++++++++++++++++- drivers/bluetooth/btmtk.h | 41 ++- drivers/bluetooth/btmtksdio.c | 1 + drivers/bluetooth/btmtkuart.c | 1 + drivers/bluetooth/btusb.c | 338 +++------------------ drivers/bluetooth/hci_ldisc.c | 48 ++- drivers/bus/simple-pm-bus.c | 4 +- drivers/clk/imx/clk-scu.c | 3 +- drivers/firmware/arm_ffa/bus.c | 4 +- drivers/firmware/arm_ffa/driver.c | 2 +- drivers/firmware/efi/efi.c | 28 +- drivers/gpio/gpiolib-cdev.c | 21 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 9 + .../drm/amd/display/dc/bios/bios_parser_helper.c | 9 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 6 +- drivers/gpu/drm/bridge/chipone-icn6211.c | 4 +- drivers/gpu/drm/bridge/ite-it66121.c | 5 + .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 16 +- drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 24 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 1 + drivers/gpu/drm/msm/msm_iommu.c | 5 +- drivers/gpu/drm/virtio/virtgpu_drv.h | 1 + drivers/gpu/drm/virtio/virtgpu_gem.c | 17 ++ drivers/gpu/drm/virtio/virtgpu_plane.c | 10 +- drivers/hid/hid-quirks.c | 2 +- drivers/hid/hid-uclogic-core.c | 4 +- drivers/hwmon/pmbus/adm1266.c | 32 +- drivers/i3c/master/mipi-i3c-hci/dma.c | 25 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 15 + drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c | 2 +- drivers/irqchip/irq-ath79-cpu.c | 7 - drivers/net/dsa/mt7530.c | 79 ++--- drivers/net/dsa/mt7530.h | 70 ++--- drivers/net/ethernet/amd/pds_core/debugfs.c | 7 +- drivers/net/ethernet/amd/pds_core/dev.c | 11 +- drivers/net/ethernet/amd/pds_core/devlink.c | 8 +- drivers/net/ethernet/atheros/ag71xx.c | 3 + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 9 +- drivers/net/ethernet/cirrus/cs89x0.c | 2 - drivers/net/ethernet/cortina/gemini.c | 21 +- drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 4 +- drivers/net/ethernet/intel/ice/ice_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_txrx.c | 7 +- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 1 + .../net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c | 3 +- .../net/ethernet/microchip/lan966x/lan966x_main.c | 8 +- drivers/net/ethernet/microsoft/mana/hw_channel.c | 35 ++- drivers/net/ethernet/qlogic/qed/qed_cxt.c | 2 + drivers/net/ifb.c | 11 +- drivers/net/phy/dp83tc811.c | 1 + drivers/net/phy/phy-c45.c | 129 ++++---- drivers/net/wireless/ath/ath11k/dp_rx.c | 3 +- drivers/net/wireless/ath/ath11k/hal.c | 14 +- drivers/net/wireless/ath/ath11k/hal_rx.c | 5 +- drivers/net/wireless/ath/ath11k/testmode.c | 1 + drivers/net/wireless/ath/ath11k/wmi.c | 19 +- drivers/net/wwan/iosm/iosm_ipc_imem.c | 2 + drivers/phy/marvell/phy-mvebu-a3700-utmi.c | 5 +- drivers/phy/tegra/xusb-tegra186.c | 33 +- drivers/phy/tegra/xusb.h | 1 + drivers/pinctrl/qcom/pinctrl-sm8150.c | 8 +- drivers/platform/x86/adv_swbutton.c | 6 +- drivers/platform/x86/hp/hp_accel.c | 3 + drivers/platform/x86/intel/hid.c | 6 +- drivers/platform/x86/intel/vbtn.c | 6 +- drivers/s390/cio/device.c | 37 +-- drivers/scsi/isci/host.c | 3 + drivers/slimbus/qcom-ngd-ctrl.c | 6 +- drivers/spi/spi-mtk-snfi.c | 2 +- drivers/spi/spi-qup.c | 3 + drivers/spi/spi-sprd.c | 3 +- drivers/spi/spi-ti-qspi.c | 1 + drivers/spi/spidev.c | 63 ++-- fs/netfs/iterator.c | 26 +- fs/smb/client/cifs_spnego.c | 16 + fs/smb/client/cifsfs.c | 2 + fs/smb/client/smb2transport.c | 2 + fs/smb/server/mgmt/user_session.c | 10 +- fs/smb/server/oplock.c | 13 +- fs/smb/server/oplock.h | 1 + fs/smb/server/server.c | 1 + fs/smb/server/server.h | 1 + fs/smb/server/smb2pdu.c | 5 +- fs/smb/server/smb2pdu.h | 2 + fs/smb/server/smbacl.c | 12 +- fs/smb/server/vfs_cache.c | 325 ++++++++++++++++++-- fs/smb/server/vfs_cache.h | 15 +- fs/sysfs/group.c | 2 +- fs/zonefs/super.c | 6 +- include/asm-generic/kprobes.h | 2 +- include/linux/device.h | 54 ++++ include/linux/device/bus.h | 4 + include/linux/fwnode.h | 1 + include/linux/netfilter/x_tables.h | 3 +- include/linux/netfilter_arp/arp_tables.h | 1 - include/linux/netfilter_ipv4/ip_tables.h | 1 - include/linux/netfilter_ipv6/ip6_tables.h | 1 - include/linux/phy.h | 1 + include/linux/platform_device.h | 5 - include/linux/sched/task.h | 2 + include/linux/spinlock.h | 26 ++ include/linux/string.h | 12 + include/net/af_unix.h | 1 + include/net/bluetooth/bluetooth.h | 1 + include/net/netfilter/nf_queue.h | 1 + include/trace/events/btrfs.h | 4 +- kernel/irq_work.c | 7 + kernel/ptrace.c | 154 +++++----- kernel/trace/ring_buffer.c | 8 +- kernel/trace/trace_events_hist.c | 6 +- kernel/trace/tracing_map.c | 17 +- lib/kunit/Kconfig | 5 +- lib/test_kprobes.c | 29 +- mm/damon/sysfs-schemes.c | 1 + net/batman-adv/bridge_loop_avoidance.c | 54 ++-- net/batman-adv/distributed-arp-table.c | 3 + net/batman-adv/fragmentation.c | 58 +++- net/batman-adv/gateway_client.c | 4 + net/batman-adv/originator.c | 4 +- net/batman-adv/tp_meter.c | 64 ++-- net/batman-adv/types.h | 17 +- net/bluetooth/af_bluetooth.c | 99 ++++-- net/bluetooth/bnep/core.c | 2 +- net/bluetooth/iso.c | 14 +- net/bluetooth/l2cap_sock.c | 51 +++- net/bluetooth/mgmt.c | 6 + net/bluetooth/rfcomm/sock.c | 9 +- net/bluetooth/sco.c | 9 +- net/bridge/br_multicast.c | 27 +- net/bridge/netfilter/Kconfig | 13 + net/bridge/netfilter/Makefile | 2 +- net/bridge/netfilter/ebtable_broute.c | 14 +- net/bridge/netfilter/ebtable_filter.c | 14 +- net/bridge/netfilter/ebtable_nat.c | 12 +- net/bridge/netfilter/ebtables.c | 71 +++-- net/core/gro.c | 3 + net/core/skmsg.c | 9 +- net/ethtool/bitset.c | 8 +- net/ipv4/inet_connection_sock.c | 2 +- net/ipv4/netfilter/Kconfig | 59 ++-- net/ipv4/netfilter/Makefile | 2 +- net/ipv4/netfilter/arp_tables.c | 18 +- net/ipv4/netfilter/arptable_filter.c | 27 +- net/ipv4/netfilter/ip_tables.c | 18 +- net/ipv4/netfilter/iptable_filter.c | 27 +- net/ipv4/netfilter/iptable_mangle.c | 29 +- net/ipv4/netfilter/iptable_nat.c | 6 +- net/ipv4/netfilter/iptable_raw.c | 26 +- net/ipv4/netfilter/iptable_security.c | 27 +- net/ipv4/raw.c | 2 +- net/ipv6/netfilter/Kconfig | 30 +- net/ipv6/netfilter/Makefile | 2 +- net/ipv6/netfilter/ip6_tables.c | 18 +- net/ipv6/netfilter/ip6t_hbh.c | 4 + net/ipv6/netfilter/ip6table_filter.c | 26 +- net/ipv6/netfilter/ip6table_mangle.c | 27 +- net/ipv6/netfilter/ip6table_nat.c | 6 +- net/ipv6/netfilter/ip6table_raw.c | 24 +- net/ipv6/netfilter/ip6table_security.c | 27 +- net/mac80211/tdls.c | 2 +- net/mptcp/pm_netlink.c | 35 +-- net/mptcp/protocol.c | 3 +- net/netfilter/Kconfig | 22 +- net/netfilter/ipset/ip_set_hash_ipmark.c | 6 +- net/netfilter/ipset/ip_set_hash_ipport.c | 5 +- net/netfilter/ipset/ip_set_hash_ipportip.c | 5 +- net/netfilter/ipset/ip_set_hash_ipportnet.c | 5 +- net/netfilter/nf_queue.c | 4 +- net/netfilter/nfnetlink_queue.c | 2 + net/netfilter/nft_inner.c | 1 - net/netfilter/x_tables.c | 116 +++++-- net/phonet/pep.c | 19 +- net/smc/af_smc.c | 3 +- net/smc/smc_tracepoint.h | 2 +- net/tls/tls_sw.c | 46 ++- net/unix/af_unix.c | 5 +- net/unix/garbage.c | 79 +++-- net/vmw_vsock/virtio_transport_common.c | 20 +- net/vmw_vsock/vmci_transport.c | 2 +- net/wireless/scan.c | 3 + sound/core/pcm_lib.c | 3 + sound/core/seq/seq_ump_client.c | 35 ++- sound/pci/asihpi/hpicmn.c | 6 + sound/pci/hda/cs35l56_hda.c | 1 + sound/soc/codecs/cs35l56-sdw.c | 3 +- sound/soc/samsung/i2s.c | 6 +- sound/usb/misc/ua101.c | 5 +- 203 files changed, 2704 insertions(+), 1346 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/186 mptcp: sync the msk->sndbuf at accept() time
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gang Yan <[email protected]>
commit fcf04b14334641f4b0b8647824480935e9416d52 upstream.
On passive MPTCP connections, the msk sndbuf is not updated correctly.
The root cause is an order issue in the accept path:
- tcp_check_req() -> subflow_syn_recv_sock() -> mptcp_sk_clone_init() calls __mptcp_propagate_sndbuf() to copy the ssk sndbuf into msk
- Later, tcp_child_process() -> tcp_init_transfer() -> tcp_sndbuf_expand() grows the ssk sndbuf.
So __mptcp_propagate_sndbuf() runs before the ssk sndbuf has been expanded and the msk ends up with a much smaller sndbuf than the subflow:
MPTCP: msk->sndbuf:20480, msk->first->sndbuf:2626560
Fix this by moving the __mptcp_propagate_sndbuf() call from mptcp_sk_clone_init() -- the ssk sndbuf is not yet finalized there -- to __mptcp_propagate_sndbuf() at accept() time, when the ssk sndbuf has been fully expanded by tcp_sndbuf_expand().
[ No conflicts, but move __mptcp_propagate_sndbuf() above the for-loop
(mptcp_for_each_subflow()) present in this version, which will modify 'subflow' used by __mptcp_propagate_sndbuf() in this new patch. ]
--- net/mptcp/protocol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mptcp/protocol.c +2 -1
@@ -3451,7 +3451,6 @@ struct sock *mptcp_sk_clone_init(const struct sock *sk,* uses the correct data */ mptcp_copy_inaddrs (nsk, ssk); -__mptcp_propagate_sndbuf (nsk, ssk);mptcp_rcv_space_init (msk, ssk); msk->rcvq_space.time =mptcp_stamp ();
@@ -4064,6 +4063,8 @@ static int mptcp_stream_accept(struct socket *sock, struct socket *newsock, msk =mptcp_sk (newsk); msk->in_accept_queue =0 ; +__mptcp_propagate_sndbuf (newsk,mptcp_subflow_tcp_sock (subflow)); +/* set ssk->sk_socket of accept()ed flows to mptcp socket. * This is needed so NOSPACE flag can be set from tcp stack. */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 2/186 mptcp: pm: ADD_ADDR rtx: allow ID 0
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 03f324f3f1f7619a47b9c91282cb12775ab0a2f1 upstream.
ADD_ADDR can be sent for the ID 0, which corresponds to the local address and port linked to the initial subflow.
Indeed, this address could be removed, and re-added later on, e.g. what is done in the "delete re-add signal" MPTCP Join selftests. So no reason to ignore it.
--- net/mptcp/pm_netlink.c | 3 --- 1 file changed, 3 deletions(-)
net/mptcp/pm_netlink.c +0 -3
@@ -305,9 +305,6 @@ static void mptcp_pm_add_timer(struct timer_list *timer)if (inet_sk_state_load (sk) ==TCP_CLOSE )return ; -if (!entry->addr.id) -return ; -bh_lock_sock (sk);if (sock_owned_by_user (sk)) {/* Try again later. */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 3/186 mptcp: pm: ADD_ADDR rtx: always decrease sk refcount
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 9634cb35af17019baec21ca648516ce376fa10e6 upstream.
When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(). It should then be released in all cases at the end.
Some (unlikely) checks were returning directly instead of calling sock_put() to decrease the refcount. Jump to a new 'exit' label to call __sock_put() (which will become sock_put() in the next commit) to fix this potential leak.
While at it, drop the '!msk' check which cannot happen because it is never reset, and explicitly mark the remaining one as "unlikely".
--- net/mptcp/pm_netlink.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
net/mptcp/pm_netlink.c +3 -5
@@ -299,11 +299,8 @@ static void mptcp_pm_add_timer(struct timer_list *timer)pr_debug ("msk=%p\n" , msk); -if (!msk) -return ; - -if (inet_sk_state_load (sk) ==TCP_CLOSE ) -return ; +if (unlikely (inet_sk_state_load (sk) ==TCP_CLOSE )) + goto exit;bh_lock_sock (sk);if (sock_owned_by_user (sk)) {
@@ -341,6 +338,7 @@ static void mptcp_pm_add_timer(struct timer_list *timer) out:bh_unlock_sock (sk); +exit:__sock_put (sk); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 4/186 mptcp: pm: ADD_ADDR rtx: free sk if last
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit b7b9a461569734d33d3259d58d2507adfac107ed upstream.
When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(), and released at the end.
If at that moment, it was the last reference being held, the sk would not be freed. sock_put() should then be called instead of __sock_put().
But that's not enough: if it is the last reference, sock_put() will call sk_free(), which will end up calling sk_stop_timer_sync() on the same timer, and waiting indefinitely to finish. So it is needed to mark that the timer is done at the end of the timer handler when it has not been rescheduled, not to call sk_stop_timer_sync() on "itself".
[ Applied to net/mptcp/pm_netlink.c instead of upstream's pm_kernel.c.
Also, there were conflicts, because commit 30549eebc4d8 ("mptcp: make ADD_ADDR retransmission timeout adaptive") is not in this version and changed the context. Also, other conflicts were due to newer patches being backported with resolved conflicts before this one. ]
--- net/mptcp/pm_netlink.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-)
net/mptcp/pm_netlink.c +17 -11
@@ -27,6 +27,7 @@ struct mptcp_pm_add_entry {struct list_head list;struct mptcp_addr_info addr;u8 retrans_times; +bool timer_done;struct timer_list add_timer;struct mptcp_sock *sock;struct rcu_head rcu;
@@ -295,22 +296,22 @@ static void mptcp_pm_add_timer(struct timer_list *timer)struct mptcp_pm_add_entry *entry =from_timer (entry, timer, add_timer);struct mptcp_sock *msk = entry->sock;struct sock *sk = (struct sock *)msk; -unsigned int timeout; +unsigned int timeout =0 ;pr_debug ("msk=%p\n" , msk); +bh_lock_sock (sk);if (unlikely (inet_sk_state_load (sk) ==TCP_CLOSE )) - goto exit; + goto out; -bh_lock_sock (sk);if (sock_owned_by_user (sk)) {/* Try again later. */ -sk_reset_timer (sk, timer, jiffies +HZ /20 ); + timeout =HZ /20 ; goto out; }if (mptcp_pm_should_add_signal_addr (msk)) { -sk_reset_timer (sk, timer, jiffies +HZ ); + timeout =HZ ; goto out; }
@@ -327,9 +328,8 @@ static void mptcp_pm_add_timer(struct timer_list *timer) entry->retrans_times++; } -if (entry->retrans_times <ADD_ADDR_RETRANS_MAX ) -sk_reset_timer (sk, timer, - jiffies + timeout); +if (entry->retrans_times >=ADD_ADDR_RETRANS_MAX ) + timeout =0 ;spin_unlock_bh (&msk->pm.lock);
@@ -337,9 +337,13 @@ static void mptcp_pm_add_timer(struct timer_list *timer)mptcp_pm_subflow_established (msk); out: +if (timeout) +sk_reset_timer (sk, timer, jiffies + timeout); +else +/* if sock_put calls sk_free: avoid waiting for this timer */ + entry->timer_done = true;bh_unlock_sock (sk); -exit: -__sock_put (sk); +sock_put (sk); } struct mptcp_pm_add_entry *
@@ -403,6 +407,7 @@ bool mptcp_pm_alloc_anno_list(struct mptcp_sock *msk,timer_setup (&add_entry->add_timer, mptcp_pm_add_timer,0 ); reset_timer: + add_entry->timer_done = false; timeout =mptcp_get_add_addr_timeout (net);if (timeout)sk_reset_timer (sk, &add_entry->add_timer, jiffies + timeout);
@@ -423,7 +428,8 @@ void mptcp_pm_free_anno_list(struct mptcp_sock *msk)spin_unlock_bh (&msk->pm.lock);list_for_each_entry_safe (entry, tmp, &free_list, list) { -sk_stop_timer_sync (sk, &entry->add_timer); +if (!entry->timer_done) +sk_stop_timer_sync (sk, &entry->add_timer);kfree_rcu (entry, rcu); } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 5/186 spi: spidev: fix lock inversion between spi_lock and buf_lock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabian Godehardt <[email protected]>
[ Upstream commit 40534d19ed2afb880ecf202dab26a8e7a5808d16 ]
The spidev driver previously used two mutexes, spi_lock and buf_lock, but acquired them in different orders depending on the code path:
write()/read(): buf_lock -> spi_lock
ioctl(): spi_lock -> buf_lock
This AB-BA locking pattern triggers lockdep warnings and can cause real deadlocks:
WARNING: possible circular locking dependency detected spidev_ioctl() -> mutex_lock(&spidev->buf_lock) spidev_sync_write() -> mutex_lock(&spidev->spi_lock) *** DEADLOCK ***
The issue is reproducible with a simple userspace program that performs write() and SPI_IOC_WR_MAX_SPEED_HZ ioctl() calls from separate threads on the same spidev file descriptor.
Fix this by simplifying the locking model and removing the lock inversion entirely. spidev_sync() no longer performs any locking, and all callers serialize access using spi_lock.
buf_lock is removed since its functionality is fully covered by spi_lock, eliminating the possibility of lock ordering issues.
This removes the lock inversion and prevents deadlocks without changing userspace ABI or behaviour.
--- drivers/spi/spidev.c | 63 ++++++++++++++++---------------------------- 1 file changed, 22 insertions(+), 41 deletions(-)
drivers/spi/spidev.c +22 -41
@@ -74,7 +74,6 @@ struct spidev_data {struct list_head device_entry;/* TX/RX buffers are NULL unless this device is open (users > 0) */ -struct mutex buf_lock;unsigned users;u8 *tx_buffer;u8 *rx_buffer;
@@ -102,24 +101,6 @@ spidev_sync_unlocked(struct spi_device *spi, struct spi_message *message)return status; } -static ssize_t -spidev_sync (struct spidev_data *spidev,struct spi_message *message) -{ -ssize_t status; -struct spi_device *spi; - -mutex_lock (&spidev->spi_lock); - spi = spidev->spi; - -if (spi ==NULL ) - status = -ESHUTDOWN ; -else - status =spidev_sync_unlocked (spi, message); - -mutex_unlock (&spidev->spi_lock); -return status; -} -static inline ssize_t spidev_sync_write (struct spidev_data *spidev,size_t len) {
@@ -132,7 +113,8 @@ spidev_sync_write(struct spidev_data *spidev, size_t len)spi_message_init (&m);spi_message_add_tail (&t, &m); -return spidev_sync (spidev, &m); + +return spidev_sync_unlocked (spidev->spi, &m); } static inline ssize_t
@@ -147,7 +129,8 @@ spidev_sync_read(struct spidev_data *spidev, size_t len)spi_message_init (&m);spi_message_add_tail (&t, &m); -return spidev_sync (spidev, &m); + +return spidev_sync_unlocked (spidev->spi, &m); }/*-------------------------------------------------------------------------*/
@@ -157,7 +140,7 @@ static ssize_t spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos) { struct spidev_data *spidev; -ssize_t status; +ssize_t status = -ESHUTDOWN ;/* chipselect only toggles at start or end of operation */ if (count > bufsiz)
@@ -165,7 +148,11 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos) spidev = filp->private_data; -mutex_lock (&spidev->buf_lock); +mutex_lock (&spidev->spi_lock); + +if (spidev->spi ==NULL ) + goto err_spi_removed; + status =spidev_sync_read (spidev, count);if (status >0 ) {unsigned long missing;
@@ -176,7 +163,9 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)else status = status - missing; } -mutex_unlock (&spidev->buf_lock); + +err_spi_removed: +mutex_unlock (&spidev->spi_lock);return status; }
@@ -187,7 +176,7 @@ spidev_write(struct file *filp, const char __user *buf, size_t count, loff_t *f_pos) { struct spidev_data *spidev; -ssize_t status; +ssize_t status = -ESHUTDOWN ;unsigned long missing;/* chipselect only toggles at start or end of operation */
@@ -196,13 +185,19 @@ spidev_write(struct file *filp, const char __user *buf, spidev = filp->private_data; -mutex_lock (&spidev->buf_lock); +mutex_lock (&spidev->spi_lock); + +if (spidev->spi ==NULL ) + goto err_spi_removed; + missing =copy_from_user (spidev->tx_buffer, buf, count);if (missing ==0 ) status =spidev_sync_write (spidev, count);else status = -EFAULT ; -mutex_unlock (&spidev->buf_lock); + +err_spi_removed: +mutex_unlock (&spidev->spi_lock);return status; }
@@ -376,14 +371,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)return -ESHUTDOWN ; } -/* use the buffer lock here for triple duty: -* - prevent I/O (from us) so calling spi_setup() is safe; -* - prevent concurrent SPI_IOC_WR_* from morphing -* data fields while SPI_IOC_RD_* reads them; -* - SPI_IOC_MESSAGE needs the buffer locked "normally". -*/ -mutex_lock (&spidev->buf_lock); -switch (cmd) {/* read requests */ case SPI_IOC_RD_MODE :
@@ -516,7 +503,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)break ; } -mutex_unlock (&spidev->buf_lock);spi_dev_put (spi);mutex_unlock (&spidev->spi_lock);return retval;
@@ -547,9 +533,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd,return -ESHUTDOWN ; } -/* SPI_IOC_MESSAGE needs the buffer locked "normally" */ -mutex_lock (&spidev->buf_lock); -/* Check message and copy into scratch area */ ioc =spidev_get_ioc_message (cmd, u_ioc, &n_ioc);if (IS_ERR (ioc)) {
@@ -570,7 +553,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd,kfree (ioc); done: -mutex_unlock (&spidev->buf_lock);spi_dev_put (spi);mutex_unlock (&spidev->spi_lock);return retval;
@@ -795,7 +777,6 @@ static int spidev_probe(struct spi_device *spi)/* Initialize the driver data */ spidev->spi = spi;mutex_init (&spidev->spi_lock); -mutex_init (&spidev->buf_lock);INIT_LIST_HEAD (&spidev->device_entry);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 6/186 driver core: generalize driver_override in struct device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <[email protected]>
[ Upstream commit cb3d1049f4ea77d5ad93f17d8ac1f2ed4da70501 ]
Currently, there are 12 busses (including platform and PCI) that duplicate the driver_override logic for their individual devices.
All of them seem to be prone to the bug described in [1].
While this could be solved for every bus individually using a separate lock, solving this in the driver-core generically results in less (and cleaner) changes overall.
Thus, move driver_override to struct device, provide corresponding accessors for busses and handle locking with a separate lock internally.
In particular, add device_set_driver_override(), device_has_driver_override(), device_match_driver_override() and generalize the sysfs store() and show() callbacks via a driver_override feature flag in struct bus_type.
Until all busses have migrated, keep driver_set_override() in place.
Note that we can't use the device lock for the reasons described in [2].
[ Use dev->bus instead of sp->bus for consistency; fix commit message to
refer to the struct bus_type's driver_override feature flag. - Danilo ]
Stable-dep-of: 2b38efc05bf7 ("driver core: platform: use generic driver_override infrastructure")
--- drivers/base/bus.c | 43 ++++++++++++++++++++++++++- drivers/base/core.c | 2 ++ drivers/base/dd.c | 60 ++++++++++++++++++++++++++++++++++++++ include/linux/device.h | 54 ++++++++++++++++++++++++++++++++++ include/linux/device/bus.h | 4 +++ 5 files changed, 162 insertions(+), 1 deletion(-)
drivers/base/bus.c +42 -1
@@ -463,6 +463,36 @@ int bus_for_each_drv(const struct bus_type *bus, struct device_driver *start, }EXPORT_SYMBOL_GPL (bus_for_each_drv); +static ssize_t driver_override_store (struct device *dev, +struct device_attribute *attr, +const char *buf,size_t count) +{ +int ret; + + ret =__device_set_driver_override (dev, buf, count); +if (ret) +return ret; + +return count; +} + +static ssize_t driver_override_show (struct device *dev, +struct device_attribute *attr,char *buf) +{ +guard (spinlock)(&dev->driver_override.lock); +return sysfs_emit (buf,"%s\n" , dev->driver_override.name); +} +static DEVICE_ATTR_RW (driver_override); + +static struct attribute *driver_override_dev_attrs[] = { + &dev_attr_driver_override.attr, +NULL , +}; + +static const struct attribute_group driver_override_dev_group = { + .attrs = driver_override_dev_attrs, +}; +/** * bus_add_device - add device to bus * @dev: device being added
@@ -496,9 +526,15 @@ int bus_add_device(struct device *dev)if (error) goto out_put; +if (dev->bus->driver_override) { + error =device_add_group (dev, &driver_override_dev_group); +if (error) + goto out_groups; + } + error =sysfs_create_link (&sp->devices_kset->kobj, &dev->kobj,dev_name (dev));if (error) - goto out_groups; + goto out_override; error =sysfs_create_link (&dev->kobj, &sp->subsys.kobj,"subsystem" );if (error)
@@ -509,6 +545,9 @@ int bus_add_device(struct device *dev) out_subsys:sysfs_remove_link (&sp->devices_kset->kobj,dev_name (dev)); +out_override: +if (dev->bus->driver_override) +device_remove_group (dev, &driver_override_dev_group); out_groups:device_remove_groups (dev, sp->bus->dev_groups); out_put:
@@ -567,6 +606,8 @@ void bus_remove_device(struct device *dev)sysfs_remove_link (&dev->kobj,"subsystem" );sysfs_remove_link (&sp->devices_kset->kobj,dev_name (dev)); +if (dev->bus->driver_override) +device_remove_group (dev, &driver_override_dev_group);device_remove_groups (dev, dev->bus->dev_groups);if (klist_node_attached (&dev->p->knode_bus))klist_del (&dev->p->knode_bus);
drivers/base/core.c +2 -0
@@ -2505,6 +2505,7 @@ static void device_release(struct kobject *kobj)devres_release_all (dev);kfree (dev->dma_range_map); +kfree (dev->driver_override.name);if (dev->release) dev->release (dev);
@@ -3153,6 +3154,7 @@ void device_initialize(struct device *dev)kobject_init (&dev->kobj, &device_ktype);INIT_LIST_HEAD (&dev->dma_pools);mutex_init (&dev->mutex); +spin_lock_init (&dev->driver_override.lock);lockdep_set_novalidate_class (&dev->mutex);spin_lock_init (&dev->devres_lock);INIT_LIST_HEAD (&dev->devres_head);
drivers/base/dd.c +60 -0
66 lines not on this page · raw message
include/linux/device.h +54 -0
72 lines not on this page · raw message
include/linux/device/bus.h +4 -0
@@ -65,6 +65,9 @@ struct fwnode_handle;* @iommu_ops: IOMMU specific operations for this bus, used to attach IOMMU * driver implementations to a bus and allow the driver to do * bus-specific setup +* @driver_override: Set to true if this bus supports the driver_override +* mechanism, which allows userspace to force a specific +* driver to bind to a device via a sysfs attribute. * @need_parent_lock: When probing or removing a device on this bus, the * device core should lock the device's parent. *
@@ -106,6 +109,7 @@ struct bus_type {const struct iommu_ops *iommu_ops; +bool driver_override;bool need_parent_lock; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 7/186 driver core: platform: use generic driver_override infrastructure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <[email protected]>
[ Upstream commit 2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d ]
When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF.
Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally.
Note that calling match() from __driver_attach() without the device lock held is intentional. [1]
--- drivers/base/platform.c | 37 +++++---------------------------- drivers/bus/simple-pm-bus.c | 4 ++-- drivers/clk/imx/clk-scu.c | 3 +-- drivers/slimbus/qcom-ngd-ctrl.c | 6 ++---- include/linux/platform_device.h | 5 ----- sound/soc/samsung/i2s.c | 6 +++--- 6 files changed, 13 insertions(+), 48 deletions(-)
drivers/base/platform.c +5 -32
@@ -561,7 +561,6 @@ static void platform_device_release(struct device *dev)kfree (pa->pdev.dev.platform_data);kfree (pa->pdev.mfd_cell);kfree (pa->pdev.resource); -kfree (pa->pdev.driver_override);kfree (pa); }
@@ -1265,38 +1264,9 @@ static ssize_t numa_node_show(struct device *dev, }static DEVICE_ATTR_RO (numa_node); -static ssize_t driver_override_show (struct device *dev, -struct device_attribute *attr,char *buf) -{ -struct platform_device *pdev =to_platform_device (dev); -ssize_t len; - -device_lock (dev); - len =sysfs_emit (buf,"%s\n" , pdev->driver_override); -device_unlock (dev); - -return len; -} - -static ssize_t driver_override_store (struct device *dev, -struct device_attribute *attr, -const char *buf,size_t count) -{ -struct platform_device *pdev =to_platform_device (dev); -int ret; - - ret =driver_set_override (dev, &pdev->driver_override, buf, count); -if (ret) -return ret; - -return count; -} -static DEVICE_ATTR_RW (driver_override); -static struct attribute *platform_dev_attrs[] = { &dev_attr_modalias.attr, &dev_attr_numa_node.attr, - &dev_attr_driver_override.attr,NULL , };
@@ -1336,10 +1306,12 @@ static int platform_match(struct device *dev, struct device_driver *drv) {struct platform_device *pdev =to_platform_device (dev);struct platform_driver *pdrv =to_platform_driver (drv); +int ret;/* When driver_override is set, only bind to the matching driver */ -if (pdev->driver_override) -return !strcmp (pdev->driver_override, drv->name); + ret =device_match_driver_override (dev, drv); +if (ret >=0 ) +return ret;/* Attempt an OF style match first */ if (of_driver_match_device (dev, drv))
@@ -1482,6 +1454,7 @@ static const struct dev_pm_ops platform_dev_pm_ops = {struct bus_type platform_bus_type = { .name ="platform" , .dev_groups = platform_dev_groups, + .driver_override = true, .match = platform_match, .uevent = platform_uevent, .probe = platform_probe,
drivers/bus/simple-pm-bus.c +2 -2
@@ -36,7 +36,7 @@ static int simple_pm_bus_probe(struct platform_device *pdev)* that's not listed in simple_pm_bus_of_match. We don't want to do any * of the simple-pm-bus tasks for these devices, so return early. */ -if (pdev->driver_override) +if (device_has_driver_override (&pdev->dev))return 0 ; match =of_match_device (dev->driver->of_match_table, dev);
@@ -78,7 +78,7 @@ static int simple_pm_bus_remove(struct platform_device *pdev) {const void *data =of_device_get_match_data (&pdev->dev); -if (pdev->driver_override || data) +if (device_has_driver_override (&pdev->dev) || data)return 0 ;dev_dbg (&pdev->dev,"%s\n" , __func__);
drivers/clk/imx/clk-scu.c +1 -2
@@ -700,8 +700,7 @@ struct clk_hw *imx_clk_scu_alloc_dev(const char *name,return ERR_PTR (ret); } - ret =driver_set_override (&pdev->dev, &pdev->driver_override, -"imx-scu-clk" ,strlen ("imx-scu-clk" )); + ret =device_set_driver_override (&pdev->dev,"imx-scu-clk" );if (ret) {platform_device_put (pdev);return ERR_PTR (ret);
drivers/slimbus/qcom-ngd-ctrl.c +2 -4
@@ -1537,10 +1537,8 @@ static int of_qcom_slim_ngd_register(struct device *parent, ngd->id = id; ngd->pdev->dev.parent = parent; - ret =driver_set_override (&ngd->pdev->dev, - &ngd->pdev->driver_override, -QCOM_SLIM_NGD_DRV_NAME , -strlen (QCOM_SLIM_NGD_DRV_NAME )); + ret =device_set_driver_override (&ngd->pdev->dev, +QCOM_SLIM_NGD_DRV_NAME );if (ret) {platform_device_put (ngd->pdev);kfree (ngd);
include/linux/platform_device.h +0 -5
@@ -31,11 +31,6 @@ struct platform_device {struct resource *resource;const struct platform_device_id *id_entry; -/* -* Driver name to force a match. Do not set directly, because core -* frees it. Use driver_set_override() to set or clear it. -*/ -const char *driver_override;/* MFD cell pointer */ struct mfd_cell *mfd_cell;
sound/soc/samsung/i2s.c +3 -3
@@ -1364,10 +1364,10 @@ static int i2s_create_secondary_device(struct samsung_i2s_priv *priv)if (!pdev_sec)return -ENOMEM ; - pdev_sec->driver_override =kstrdup ("samsung-i2s" ,GFP_KERNEL ); -if (!pdev_sec->driver_override) { + ret =device_set_driver_override (&pdev_sec->dev,"samsung-i2s" ); +if (ret) {platform_device_put (pdev_sec); -return -ENOMEM ; +return ret; } ret =platform_device_add (pdev_sec);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 8/186 s390/debug: Reject zero-length input before trimming a newline
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit c366a7b5ed7564e41345c380285bd3f6cb98971b ]
debug_get_user_string() copies the userspace buffer into a newly allocated NUL-terminated buffer and then unconditionally looks at buffer[user_len - 1] to strip a trailing newline.
A zero-length write reaches this helper unchanged, so the newline trim reads before the start of the allocated buffer.
Reject empty writes before accessing the last input byte.
--- arch/s390/kernel/debug.c | 3 +++ 1 file changed, 3 insertions(+)
arch/s390/kernel/debug.c +3 -0
@@ -1258,6 +1258,9 @@ static inline char *debug_get_user_string(const char __user *user_buf, {char *buffer; +if (!user_len) +return ERR_PTR (-EINVAL ); + buffer =kmalloc (user_len +1 ,GFP_KERNEL );if (!buffer)return ERR_PTR (-ENOMEM );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 9/186 wifi: mac80211: check tdls flag in ieee80211_tdls_oper
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
[ Upstream commit 7d73872d949c488a1d7c308031d6a9d89b5e0a8b ]
When NL80211_TDLS_ENABLE_LINK is called, the code only checks if the station exists but not whether it is actually a TDLS station. This allows the operation to proceed for non-TDLS stations, causing unintended side effects like modifying channel context and HT protection before failing.
Add a check for sta->sta.tdls early in the ENABLE_LINK case, before any side effects occur, to ensure the operation is only allowed for actual TDLS peers.
--- net/mac80211/tdls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/tdls.c +1 -1
@@ -1481,7 +1481,7 @@ int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,mutex_lock (&local->sta_mtx); sta =sta_info_get (sdata, peer); -if (!sta) { +if (!sta || !sta->sta.tdls) {mutex_unlock (&local->sta_mtx); ret = -ENOLINK ;break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 10/186 Revert "x86/vdso: Fix output operand size of RDPID"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit db82a94b0c109e7697a593f36783e7ef36073983.
--- arch/x86/include/asm/segment.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/x86/include/asm/segment.h +4 -4
@@ -244,7 +244,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node)static inline void vdso_read_cpunode (unsigned *cpu,unsigned *node) { -unsigned long p; +unsigned int p;/* * Load CPU and node number from the GDT. LSL is faster than RDTSCP
@@ -254,10 +254,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)* * If RDPID is available, use it. */ -alternative_io ("lsl %[seg],%k[p]" , -"rdpid %[p]" , +alternative_io ("lsl %[seg],%[p]" , +".byte 0xf3,0x0f,0xc7,0xf8" ,/* RDPID %eax/rax */ X86_FEATURE_RDPID, - [p] "=r" (p), [seg] "r" (__CPUNODE_SEG)); + [p] "=a" (p), [seg] "r" (__CPUNODE_SEG)); if (cpu) *cpu = (p & VDSO_CPUNODE_MASK);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 11/186 ksmbd: avoid reclaiming expired durable opens by the client
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 520da3c488c5bb177871634e713eb8a106082e6b ]
The expired durable opens should not be reclaimed by client. This patch add ->durable_scavenger_timeout to fp and check it in ksmbd_lookup_durable_fd().
--- fs/smb/server/vfs_cache.c | 9 ++++++++- fs/smb/server/vfs_cache.h | 1 + 2 files changed, 9 insertions(+), 1 deletion(-)
fs/smb/server/vfs_cache.c +8 -1
@@ -515,7 +515,10 @@ struct ksmbd_file *ksmbd_lookup_durable_fd(unsigned long long id)struct ksmbd_file *fp; fp =__ksmbd_lookup_fd (&global_ft, id); -if (fp && fp->conn) { +if (fp && (fp->conn || + (fp->durable_scavenger_timeout && + (fp->durable_scavenger_timeout < +jiffies_to_msecs (jiffies))))) {ksmbd_put_durable_fd (fp); fp =NULL ; }
@@ -784,6 +787,10 @@ static bool session_fd_check(struct ksmbd_tree_connect *tcon, fp->tcon =NULL ; fp->volatile_id =KSMBD_NO_FID ; +if (fp->durable_timeout) + fp->durable_scavenger_timeout = +jiffies_to_msecs (jiffies) + fp->durable_timeout; +return true; }
fs/smb/server/vfs_cache.h +1 -0
@@ -101,6 +101,7 @@ struct ksmbd_file {struct list_head lock_list;int durable_timeout; +int durable_scavenger_timeout;/* if ls is happening on directory, below is valid*/ struct ksmbd_readdir_data readdir_data;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 12/186 ksmbd: add durable scavenger timer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit d484d621d40f4a8b8959008802d79bef3609641b ]
Launch ksmbd-durable-scavenger kernel thread to scan durable fps that have not been reclaimed by a client within the configured time.
--- fs/smb/server/mgmt/user_session.c | 2 + fs/smb/server/server.c | 1 + fs/smb/server/server.h | 1 + fs/smb/server/smb2pdu.c | 2 +- fs/smb/server/smb2pdu.h | 2 + fs/smb/server/vfs_cache.c | 163 +++++++++++++++++++++++++++++- fs/smb/server/vfs_cache.h | 2 + 7 files changed, 167 insertions(+), 6 deletions(-)
fs/smb/server/mgmt/user_session.c +2 -0
@@ -164,6 +164,7 @@ void ksmbd_session_destroy(struct ksmbd_session *sess)ksmbd_tree_conn_session_logoff (sess);ksmbd_destroy_file_table (&sess->file_table); +ksmbd_launch_ksmbd_durable_scavenger ();ksmbd_session_rpc_clear_list (sess);free_channel_list (sess);kfree (sess->Preauth_HashValue);
@@ -399,6 +400,7 @@ void destroy_previous_session(struct ksmbd_conn *conn,ksmbd_destroy_file_table (&prev_sess->file_table); prev_sess->state =SMB2_SESSION_EXPIRED ;ksmbd_all_conn_set_status (id,KSMBD_SESS_NEED_SETUP ); +ksmbd_launch_ksmbd_durable_scavenger (); out:up_write (&conn->session_lock);up_write (&sessions_table_lock);
fs/smb/server/server.c +1 -0
@@ -372,6 +372,7 @@ static void server_ctrl_handle_reset(struct server_ctrl_struct *ctrl) {ksmbd_ipc_soft_reset ();ksmbd_conn_transport_destroy (); +ksmbd_stop_durable_scavenger ();server_conf_free ();server_conf_init ();WRITE_ONCE (server_conf.state,SERVER_STATE_STARTING_UP );
fs/smb/server/server.h +1 -0
@@ -47,6 +47,7 @@ struct ksmbd_server_config {char *conf[SERVER_CONF_WORK_GROUP +1 ];bool bind_interfaces_only; +struct task_struct *dh_task; };extern struct ksmbd_server_config server_conf;
fs/smb/server/smb2pdu.c +1 -1
@@ -3601,7 +3601,7 @@ int smb2_open(struct ksmbd_work *work) SMB2_CREATE_GUID_SIZE);if (dh_info.timeout) fp->durable_timeout =min (dh_info.timeout, -300000 ); +DURABLE_HANDLE_MAX_TIMEOUT );else fp->durable_timeout =60 ; }
fs/smb/server/smb2pdu.h +2 -0
@@ -75,6 +75,8 @@ struct create_durable_req_v2 {__u8 CreateGuid[16 ]; } __packed; +#define DURABLE_HANDLE_MAX_TIMEOUT 300000 +struct create_durable_reconn_req {struct create_context_hdr ccontext;__u8 Name[8 ];
fs/smb/server/vfs_cache.c +158 -5
215 lines not on this page · raw message
fs/smb/server/vfs_cache.h +2 -0
@@ -153,6 +153,8 @@ struct ksmbd_file *ksmbd_lookup_fd_cguid(char *cguid);struct ksmbd_file *ksmbd_lookup_fd_inode (struct dentry *dentry);unsigned int ksmbd_open_durable_fd (struct ksmbd_file *fp);struct ksmbd_file *ksmbd_open_fd (struct ksmbd_work *work,struct file *filp); +void ksmbd_launch_ksmbd_durable_scavenger (void ); +void ksmbd_stop_durable_scavenger (void );void ksmbd_close_tree_conn_fds (struct ksmbd_work *work);void ksmbd_close_session_fds (struct ksmbd_work *work);int ksmbd_close_inode_fds (struct ksmbd_work *work,struct inode *inode);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 13/186 ksmbd: validate owner of durable handle on reconnect
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 49110a8ce654bbe56bef7c5e44cce31f4b102b8a ]
Currently, ksmbd does not verify if the user attempting to reconnect to a durable handle is the same user who originally opened the file. This allows any authenticated user to hijack an orphaned durable handle by predicting or brute-forcing the persistent ID.
According to MS-SMB2, the server MUST verify that the SecurityContext of the reconnect request matches the SecurityContext associated with the existing open.
Add a durable_owner structure to ksmbd_file to store the original opener's UID, GID, and account name. and catpure the owner information when a file handle becomes orphaned. and implementing ksmbd_vfs_compare_durable_owner() to validate the identity of the requester during SMB2_CREATE (DHnC).
--- fs/smb/server/mgmt/user_session.c | 8 +-- fs/smb/server/oplock.c | 7 +++ fs/smb/server/oplock.h | 1 + fs/smb/server/smb2pdu.c | 3 +- fs/smb/server/vfs_cache.c | 87 +++++++++++++++++++++++++++---- fs/smb/server/vfs_cache.h | 12 ++++- 6 files changed, 103 insertions(+), 15 deletions(-)
fs/smb/server/mgmt/user_session.c +4 -4
@@ -159,11 +159,10 @@ void ksmbd_session_destroy(struct ksmbd_session *sess)if (!sess)return ; +ksmbd_tree_conn_session_logoff (sess); +ksmbd_destroy_file_table (sess);if (sess->user)ksmbd_free_user (sess->user); - -ksmbd_tree_conn_session_logoff (sess); -ksmbd_destroy_file_table (&sess->file_table);ksmbd_launch_ksmbd_durable_scavenger ();ksmbd_session_rpc_clear_list (sess);free_channel_list (sess);
@@ -397,7 +396,8 @@ void destroy_previous_session(struct ksmbd_conn *conn,ksmbd_all_conn_set_status (id,KSMBD_SESS_NEED_SETUP ); goto out; } -ksmbd_destroy_file_table (&prev_sess->file_table); + +ksmbd_destroy_file_table (prev_sess); prev_sess->state =SMB2_SESSION_EXPIRED ;ksmbd_all_conn_set_status (id,KSMBD_SESS_NEED_SETUP );ksmbd_launch_ksmbd_durable_scavenger ();
fs/smb/server/oplock.c +7 -0
@@ -1841,6 +1841,7 @@ int smb2_check_durable_oplock(struct ksmbd_conn *conn,struct ksmbd_share_config *share, struct ksmbd_file *fp, struct lease_ctx_info *lctx, + struct ksmbd_user *user, char *name) { struct oplock_info *opinfo = opinfo_get(fp);
@@ -1849,6 +1850,12 @@ int smb2_check_durable_oplock(struct ksmbd_conn *conn,if (!opinfo)return 0 ; +if (ksmbd_vfs_compare_durable_owner (fp, user) == false) { +ksmbd_debug (SMB ,"Durable handle reconnect failed: owner mismatch\n" ); + ret = -EBADF ; + goto out; + } +if (opinfo->is_lease == false) {if (lctx) {pr_err ("create context include lease\n" );
fs/smb/server/oplock.h +1 -0
@@ -133,5 +133,6 @@ int smb2_check_durable_oplock(struct ksmbd_conn *conn,struct ksmbd_share_config *share, struct ksmbd_file *fp, struct lease_ctx_info *lctx, + struct ksmbd_user *user, char *name);#endif /* __KSMBD_OPLOCK_H */
fs/smb/server/smb2pdu.c +2 -1
@@ -2994,7 +2994,8 @@ int smb2_open(struct ksmbd_work *work) }if (dh_info.reconnected == true) { - rc =smb2_check_durable_oplock (conn, share, dh_info.fp, lc, name); + rc =smb2_check_durable_oplock (conn, share, dh_info.fp, + lc, sess->user, name);if (rc) {ksmbd_put_durable_fd (dh_info.fp); goto err_out2;
fs/smb/server/vfs_cache.c +78 -9
161 lines not on this page · raw message
fs/smb/server/vfs_cache.h +11 -1
@@ -67,6 +67,13 @@ enum {FP_CLOSED }; +/* Owner information for durable handle reconnect */ +struct durable_owner { +unsigned int uid; +unsigned int gid; +char *name; +}; +struct ksmbd_file {struct file *filp;u64 persistent_id;
@@ -111,6 +118,7 @@ struct ksmbd_file {bool is_durable;bool is_persistent;bool is_resilient; +struct durable_owner owner; }; static inline void set_ctx_actor(struct dir_context *ctx,
@@ -137,7 +145,7 @@ static inline bool ksmbd_stream_fd(struct ksmbd_file *fp) }int ksmbd_init_file_table (struct ksmbd_file_table *ft); -void ksmbd_destroy_file_table (struct ksmbd_file_table *ft); +void ksmbd_destroy_file_table (struct ksmbd_session *sess);int ksmbd_close_fd (struct ksmbd_work *work,u64 id);struct ksmbd_file *ksmbd_lookup_fd_fast (struct ksmbd_work *work,u64 id);struct ksmbd_file *ksmbd_lookup_foreign_fd (struct ksmbd_work *work,u64 id);
@@ -163,6 +171,8 @@ void ksmbd_free_global_file_table(void);void ksmbd_set_fd_limit (unsigned long limit);void ksmbd_update_fstate (struct ksmbd_file_table *ft,struct ksmbd_file *fp,unsigned int state); +bool ksmbd_vfs_compare_durable_owner (struct ksmbd_file *fp, +struct ksmbd_user *user);/* * INODE hash
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 14/186 ksmbd: close durable scavenger races against m_fp_list lookups
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: DaeMyung Kang <[email protected]>
[ Upstream commit bf736184d063da1a552ffeff0481813599a182cc ]
ksmbd_durable_scavenger() has two related races against any walker that iterates f_ci->m_fp_list, including ksmbd_lookup_fd_inode() (used by ksmbd_vfs_rename) and the share-mode checks in fs/smb/server/smb_common.c.
(1) fp->node list-head reuse. Durable-preserved handles can remain linked on f_ci->m_fp_list after session teardown so share-mode checks still see them while the handle is reconnectable. The scavenger collected expired handles by adding fp->node to a local scavenger_list after removing them from the global durable idr. Because fp->node is the same list_head used by m_fp_list, list_add(&fp->node, &scavenger_list) overwrites the m_fp_list links and corrupts both lists. CONFIG_DEBUG_LIST can report this on the share-mode walk path.
(2) Refcount race against m_fp_list walkers. The scavenger qualifies an expired durable handle with atomic_read(&fp->refcount) > 1 and fp->conn under global_ft.lock, removes fp from global_ft, then drops global_ft.lock before unlinking fp from m_fp_list and freeing it. During that gap fp is still linked on m_fp_list with f_state == FP_INITED. ksmbd_lookup_fd_inode() under m_lock read calls ksmbd_fp_get() (atomic_inc_not_zero on refcount that is still 1) and takes a live reference; the scavenger then unlinks and frees fp while the holder owns a reference, leading to UAF on the holder's subsequent ksmbd_fd_put() and on any field reads performed by a concurrent share-mode walker that iterates m_fp_list without taking ksmbd_fp_get() (smb_check_perm_dleases-like paths).
Fix both:
* Stop reusing fp->node as a scavenger-private list node. Remove one expired handle from global_ft under global_ft.lock, take an explicit transient reference, drop the lock, unlink fp->node from m_fp_list under f_ci->m_lock, then drop both the durable lifetime and transient references with atomic_sub_and_test(2, &fp->refcount). If the scavenger is the last putter the close runs there; otherwise an in-flight holder that already raced through the m_fp_list lookup owns the final close via its ksmbd_fd_put() path. The one-at-a-time disposal can rescan the durable idr when multiple handles expire in the same pass, but durable scavenging is a background expiration path and the final full scan recomputes min_timeout before the next wait.
* Clear fp->persistent_id inside __ksmbd_remove_durable_fd() right after idr_remove(), so a delayed final close from a holder that snatched fp does not re-issue idr_remove() on a persistent id that idr_alloc_cyclic() in ksmbd_open_durable_fd() may have already handed out to a brand-new durable handle.
* Bypass the per-conn open_files_count decrement in __put_fd_final() when fp is detached from any session table (fp->conn cleared by session_fd_check() at durable preserve -- paired with the volatile_id clear at unpublish, so checking fp->conn alone is sufficient). The walker that owns the final close runs from an unrelated work->conn whose stats.open_files_count never tracked this durable fp; without this guard the holder would underflow that unrelated counter.
The two races are folded into one patch because patch (1) alone cleans up the corrupted list but leaves a deterministic UAF window for m_fp_list walkers that the transient-reference and persistent_id discipline in (2) close; bisecting onto an intermediate state would land on a UAF that pre-patch chaos merely made less reproducible.
Validation:
* CONFIG_DEBUG_LIST coverage for the list_head reuse path.
* KASAN-enabled direct SMB2 durable-handle coverage that exercised ksmbd_durable_scavenger() and non-NULL ksmbd_lookup_fd_inode() returns while durable handles expired under concurrent rename lookups, with no KASAN, UAF, list-corruption, ODEBUG, or WARNING reports.
* checkpatch --strict
* make -j$(nproc) M=fs/smb/server
--- fs/smb/server/vfs_cache.c | 104 ++++++++++++++++++++++++++++---------- 1 file changed, 77 insertions(+), 27 deletions(-)
fs/smb/server/vfs_cache.c +77 -27
@@ -325,6 +325,14 @@ static void __ksmbd_remove_durable_fd(struct ksmbd_file *fp)return ;idr_remove (global_ft.idr, fp->persistent_id); +/* +* Clear persistent_id so a later __ksmbd_close_fd() that runs from a +* delayed putter (e.g. when a concurrent ksmbd_lookup_fd_inode() +* walker held the final reference) does not re-issue idr_remove() on +* an id that idr_alloc_cyclic() may have already handed out to a new +* durable handle. +*/ + fp->persistent_id =KSMBD_NO_FID ; }static void ksmbd_remove_durable_fd (struct ksmbd_file *fp)
@@ -417,6 +425,20 @@ static struct ksmbd_file *__ksmbd_lookup_fd(struct ksmbd_file_table *ft,static void __put_fd_final (struct ksmbd_work *work,struct ksmbd_file *fp) { +/* +* Detached durable fp -- session_fd_check() cleared fp->conn at +* preserve, so this fp is no longer tracked by any conn's +* stats.open_files_count. This happens when +* ksmbd_scavenger_dispose_dh() hands the final close off to an +* m_fp_list walker (e.g. ksmbd_lookup_fd_inode()) whose work->conn +* is unrelated to the conn that originally opened the handle; close +* via the NULL-ft path so we do not underflow that unrelated +* counter. +*/ +if (!fp->conn) { +__ksmbd_close_fd (NULL , fp); +return ; + }__ksmbd_close_fd (&work->sess->file_table, fp);atomic_dec (&work->conn->stats.open_files_count); }
@@ -792,24 +814,37 @@ static bool ksmbd_durable_scavenger_alive(void)return true; } -static void ksmbd_scavenger_dispose_dh (struct list_head *head) +static void ksmbd_scavenger_dispose_dh (struct ksmbd_file *fp) { -while (!list_empty (head)) { -struct ksmbd_file *fp; +/* +* Durable-preserved fp can remain linked on f_ci->m_fp_list for +* share-mode checks. Unlink it before final close; fp->node is not +* available as a scavenger-private list node because re-adding it to +* another list corrupts m_fp_list. +*/ +down_write (&fp->f_ci->m_lock); +list_del_init (&fp->node); +up_write (&fp->f_ci->m_lock); - fp = list_first_entry(head, struct ksmbd_file, node); -list_del_init (&fp->node); +/* +* Drop both the durable lifetime reference and the transient reference +* taken by the scavenger under global_ft.lock. If a concurrent +* ksmbd_lookup_fd_inode() (or any other m_fp_list walker) snatched fp +* before the unlink above, that holder owns the final close via +* ksmbd_fd_put() -> __ksmbd_close_fd(). Otherwise the scavenger is +* the last putter and finalises fp here. +*/ +if (atomic_sub_and_test (2 , &fp->refcount))__ksmbd_close_fd (NULL , fp); - } }static int ksmbd_durable_scavenger (void *dummy) {struct ksmbd_file *fp =NULL ; +struct ksmbd_file *expired_fp;unsigned int id;unsigned int min_timeout =1 ;bool found_fp_timeout; -LIST_HEAD (scavenger_list);unsigned long remaining_jiffies;__module_get (THIS_MODULE );
@@ -819,8 +854,6 @@ static int ksmbd_durable_scavenger(void *dummy)if (try_to_freeze ())continue ; - found_fp_timeout = false; - remaining_jiffies =wait_event_timeout (dh_wq,ksmbd_durable_scavenger_alive () == false,__msecs_to_jiffies (min_timeout));
@@ -829,23 +862,39 @@ static int ksmbd_durable_scavenger(void *dummy)else min_timeout =DURABLE_HANDLE_MAX_TIMEOUT ; -write_lock (&global_ft.lock); -idr_for_each_entry (global_ft.idr, fp, id) { -if (!fp->durable_timeout) -continue ; - -if (atomic_read (&fp->refcount) >1 || - fp->conn) -continue ; - - found_fp_timeout = true; -if (fp->durable_scavenger_timeout <= -jiffies_to_msecs (jiffies)) { -__ksmbd_remove_durable_fd (fp); -list_add (&fp->node, &scavenger_list); - }else { + do { + expired_fp = NULL; + found_fp_timeout = false; + + write_lock(&global_ft.lock); + idr_for_each_entry(global_ft.idr, fp, id) { unsigned long durable_timeout; + if (!fp->durable_timeout) + continue; + + if (atomic_read(&fp->refcount) > 1 || + fp->conn) + continue; + + found_fp_timeout = true; + if (fp->durable_scavenger_timeout <= + jiffies_to_msecs(jiffies)) { + __ksmbd_remove_durable_fd(fp); + /* + * Take a transient reference so fp + * cannot be freed by an in-flight + * ksmbd_lookup_fd_inode() that found + * it through f_ci->m_fp_list while we + * drop global_ft.lock and reach the + * m_fp_list unlink in + * ksmbd_scavenger_dispose_dh(). + */ + atomic_inc(&fp->refcount); + expired_fp = fp; + break; + } + durable_timeout = fp->durable_scavenger_timeout - jiffies_to_msecs(jiffies);
@@ -853,10 +902,11 @@ static int ksmbd_durable_scavenger(void *dummy)if (min_timeout > durable_timeout) min_timeout = durable_timeout; } - } -write_unlock (&global_ft.lock); +write_unlock (&global_ft.lock); -ksmbd_scavenger_dispose_dh (&scavenger_list); +if (expired_fp) +ksmbd_scavenger_dispose_dh (expired_fp); + }while (expired_fp);if (found_fp_timeout == false)break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 15/186 af_unix: Give up GC if MSG_PEEK intervened.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit e5b31d988a41549037b8d8721a3c3cae893d8670 ]
Igor Ushakov reported that GC purged the receive queue of an alive socket due to a race with MSG_PEEK with a nice repro.
This is the exact same issue previously fixed by commit cbcf01128d0a ("af_unix: fix garbage collect vs MSG_PEEK").
After GC was replaced with the current algorithm, the cited commit removed the locking dance in unix_peek_fds() and reintroduced the same issue.
The problem is that MSG_PEEK bumps a file refcount without interacting with GC.
Consider an SCC containing sk-A and sk-B, where sk-A is close()d but can be recv()ed via sk-B.
The bad thing happens if sk-A is recv()ed with MSG_PEEK from sk-B and sk-B is close()d while GC is checking unix_vertex_dead() for sk-A and sk-B.
GC thread User thread
--------- -----------
unix_vertex_dead(sk-A)
-> true <------.
\
`------ recv(sk-B, MSG_PEEK)
invalidate !! -> sk-A's file refcount : 1 -> 2 close(sk-B)
-> sk-B's file refcount : 2 -> 1 unix_vertex_dead(sk-B)
-> true
Initially, sk-A's file refcount is 1 by the inflight fd in sk-B recvq. GC thinks sk-A is dead because the file refcount is the same as the number of its inflight fds.
However, sk-A's file refcount is bumped silently by MSG_PEEK, which invalidates the previous evaluation.
At this moment, sk-B's file refcount is 2; one by the open fd, and one by the inflight fd in sk-A. The subsequent close() releases one refcount by the former.
Finally, GC incorrectly concludes that both sk-A and sk-B are dead.
One option is to restore the locking dance in unix_peek_fds(), but we can resolve this more elegantly thanks to the new algorithm.
The point is that the issue does not occur without the subsequent close() and we actually do not need to synchronise MSG_PEEK with the dead SCC detection.
When the issue occurs, close() and GC touch the same file refcount. If GC sees the refcount being decremented by close(), it can just give up garbage-collecting the SCC.
Therefore, we only need to signal the race during MSG_PEEK with a proper memory barrier to make it visible to the GC.
Let's use seqcount_t to notify GC when MSG_PEEK occurs and let it defer the SCC to the next run.
This way no locking is needed on the MSG_PEEK side, and we can avoid imposing a penalty on every MSG_PEEK unnecessarily.
Note that we can retry within unix_scc_dead() if MSG_PEEK is detected, but we do not do so to avoid hung task splat from abusive MSG_PEEK calls.
--- include/net/af_unix.h | 1 + net/unix/af_unix.c | 2 ++ net/unix/garbage.c | 79 ++++++++++++++++++++++++++++--------------- 3 files changed, 54 insertions(+), 28 deletions(-)
include/net/af_unix.h +1 -0
@@ -23,6 +23,7 @@ void unix_del_edges(struct scm_fp_list *fpl);void unix_update_edges (struct unix_sock *receiver);int unix_prepare_fpl (struct scm_fp_list *fpl);void unix_destroy_fpl (struct scm_fp_list *fpl); +void unix_peek_fpl (struct scm_fp_list *fpl);void unix_gc (void );void wait_for_unix_gc (struct scm_fp_list *fpl);
net/unix/af_unix.c +2 -0
@@ -1848,6 +1848,8 @@ static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb)static void unix_peek_fds (struct scm_cookie *scm,struct sk_buff *skb) { scm->fp =scm_fp_dup (UNIXCB (skb).fp); + +unix_peek_fpl (scm->fp); }static void unix_destruct_scm (struct sk_buff *skb)
net/unix/garbage.c +51 -28
126 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 16/186 smb: client: reject userspace cifs.spnego descriptions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asim Viladi Oglu Manizada <[email protected]>
commit 3da1fdf4efbc490041eb4f836bf596201203f8f2 upstream.
cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin.
Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key.
--- fs/smb/client/cifs_spnego.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
fs/smb/client/cifs_spnego.c +16 -0
@@ -8,6 +8,7 @@*/ #include <linux/list.h> +#include <linux/cred.h> #include <linux/slab.h> #include <linux/string.h> #include <keys/user-type.h>
@@ -46,12 +47,27 @@ cifs_spnego_key_destroy(struct key *key)kfree (key->payload.data[0 ]); } +static int +cifs_spnego_key_vet_description (const char *description) +{ +/* +* cifs.spnego descriptions are authority-bearing inputs to cifs.upcall. +* They are only valid when produced by CIFS while using the private +* spnego_cred installed below. Do not let userspace create this type +* of key through request_key(2)/add_key(2), since the helper treats +* pid/uid/creduid/upcall_target as kernel-originating fields. +*/ +if (current_cred () != spnego_cred) +return -EPERM ; +return 0 ; +}/* * keytype for CIFS spnego keys */ struct key_type cifs_spnego_key_type = { .name ="cifs.spnego" , + .vet_description = cifs_spnego_key_vet_description, .instantiate = cifs_spnego_key_instantiate, .destroy = cifs_spnego_key_destroy, .describe = user_describe,
Greg Kroah-Hartman
maintainerPATCH 17/186 Revert "ice: fix double-free of tx_buf skb"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit ca6f9d9aee5408c47e6c0fac10955cb6825ecd96.
--- drivers/net/ethernet/intel/ice/ice_txrx.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/ice/ice_txrx.c +2 -4
@@ -2364,9 +2364,6 @@ ice_xmit_frame_ring(struct sk_buff *skb, struct ice_tx_ring *tx_ring)ice_trace (xmit_frame_ring, tx_ring, skb); -/* record the location of the first descriptor for this packet */ - first = &tx_ring->tx_buf[tx_ring->next_to_use]; - count =ice_xmit_desc_count (skb);if (ice_chk_linearize (skb, count)) {if (__skb_linearize (skb))
@@ -2392,6 +2389,8 @@ ice_xmit_frame_ring(struct sk_buff *skb, struct ice_tx_ring *tx_ring) offload.tx_ring = tx_ring; +/* record the location of the first descriptor for this packet */ + first = &tx_ring->tx_buf[tx_ring->next_to_use]; first->skb = skb; first->type =ICE_TX_BUF_SKB ; first->bytecount = max_t(unsigned int, skb->len, ETH_ZLEN);
@@ -2453,7 +2452,6 @@ ice_xmit_frame_ring(struct sk_buff *skb, struct ice_tx_ring *tx_ring) out_drop:ice_trace (xmit_frame_ring_drop, tx_ring, skb);dev_kfree_skb_any (skb); - first->type =ICE_TX_BUF_EMPTY ;return NETDEV_TX_OK ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 18/186 Revert "ice: Remove jumbo_remove step from TX path"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit a753619ffecfe629ee73c821469edd8b37c72d3b.
--- drivers/net/ethernet/intel/ice/ice_txrx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/intel/ice/ice_txrx.c +3 -0
@@ -2364,6 +2364,9 @@ ice_xmit_frame_ring(struct sk_buff *skb, struct ice_tx_ring *tx_ring)ice_trace (xmit_frame_ring, tx_ring, skb); +if (unlikely (ipv6_hopopt_jumbo_remove (skb))) + goto out_drop; + count =ice_xmit_desc_count (skb);if (ice_chk_linearize (skb, count)) {if (__skb_linearize (skb))
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 19/186 Revert "s390/cio: Update purge function to unregister the unused subchannels"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit c34b09cbd6fc06f0f234182e462a1b010d13a5a6.
--- drivers/s390/cio/device.c | 37 +++++++++++++------------------------ 1 file changed, 13 insertions(+), 24 deletions(-)
drivers/s390/cio/device.c +13 -24
@@ -1318,34 +1318,23 @@ void ccw_device_schedule_recovery(void)spin_unlock_irqrestore (&recovery_lock, flags); } -static int purge_fn (struct subchannel *sch,void *data) +static int purge_fn (struct device *dev,void *data) { -struct ccw_device *cdev; - -spin_lock_irq (sch->lock); -if (sch->st !=SUBCHANNEL_TYPE_IO || !sch->schib.pmcw.dnv) - goto unlock; - -if (!is_blacklisted (sch->schid.ssid, sch->schib.pmcw.dev)) - goto unlock; - - cdev =sch_get_cdev (sch); -if (cdev) { -if (cdev->private->state !=DEV_STATE_OFFLINE ) - goto unlock; +struct ccw_device *cdev =to_ccwdev (dev); +struct ccw_dev_id *id = &cdev->private->dev_id; +struct subchannel *sch =to_subchannel (cdev->dev.parent); -if (atomic_cmpxchg (&cdev->private->onoff,0 ,1 ) !=0 ) - goto unlock; +spin_lock_irq (cdev->ccwlock); +if (is_blacklisted (id->ssid, id->devno) && + (cdev->private->state ==DEV_STATE_OFFLINE ) && + (atomic_cmpxchg (&cdev->private->onoff,0 ,1 ) ==0 )) { +CIO_MSG_EVENT (3 ,"ccw: purging 0.%x.%04x\n" , id->ssid, + id->devno);ccw_device_sched_todo (cdev,CDEV_TODO_UNREG ); +css_sched_sch_todo (sch,SCH_TODO_UNREG );atomic_set (&cdev->private->onoff,0 ); } - -css_sched_sch_todo (sch,SCH_TODO_UNREG ); -CIO_MSG_EVENT (3 ,"ccw: purging 0.%x.%04x%s\n" , sch->schid.ssid, - sch->schib.pmcw.dev, cdev ?"" :" (no cdev)" ); - -unlock: -spin_unlock_irq (sch->lock); +spin_unlock_irq (cdev->ccwlock);/* Abort loop in case of pending signal. */ if (signal_pending (current))return -EINTR ;
@@ -1361,7 +1350,7 @@ static int purge_fn(struct subchannel *sch, void *data)int ccw_purge_blacklisted (void ) {CIO_MSG_EVENT (2 ,"ccw: purging blacklisted devices\n" ); -for_each_subchannel_staged (purge_fn,NULL ,NULL ); +bus_for_each_dev (&ccw_bus_type,NULL ,NULL , purge_fn);return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 20/186 Revert "af_unix: Reject SIOCATMARK on non-stream sockets"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit 0d7e7235bc543c6ed7b873e3015db814d8e8c414.
--- net/unix/af_unix.c | 3 --- 1 file changed, 3 deletions(-)
net/unix/af_unix.c +0 -3
@@ -2809,9 +2809,6 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state, goto out; } -if (sk->sk_type !=SOCK_STREAM ) -return -EOPNOTSUPP ; -mutex_lock (&u->iolock); goto redo; unlock:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 21/186 i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit b795e68bf3073d67bebbb5a44d93f49efc5b8cc7 ]
The logic used to abort the DMA ring contains several flaws:
1. The driver unconditionally issues a ring abort even when the ring has already stopped.
2. The completion used to wait for abort completion is never re-initialized, resulting in incorrect wait behavior.
3. The abort sequence unintentionally clears RING_CTRL_ENABLE, which resets hardware ring pointers and disrupts the controller state.
4. If the ring is already stopped, the abort operation should be considered successful without attempting further action.
Fix the abort handling by checking whether the ring is running before issuing an abort, re-initializing the completion when needed, ensuring that RING_CTRL_ENABLE remains asserted during abort, and treating an already stopped ring as a successful condition.
--- drivers/i3c/master/mipi-i3c-hci/dma.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-)
drivers/i3c/master/mipi-i3c-hci/dma.c +17 -10
@@ -448,16 +448,23 @@ static bool hci_dma_dequeue_xfer(struct i3c_hci *hci,struct hci_rh_data *rh = &rings->headers[xfer_list[0 ].ring_number];unsigned int i;bool did_unqueue = false; - -/* stop the ring */ -rh_reg_write (RING_CONTROL ,RING_CTRL_ABORT ); -if (wait_for_completion_timeout (&rh->op_done,HZ ) ==0 ) { -/* -* We're deep in it if ever this condition is ever met. -* Hardware might still be writing to memory, etc. -*/ -dev_crit (&hci->master.dev,"unable to abort the ring\n" ); -WARN_ON (1 ); +u32 ring_status; + + ring_status =rh_reg_read (RING_STATUS ); +if (ring_status &RING_STATUS_RUNNING ) { +/* stop the ring */ +reinit_completion (&rh->op_done); +rh_reg_write (RING_CONTROL ,RING_CTRL_ENABLE |RING_CTRL_ABORT ); +wait_for_completion_timeout (&rh->op_done,HZ ); + ring_status =rh_reg_read (RING_STATUS ); +if (ring_status &RING_STATUS_RUNNING ) { +/* +* We're deep in it if ever this condition is ever met. +* Hardware might still be writing to memory, etc. +*/ +dev_crit (&hci->master.dev,"unable to abort the ring\n" ); +WARN_ON (1 ); + } }for (i =0 ; i < n; i++) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 22/186 sysfs: dont remove existing directory on update failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 237557b8a81ab948e8332f7c0058e758f081c0a3 upstream.
When sysfs_update_group() is called for a named group and create_files() fails (e.g. -ENOMEM), internal_create_group() calls kernfs_remove(kn) on the group directory. In the update path, kn was obtained via kernfs_find_and_get() and refers to a directory that already existed before this call. Removing it silently destroys a sysfs group that the caller did not create.
Only remove the directory if we created it ourselves. On update failure the directory remains as it is left empty by remove_files() inside create_files(), but can be repopulated by a retry.
--- fs/sysfs/group.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/sysfs/group.c +1 -1
@@ -151,7 +151,7 @@ static int internal_create_group(structkernfs_get (kn); error =create_files (kn, kobj, uid, gid, grp, update);if (error) { -if (grp->name) +if (grp->name && !update)kernfs_remove (kn); }kernfs_put (kn);
Greg Kroah-Hartman
maintainerPATCH 23/186 mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit d4e7b5c4cc353f154d5ab8bb2e1ce7714d77a6e9 upstream.
damon_sysfs_memcg_path_to_id() breaks mem_cgroup_iter() loop without calling mem_cgroup_iter_break(). This leaks the cgroup reference. Fix the issue by calling mem_cgroup_iter_break() before the break.
The issue was discovered [1] by Sashiko.
--- mm/damon/sysfs-schemes.c | 1 + 1 file changed, 1 insertion(+)
mm/damon/sysfs-schemes.c +1 -0
@@ -1539,6 +1539,7 @@ static int damon_sysfs_memcg_path_to_id(if (damon_sysfs_memcg_path_eq (memcg, path, memcg_path)) { *id =mem_cgroup_id (memcg); found = true; +mem_cgroup_iter_break (NULL , memcg);break ; } }
Greg Kroah-Hartman
maintainerPATCH 24/186 ksmbd: fix null pointer dereference in compare_guid_key()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Laratro <[email protected]>
commit 4b83cbc4c15f09b000cc06f033f64b0824b6dc87 upstream.
session_fd_check() walks the per-inode m_op_list during durable-handle session teardown and sets op->conn = NULL for every opinfo whose conn matched the closing session's connection. The matching opinfo, however, stays linked in its per-ClientGuid lease_table_list entry's lb->lease_list because destroy_lease_table() only runs on full TCP-connection teardown, not on SESSION_LOGOFF.
If the same TCP connection then negotiates a fresh session with the same ClientGuid (ClientGuid is bound to NEGOTIATE, not the session, and is unchanged across LOGOFF + SETUP) and issues a SMB2 CREATE with a lease context on a different inode, find_same_lease_key() walks lb->lease_list, reaches the stale opinfo, and calls compare_guid_key(), which unconditionally dereferences opinfo->conn->ClientGUID. The conn pointer is NULL and the kernel panics.
Reproducer requires only a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'. KASAN report on mainline 70390501d194:
general protection fault, probably for non-canonical address 0xdffffc0000000069: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000348-0x000000000000034f] Workqueue: ksmbd-io handle_ksmbd_work RIP: 0010:bcmp+0x5b/0x230 Call Trace: compare_guid_key+0x4b/0xd0 find_same_lease_key+0x324/0x690 smb2_open+0x6aea/0x8e60 handle_ksmbd_work+0x796/0xee0 ...
Faulting address 0x348 is the offset of ClientGUID within struct ksmbd_conn, confirming opinfo->conn was NULL.
Read opinfo->conn once and bail out if it has been cleared by a concurrent session_fd_check(). A half-detached opinfo cannot be the owner of an active lease, so returning 0 is the correct match result.
--- fs/smb/server/oplock.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/smb/server/oplock.c +5 -1
@@ -484,8 +484,12 @@ static inline int compare_guid_key(struc const char *guid1, const char *key1) { const char *guid2, *key2; +struct ksmbd_conn *conn; - guid2 = opinfo->conn->ClientGUID; + conn =READ_ONCE (opinfo->conn); +if (!conn) +return 0 ; + guid2 = conn->ClientGUID; key2 = opinfo->o_lease->lease_key;if (!memcmp (guid1, guid2,SMB2_CLIENT_GUID_SIZE ) && !memcmp (key1, key2,SMB2_LEASE_KEY_SIZE ))
Greg Kroah-Hartman
maintainerPATCH 25/186 ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ferry Meng <[email protected]>
commit af92ee994cc7f7e83a41c2025f32257a2f82a7ef upstream.
Commit 299f962c0b02 ("ksmbd: use check_add_overflow() to prevent u16 DACL size overflow") added check_add_overflow() guards that break out of the ACE-building loops in set_posix_acl_entries_dacl() when the accumulated DACL size would wrap past 65535.
However, each iteration allocates a struct smb_sid via kmalloc_obj() at the top of the loop and relies on the kfree(sid) call at the end of the loop body (the 'pass_same_sid' label in the first loop, and the explicit kfree at the tail of the second loop) to release it. The newly introduced 'break' statements bypass those kfree() calls, leaking the sid buffer every time an overflow is detected.
A malicious or malformed file with enough POSIX ACL entries to trip the overflow check will leak one or more struct smb_sid allocations on every request that touches the file's DACL, providing a trivial kernel memory exhaustion vector.
Free sid before breaking out of the loops to plug the leak.
--- fs/smb/server/smbacl.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
fs/smb/server/smbacl.c +9 -3
@@ -643,8 +643,10 @@ static void set_posix_acl_entries_dacl(struct mnt_idmap *idmap, ntace = (struct smb_ace *)((char *)pndace + *size); ace_sz =fill_ace_for_sid (ntace, sid,ACCESS_ALLOWED , flags, pace->e_perm,0777 ); -if (check_add_overflow (*size, ace_sz, size)) +if (check_add_overflow (*size, ace_sz, size)) { +kfree (sid);break ; + } (*num_aces)++;if (pace->e_tag ==ACL_USER ) ntace->access_req |=
@@ -655,8 +657,10 @@ static void set_posix_acl_entries_dacl(struct mnt_idmap *idmap, ntace = (struct smb_ace *)((char *)pndace + *size); ace_sz =fill_ace_for_sid (ntace, sid,ACCESS_ALLOWED ,0x03 , pace->e_perm,0777 ); -if (check_add_overflow (*size, ace_sz, size)) +if (check_add_overflow (*size, ace_sz, size)) { +kfree (sid);break ; + } (*num_aces)++;if (pace->e_tag ==ACL_USER ) ntace->access_req |=
@@ -698,8 +702,10 @@ posix_default_acl: ntace = (struct smb_ace *)((char *)pndace + *size); ace_sz =fill_ace_for_sid (ntace, sid,ACCESS_ALLOWED ,0x0b , pace->e_perm,0777 ); -if (check_add_overflow (*size, ace_sz, size)) +if (check_add_overflow (*size, ace_sz, size)) { +kfree (sid);break ; + } (*num_aces)++;if (pace->e_tag ==ACL_USER ) ntace->access_req |=
Signature · 1 line
2.54.0
Greg Kroah-Hartman
maintainerPATCH 26/186 smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrique Carvalho <[email protected]>
commit 4d8690dace005a38e6dbde9ecce2da3ad85c7c41 upstream.
Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored cifs code to change cifs_tcp_ses_lock for tc_lock around tc_count changes.
There was missing lock around tc_count increment inside smb2_find_smb_sess_tcon_unlocked().
--- fs/smb/client/smb2transport.c | 2 ++ 1 file changed, 2 insertions(+)
fs/smb/client/smb2transport.c +2 -0
@@ -214,7 +214,9 @@ smb2_find_smb_sess_tcon_unlocked(structlist_for_each_entry (tcon, &ses->tcon_list, tcon_list) {if (tcon->tid != tid)continue ; +spin_lock (&tcon->tc_lock); ++tcon->tc_count; +spin_unlock (&tcon->tc_lock);trace_smb3_tcon_ref (tcon->debug_id, tcon->tc_count, netfs_trace_tcon_ref_get_find_sess_tcon);return tcon;
Greg Kroah-Hartman
maintainerPATCH 27/186 smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChenXiaoSong <[email protected]>
commit 4ec9c8e023c79f613fe4d5ad8cc737112efb2e44 upstream.
Reproducer:
1. server: systemctl start ksmbd
2. client: mount -t cifs //${server_ip}/export /mnt
3. client: C program: openat(AT_FDCWD, "/mnt", O_RDWR | O_TMPFILE, 0600)
Do not treat FILE_DELETE_ON_CLOSE_LE as delete pending while files remain open.
This patch fixes xfstests generic/004.
--- fs/smb/server/vfs_cache.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
fs/smb/server/vfs_cache.c +12 -4
@@ -118,7 +118,7 @@ int ksmbd_query_inode_status(struct dentreturn ret;down_read (&ci->m_lock); -if (ci->m_flags & (S_DEL_PENDING |S_DEL_ON_CLS )) +if (ci->m_flags &S_DEL_PENDING ) ret =KSMBD_INODE_STATUS_PENDING_DELETE ;else ret =KSMBD_INODE_STATUS_OK ;
@@ -134,7 +134,7 @@ bool ksmbd_inode_pending_delete(struct kint ret;down_read (&ci->m_lock); - ret = (ci->m_flags & (S_DEL_PENDING |S_DEL_ON_CLS )); + ret = (ci->m_flags &S_DEL_PENDING );up_read (&ci->m_lock);return ret;
@@ -302,12 +302,20 @@ static void __ksmbd_inode_close(struct k } } +down_write (&ci->m_lock); +/* Promote S_DEL_ON_CLS to S_DEL_PENDING when close */ +if (ci->m_flags &S_DEL_ON_CLS ) { + ci->m_flags &= ~S_DEL_ON_CLS ; + ci->m_flags |=S_DEL_PENDING ; + } +up_write (&ci->m_lock); +if (atomic_dec_and_test (&ci->m_count)) {bool do_unlink = false;down_write (&ci->m_lock); -if (ci->m_flags & (S_DEL_ON_CLS |S_DEL_PENDING )) { - ci->m_flags &= ~(S_DEL_ON_CLS |S_DEL_PENDING ); +if (ci->m_flags &S_DEL_PENDING ) { + ci->m_flags &= ~S_DEL_PENDING ; do_unlink = true; }up_write (&ci->m_lock);
Greg Kroah-Hartman
maintainerPATCH 28/186 hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdurrahman Hussain <[email protected]>
commit eee213daa1e1b402eb631bcd1b8c5aa340a6b081 upstream.
adm1266_nvmem_read_blackbox() declares a 5-byte stack buffer and passes it to i2c_smbus_read_block_data() to retrieve the 4-byte BLACKBOX_INFO response. i2c_smbus_read_block_data() does not honour caller buffer sizes -- it memcpy()s data.block[0] bytes from the SMBus transaction (where data.block[0] is the length byte returned by the slave device, up to I2C_SMBUS_BLOCK_MAX = 32):
memcpy(values, &data.block[1], data.block[0]);
If the device returns any block length above 5, the call overflows the caller's 5-byte stack buffer before the post-call
if (ret != 4) return -EIO;
check has a chance to reject the response.
Widen the local buffer to I2C_SMBUS_BLOCK_MAX so the helper has room for any well-formed SMBus block response, matching the convention used by the other i2c_smbus_read_block_data() callers in this driver.
--- drivers/hwmon/pmbus/adm1266.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/pmbus/adm1266.c +1 -1
@@ -349,7 +349,7 @@ static int adm1266_nvmem_read_blackbox(s {int record_count;char index; -u8 buf[5 ]; +u8 buf[I2C_SMBUS_BLOCK_MAX ];int ret; ret =i2c_smbus_read_block_data (data->client,ADM1266_BLACKBOX_INFO , buf);
Greg Kroah-Hartman
maintainerPATCH 29/186 ALSA: ua101: Reject too-short USB descriptors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
commit b59d5c51bb328a60749b4dd5fe7e649bfb4089b4 upstream.
find_format_descriptor() walks the class-specific interface extras by advancing with bLength. It rejects descriptors that extend past the remaining buffer, but it does not reject descriptor lengths smaller than a USB descriptor header.
Reject too-short descriptors before using bLength to advance the local scan. This keeps the UA-101 parser robust against malformed descriptor data and matches the usual USB descriptor walking rules.
--- sound/usb/misc/ua101.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/usb/misc/ua101.c +3 -2
@@ -914,8 +914,9 @@ find_format_descriptor(struct usb_interfstruct uac_format_type_i_discrete_descriptor *desc; desc = (struct uac_format_type_i_discrete_descriptor *)extra; -if (desc->bLength > extralen) { -dev_err (&interface->dev,"descriptor overflow\n" ); +if (desc->bLength <sizeof (struct usb_descriptor_header ) || + desc->bLength > extralen) { +dev_err (&interface->dev,"invalid descriptor length\n" );return NULL ; } if (desc->bLength == UAC_FORMAT_TYPE_I_DISCRETE_DESC_SIZE(1) &&
Greg Kroah-Hartman
maintainerPATCH 30/186 ALSA: pcm: Dont setup bogus iov_iter for silencing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit e4d3386b74fba8e01280484b67ee481ece00201e upstream.
At transition to the iov_iter for PCM data transfer, we blindly applied the iov_iter setup also for silencing (i.e. data = NULL), and it leads to a calculation of bogus iov_iter. Fortunately this didn't cause troubles on most of architectures but it goes wrong on RISC-V now, causing a NULL dereference.
Handle the NULL data case to treat the silencing in interleaved_copy() for addressing the bug above. noninterleaved_copy() has already the NULL data handling, so it doesn't need changes.
--- sound/core/pcm_lib.c | 3 +++ 1 file changed, 3 insertions(+)
sound/core/pcm_lib.c +3 -0
@@ -2074,6 +2074,9 @@ static int interleaved_copy(struct snd_p off =frames_to_bytes (runtime, off); frames =frames_to_bytes (runtime, frames); +if (!data) +return fill_silence (substream,0 , hwoff,NULL , frames); +return do_transfer (substream,0 , hwoff, data + off, frames, transfer, in_kernel); }
Greg Kroah-Hartman
maintainerPATCH 31/186 ALSA: asihpi: Fix potential OOB array access at reading cache
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 7b7d6572145c1dab2dd9bfb550b188e5f0ff3c3f upstream.
find_control() to retrieve a cached info accesses the array with the given index blindly, which may lead to an OOB array access. Add a sanity check for avoiding it.
--- sound/pci/asihpi/hpicmn.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/pci/asihpi/hpicmn.c +6 -0
@@ -276,6 +276,12 @@ static short find_control(u16 control_inreturn 0 ; } +if (control_index >= p_cache->control_count) { +HPI_DEBUG_LOG (VERBOSE ,"control_index out of bounce %d\n" , + control_index); +return 0 ; + } + *pI = p_cache->p_info[control_index];if (!*pI) { HPI_DEBUG_LOG(VERBOSE, "Uncached Control %d\n",
Greg Kroah-Hartman
maintainerPATCH 32/186 efi: Allocate runtime workqueue before ACPI init
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit 13c6da02e767152c9ac4330962247a5e47011035 upstream.
Since commit
5894cf571e14 ("acpi/prmt: Use EFI runtime sandbox to invoke PRM handlers")
ACPI PRM calls are delegated to a workqueue which runs in a kernel thread, making it easier to detect and mitigate faulting memory accesses performed by the firmware.
Rafael reports that such PRM accesses may occur before efisubsys_init() executes, which is where the workqueue is allocated, leading to NULL pointer dereferences. Since acpi_init() [which triggers the early PRM accesses] executes as a subsys_initcall() as well, and has its own dependencies that may be sensitive to initcall ordering, deferring acpi_init() is not an option.
So instead, split off the workqueue allocation into its own postcore initcall, as this is the only missing piece to allow EFI runtime calls to be made. This ensures that EFI runtime call (including PRM calls) are accessible to all code running at subsys_initcall() level.
--- drivers/firmware/efi/efi.c | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-)
drivers/firmware/efi/efi.c +16 -12
@@ -371,21 +371,11 @@ static void __init efi_debugfs_init(voidstatic inline void efi_debugfs_init (void ) {}#endif -/* -* We register the efi subsystem with the firmware subsystem and the -* efivars subsystem with the efi subsystem, if the system was booted with -* EFI. -*/ -static int __init efisubsys_init (void ) +static int __init efipostcore_init (void ) { -int error; -if (!efi_enabled (EFI_RUNTIME_SERVICES )) efi.runtime_supported_mask =0 ; -if (!efi_enabled (EFI_BOOT )) -return 0 ; -if (efi.runtime_supported_mask) {/* * Since we process only one efi_runtime_service() at a time, an
@@ -397,9 +387,23 @@ static int __init efisubsys_init(void)pr_err ("Creating efi_rts_wq failed, EFI runtime services disabled.\n" );clear_bit (EFI_RUNTIME_SERVICES , &efi.flags); efi.runtime_supported_mask =0 ; -return 0 ; } } +return 0 ; +} +postcore_initcall (efipostcore_init); + +/* +* We register the efi subsystem with the firmware subsystem and the +* efivars subsystem with the efi subsystem, if the system was booted with +* EFI. +*/ +static int __init efisubsys_init (void ) +{ +int error; + +if (!efi_enabled (EFI_BOOT )) +return 0 ;if (efi_rt_services_supported (EFI_RT_SUPPORTED_TIME_SERVICES ))platform_device_register_simple ("rtc-efi" ,0 ,NULL ,0 );
Greg Kroah-Hartman
maintainerPATCH 33/186 drivers/base/memory: fix memory block reference leak in poison accounting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muchun Song <[email protected]>
commit 03a2cc1756a0570f887d624cd6c535ea0cbd4951 upstream.
memblk_nr_poison_inc() and memblk_nr_poison_sub() look up a memory block via find_memory_block_by_id(), which acquires a reference to the memory block device.
Both helpers use the returned memory block without dropping that reference, leaking the device reference on each successful lookup. Drop the reference after updating nr_hwpoison.
--- drivers/base/memory.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/base/memory.c +6 -2
@@ -1211,8 +1211,10 @@ void memblk_nr_poison_inc(unsigned longconst unsigned long block_id =pfn_to_block_id (pfn);struct memory_block *mem =find_memory_block_by_id (block_id); -if (mem) +if (mem) {atomic_long_inc (&mem->nr_hwpoison); +put_device (&mem->dev); + } }void memblk_nr_poison_sub (unsigned long pfn,long i)
@@ -1220,8 +1222,10 @@ void memblk_nr_poison_sub(unsigned longconst unsigned long block_id =pfn_to_block_id (pfn);struct memory_block *mem =find_memory_block_by_id (block_id); -if (mem) +if (mem) {atomic_long_sub (i, &mem->nr_hwpoison); +put_device (&mem->dev); + } }static unsigned long memblk_nr_poison (struct memory_block *mem)
Greg Kroah-Hartman
maintainerPATCH 34/186 net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
commit c5d93b2c40355e999715262a824965aac025a427 upstream.
The memory allocated in ipc_protocol_init() is not freed on the error paths that follow in ipc_imem_init(). Fix that by calling the corresponding release function ipc_protocol_deinit() in the error path.
--- drivers/net/wwan/iosm/iosm_ipc_imem.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wwan/iosm/iosm_ipc_imem.c +2 -0
@@ -1430,6 +1430,8 @@ imem_config_fail: protocol_init_fail:cancel_work_sync (&ipc_imem->run_state_worker);ipc_task_deinit (ipc_imem->ipc_task); +if (ipc_imem->ipc_protocol) +ipc_protocol_deinit (ipc_imem->ipc_protocol); ipc_task_init_fail:kfree (ipc_imem->ipc_task); ipc_task_fail:
Greg Kroah-Hartman
maintainerPATCH 35/186 Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Safa Karakuş <[email protected]>
commit ab1513597c6cf17cd1ad2a21e3b045421b48e022 upstream.
bt_accept_dequeue() unlinks a not-yet-accepted child from the parent accept queue and release_sock()s it before returning, so the returned sk has no caller reference and is unlocked.
l2cap_sock_cleanup_listen() walks these children on listening-socket close. A concurrent HCI disconnect drives hci_rx_work -> l2cap_conn_del() which runs l2cap_chan_del() + l2cap_sock_kill() and frees the child sk and its l2cap_chan; cleanup_listen() then uses both:
BUG: KASAN: slab-use-after-free in l2cap_sock_kill
l2cap_sock_kill / l2cap_sock_cleanup_listen / __x64_sys_close
Freed by: l2cap_conn_del -> l2cap_sock_close_cb -> l2cap_sock_killThis is distinct from the two fixes already in this area: commit e83f5e24da741 ("Bluetooth: serialize accept_q access") serialises the accept_q list/poll and takes temporary refs inside bt_accept_dequeue(), and CVE-2025-39860 serialises the userspace close()/accept() race by calling cleanup_listen() under lock_sock() in l2cap_sock_release(). Neither covers l2cap_conn_del() running from hci_rx_work, so this UAF still reproduces on current bluetooth/master.
Take the reference at the source: bt_accept_dequeue() does sock_hold() while sk is still locked, before release_sock(); callers sock_put(). cleanup_listen() pins the chan with l2cap_chan_hold_unless_zero() under a brief child sk lock (serialising vs l2cap_sock_teardown_cb()), drops it before l2cap_chan_lock(), and skips a duplicate l2cap_sock_kill() on SOCK_DEAD. conn->lock is not taken here: cleanup_listen() runs under the parent sk lock and that would invertconn->lock -> chan->lock -> sk_lock (lockdep).
KASAN/SMP: an unprivileged listen/close vs HCI-disconnect race produced 12 use-after-free reports per run before this change; 0, and no lockdep report, over 1600+ raced iterations after it on bluetooth/master.
--- net/bluetooth/af_bluetooth.c | 10 ++++++++ net/bluetooth/iso.c | 9 ++++++- net/bluetooth/l2cap_sock.c | 51 +++++++++++++++++++++++++++++++++++++------ net/bluetooth/rfcomm/sock.c | 9 ++++++- net/bluetooth/sco.c | 9 ++++++- 5 files changed, 78 insertions(+), 10 deletions(-)
net/bluetooth/af_bluetooth.c +10 -0
@@ -306,6 +306,16 @@ restart:if (newsock)sock_graft (sk, newsock); +/* Hand the caller a reference taken while sk is +* still locked. bt_accept_unlink() just dropped +* the accept-queue reference; without this hold a +* concurrent teardown (e.g. l2cap_conn_del() -> +* l2cap_sock_kill()) could free sk between +* release_sock() and the caller using it. Every +* caller drops this with sock_put() when done. +*/ +sock_hold (sk); +release_sock (sk);return sk; }
net/bluetooth/iso.c +8 -1
@@ -692,6 +692,8 @@ static void iso_sock_cleanup_listen(struwhile ((sk =bt_accept_dequeue (parent,NULL ))) {iso_sock_close (sk);iso_sock_kill (sk); +/* Drop the reference handed back by bt_accept_dequeue(). */ +sock_put (sk); }/* If listening socket stands for a PA sync connection,
@@ -1146,8 +1148,13 @@ static int iso_sock_accept(struct socket } ch =bt_accept_dequeue (sk, newsock); -if (ch) +if (ch) { +/* Drop the bridging ref from bt_accept_dequeue(); +* the grafted socket keeps ch alive from here. +*/ +sock_put (ch);break ; + }if (!timeo) { err = -EAGAIN ;
net/bluetooth/l2cap_sock.c +44 -7
74 lines not on this page · raw message
net/bluetooth/rfcomm/sock.c +8 -1
@@ -180,6 +180,8 @@ static void rfcomm_sock_cleanup_listen(swhile ((sk =bt_accept_dequeue (parent,NULL ))) {rfcomm_sock_close (sk);rfcomm_sock_kill (sk); +/* Drop the reference handed back by bt_accept_dequeue(). */ +sock_put (sk); } parent->sk_state =BT_CLOSED ;
@@ -496,8 +498,13 @@ static int rfcomm_sock_accept(struct soc } nsk =bt_accept_dequeue (sk, newsock); -if (nsk) +if (nsk) { +/* Drop the bridging ref from bt_accept_dequeue(); +* the grafted socket keeps nsk alive from here. +*/ +sock_put (nsk);break ; + }if (!timeo) { err = -EAGAIN ;
net/bluetooth/sco.c +8 -1
@@ -432,6 +432,8 @@ static void sco_sock_cleanup_listen(struwhile ((sk =bt_accept_dequeue (parent,NULL ))) {sco_sock_close (sk);sco_sock_kill (sk); +/* Drop the reference handed back by bt_accept_dequeue(). */ +sock_put (sk); } parent->sk_state =BT_CLOSED ;
@@ -704,8 +706,13 @@ static int sco_sock_accept(struct socket } ch =bt_accept_dequeue (sk, newsock); -if (ch) +if (ch) { +/* Drop the bridging ref from bt_accept_dequeue(); +* the grafted socket keeps ch alive from here. +*/ +sock_put (ch);break ; + }if (!timeo) { err = -EAGAIN ;
Greg Kroah-Hartman
maintainerPATCH 36/186 Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <[email protected]>
commit 84c24fb151fc1179355296d7ff29129ac7c42129 upstream.
ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISO_CONT branch of iso_recv() guards against a missing ISO_START by checking conn->rx_len before touching conn->rx_skb, but ISO_END does not.
If a peer sends an ISO_END as the first packet on a fresh ISO connection, conn->rx_skb is still NULL and conn->rx_len is zero, so skb_put(conn->rx_skb, ...) dereferences NULL and oopses. For BIS, where receivers sync to a broadcaster without pairing, any broadcaster on the air can trigger this.
Mirror the ISO_CONT check at the top of ISO_END so a stray end fragment is logged and dropped instead of crashing the host.
--- net/bluetooth/iso.c | 5 +++++ 1 file changed, 5 insertions(+)
net/bluetooth/iso.c +5 -0
@@ -2107,6 +2107,11 @@ void iso_recv(struct hci_conn *hcon, strbreak ;case ISO_END : +if (!conn->rx_len) { +BT_ERR ("Unexpected end frame (len %d)" , skb->len); + goto drop; + } +skb_copy_from_linear_data (skb,skb_put (conn->rx_skb, skb->len), skb->len); conn->rx_len -= skb->len;
Greg Kroah-Hartman
maintainerPATCH 37/186 Bluetooth: bnep: Fix UAF read of dev->name
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit 59e932ded949fa6f0340bf7c6d7818f962fa4fd2 upstream.
bnep_add_connection() needs to keep holding the bnep_session_sem while reading dev->name (just like bnep_get_connlist() does); otherwise the bnep_session() thread can concurrently free the net_device, which can for example be triggered by a concurrent bnep_del_connection().
(This UAF is fairly uninteresting from a security perspective; calling bnep_add_connection() requires passing a capable(CAP_NET_ADMIN) check. It also requires completely tearing down a netdev during a fairly tight race window.)
--- net/bluetooth/bnep/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bluetooth/bnep/core.c +1 -1
@@ -638,8 +638,8 @@ int bnep_add_connection(struct bnep_conn goto failed; } -up_write (&bnep_session_sem);strcpy (req->device, dev->name); +up_write (&bnep_session_sem);return 0 ; failed:
Greg Kroah-Hartman
maintainerPATCH 38/186 Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mingyu Wang <[email protected]>
commit c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b upstream.
Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart.
The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the hu struct. When the scheduled work executes later, it blindly dereferences the freed hu struct.
Furthermore, several data races and UAFs were identified in the teardown sequence:
1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work.
2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev.
3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently.
Fix these synchronization and lifecycle issues by:
1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first, followed immediately by a cancel_work_sync(&hu->write_work). Clearing the flag locks out concurrent protocol timers from successfully invoking hci_uart_tx_wakeup(), effectively rendering the cancellation permanent and preventing the tx_skb double-free.
2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip hu->proto->flush(). This is perfectly safe in the tty_close path because hu->proto->close() executes shortly after, which intrinsically purges all protocol SKB queues and tears down the state.
3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev) across all close and error paths to prevent vendor-level UAFs.
4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive() inside the proto_lock read-side critical section to safely synchronize with device unregistration.
5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely flush the workqueue before hci_uart_flush() is invoked via the HCI core.
6. Utilizing cancel_work_sync() instead of disable_work_sync() across all paths to prevent permanently breaking user-space retry capabilities.
--- drivers/bluetooth/hci_ldisc.c | 48 +++++++++++++++++++++++++++++++++++------- 1 file changed, 40 insertions(+), 8 deletions(-)
drivers/bluetooth/hci_ldisc.c +40 -8
@@ -194,7 +194,15 @@ void hci_uart_init_work(struct work_stru err =hci_register_dev (hu->hdev);if (err <0 ) {BT_ERR ("Can't register HCI device" ); + +percpu_down_write (&hu->proto_lock);clear_bit (HCI_UART_PROTO_READY , &hu->flags); +percpu_up_write (&hu->proto_lock); + +/* Safely cancel work after clearing flags */ +cancel_work_sync (&hu->write_work); + +/* Close protocol before freeing hdev */ hu->proto->close (hu); hdev = hu->hdev; hu->hdev =NULL ;
@@ -263,8 +271,12 @@ static int hci_uart_open(struct hci_dev/* Close device */ static int hci_uart_close (struct hci_dev *hdev) { +struct hci_uart *hu =hci_get_drvdata (hdev); +BT_DBG ("hdev %p" , hdev); +cancel_work_sync (&hu->write_work); +hci_uart_flush (hdev); hdev->flush =NULL ;return 0 ;
@@ -528,6 +540,7 @@ static void hci_uart_tty_close(struct tt {struct hci_uart *hu = tty->disc_data;struct hci_dev *hdev; +bool proto_ready;BT_DBG ("tty %p" , tty);
@@ -537,24 +550,38 @@ static void hci_uart_tty_close(struct ttif (!hu)return ; - hdev = hu->hdev; -if (hdev) -hci_uart_close (hdev); +/* Wait for init_ready to finish to prevent registration races */ +cancel_work_sync (&hu->init_ready); -if (test_bit (HCI_UART_PROTO_READY , &hu->flags)) { + proto_ready =test_bit (HCI_UART_PROTO_READY , &hu->flags); +if (proto_ready) {percpu_down_write (&hu->proto_lock);clear_bit (HCI_UART_PROTO_READY , &hu->flags);percpu_up_write (&hu->proto_lock); + } -cancel_work_sync (&hu->init_ready); -cancel_work_sync (&hu->write_work); +/* +* Unconditionally cancel write_work AFTER clearing PROTO_READY. +* This ensures that concurrent protocol timers cannot requeue +* write_work via hci_uart_tx_wakeup(), permanently preventing +* double-free races and UAFs. +*/ +cancel_work_sync (&hu->write_work); + + hdev = hu->hdev; +if (hdev) +hci_uart_close (hdev);/* proto->flush is safely skipped */ +if (proto_ready) {if (hdev) {if (test_bit (HCI_UART_REGISTERED , &hu->flags))hci_unregister_dev (hdev); -hci_free_dev (hdev); } +/* Close protocol before freeing hdev (intrinsically purges queues) */ hu->proto->close (hu); + +if (hdev) +hci_free_dev (hdev); }clear_bit (HCI_UART_PROTO_SET , &hu->flags);
@@ -622,11 +649,12 @@ static void hci_uart_tty_receive(struct* tty caller */ hu->proto->recv (hu, data, count); -percpu_up_read (&hu->proto_lock);if (hu->hdev) hu->hdev->stat.byte_rx += count; +percpu_up_read (&hu->proto_lock); +tty_unthrottle (tty); }
@@ -692,6 +720,10 @@ static int hci_uart_register_dev(structpercpu_down_write (&hu->proto_lock);clear_bit (HCI_UART_PROTO_INIT , &hu->flags);percpu_up_write (&hu->proto_lock); +/* Cancel work after clearing flags */ +cancel_work_sync (&hu->write_work); + +/* Close protocol before freeing hdev */ hu->proto->close (hu); hu->hdev =NULL ;hci_free_dev (hdev);
Greg Kroah-Hartman
maintainerPATCH 39/186 Bluetooth: MGMT: validate Add Extended Advertising Data length
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
commit d3f7d17960ed50df3a6709c5158caff989c8c905 upstream.
MGMT_OP_ADD_EXT_ADV_DATA is registered as a variable-length command, with MGMT_ADD_EXT_ADV_DATA_SIZE as the fixed header size. The handler then uses cp->adv_data_len and cp->scan_rsp_len to validate and copy cp->data, but it never checks that those bytes are part of the mgmt command payload.
A short command can therefore make add_ext_adv_data() pass an out-of-bounds pointer into tlv_data_is_valid(). If the bytes beyond the command buffer are addressable, they can also be copied into the advertising instance as scan response data, where the caller can read them back via MGMT_OP_GET_ADV_INSTANCE. The trigger requires CAP_NET_ADMIN in the initial user namespace; KASAN reports an 8-byte slab-out-of-bounds read.
Reject commands whose length does not match the fixed header plus both advertising data lengths before parsing cp->data.
--- net/bluetooth/mgmt.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/bluetooth/mgmt.c +6 -0
@@ -9140,9 +9140,15 @@ static int add_ext_adv_data(struct sockstruct adv_info *adv_instance;int err =0 ;struct mgmt_pending_cmd *cmd; +u16 expected_len;BT_DBG ("%s" , hdev->name); + expected_len =struct_size (cp, data, cp->adv_data_len + cp->scan_rsp_len); +if (expected_len != data_len) +return mgmt_cmd_status (sk, hdev->id,MGMT_OP_ADD_EXT_ADV_DATA , +MGMT_STATUS_INVALID_PARAMS ); +hci_dev_lock (hdev); adv_instance =hci_find_adv_instance (hdev, cp->instance);
Greg Kroah-Hartman
maintainerPATCH 40/186 Bluetooth: serialize accept_q access
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiexun Wang <[email protected]>
commit e83f5e24da741fa9405aeeff00b08c5ee7c37b88 upstream.
bt_sock_poll() walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last reference. The unsynchronized accept queue walk has existed since the initial Bluetooth import.
Protect accept_q with a dedicated lock for queue updates and polling. Also rework bt_accept_dequeue() to take temporary child references under the queue lock before dropping it and locking the child socket.
--- include/net/bluetooth/bluetooth.h | 1 net/bluetooth/af_bluetooth.c | 87 ++++++++++++++++++++++++++++---------- 2 files changed, 66 insertions(+), 22 deletions(-)
include/net/bluetooth/bluetooth.h +1 -0
@@ -380,6 +380,7 @@ void baswap(bdaddr_t *dst, const bdaddr_struct bt_sock {struct sock sk;struct list_head accept_q; +spinlock_t accept_q_lock;/* protects accept_q */ struct sock *parent;unsigned long flags;void (*skb_msg_name)(struct sk_buff *,void *,int *);
net/bluetooth/af_bluetooth.c +65 -22
163 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 41/186 phonet/pep: disable BH around forwarded sk_receive_skb()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijing Yin <[email protected]>
commit dbc81608e3a653dea6cf403f20cae35468b8ab9c upstream.
The networking receive path is usually run from softirq context, but protocols that take the socket lock may have packets stored in the backlog and processed later from process context. In that case release_sock() -> __release_sock() drops the slock with spin_unlock_bh() and then calls sk->sk_backlog_rcv() with bottom halves enabled.
Typical sk_backlog_rcv handlers process the socket whose backlog is being drained, so the BH state at entry is irrelevant for the slocks they touch. pep_do_rcv() is different: when the inbound skb targets an existing PEP pipe, it forwards the skb to a different *child* socket via sk_receive_skb(). That helper takes the child slock with bh_lock_sock_nested(), which is just spin_lock_nested() and assumes BH is already off. The same child slock therefore ends up acquired with BH on (process path) and with BH off (softirq path):
process context softirq context
--------------- ---------------
release_sock(listener) __netif_receive_skb()
__release_sock() phonet_rcv()
spin_unlock_bh() __sk_receive_skb(listener)
[BH now ENABLED] [BH already disabled]
sk_backlog_rcv: sk_backlog_rcv: pep_do_rcv() pep_do_rcv()
sk_receive_skb(child) sk_receive_skb(child)
bh_lock_sock_nested(child) bh_lock_sock_nested(child)
=> SOFTIRQ-ON-W => IN-SOFTIRQ-W
Lockdep flags this as inconsistent lock state, and it can become a real self-deadlock if a softirq on the same CPU tries to receive to the same child socket while its slock is held in the BH-enabled path:
WARNING: inconsistent lock state
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
(slock-AF_PHONET/1){+.?.}-{3:3}, at: __sk_receive_skb+0x1cf/0x900
__sk_receive_skb net/core/sock.c:563
sk_receive_skb include/net/sock.h:2022 [inline]
pep_do_rcv net/phonet/pep.c:675
sk_backlog_rcv include/net/sock.h:1190
__release_sock net/core/sock.c:3216
release_sock net/core/sock.c:3815
pep_sock_accept net/phonet/pep.c:879Wrap the forwarded sk_receive_skb() in local_bh_disable() / local_bh_enable() so the child slock is always acquired with BH off. local_bh_disable() nests safely on the softirq path.
Discovered via in-house syzkaller fuzzing; the same root cause also on the linux-6.1.y syzbot dashboard as extid 44f0626dd6284f02663c. Reproduced under KASAN + LOCKDEP + PROVE_LOCKING, reproducer:
https://pastebin.com/A3t8xzCR
--- net/phonet/pep.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
net/phonet/pep.c +17 -2
@@ -671,8 +671,23 @@ static int pep_do_rcv(struct sock *sk, s/* Look for an existing pipe handle */ sknode =pep_find_pipe (&pn->hlist, &dst, pipe_handle); -if (sknode) -return sk_receive_skb (sknode, skb,1 ); +if (sknode) { +int rc; + +/* pep_do_rcv() runs from two contexts: from softirq via +* phonet_rcv() -> __sk_receive_skb() with BH disabled, +* and from process context via +* release_sock() -> __release_sock(), which drops +* the listener slock with spin_unlock_bh() before draining +* the backlog. The child pipe slock is taken below via +* bh_lock_sock_nested(), which does not itself disable BH, so +* disable BH here to keep both acquire contexts consistent. +*/ +local_bh_disable (); + rc =sk_receive_skb (sknode, skb,1 ); +local_bh_enable (); +return rc; + }switch (hdr->message_id) {case PNS_PEP_CONNECT_REQ :
Greg Kroah-Hartman
maintainerPATCH 42/186 net: bcmgenet: keep RBUF EEE/PM disabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Buchwitz <[email protected]>
commit 9a1730245e416d11ad5c0f2c100061d61cc43f60 upstream.
Setting RBUF_EEE_EN | RBUF_PM_EN in RBUF_ENERGY_CTRL breaks the RX path on GENET hardware once MAC EEE becomes active. RX traffic stops flowing while the link stays up and the usual descriptor/RX error counters remain quiet. In that state the MAC still accepts frames (rbuf_ovflow_cnt keeps climbing) but RBUF no longer forwards them to DMA, so rx_packets is no longer incremented at the netdev level. On some boards the corruption ends up as a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit.
Reproduced on Pi 4B (BCM2711 + BCM54213PE) and confirmed by Florian Fainelli on an internal Broadcom 4908-family board with the same crash signature. RBUF_PM_EN is not publicly documented.
This shows up more often now that phy_support_eee() enables EEE by default, but it also affects older kernels as soon as TX LPI is turned on via ethtool, so it is not specific to recent changes.
Always clear RBUF_EEE_EN | RBUF_PM_EN in bcmgenet_eee_enable_set so the bits stay off across resets. UMAC and TBUF setup is left alone so TX-side EEE keeps working.
--- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/net/ethernet/broadcom/genet/bcmgenet.c +4 -5
@@ -1326,13 +1326,12 @@ void bcmgenet_eee_enable_set(struct net_ reg &= ~(TBUF_EEE_EN |TBUF_PM_EN );bcmgenet_writel (reg, priv->base + off); -/* Do the same for thing for RBUF */ +/* RBUF EEE/PM can break the RX path on GENET. Keep it disabled. */ reg =bcmgenet_rbuf_readl (priv,RBUF_ENERGY_CTRL ); -if (enable) - reg |=RBUF_EEE_EN |RBUF_PM_EN ; -else +if (reg & (RBUF_EEE_EN |RBUF_PM_EN )) { reg &= ~(RBUF_EEE_EN |RBUF_PM_EN ); -bcmgenet_rbuf_writel (priv, reg,RBUF_ENERGY_CTRL ); +bcmgenet_rbuf_writel (priv, reg,RBUF_ENERGY_CTRL ); + }if (!enable && priv->clk_eee_enabled) {clk_disable_unprepare (priv->clk_eee);
Greg Kroah-Hartman
maintainerPATCH 43/186 net: ifb: report ethtool stats over num_tx_queues
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
commit 5db89c99566fc4728cc92e941d8e1975711e24b5 upstream.
ifb_dev_init() allocates dp->tx_private to dev->num_tx_queues entries via kzalloc_objs(*txp, dev->num_tx_queues). Both IFB per-queue RX and TX stats live in those entries: ifb_xmit() updates txp->rx_stats using the skb queue mapping, ifb_ri_tasklet() updates txp->tx_stats, and ifb_stats64() aggregates both over dev->num_tx_queues.
The ethtool stats callbacks instead size and walk the per-queue stats with dev->real_num_rx_queues and dev->real_num_tx_queues. With an asymmetric device where the RX queue count exceeds the TX queue count, for example:
ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb ethtool -S ifb10
ifb_get_ethtool_stats() indexes past the tx_private allocation and copies adjacent slab data through ETHTOOL_GSTATS.
Use dev->num_tx_queues consistently for the stats strings, the stats count, and the stats data walks. This reports one RX stats group and one TX stats group for each backing ifb_q_private entry, which is the queue set IFB can actually populate.
Reproduced under UML+KASAN at v7.1-rc2:
BUG: KASAN: slab-out-of-bounds in ifb_fill_stats_data+0x3c/0xae Read of size 8 at addr 0000000062dbd228 by task ethtool/36 ifb_fill_stats_data+0x3c/0xae ifb_get_ethtool_stats+0xc0/0x129 __dev_ethtool+0x1ca5/0x363c dev_ethtool+0x123/0x1b3 dev_ioctl+0x56c/0x744 sock_do_ioctl+0x15f/0x1b2 sock_ioctl+0x4d5/0x50a sys_ioctl+0xd8b/0xde9
With the patch applied, the same UML+KASAN repro is silent and ethtool -S ifb10 reports only the stats backed by the single allocated tx_private entry.
--- drivers/net/ifb.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/net/ifb.c +5 -6
@@ -211,12 +211,12 @@ static void ifb_get_strings(struct net_dswitch (stringset) {case ETH_SS_STATS : -for (i =0 ; i < dev->real_num_rx_queues; i++) +for (i =0 ; i < dev->num_tx_queues; i++)for (j =0 ; j <IFB_Q_STATS_LEN ; j++)ethtool_sprintf (&p,"rx_queue_%u_%.18s" , i, ifb_q_stats_desc[j].desc); -for (i =0 ; i < dev->real_num_tx_queues; i++) +for (i =0 ; i < dev->num_tx_queues; i++)for (j =0 ; j <IFB_Q_STATS_LEN ; j++)ethtool_sprintf (&p,"tx_queue_%u_%.18s" , i, ifb_q_stats_desc[j].desc);
@@ -229,8 +229,7 @@ static int ifb_get_sset_count(struct net {switch (sset) {case ETH_SS_STATS : -return IFB_Q_STATS_LEN * (dev->real_num_rx_queues + - dev->real_num_tx_queues); +return IFB_Q_STATS_LEN * dev->num_tx_queues *2 ;default :return -EOPNOTSUPP ; }
@@ -262,12 +261,12 @@ static void ifb_get_ethtool_stats(structstruct ifb_q_private *txp;int i; -for (i =0 ; i < dev->real_num_rx_queues; i++) { +for (i =0 ; i < dev->num_tx_queues; i++) { txp = dp->tx_private + i;ifb_fill_stats_data (&data, &txp->rx_stats); } -for (i =0 ; i < dev->real_num_tx_queues; i++) { +for (i =0 ; i < dev->num_tx_queues; i++) { txp = dp->tx_private + i;ifb_fill_stats_data (&data, &txp->tx_stats); }
Greg Kroah-Hartman
maintainerPATCH 44/186 netfilter: ip6t_hbh: reject oversized option lists
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengchuan Liang <[email protected]>
commit 4322dcde6b4173c2d8e8e6118ed290794263bcc8 upstream.
struct ip6t_opts stores at most IP6T_OPTS_OPTSNR option descriptors, but hbh_mt6_check() does not reject larger optsnr values supplied from userspace.
Validate optsnr in the rule setup path so only match data that fits the fixed-size opts array can be installed. This follows the existing xtables pattern of rejecting invalid user-provided counts in checkentry() and keeps the packet matching path unchanged.
struct ip6t_opts has a fixed opts[IP6T_OPTS_OPTSNR] array, where IP6T_OPTS_OPTSNR is 16, then off-by-one array access is possible:
[ 137.924693][ T8692] UBSAN: array-index-out-of-bounds in ../net/ipv6/netfilter/ip6t_hbh.c:110:29 [ 137.926167][ T8692] index 16 is out of range for type '__u16 [16]'
--- net/ipv6/netfilter/ip6t_hbh.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ipv6/netfilter/ip6t_hbh.c +4 -0
@@ -168,6 +168,10 @@ static int hbh_mt6_check(const struct xtpr_debug ("unknown flags %X\n" , optsinfo->invflags);return -EINVAL ; } +if (optsinfo->optsnr >IP6T_OPTS_OPTSNR ) { +pr_debug ("too many supported opts specified\n" ); +return -EINVAL ; + }if (optsinfo->flags &IP6T_OPTS_NSTRICT ) {pr_debug ("Not strict - not implemented" );
Greg Kroah-Hartman
maintainerPATCH 45/186 netfilter: nf_queue: hold bridge skb->dev while queued
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoze Xie <[email protected]>
commit e196115ec330a18de415bdb9f5071aa9f08e53ce upstream.
br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queueing bridge LOCAL_IN packets. NFQUEUE only holds references on state.in/out and bridge physdevs, so a queued bridge packet can retain a freed bridge master in skb->dev until reinjection.
When the verdict is reinjected later, br_netif_receive_skb() re-enters the receive path with skb->dev still pointing at the freed bridge master, triggering a use-after-free.
Store skb->dev in the queue entry, hold a reference on it for the queue lifetime, and use the saved device when dropping queued packets during NETDEV_DOWN handling.
--- include/net/netfilter/nf_queue.h | 1 + net/netfilter/nf_queue.c | 4 +++- net/netfilter/nfnetlink_queue.c | 2 ++ 3 files changed, 6 insertions(+), 1 deletion(-)
include/net/netfilter/nf_queue.h +1 -0
@@ -12,6 +12,7 @@struct nf_queue_entry {struct list_head list;struct sk_buff *skb; +struct net_device *skb_dev;unsigned int id;unsigned int hook_index;/* index in hook_entries->hook[] */ #if IS_ENABLED (CONFIG_BRIDGE_NETFILTER )
net/netfilter/nf_queue.c +3 -1
@@ -60,6 +60,7 @@ static void nf_queue_entry_release_refs(struct nf_hook_state *state = &entry->state;/* Release those devices we held, or Alexey will kill me. */ +dev_put (entry->skb_dev);dev_put (state->in);dev_put (state->out);if (state->sk)
@@ -101,6 +102,7 @@ bool nf_queue_entry_get_refs(struct nf_qif (state->sk && !refcount_inc_not_zero (&state->sk->sk_refcnt))return false; +dev_hold (entry->skb_dev);dev_hold (state->in);dev_hold (state->out);
@@ -201,11 +203,11 @@ static int __nf_queue(struct sk_buff *sk *entry = (struct nf_queue_entry ) { .skb = skb, + .skb_dev = skb->dev, .state = *state, .hook_index = index, .size =sizeof (*entry) + route_key_size, }; -__nf_queue_entry_init_physdevs (entry);if (!nf_queue_entry_get_refs (entry)) {
net/netfilter/nfnetlink_queue.c +2 -0
@@ -972,6 +972,8 @@ dev_cmp(struct nf_queue_entry *entry, unif (physinif == ifindex || physoutif == ifindex)return 1 ;#endif +if (entry->skb_dev && entry->skb_dev->ifindex == ifindex) +return 1 ;if (entry->state.in)if (entry->state.in->ifindex == ifindex)return 1 ;
Greg Kroah-Hartman
maintainerPATCH 46/186 netfilter: ipset: stop hash:* range iteration at end
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nan Li <[email protected]>
commit 0d3a282ab5f165fc207ff49ea5b6ad8f54616bd6 upstream.
The following hash set variants:
hash:ip,mark
hash:ip,port
hash:ip,port,ip
hash:ip,port,net
iterate IPv4 ranges with a 32-bit iterator.
The iterator must stop once the last address in the requested range has been processed. Advancing it once more can move the traversal state past the end of the request, so a later retry may continue from an unintended position.
Handle the iterator increment explicitly at the end of the loop and stop once the upper bound has been processed. This keeps the existing retry behaviour intact for valid ranges while preventing traversal from continuing past the original boundary.
--- net/netfilter/ipset/ip_set_hash_ipmark.c | 6 +++++- net/netfilter/ipset/ip_set_hash_ipport.c | 5 ++++- net/netfilter/ipset/ip_set_hash_ipportip.c | 5 ++++- net/netfilter/ipset/ip_set_hash_ipportnet.c | 5 ++++- 4 files changed, 17 insertions(+), 4 deletions(-)
net/netfilter/ipset/ip_set_hash_ipmark.c +5 -1
@@ -150,7 +150,7 @@ hash_ipmark4_uadt(struct ip_set *set, stif (retried) ip =ntohl (h->next.ip); -for (; ip <= ip_to; ip++, i++) { +for (; ip <= ip_to; i++) { e.ip =htonl (ip);if (i >IPSET_MAX_RANGE ) {hash_ipmark4_data_next (&h->next, &e);
@@ -162,6 +162,10 @@ hash_ipmark4_uadt(struct ip_set *set, streturn ret; ret =0 ; + +if (ip == ip_to) +break ; + ip++; }return ret; }
net/netfilter/ipset/ip_set_hash_ipport.c +4 -1
@@ -186,7 +186,7 @@ hash_ipport4_uadt(struct ip_set *set, stif (retried) ip =ntohl (h->next.ip); -for (; ip <= ip_to; ip++) { +for (; ip <= ip_to;) { p = retried && ip ==ntohl (h->next.ip) ?ntohs (h->next.port) : port;for (; p <= port_to; p++, i++) {
@@ -203,6 +203,9 @@ hash_ipport4_uadt(struct ip_set *set, st ret =0 ; } +if (ip == ip_to) +break ; + ip++; }return ret; }
net/netfilter/ipset/ip_set_hash_ipportip.c +4 -1
@@ -182,7 +182,7 @@ hash_ipportip4_uadt(struct ip_set *set,if (retried) ip =ntohl (h->next.ip); -for (; ip <= ip_to; ip++) { +for (; ip <= ip_to;) { p = retried && ip ==ntohl (h->next.ip) ?ntohs (h->next.port) : port;for (; p <= port_to; p++, i++) {
@@ -199,6 +199,9 @@ hash_ipportip4_uadt(struct ip_set *set, ret =0 ; } +if (ip == ip_to) +break ; + ip++; }return ret; }
net/netfilter/ipset/ip_set_hash_ipportnet.c +4 -1
@@ -274,7 +274,7 @@ hash_ipportnet4_uadt(struct ip_set *set, p = port; ip2 = ip2_from; } -for (; ip <= ip_to; ip++) { +for (; ip <= ip_to;) { e.ip =htonl (ip);for (; p <= port_to; p++) { e.port =htons (p);
@@ -298,6 +298,9 @@ hash_ipportnet4_uadt(struct ip_set *set, ip2 = ip2_from; } p = port; +if (ip == ip_to) +break ; + ip++; }return ret; }
Greg Kroah-Hartman
maintainerPATCH 47/186 netfilter: nft_inner: Fix IPv6 inner_thoff desync
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <[email protected]>
commit b6a91f68ebfed9c38e0e9150f58a9b85da07181c upstream.
In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between inner_thoff (wrong — points to extension header start) and l4proto (correct — e.g., IPPROTO_TCP), enabling transport header forgery and potential firewall bypass. This issue affects stable versions from Linux 6.2.
For comparison, the normal (non-inner) IPv6 path correctly preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite ensures that ipv6_find_hdr()'s calculated transport header offset is preserved, thereby fixing the desynchronization.
--- net/netfilter/nft_inner.c | 1 - 1 file changed, 1 deletion(-)
net/netfilter/nft_inner.c +0 -1
@@ -156,7 +156,6 @@ static int nft_inner_parse_l2l3(const streturn -1 ;if (fragoff ==0 ) { - thoff = nhoff +sizeof (_ip6h); ctx->flags |=NFT_PAYLOAD_CTX_INNER_TH ; ctx->inner_thoff = thoff; ctx->l4proto = l4proto;
Greg Kroah-Hartman
maintainerPATCH 48/186 qed: fix double free in qed_cxt_tables_alloc()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <[email protected]>
commit 2bccfb8476ca5f3548afbd623dc7a6980d4e77de upstream.
If one of the later PF or VF CID bitmap allocations fails, qed_cid_map_alloc() jumps to cid_map_fail and frees the previously allocated CID bitmaps before returning an error. qed_cxt_tables_alloc() then calls qed_cxt_mngr_free(), which invokes qed_cid_map_free() again.
Fix this by setting each CID bitmap pointer to NULL after bitmap_free() to avoid double free.
The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc3.
Runtime reproduction was not attempted because exercising the failing allocation path requires device-specific setup.
--- drivers/net/ethernet/qlogic/qed/qed_cxt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/qlogic/qed/qed_cxt.c +2 -0
@@ -1038,11 +1038,13 @@ static void qed_cid_map_free(struct qed_for (type =0 ; type <MAX_CONN_TYPES ; type++) {bitmap_free (p_mngr->acquired[type].cid_map); + p_mngr->acquired[type].cid_map =NULL ; p_mngr->acquired[type].max_count =0 ; p_mngr->acquired[type].start_cid =0 ;for (vf =0 ; vf <MAX_NUM_VFS ; vf++) {bitmap_free (p_mngr->acquired_vf[type][vf].cid_map); + p_mngr->acquired_vf[type][vf].cid_map =NULL ; p_mngr->acquired_vf[type][vf].max_count =0 ; p_mngr->acquired_vf[type][vf].start_cid =0 ; }
Greg Kroah-Hartman
maintainerPATCH 49/186 ring-buffer: Fix reporting of missed events in iterator
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit a254b6d13b0edd6272926674d2afc46d46e496b7 upstream.
When tracing is active while reading the trace file, if the iterator reading the buffer detects that the writer has passed the iterator head, it will reset and set a "missed events" flag. This flag is passed to the output processing to show the user that events were missed:
CPU:4 [LOST EVENTS]
The problem is that the flag is reset after it is checked in ring_buffer_iter_dropped(). But the "trace" file iterates over all the CPU ring buffers and it will check if they are dropped when figuring out which buffer to print next. This prematurely clears the missed_events flag if the CPU buffer with the missed events is not the one that is printed next.
On the iteration where the CPU buffer with the missed events is printed, the check if it had missed events would return false and the output does not show that events were missed.
Do not reset the missed_events flag when checking if there were missed events, but instead clear it when moving the iterator head to the next event.
--- kernel/trace/ring_buffer.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
kernel/trace/ring_buffer.c +3 -5
@@ -4392,6 +4392,7 @@ static void rb_iter_reset(struct ring_bu iter->head_page = cpu_buffer->reader_page; iter->head = cpu_buffer->reader_page->read; iter->next_event = iter->head; + iter->missed_events =0 ; iter->cache_reader_page = iter->head_page; iter->cache_read = cpu_buffer->read;
@@ -5002,10 +5003,7 @@ ring_buffer_peek(struct trace_buffer *bu*/ bool ring_buffer_iter_dropped (struct ring_buffer_iter *iter) { -bool ret = iter->missed_events !=0 ; - - iter->missed_events =0 ; -return ret; +return iter->missed_events !=0 ; }EXPORT_SYMBOL_GPL (ring_buffer_iter_dropped);
@@ -5222,7 +5220,7 @@ void ring_buffer_iter_advance(struct rinunsigned long flags;raw_spin_lock_irqsave (&cpu_buffer->reader_lock, flags); - + iter->missed_events =0 ;rb_advance_iter (iter);raw_spin_unlock_irqrestore (&cpu_buffer->reader_lock, flags);
Greg Kroah-Hartman
maintainerPATCH 50/186 vsock/vmci: fix UAF when peer resets connection during handshake
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minh Nguyen <[email protected]>
commit 99e22ddf4edb63dc8382bc028af928056d3450cf upstream.
vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm:
err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL;
That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state = TCP_CLOSE while destroy: still dropped the explicit reference taken before schedule_delayed_work().
One second later vsock_pending_work() observed is_pending=true and performed full cleanup: vsock_remove_pending() then the two trailing sock_put(sk) calls -- the first reached refcount 0 and __sk_freed the socket, and the second wrote into the freed object:
BUG: KASAN: slab-use-after-free in refcount_warn_saturate Write of size 4 at addr ffff88800b1cac80 by task kworker Workqueue: events vsock_pending_work
Treat peer RST like any other unexpected packet type (err = -EINVAL). All destroy: arms now return err < 0, so vmci_transport_recv_listen() removes pending from pending_links synchronously and vsock_pending_work() takes the is_pending=false / !rejected branch, dropping only its own work reference. This also closes the multi-packet race Sashiko reported on v2: pending is removed from the list before any subsequent packet can find it.
The pre-existing sk_acceptq_removed() gap on the err < 0 path of vmci_transport_recv_listen() that Sashiko also noted is not introduced or changed by this patch.
Tested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.
--- net/vmw_vsock/vmci_transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/vmw_vsock/vmci_transport.c +1 -1
@@ -1156,7 +1156,7 @@ vmci_transport_recv_connecting_server(st/* Close and cleanup the connection. */ vmci_transport_send_reset (pending, pkt); skerr =EPROTO ; - err = pkt->type ==VMCI_TRANSPORT_PACKET_TYPE_RST ?0 : -EINVAL ; + err = -EINVAL ; goto destroy; }
Greg Kroah-Hartman
maintainerPATCH 51/186 vsock/virtio: reset connection on receiving queue overflow
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Garzarella <[email protected]>
commit a4f0b001782b21663d10df983b4b208195bec66c upstream.
When there is no more space to queue an incoming packet, the packet is silently dropped. This causes data loss without any notification to either peer, since there is no retransmission.
Under normal circumstances, this should never happen. However, it could happen if the other peer doesn't respect the credit, or if the skb overhead, which we recently began to take into account with commit 059b7dbd20a6 ("vsock/virtio: fix potential unbounded skb queue"), is too high.
Fix this by resetting the connection and setting the local socket error to ENOBUFS when virtio_transport_recv_enqueue() can no longer queue a packet, so both peers are explicitly notified of the failure rather than silently losing data.
--- net/vmw_vsock/virtio_transport_common.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
net/vmw_vsock/virtio_transport_common.c +15 -5
@@ -1157,7 +1157,7 @@ destroy:return err; } -static void +static bool virtio_transport_recv_enqueue (struct vsock_sock *vsk,struct sk_buff *skb) {
@@ -1172,10 +1172,8 @@ virtio_transport_recv_enqueue(struct vsospin_lock_bh (&vvs->rx_lock); can_enqueue =virtio_transport_inc_rx_pkt (vvs, len); -if (!can_enqueue) { - free_pkt = true; +if (!can_enqueue) goto out; - }if (le32_to_cpu (hdr->flags) &VIRTIO_VSOCK_SEQ_EOM ) vvs->msg_count++;
@@ -1213,6 +1211,8 @@ out:spin_unlock_bh (&vvs->rx_lock);if (free_pkt)kfree_skb (skb); + +return can_enqueue; } static int
@@ -1225,7 +1225,17 @@ virtio_transport_recv_connected(struct sswitch (le16_to_cpu (hdr->op)) {case VIRTIO_VSOCK_OP_RW : -virtio_transport_recv_enqueue (vsk, skb); +if (!virtio_transport_recv_enqueue (vsk, skb)) { +/* There is no more space to queue the packet, so let's +* close the connection; otherwise, we'll lose data. +*/ + (void )virtio_transport_reset (vsk, skb); +virtio_transport_do_close (vsk, true); + sk->sk_err =ENOBUFS ; +sk_error_report (sk); +vsock_remove_sock (vsk); +break ; + }vsock_data_ready (sk);return err;case VIRTIO_VSOCK_OP_CREDIT_REQUEST :
Greg Kroah-Hartman
maintainerPATCH 52/186 wifi: ath11k: clear shared SRNG pointer state on restart
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Farnung <[email protected]>
commit f51e4b3b5574ad8cb5b16b11f8a1452147ece87a upstream.
LMAC rings reuse the shared rdp/wrp pointer buffers without going through the normal SRNG hw-init path that zeros non-LMAC ring pointers. After restart, ath11k_hal_srng_clear() can therefore hand stale hp/tp state from the previous firmware instance back to the new one.
Clear the shared pointer buffers while keeping the allocations in place so restart still avoids reallocating SRNG DMA memory, but starts with fresh ring-pointer state.
--- drivers/net/wireless/ath/ath11k/hal.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath11k/hal.c +11 -3
@@ -1372,14 +1372,22 @@ EXPORT_SYMBOL(ath11k_hal_srng_deinit);void ath11k_hal_srng_clear (struct ath11k_base *ab) { -/* No need to memset rdp and wrp memory since each individual -* segment would get cleared in ath11k_hal_srng_src_hw_init() -* and ath11k_hal_srng_dst_hw_init(). +/* +* Preserve the shared pointer buffers, but clear the previous +* firmware instance's hp/tp state before handing them back to FW. +* LMAC rings reuse this shared memory without going through the +* normal SRNG hw-init path that zeros non-LMAC ring pointers. */ memset (ab->hal.srng_list,0 ,sizeof (ab->hal.srng_list));memset (ab->hal.shadow_reg_addr,0 ,sizeof (ab->hal.shadow_reg_addr)); +if (ab->hal.rdp.vaddr) +memset (ab->hal.rdp.vaddr,0 , +sizeof (*ab->hal.rdp.vaddr) *HAL_SRNG_RING_ID_MAX ); +if (ab->hal.wrp.vaddr) +memset (ab->hal.wrp.vaddr,0 , +sizeof (*ab->hal.wrp.vaddr) *HAL_SRNG_NUM_LMAC_RINGS ); ab->hal.avail_blk_resource =0 ; ab->hal.current_blk_index =0 ; ab->hal.num_shadow_reg_configured =0 ;
Greg Kroah-Hartman
maintainerPATCH 53/186 ipv4: raw: reject IP_HDRINCL packets with ihl < 5
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
commit 915fab69823a14c170dbaa3b41978768e0fe62fc upstream.
raw_send_hdrinc() validates that the caller-supplied IPv4 header fits within the message length:
iphlen = iph->ihl * 4;
err = -EINVAL;
if (iphlen > length)
goto error_free;
if (iphlen >= sizeof(*iph)) {
/* fix up saddr, tot_len, id, csum, transport_header */
}It does not, however, reject ihl < 5. For such a packet the "if (iphlen >= sizeof(*iph))" branch is skipped, leaving the crafted iphdr untouched, but the packet is still handed to __ip_local_out() and onward. Downstream consumers that read iph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in particular subtracts sizeof(struct iphdr) from top_iph->ihl * 4 and passes the (signed-int-negative, then cast to size_t) result to memcpy(), producing an OOB access of length close to SIZE_MAX and a host kernel panic.
An IPv4 header with ihl < 5 is malformed by definition (RFC 791:
"Internet Header Length is the length of the internet header in 32 bit words ... Note that the minimum value for a correct header is 5."). The kernel should not be willing to inject such a packet into its own output path.
Reject "iphlen < sizeof(*iph)" alongside the existing "iphlen > length" check. This matches the principle that locally constructed packets that re-enter the IP stack must pass the same basic sanity tests that a foreign packet would be subjected to.
Once this lands, the "if (iphlen >= sizeof(*iph))" wrapper around the fixup branch becomes redundant; left in place to keep the patch minimal and backport-friendly. A follow-up can unwrap it.
Note that commit 86f4c90a1c5c ("ipv4, ipv6: ensure raw socket message is big enough to hold an IP header") ensures the message buffer is large enough to hold an iphdr, but does not constrain the self-reported iph->ihl.
Reachability: the malformed packet source is any caller with CAP_NET_RAW, including an unprivileged process in a user+net namespace on a kernel with CONFIG_USER_NS=y. The reproduced AH crash also requires a matching xfrm AH policy on the outgoing route; a container granted CAP_NET_ADMIN can install that state and policy in its netns. Loopback bypasses xfrm_output, so the trigger uses a real netdev.
Reproduced on UML + KASAN: kernel-mode fault at addr 0x0 with memcpy_orig at the crash site. Same shape reproduces inside a rootless Docker container with --cap-add NET_ADMIN on a stock distro kernel.
--- net/ipv4/raw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/raw.c +1 -1
@@ -383,7 +383,7 @@ static int raw_send_hdrinc(struct sock ** in, reject the frame as invalid */ err = -EINVAL ; -if (iphlen > length) +if (iphlen > length || iphlen <sizeof (*iph)) goto error_free;if (iphlen >=sizeof (*iph)) {
Greg Kroah-Hartman
maintainerPATCH 54/186 ixgbevf: fix use-after-free in VEPA multicast source pruning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
commit 5d49b568c188dc77199d8d2b959c91da8cc27cf1 upstream.
ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to the next descriptor:
dev_kfree_skb_irq(skb);
continue;The skb pointer is declared outside the while loop and persists across iterations. Because the continue skips the "skb = NULL" reset at the bottom of the loop, the next iteration enters the "else if (skb)" path and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context.
The sibling driver iavf already handles this correctly by nulling the pointer before continuing. Apply the same pattern here.
I do not have ixgbevf hardware; the bug was found by static analysis (scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool corroboration with the highest score in the scan). The UAF was confirmed under KASAN by loading a test module that reproduces the exact code pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):
BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000 Read of size 8 at addr 000000006163ae78 by task insmod/30 freed 208-byte region [000000006163adc0, 000000006163ae90)
QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF driver does not include the VEPA source pruning path, so a full end-to-end reproduction with emulated hardware was not possible.
--- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +1 -0
@@ -1225,6 +1225,7 @@ static int ixgbevf_clean_rx_irq(struct i ether_addr_equal(rx_ring->netdev->dev_addr, eth_hdr(skb)->h_source)) {dev_kfree_skb_irq (skb); + skb =NULL ;continue ; }
Greg Kroah-Hartman
maintainerPATCH 55/186 ice: fix setting promisc mode while adding VID filter
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcin Szycik <[email protected]>
commit ebc8de716c9ec2be384abdc2dd866da26c6580d1 upstream.
There are at least two paths through which VSI promiscuous mode can be independently configured via ice_fltr_set_vsi_promisc():
- ice_vlan_rx_add_vid() (netdev op)
- ice_service_task() -> ... -> ice_set_promisc()
Both paths may try to program promiscuous mode concurrently. One such scenario is:
1. Add ice netdev to bond
2. Add the bond netdev to bridge
3. ice netdev enters allmulticast mode (IFF_ALLMULTI)
4. Service task programs promisc mode filter
5. Bridge -> bond calls ice_vlan_rx_add_vid()
Crucially, ice_vlan_rx_add_vid() fails if ice_fltr_set_vsi_promisc() returns any error, including -EEXIST. This causes VLAN filtering setup to fail on the bond interface. ice_set_promisc() already handles -EEXIST correctly.
Fix by adding the same -EEXIST check to ice_vlan_rx_add_vid(): if the promisc filter is already programmed, continue without returning error.
--- drivers/net/ethernet/intel/ice/ice_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_main.c +1 -1
@@ -3646,7 +3646,7 @@ ice_vlan_rx_add_vid(struct net_device *n ret =ice_fltr_set_vsi_promisc (&vsi->back->hw, vsi->idx,ICE_MCAST_VLAN_PROMISC_BITS , vid); -if (ret) +if (ret && ret != -EEXIST ) goto finish; }
Greg Kroah-Hartman
maintainerPATCH 56/186 wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Walker <[email protected]>
commit 7666dbb1bacc4ba522b96740cba7283d243d16e1 upstream.
cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls
cfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem)
but never advances mbssid_elem or sub_elem inside the body. Each iteration therefore searches for a continuation that follows the same fixed pair; the helper returns the same next_mbssid; and the same next_sub bytes are memcpy()'d into merged_ie at a growing offset until the buffer fills.
Advance both mbssid_elem and sub_elem to the just-consumed continuation so the next call to cfg80211_get_profile_continuation() searches for a further continuation beyond it (or returns NULL when none exists).
A specially-crafted malicious beacon can take advantage of this bug to cause the kernel to spend an excessive amount of time in cfg80211_merge_profile (up to as much as 2ms per beacon received), which could theoretically be abused in some way.
--- net/wireless/scan.c | 3 +++ 1 file changed, 3 insertions(+)
net/wireless/scan.c +3 -0
@@ -2300,6 +2300,9 @@ size_t cfg80211_merge_profile(const u8 *memcpy (merged_ie + copied_len, next_sub->data, next_sub->datalen); copied_len += next_sub->datalen; + + mbssid_elem = next_mbssid; + sub_elem = next_sub; }return copied_len;
Greg Kroah-Hartman
maintainerPATCH 57/186 cifs: Fix busy dentry used after unmounting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhihao Cheng <[email protected]>
commit c68337442f03953237a94577beb468ab2662a851 upstream.
Since commit 340cea84f691c ("cifs: open files should not hold ref on superblock"), cifs file only holds the dentry ref_cnt, the cifs file close work(cfile->deferred) could be executed after unmounting, which will trigger a warning in generic_shutdown_super:
BUG: Dentry 00000000a14a6845{i=c,n=file} still in use (1) [unmount of
cifs cifs]The detailed processs is:
process A process B kworker
fd = open(PATH)
vfs_open
file->__f_path = *path // dentry->d_lockref.count = 1 cifs_open
cifs_new_fileinfo
cfile->dentry = dget(dentry) // dentry->d_lockref.count = 2
close(fd)
__fput
cifs_close
queue_delayed_work(deferredclose_wq, cfile->deferred)
dput(dentry) // dentry->d_lockref.count = 1
smb2_deferred_work_close
_cifsFileInfo_put
list_del(&cifs_file->flist)
umount
cleanup_mnt
deactivate_super
cifs_kill_sb
cifs_close_all_deferred_files_sb
cifs_close_all_deferred_files
// cannot find cfile, skip _cifsFileInfo_put
kill_anon_super
generic_shutdown_super
shrink_dcache_for_umount
umount_check
WARN ! // dentry->d_lockref.count = 1
cifsFileInfo_put_final
dput(cifs_file->dentry)
// dentry->d_lockref.count = 0Fix it by flushing 'deferredclose_wq' before calling kill_anon_super.
Fetch a reproducer in https://bugzilla.kernel.org/show_bug.cgi?id=221548.
--- fs/smb/client/cifsfs.c | 2 ++ 1 file changed, 2 insertions(+)
fs/smb/client/cifsfs.c +2 -0
@@ -298,6 +298,8 @@ static void cifs_kill_sb(struct super_bl/* Wait for all pending oplock breaks to complete */ flush_workqueue (cifsoplockd_wq); +/* Wait for all opened files to release */ +flush_workqueue (deferredclose_wq);/* finally release root dentry */ dput (cifs_sb->root);
Greg Kroah-Hartman
maintainerPATCH 58/186 tracing: Do not call map->ops->elt_free() if elt_alloc() fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
commit 8f0f5c4fb9df0e19a341e0c6ed8dc4fda9124f03 upstream.
In paths where tracing_map_elt_alloc() failed to allocate objects, the map->ops->elt_alloc() call was never successful. In this case, map->ops->elt_free() should not be called.
--- kernel/trace/tracing_map.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
kernel/trace/tracing_map.c +13 -4
@@ -386,13 +386,11 @@ static void tracing_map_elt_init_fields( } } -static void tracing_map_elt_free (struct tracing_map_elt *elt) +static void __tracing_map_elt_free (struct tracing_map_elt *elt) {if (!elt)return ; -if (elt->map->ops && elt->map->ops->elt_free) - elt->map->ops->elt_free (elt);kfree (elt->fields);kfree (elt->vars);kfree (elt->var_set);
@@ -400,6 +398,17 @@ static void tracing_map_elt_free(structkfree (elt); } +static void tracing_map_elt_free (struct tracing_map_elt *elt) +{ +if (!elt) +return ; + +/* Only objects initialized with alloc_elt() should be passed to free_elt().*/ +if (elt->map->ops && elt->map->ops->elt_free) + elt->map->ops->elt_free (elt); +__tracing_map_elt_free (elt); +} +static struct tracing_map_elt *tracing_map_elt_alloc (struct tracing_map *map) {struct tracing_map_elt *elt;
@@ -444,7 +453,7 @@ static struct tracing_map_elt *tracing_m }return elt; free: -tracing_map_elt_free (elt); +__tracing_map_elt_free (elt);return ERR_PTR (err); }
Greg Kroah-Hartman
maintainerPATCH 59/186 arm64: probes: Handle probes on hinted conditional branch instructions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Murzin <[email protected]>
commit 2ccd8ff980b50e842481bae71102fa3883fc4377 upstream.
BC.cond instructions introduced by FEAT_HBC cannot be executed out-of-line, like other branch instructions. However, they can be simulated in the same way as B.cond instructions.
Extend the B.cond decoder mask to match BC.cond instructions as well, and handle them using the existing B.cond simulation path.
--- arch/arm64/include/asm/insn.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/include/asm/insn.h +1 -1
@@ -399,7 +399,7 @@ __AARCH64_INSN_FUNCS(cbz, 0x7F000000, 0x __AARCH64_INSN_FUNCS(cbnz, 0x7F000000, 0x35000000) __AARCH64_INSN_FUNCS(tbz, 0x7F000000, 0x36000000) __AARCH64_INSN_FUNCS(tbnz, 0x7F000000, 0x37000000) -__AARCH64_INSN_FUNCS(bcond, 0xFF000010, 0x54000000) +__AARCH64_INSN_FUNCS(bcond, 0xFF000000, 0x54000000) __AARCH64_INSN_FUNCS(svc, 0xFFE0001F, 0xD4000001) __AARCH64_INSN_FUNCS(hvc, 0xFFE0001F, 0xD4000002)__AARCH64_INSN_FUNCS (smc,0xFFE0001F ,0xD4000003 )
Greg Kroah-Hartman
maintainerPATCH 60/186 KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
commit 9ce754ed8e7ab4e3999767ce1505f85c449ccb07 upstream.
Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that state, but vgic_its_restore_dte() accepts it and stores the out-of-range value in dev->num_eventid_bits.
Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before allocating the device. This mirrors the MAPD check and prevents the restored state from reaching vgic_its_restore_itt(), where the unchecked value can be converted into an oversized scan_its_table() range.
--- arch/arm64/kvm/vgic/vgic-its.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/kvm/vgic/vgic-its.c +4 -0
@@ -2413,6 +2413,10 @@ static int vgic_its_restore_dte(struct v/* dte entry is valid */ offset = (entry &KVM_ITS_DTE_NEXT_MASK ) >>KVM_ITS_DTE_NEXT_SHIFT ; +/* Mimic the MAPD behaviour and reject invalid EID bits. */ +if (num_eventid_bits >VITS_TYPER_IDBITS ) +return -EINVAL ; +if (!vgic_its_check_id (its, baser, id,NULL ))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 61/186 drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Osama Abdelkader <[email protected]>
commit 73d01051e8040c0b1de7fd26b3b8d0c2ffa6895c upstream.
Use devm_drm_bridge_add() so the bridge is released if probe fails after registration, and drop drm_bridge_remove() in chipone_i2c_probe.
--- drivers/gpu/drm/bridge/chipone-icn6211.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/bridge/chipone-icn6211.c +3 -1
@@ -757,7 +757,9 @@ static int chipone_i2c_probe(struct i2c_dev_set_drvdata (dev, icn);i2c_set_clientdata (client, icn); -drm_bridge_add (&icn->bridge); + ret =devm_drm_bridge_add (dev, &icn->bridge); +if (ret) +return ret;return chipone_dsi_host_attach (icn); }
Greg Kroah-Hartman
maintainerPATCH 62/186 spi: qup: fix error pointer deref after DMA setup failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit a7e8f3efd50a165ba0189f6dc57f7e51a7d149db upstream.
The driver falls back to PIO mode if DMA setup fails during probe.
Make sure to the clear the DMA channel pointers on setup failure to avoid dereferencing an error pointer (or attempting to release a channel a second time) on later probe errors or driver unbind.
This issue was flagged by Sashiko when reviewing a devres allocation conversion patch.
--- drivers/spi/spi-qup.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/spi/spi-qup.c +3 -0
@@ -967,8 +967,11 @@ static int spi_qup_init_dma(struct spi_c err:dma_release_channel (host->dma_tx); + host->dma_tx =NULL ; err_tx:dma_release_channel (host->dma_rx); + host->dma_rx =NULL ; +return ret; }
Greg Kroah-Hartman
maintainerPATCH 63/186 phy: tegra: xusb: Fix per-pad high-speed termination calibration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Chang <[email protected]>
commit da110228b54f2e2143d97ea7151e0dc22e539d67 upstream.
The existing code reads a single hs_term_range_adj value from bit field [10:7] of FUSE_SKU_CALIB_0 and applies it to all USB2 pads uniformly. However, on SoCs that support per-pad termination, each pad has its own hs_term_range_adj field: pad 0 in FUSE_SKU_CALIB_0[10:7], and pads 1-3 in FUSE_USB_CALIB_EXT_0 at bit offsets [8:5], [12:9], and [16:13] respectively.
Fix the calibration by reading per-pad values from the appropriate fuse registers. For SoCs that do not support per-pad termination, replicate pad 0's value to all pads to maintain existing behavior.
Add a has_per_pad_term flag to the SoC data to indicate whether per-pad termination values are available in FUSE_USB_CALIB_EXT_0.
--- drivers/phy/tegra/xusb-tegra186.c | 33 ++++++++++++++++++++++++++------- drivers/phy/tegra/xusb.h | 1 + 2 files changed, 27 insertions(+), 7 deletions(-)
drivers/phy/tegra/xusb-tegra186.c +26 -7
@@ -20,8 +20,8 @@/* FUSE USB_CALIB registers */ #define HS_CURR_LEVEL_PADX_SHIFT (x) ((x) ? (11 + (x - 1) * 6) : 0)#define HS_CURR_LEVEL_PAD_MASK 0x3f -#define HS_TERM_RANGE_ADJ_SHIFT 7 -#define HS_TERM_RANGE_ADJ_MASK 0xf +#define HS_TERM_RANGE_ADJ_PADX_SHIFT (x) ((x) ? (5 + (x - 1) * 4) : 7) +#define HS_TERM_RANGE_ADJ_PAD_MASK 0xf#define HS_SQUELCH_SHIFT 29#define HS_SQUELCH_MASK 0x7
@@ -253,7 +253,7 @@struct tegra_xusb_fuse_calibration {u32 *hs_curr_level;u32 hs_squelch; -u32 hs_term_range_adj; +u32 *hs_term_range_adj;u32 rpd_ctrl; };
@@ -930,7 +930,7 @@ static int tegra186_utmi_phy_power_on(st value =padctl_readl (padctl,XUSB_PADCTL_USB2_OTG_PADX_CTL1 (index)); value &= ~TERM_RANGE_ADJ (~0 ); - value |=TERM_RANGE_ADJ (priv->calib.hs_term_range_adj); + value |=TERM_RANGE_ADJ (priv->calib.hs_term_range_adj[index]); value &= ~RPD_CTRL (~0 ); value |=RPD_CTRL (priv->calib.rpd_ctrl);padctl_writel (padctl, value,XUSB_PADCTL_USB2_OTG_PADX_CTL1 (index));
@@ -1464,17 +1464,23 @@ static const char * const tegra186_usb3_static int tegra186_xusb_read_fuse_calibration (struct tegra186_xusb_padctl *padctl) { +const struct tegra_xusb_padctl_soc *soc = padctl->base.soc;struct device *dev = padctl->base.dev;unsigned int i, count;u32 value, *level; +u32 *hs_term_range_adj;int err; - count = padctl->base.soc->ports.usb2.count; + count = soc->ports.usb2.count; level =devm_kcalloc (dev, count,sizeof (u32),GFP_KERNEL );if (!level)return -ENOMEM ; + hs_term_range_adj =devm_kcalloc (dev, count,sizeof (u32),GFP_KERNEL ); +if (!hs_term_range_adj) +return -ENOMEM ; + err =tegra_fuse_readl (TEGRA_FUSE_SKU_CALIB_0 , &value);if (err) return dev_err_probe(dev, err,
@@ -1490,8 +1496,8 @@ tegra186_xusb_read_fuse_calibration(stru padctl->calib.hs_squelch = (value >>HS_SQUELCH_SHIFT ) &HS_SQUELCH_MASK ; - padctl->calib.hs_term_range_adj = (value >>HS_TERM_RANGE_ADJ_SHIFT ) & -HS_TERM_RANGE_ADJ_MASK ; + hs_term_range_adj[0 ] = (value >>HS_TERM_RANGE_ADJ_PADX_SHIFT (0 )) & +HS_TERM_RANGE_ADJ_PAD_MASK ; err =tegra_fuse_readl (TEGRA_FUSE_USB_CALIB_EXT_0 , &value);if (err) {
@@ -1503,6 +1509,17 @@ tegra186_xusb_read_fuse_calibration(stru padctl->calib.rpd_ctrl = (value >>RPD_CTRL_SHIFT ) &RPD_CTRL_MASK ; +for (i =1 ; i < count; i++) { +if (soc->has_per_pad_term) + hs_term_range_adj[i] = + (value >>HS_TERM_RANGE_ADJ_PADX_SHIFT (i)) & +HS_TERM_RANGE_ADJ_PAD_MASK ; +else + hs_term_range_adj[i] = hs_term_range_adj[0 ]; + } + + padctl->calib.hs_term_range_adj = hs_term_range_adj; +return 0 ; }
@@ -1708,6 +1725,7 @@ const struct tegra_xusb_padctl_soc tegra .num_supplies = ARRAY_SIZE(tegra194_xusb_padctl_supply_names), .supports_gen2 = true, .poll_trk_completed = true, + .has_per_pad_term = true, };EXPORT_SYMBOL_GPL (tegra194_xusb_padctl_soc);
@@ -1732,6 +1750,7 @@ const struct tegra_xusb_padctl_soc tegra .trk_hw_mode = false, .trk_update_on_idle = true, .supports_lp_cfg_en = true, + .has_per_pad_term = true, };EXPORT_SYMBOL_GPL (tegra234_xusb_padctl_soc);#endif
drivers/phy/tegra/xusb.h +1 -0
@@ -436,6 +436,7 @@ struct tegra_xusb_padctl_soc {bool trk_hw_mode;bool trk_update_on_idle;bool supports_lp_cfg_en; +bool has_per_pad_term; };struct tegra_xusb_padctl {
Greg Kroah-Hartman
maintainerPATCH 64/186 scsi: isci: Fix use-after-free in device removal path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
commit b52a8d52c3125ec9a93106ed816582368de34426 upstream.
The ISCI completion tasklet is initialized in isci_host_alloc() (drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy interrupt handlers (drivers/scsi/isci/host.c:223,613).
isci_host_deinit() stops the controller and waits for stop completion, but it never kills completion_tasklet before teardown continues. A top-of-function tasklet_kill() is not sufficient here: interrupts are only disabled when isci_host_stop_complete() runs, so until wait_for_stop() returns the IRQ handlers can still requeue the tasklet. The tasklet callback also re-enables interrupts after draining completions, so killing the tasklet before the source is quiesced leaves the same race open.
Once wait_for_stop() returns, no further IRQ-driven scheduling can occur. Kill completion_tasklet there so teardown cannot race a queued tasklet running on a dead ihost. On remove or unload, the stale callback can otherwise dereference ihost and touch ihost->smu_registers after the host lifetime ends.
A UML + KASAN analogue reproduced the failure class both with no tasklet_kill() and with tasklet_kill() placed before source quiesce, and stayed clean once the kill happened after quiescing the scheduling source.
This mirrors commit f6ab594672d4 ("scsi: aic94xx: fix use-after-free in device removal path"), but ISCI needs the kill after wait_for_stop().
--- drivers/scsi/isci/host.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/scsi/isci/host.c +3 -0
@@ -1252,6 +1252,9 @@ void isci_host_deinit(struct isci_host *wait_for_stop (ihost); +/* No further IRQ-driven scheduling can happen past wait_for_stop(). */ +tasklet_kill (&ihost->completion_tasklet); +/* phy stop is after controller stop to allow port and device to * go idle before shutting down the phys, but the expectation is * that i/o has been shut off well before we reach this
Greg Kroah-Hartman
maintainerPATCH 65/186 spi: sprd: fix error pointer deref after DMA setup failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 3d67fffb74267772d461c02c67f1eff893ad547d upstream.
The driver falls back to PIO mode if DMA setup fails during probe.
Make sure to check the dma.enabled flag before trying to release the DMA channels also on late probe errors to avoid dereferencing an error pointer (or attempting to release a channel a second time).
This issue was flagged by Sashiko when reviewing a devres allocation conversion patch.
--- drivers/spi/spi-sprd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/spi/spi-sprd.c +2 -1
@@ -993,7 +993,8 @@ err_rpm_put: disable_clk:clk_disable_unprepare (ss->clk); release_dma: -sprd_spi_dma_release (ss); +if (ss->dma.enable) +sprd_spi_dma_release (ss); free_controller:spi_controller_put (sctlr);
Greg Kroah-Hartman
maintainerPATCH 66/186 spi: ti-qspi: fix use-after-free after DMA setup failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit ea6ec3343e05f7937a53eb6d7617b3abdb4abc19 upstream.
The driver falls back to PIO mode if DMA setup fails during probe.
Make sure to clear the DMA channel pointer also if buffer allocation fails to avoid passing a pointer to the released channel to the DMA engine (or trying to free the channel a second time on late probe errors or driver unbind).
This issue was flagged by Sashiko when reviewing a devres allocation conversion patch.
--- drivers/spi/spi-ti-qspi.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-ti-qspi.c +1 -0
@@ -874,6 +874,7 @@ static int ti_qspi_probe(struct platformdev_err (qspi->dev,"dma_alloc_coherent failed, using PIO mode\n" );dma_release_channel (qspi->rx_chan); + qspi->rx_chan =NULL ; goto no_dma; } host->dma_rx = qspi->rx_chan;
Greg Kroah-Hartman
maintainerPATCH 67/186 RDMA/siw: Reject MPA FPDU length underflow before signed receive math
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
commit 0ce1bc9e46ecabe84772bb561e373c0d9876d6f2 upstream.
A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length.
siw_tcp_rx_data() then derives
srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd
+ MPA_HDR_SIZE;
where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below hdr_len - MPA_HDR_SIZE underflows to a negative int.
The signed value then flows into siw_proc_write()/siw_proc_rresp() as
bytes = min(srx->fpdu_part_rem, srx->skb_new);
is handed to siw_check_mem() as an int len (whose interval check addr + len > mem->va + mem->len is satisfied for a valid base when len is negative), and reaches siw_rx_data() -> siw_rx_kva() / siw_rx_umem() -> skb_copy_bits() as a signed copy length. The header copy branch in skb_copy_bits() promotes that to size_t, producing a multi-gigabyte read.
KASAN under a KUnit harness that drives the real kernel TCP receive path -- a loopback AF_INET socketpair, the malformed FPDU written via kernel_sendmsg, sk_data_ready firing in softirq, tcp_read_sock dispatching to siw_tcp_rx_data -- reports:
BUG: KASAN: use-after-free in skb_copy_bits+0x284/0x480
Read of size 4294967295 at addr ffff888...
Call Trace:
skb_copy_bits
siw_rx_kva
siw_rx_data
siw_check_mem
siw_proc_write
siw_tcp_rx_data
__tcp_read_sock
siw_qp_llp_data_ready
tcp_data_ready
tcp_data_queueAdd the missing invariant at the earliest point where the peer header is fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly the value the siw transmitter uses as the minimum mpa_len for each opcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this matches the protocol contract. Out-of-range FPDUs terminate the connection with TERM_ERROR_LAYER_LLP / LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which is RFC 5044 Section 8 error code 3 ("Marker and ULPDU Length fields do not agree on the start of an FPDU"), the correct framing-error class for this inconsistency.
--- drivers/infiniband/sw/siw/siw_qp_rx.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/infiniband/sw/siw/siw_qp_rx.c +15 -0
@@ -1102,6 +1102,21 @@ static int siw_get_hdr(struct siw_rx_str }/* +* Peer-controlled mpa_len must not underflow srx->fpdu_part_rem +* in siw_tcp_rx_data(); a negative value flows as a signed copy +* length into siw_check_mem() and skb_copy_bits(). +*/ +if (unlikely (be16_to_cpu (c_hdr->mpa_len) +MPA_HDR_SIZE < + iwarp_pktinfo[opcode].hdr_len)) { +pr_warn_ratelimited ("siw: short mpa_len %u for opcode %u (hdr_len %u)\n" , +be16_to_cpu (c_hdr->mpa_len), opcode, + iwarp_pktinfo[opcode].hdr_len); +siw_init_terminate (rx_qp (srx),TERM_ERROR_LAYER_LLP , +LLP_ETYPE_MPA ,LLP_ECODE_FPDU_START ,0 ); +return -EINVAL ; + } + +/* * DDP/RDMAP header receive completed. Check if the current * DDP segment starts a new RDMAP message or continues a previously * started RDMAP message.
Greg Kroah-Hartman
maintainerPATCH 68/186 LoongArch: Remove unused code to avoid build warning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 0ccc9d47cf020994097ff51827cebd04aa2b0bf4 upstream.
After commit feee6b2989165631b1 ("mm/memory_hotplug: shrink zones when offlining memory"), __remove_pages() doesn't need the "zone" parameter so the "page" variable is also unused. Remove the unused code to avoid such build warning:
arch/loongarch/mm/init.c: In function 'arch_remove_memory':arch/loongarch/mm/init.c:134:22: warning: variable 'page' set but not used [-Wunused-but-set-variable=]
134 | struct page *page = pfn_to_page(start_pfn);
--- arch/loongarch/mm/init.c | 4 ---- 1 file changed, 4 deletions(-)
arch/loongarch/mm/init.c +0 -4
@@ -106,11 +106,7 @@ void arch_remove_memory(u64 start, u64 s {unsigned long start_pfn = start >>PAGE_SHIFT ;unsigned long nr_pages = size >>PAGE_SHIFT ; -struct page *page =pfn_to_page (start_pfn); -/* With altmap the first mapped page is offset from @start */ -if (altmap) - page +=vmem_altmap_offset (altmap);__remove_pages (start_pfn, nr_pages, altmap); }
Greg Kroah-Hartman
maintainerPATCH 69/186 device property: set fwnode->secondary to NULL in fwnode_init()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
commit 215c90ee656114f5e8c32408228d97082f8e0eef upstream.
If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitalized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for
example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization.
--- include/linux/fwnode.h | 1 + 1 file changed, 1 insertion(+)
include/linux/fwnode.h +1 -0
@@ -193,6 +193,7 @@ struct fwnode_operations {static inline void fwnode_init (struct fwnode_handle *fwnode,const struct fwnode_operations *ops) { + fwnode->secondary =NULL ; fwnode->ops = ops;INIT_LIST_HEAD (&fwnode->consumers);INIT_LIST_HEAD (&fwnode->suppliers);
Greg Kroah-Hartman
maintainerPATCH 70/186 drm/virtio: use uninterruptible resv lock for plane updates
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
commit 9af1b6e175c82daf4b423da339a722d8e67a735a upstream.
virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and ignore its return value. The function can fail with -EINTR from dma_resv_lock_interruptible() (signal during lock wait) or with -ENOMEM from dma_resv_reserve_fences() (fence slot allocation), leaving the resv lock not held. The queue path then walks the object array and calls dma_resv_add_fence(), which requires the lock held; with lockdep enabled this trips dma_resv_assert_held():
WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840 Call Trace: virtio_gpu_array_add_fence virtio_gpu_queue_ctrl_sgs virtio_gpu_queue_fenced_ctrl_buffer virtio_gpu_cursor_plane_update drm_atomic_helper_commit_planes drm_atomic_helper_commit_tail commit_tail drm_atomic_helper_commit drm_atomic_commit drm_atomic_helper_update_plane __setplane_atomic drm_mode_cursor_universal drm_mode_cursor_common drm_mode_cursor_ioctl drm_ioctl __x64_sys_ioctl
Beyond the WARN, mutating the dma_resv fence list without the lock races with concurrent readers/writers and can corrupt the list.
Both call sites run inside the .atomic_update plane callback, which DRM atomic helpers do not allow to fail (by the time it runs, the commit has been signed off to userspace and there is no clean rollback path). Moving the lock acquisition to .prepare_fb was rejected because the broader lock scope deadlocks against other BO locking paths in the same atomic commit.
Introduce virtio_gpu_lock_one_resv_uninterruptible() that uses dma_resv_lock() instead of dma_resv_lock_interruptible(). This eliminates the -EINTR failure mode -- the realistic syzbot trigger -- without extending the lock hold across the commit. The helper locks a single BO and rejects nents > 1 with -EINVAL; both fix sites lock exactly one BO.
Use it from virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush(); check the return value to handle the remaining -ENOMEM case from dma_resv_reserve_fences() by freeing the objs and skipping the plane update for that frame. The framebuffer BOs touched here are not shared with other contexts and lock contention is expected to be brief, so the loss of signal-interruptibility is acceptable.
Other callers of virtio_gpu_array_lock_resv() (the ioctl paths) continue to use the interruptible variant.
The bug was reported by syzbot, triggered via fault injection (fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the -ENOMEM branch in dma_resv_reserve_fences().
--- drivers/gpu/drm/virtio/virtgpu_drv.h | 1 + drivers/gpu/drm/virtio/virtgpu_gem.c | 17 +++++++++++++++++ drivers/gpu/drm/virtio/virtgpu_plane.c | 10 ++++++++-- 3 files changed, 26 insertions(+), 2 deletions(-)
drivers/gpu/drm/virtio/virtgpu_drv.h +1 -0
@@ -313,6 +313,7 @@ virtio_gpu_array_from_handles(struct drmvoid virtio_gpu_array_add_obj (struct virtio_gpu_object_array *objs,struct drm_gem_object *obj);int virtio_gpu_array_lock_resv (struct virtio_gpu_object_array *objs); +int virtio_gpu_lock_one_resv_uninterruptible (struct virtio_gpu_object_array *objs);void virtio_gpu_array_unlock_resv (struct virtio_gpu_object_array *objs);void virtio_gpu_array_add_fence (struct virtio_gpu_object_array *objs,struct dma_fence *fence);
drivers/gpu/drm/virtio/virtgpu_gem.c +17 -0
@@ -236,6 +236,23 @@ int virtio_gpu_array_lock_resv(struct vireturn ret; } +int virtio_gpu_lock_one_resv_uninterruptible (struct virtio_gpu_object_array *objs) +{ +int ret; + +if (objs->nents !=1 ) +return -EINVAL ; + +dma_resv_lock (objs->objs[0 ]->resv,NULL ); + + ret =dma_resv_reserve_fences (objs->objs[0 ]->resv,1 ); +if (ret) { +virtio_gpu_array_unlock_resv (objs); +return ret; + } +return 0 ; +} +void virtio_gpu_array_unlock_resv (struct virtio_gpu_object_array *objs) {if (objs->nents ==1 ) {
drivers/gpu/drm/virtio/virtgpu_plane.c +8 -2
@@ -168,7 +168,10 @@ static void virtio_gpu_resource_flush(stif (!objs)return ;virtio_gpu_array_add_obj (objs, vgfb->base.obj[0 ]); -virtio_gpu_array_lock_resv (objs); +if (virtio_gpu_lock_one_resv_uninterruptible (objs)) { +virtio_gpu_array_put_free (objs); +return ; + }virtio_gpu_cmd_resource_flush (vgdev, bo->hw_res_handle, x, y, width, height, objs, vgplane_st->fence);
@@ -339,7 +342,10 @@ static void virtio_gpu_cursor_plane_updaif (!objs)return ;virtio_gpu_array_add_obj (objs, vgfb->base.obj[0 ]); -virtio_gpu_array_lock_resv (objs); +if (virtio_gpu_lock_one_resv_uninterruptible (objs)) { +virtio_gpu_array_put_free (objs); +return ; + } virtio_gpu_cmd_transfer_to_host_2d (vgdev, 0, plane->state->crtc_w,
Greg Kroah-Hartman
maintainerPATCH 71/186 drm/bridge: it66121: acquire reset GPIO in probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julien Chauveau <[email protected]>
commit e02b5262fd288cc235f14e12233ea54e78c04611 upstream.
The it66121_ctx structure has a gpio_reset field, and it66121_hw_reset() calls gpiod_set_value() on it. However, the GPIO descriptor is never acquired via devm_gpiod_get(), leaving gpio_reset as NULL throughout the driver lifetime.
gpiod_set_value() silently returns when passed a NULL descriptor, so the hardware reset sequence in it66121_hw_reset() is a no-op. This leaves the chip in an undefined state at probe time, which can prevent it from responding on the I2C bus.
The DT binding marks reset-gpios as a required property, so all compliant device trees provide this GPIO. Add the missing devm_gpiod_get() call after enabling power supplies and before the hardware reset, so the chip is properly reset with power applied.
--- drivers/gpu/drm/bridge/ite-it66121.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/bridge/ite-it66121.c +5 -0
@@ -1566,6 +1566,11 @@ static int it66121_probe(struct i2c_cliereturn ret; } + ctx->gpio_reset =devm_gpiod_get (dev,"reset" ,GPIOD_OUT_LOW ); +if (IS_ERR (ctx->gpio_reset)) +return dev_err_probe (dev,PTR_ERR (ctx->gpio_reset), +"Failed to get reset GPIO\n" ); +it66121_hw_reset (ctx); ctx->regmap =devm_regmap_init_i2c (client, &it66121_regmap_config);
Greg Kroah-Hartman
maintainerPATCH 72/186 drm/bridge: megachips: remove bridge when irq request fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Osama Abdelkader <[email protected]>
commit d45d5c819f2cd0b6b5d76a194a537a5f4aeefecb upstream.
If devm_request_threaded_irq() fails after drm_bridge_add(), remove the bridge before returning.
Keep drm_bridge_add() rather than devm_drm_bridge_add(): registration is tied to the STDP4028 device while ge_b850v3_register() may complete from either I2C probe; devm would not unwind the bridge if the other client's probe fails.
--- drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 16 +++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +10 -6
@@ -302,7 +302,6 @@ static void ge_b850v3_lvds_remove(void) goto out;drm_bridge_remove (&ge_b850v3_lvds_ptr->bridge); - ge_b850v3_lvds_ptr =NULL ; out:mutex_unlock (&ge_b850v3_lvds_dev_mutex);
@@ -312,6 +311,7 @@ static int ge_b850v3_register(void) {struct i2c_client *stdp4028_i2c = ge_b850v3_lvds_ptr->stdp4028_i2c;struct device *dev = &stdp4028_i2c->dev; +int ret;/* drm bridge initialization */ ge_b850v3_lvds_ptr->bridge.funcs = &ge_b850v3_lvds_funcs;
@@ -329,11 +329,15 @@ static int ge_b850v3_register(void)if (!stdp4028_i2c->irq)return 0 ; -return devm_request_threaded_irq (&stdp4028_i2c->dev, - stdp4028_i2c->irq,NULL , - ge_b850v3_lvds_irq_handler, -IRQF_TRIGGER_HIGH |IRQF_ONESHOT , -"ge-b850v3-lvds-dp" , ge_b850v3_lvds_ptr); + ret =devm_request_threaded_irq (&stdp4028_i2c->dev, + stdp4028_i2c->irq,NULL , + ge_b850v3_lvds_irq_handler, +IRQF_TRIGGER_HIGH |IRQF_ONESHOT , +"ge-b850v3-lvds-dp" , ge_b850v3_lvds_ptr); +if (ret) +drm_bridge_remove (&ge_b850v3_lvds_ptr->bridge); + +return ret; }static int stdp4028_ge_b850v3_fw_probe (struct i2c_client *stdp4028_i2c)
Greg Kroah-Hartman
maintainerPATCH 73/186 drm/amd/display: Fix integer overflow in bios_get_image()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harry Wentland <[email protected]>
commit cd86529ec61474a38c3837fb7823790a7c3f8cce upstream.
[Why&How]
The bounds check in bios_get_image() computes 'offset + size' using unsigned 32-bit arithmetic before comparing against bios_size. If a VBIOS image contains a near-UINT32_MAX offset the addition wraps to a small value, the comparison passes, and the function returns a wild pointer past the VBIOS mapping.
Additionally, the comparison uses '<' (strict), which incorrectly rejects the valid exact-fit case where offset + size == bios_size.
Fix both issues by restructuring the check to avoid the addition
entirely: first reject if offset alone exceeds bios_size, then check size against the remaining space (bios_size - offset). This eliminates the overflow and correctly permits exact-fit accesses.
--- drivers/gpu/drm/amd/display/dc/bios/bios_parser_helper.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/dc/bios/bios_parser_helper.c +6 -3
@@ -37,10 +37,13 @@ uint8_t *bios_get_image(struct dc_bios * uint32_t offset, uint32_t size) { -if (bp->bios && offset + size < bp->bios_size) -return bp->bios + offset; -else +if (!bp->bios)return NULL ; + +if (offset > bp->bios_size || size > bp->bios_size - offset) +return NULL ; + +return bp->bios + offset; }#include "reg_helper.h"
Greg Kroah-Hartman
maintainerPATCH 74/186 drm/amd/display: Validate GPIO pin LUT table size before iterating
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harry Wentland <[email protected]>
commit 86d2b20644b11d21fe52c596e6e922b4590a3e3f upstream.
[Why&How]
The GPIO pin table parsers in get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() derive an element count from the VBIOS table_header.structuresize field, then iterate over gpio_pin[] entries. However, GET_IMAGE() only validates that the table header itself fits within the BIOS image. If the VBIOS reports a structuresize larger than the actual mapped data, the loop reads past the end of the BIOS image, causing an out-of-bounds read.
Fix this by calling bios_get_image() to validate that the full claimed structuresize is accessible within the BIOS image before entering the loop in both functions.
--- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +9 -0
@@ -488,6 +488,10 @@ static enum bp_result get_gpio_i2c_info( - sizeof(struct atom_common_table_header)) /sizeof (struct atom_gpio_pin_assignment ); +if (!bios_get_image (&bp->base,DATA_TABLES (gpio_pin_lut), +le16_to_cpu (header->table_header.structuresize))) +return BP_RESULT_BADBIOSTABLE ; + pin = (struct atom_gpio_pin_assignment *) header->gpio_pin;for (table_index =0 ; table_index < count; table_index++) {
@@ -677,6 +681,11 @@ static enum bp_result bios_parser_get_gp count = (le16_to_cpu (header->table_header.structuresize) -sizeof (struct atom_common_table_header )) /sizeof (struct atom_gpio_pin_assignment ); + +if (!bios_get_image (&bp->base,DATA_TABLES (gpio_pin_lut), +le16_to_cpu (header->table_header.structuresize))) +return BP_RESULT_BADBIOSTABLE ; +for (i =0 ; i < count; ++i) {if (header->gpio_pin[i].gpio_id != gpio_id)continue ;
Greg Kroah-Hartman
maintainerPATCH 75/186 drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harry Wentland <[email protected]>
commit 6c92f6d9600efa3ef0d9e560a2b52776d9803c29 upstream.
[Why&How]dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which is a no-op in release builds. If a caller ever passes length > 16 this results in a stack buffer overflow via memcpy.
Additionally, link_index is used to dereference dc->links[] without bounds checking against dc->link_count, risking an out-of-bounds access.
Replace the ASSERT with a hard runtime check that returns false when payload->length exceeds the destination buffer size, and add a bounds check for link_index before it is used.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +5 -1
@@ -4965,7 +4965,11 @@ bool dc_process_dmub_aux_transfer_async(uint8_t action;union dmub_rb_cmd cmd = {0 }; -ASSERT (payload->length <=16 ); +if (link_index >= dc->link_count || !dc->links[link_index]) +return false; + +if (payload->length >sizeof (cmd.dp_aux_access.aux_control.dpaux.data)) +return false; cmd.dp_aux_access.header.type =DMUB_CMD__DP_AUX_ACCESS ; cmd.dp_aux_access.header.payload_bytes =0 ;
Greg Kroah-Hartman
maintainerPATCH 76/186 batman-adv: mcast: fix use-after-free in orig_node RCU release
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit 20c2d6a20ca936f5aaa6dd40f73f262ac45c87cc upstream.
batadv_mcast_purge_orig() removes entries from RCU-protected hlists but does not wait for an RCU grace period before returning. Concurrent RCU readers may still accesses references to those entries at the point of removal. RCU-protected readers trying to operate on entries like orig->mcast_want_all_ipv6_node will then access already freed memory.
Fix this by moving batadv_mcast_purge_orig() to batadv_orig_node_release(), just before the call_rcu() invocation. This ensures RCU readers that were active at purge time have drained before the orig_node memory is reclaimed.
--- net/batman-adv/originator.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/batman-adv/originator.c +2 -2
@@ -823,8 +823,6 @@ static void batadv_orig_node_free_rcu(st orig_node = container_of(rcu, struct batadv_orig_node, rcu); -batadv_mcast_purge_orig (orig_node); -batadv_frag_purge_orig (orig_node,NULL );kfree (orig_node->tt_buff);
@@ -878,6 +876,8 @@ void batadv_orig_node_release(struct kre/* Free nc_nodes */ batadv_nc_purge_orig (orig_node->bat_priv, orig_node,NULL ); +batadv_mcast_purge_orig (orig_node); +call_rcu (&orig_node->rcu, batadv_orig_node_free_rcu); }
Greg Kroah-Hartman
maintainerPATCH 77/186 batman-adv: clear current gateway during teardown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruijie Li <[email protected]>
commit a340a51ed801eab7bb454150c226323b865263cc upstream.
batadv_gw_node_free() removes the gateway list entries during mesh teardown, but it does not clear the currently selected gateway. This leaves stale gateway state behind across cleanup and can break a later mesh recreation.
Clear bat_priv->gw.curr_gw before walking the gateway list so the selected gateway reference is dropped as part of teardown.
--- net/batman-adv/gateway_client.c | 4 ++++ 1 file changed, 4 insertions(+)
net/batman-adv/gateway_client.c +4 -0
@@ -479,10 +479,14 @@ void batadv_gw_node_delete(struct batadv*/ void batadv_gw_node_free (struct batadv_priv *bat_priv) { +struct batadv_gw_node *curr_gw;struct batadv_gw_node *gw_node;struct hlist_node *node_tmp;spin_lock_bh (&bat_priv->gw.list_lock); + curr_gw =rcu_replace_pointer (bat_priv->gw.curr_gw,NULL , true); +batadv_gw_node_put (curr_gw); +hlist_for_each_entry_safe (gw_node, node_tmp, &bat_priv->gw.gateway_list, list) {hlist_del_init_rcu (&gw_node->list);
Greg Kroah-Hartman
maintainerPATCH 78/186 batman-adv: dat: handle forward allocation error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit 2d8826a2d3657cea66fb0370f9e521575a673871 upstream.
batadv_dat_forward_data() calls pskb_copy_for_clone() to duplicate an skb for each DHT candidate, but does not check the return value before passing it to batadv_send_skb_prepare_unicast_4addr(). That function dereferences the skb unconditionally, so a failed allocation triggers a NULL pointer dereference.
Skip forwarding to the current DHT candidate on allocation failure.
--- net/batman-adv/distributed-arp-table.c | 3 +++ 1 file changed, 3 insertions(+)
net/batman-adv/distributed-arp-table.c +3 -0
@@ -698,6 +698,9 @@ static bool batadv_dat_forward_data(stru goto free_orig; tmp_skb =pskb_copy_for_clone (skb,GFP_ATOMIC ); +if (!tmp_skb) + goto free_neigh; +if (!batadv_send_skb_prepare_unicast_4addr (bat_priv, tmp_skb, cand[i].orig_node, packet_subtype)) {
Greg Kroah-Hartman
maintainerPATCH 79/186 batman-adv: fix fragment reassembly length accounting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruide Cao <[email protected]>
commit 9cd3f16c320bfdadd4509358122368deb56a5741 upstream.
batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly.
That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the intended validation and drive reassembly with inconsistent length state, leading to a local denial of service.
Fix the accounting by storing the accumulated length in a length-typed field and rejecting update overflows before the existing validation logic runs.
The fix was verified against the original reproducer and against valid fragment reassembly paths.
--- net/batman-adv/fragmentation.c | 23 +++++++++++++++++------ net/batman-adv/types.h | 2 +- 2 files changed, 18 insertions(+), 7 deletions(-)
net/batman-adv/fragmentation.c +17 -6
@@ -17,6 +17,7 @@#include <linux/lockdep.h> #include <linux/minmax.h> #include <linux/netdevice.h> +#include <linux/overflow.h> #include <linux/skbuff.h> #include <linux/slab.h> #include <linux/spinlock.h>
@@ -81,9 +82,9 @@ void batadv_frag_purge_orig(struct batad* * Return: the maximum size of payload that can be fragmented. */ -static int batadv_frag_size_limit (void ) +static size_t batadv_frag_size_limit (void ) { -int limit =BATADV_FRAG_MAX_FRAG_SIZE ; +size_t limit =BATADV_FRAG_MAX_FRAG_SIZE ; limit -=sizeof (struct batadv_frag_packet ); limit *=BATADV_FRAG_MAX_FRAGMENTS ;
@@ -144,7 +145,9 @@ static bool batadv_frag_insert_packet(ststruct batadv_frag_packet *frag_packet;u8 bucket;u16 seqno, hdr_size =sizeof (struct batadv_frag_packet ); +bool overflow = false;bool ret = false; +size_t data_len;/* Linearize packet to avoid linearizing 16 packets in a row when doing * the later merge. Non-linear merge should be added to remove this
@@ -154,6 +157,7 @@ static bool batadv_frag_insert_packet(st goto err; frag_packet = (struct batadv_frag_packet *)skb->data; + data_len = skb->len - hdr_size; seqno =ntohs (frag_packet->seqno); bucket = seqno %BATADV_FRAG_BUFFER_COUNT ;
@@ -172,7 +176,7 @@ static bool batadv_frag_insert_packet(stspin_lock_bh (&chain->lock);if (batadv_frag_init_chain (chain, seqno)) {hlist_add_head (&frag_entry_new->list, &chain->fragment_list); - chain->size = skb->len - hdr_size; + chain->size = data_len; chain->timestamp = jiffies; chain->total_size =ntohs (frag_packet->total_size); ret = true;
@@ -189,7 +193,11 @@ static bool batadv_frag_insert_packet(stif (frag_entry_curr->no < frag_entry_new->no) {hlist_add_before (&frag_entry_new->list, &frag_entry_curr->list); - chain->size += skb->len - hdr_size; + +if (check_add_overflow (chain->size, data_len, + &chain->size)) + overflow = true; + chain->timestamp = jiffies; ret = true; goto out;
@@ -202,13 +210,16 @@ static bool batadv_frag_insert_packet(st/* Reached the end of the list, so insert after 'frag_entry_last'. */ if (likely (frag_entry_last)) {hlist_add_behind (&frag_entry_new->list, &frag_entry_last->list); - chain->size += skb->len - hdr_size; + +if (check_add_overflow (chain->size, data_len, &chain->size)) + overflow = true; + chain->timestamp = jiffies; ret = true; } out: -if (chain->size >batadv_frag_size_limit () || +if (overflow || chain->size >batadv_frag_size_limit () || chain->total_size !=ntohs (frag_packet->total_size) || chain->total_size >batadv_frag_size_limit ()) {/* Clear chain if total size of either the list or the packet
net/batman-adv/types.h +1 -1
@@ -295,7 +295,7 @@ struct batadv_frag_table_entry {u16 seqno;/** @size: accumulated size of packets in list */ -u16 size; +size_t size;/** @total_size: expected size of the assembled packet */ u16 total_size;
Greg Kroah-Hartman
maintainerPATCH 80/186 batman-adv: fix tp_meter counter underflow during shutdown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luxiao Xu <[email protected]>
commit 94f3b133168d1c49895e7cc6afbcf1cc0b354602 upstream.
batadv_tp_sender_shutdown() unconditionally decrements the "sending" atomic counter. If multiple paths (e.g. timeout, user cancel, and normal finish) call this function, the counter can underflow to -1.
Since the sender logic treats any non-zero value as "still sending", a negative value causes the sender kthread to loop indefinitely. This leads to a use-after-free when the interface is removed while the zombie thread is still active.
Fix this by using atomic_xchg() to ensure the counter only transitions from 1 to 0 once.
--- net/batman-adv/tp_meter.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/batman-adv/tp_meter.c +2 -2
@@ -451,7 +451,7 @@ static void batadv_tp_sender_end(structstatic void batadv_tp_sender_shutdown (struct batadv_tp_vars *tp_vars,enum batadv_tp_meter_reason reason) { -if (!atomic_dec_and_test (&tp_vars->sending)) +if (atomic_xchg (&tp_vars->sending,0 ) !=1 )return ; tp_vars->reason = reason;
@@ -885,7 +885,7 @@ static int batadv_tp_send(void *arg)"Meter: %s() cannot send packets (%d)\n" , __func__, err);/* ensure nobody else tries to stop the thread now */ -if (atomic_dec_and_test (&tp_vars->sending)) +if (atomic_xchg (&tp_vars->sending,0 ) ==1 ) tp_vars->reason = err;break ; }
Greg Kroah-Hartman
maintainerPATCH 81/186 batman-adv: frag: disallow unicast fragment in fragment
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit bc62216dc8e221e3781afa14430f45208bfa9af9 upstream.
batadv_frag_skb_buffer() is called by batadv_batman_skb_recv() when a BATADV_UNICAST_FRAG packet is received. Once all fragments are collected and the packet is reassembled, batadv_recv_frag_packet() calls batadv_batman_skb_recv() again to process the defragmented payload.
A malicious sender can craft a BATADV_UNICAST_FRAG packet whose reassembled payload is itself a BATADV_UNICAST_FRAG packet (matryoshka-style nesting). Each nesting level recurses through batadv_batman_skb_recv() without bound, growing the kernel stack until it is exhausted.
Since refragmentation or fragments in fragments are not actually allowed, discard all packets which are still BATADV_UNICAST_FRAG packets after the defragmentation process.
--- net/batman-adv/fragmentation.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+)
net/batman-adv/fragmentation.c +35 -0
@@ -306,6 +306,31 @@ free: }/** +* batadv_skb_is_frag() - check if newly merged skb is gain a unicast packet +* @skb: newly merged skb +* +* Return: if newly skb is of type BATADV_UNICAST_FRAG +*/ +static bool batadv_skb_is_frag (struct sk_buff *skb) +{ +struct batadv_ogm_packet *batadv_ogm_packet; + +/* packet should hold at least type and version */ +if (unlikely (!pskb_may_pull (skb,2 ))) +return false; + + batadv_ogm_packet = (struct batadv_ogm_packet *)skb->data; + +if (batadv_ogm_packet->version !=BATADV_COMPAT_VERSION ) +return false; + +if (batadv_ogm_packet->packet_type !=BATADV_UNICAST_FRAG ) +return false; + +return true; +} + +/** * batadv_frag_skb_buffer() - buffer fragment for later merge * @skb: skb to buffer * @orig_node_src: originator that the skb is received from
@@ -338,6 +363,16 @@ bool batadv_frag_skb_buffer(struct sk_buif (!skb_out) goto out_err; +/* fragment in fragment is not allowed. otherwise it is possible +* to exhaust the stack when receiving a matryoshka-style +* "fragments in a fragment packet" +*/ +if (batadv_skb_is_frag (skb_out)) { +kfree_skb (skb_out); + skb_out =NULL ; + goto out_err; + } + out: ret = true; out_err:
Greg Kroah-Hartman
maintainerPATCH 82/186 batman-adv: bla: fix report_work leak on backbone_gw purge
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit 0459430add32ea41f3e2ef9351610e6d33627a6b upstream.
batadv_bla_purge_backbone_gw() removes stale backbone gateway entries, but fails to properly handle their associated report_work:
- If report_work is running, the purge must wait for it to finish before freeing the backbone_gw, otherwise the worker may access freed memory (e.g. bat_priv).
- If report_work is pending, the purge must cancel it and release the reference held for that pending work item.
The previous implementation called hlist_for_each_entry_safe() inside a spin_lock_bh() section, but cancel_work_sync() may sleep and therefore cannot be called from within a spinlock-protected region.
Restructure the loop to handle one entry per spinlock critical section:
acquire the lock, find the next entry to purge, remove it from the hash list, then release the lock before calling cancel_work_sync() and dropping the hash_entry reference. Repeat until no more entries require purging.
--- net/batman-adv/bridge_loop_avoidance.c | 60 ++++++++++++++++++++------------- 1 file changed, 38 insertions(+), 22 deletions(-)
net/batman-adv/bridge_loop_avoidance.c +38 -22
@@ -1224,6 +1224,7 @@ static void batadv_bla_purge_backbone_gwstruct hlist_head *head;struct batadv_hashtable *hash;spinlock_t *list_lock;/* protects write access to the hash lists */ +bool purged;int i; hash = bat_priv->bla.backbone_hash;
@@ -1234,30 +1235,45 @@ static void batadv_bla_purge_backbone_gw head = &hash->table[i]; list_lock = &hash->list_locks[i]; -spin_lock_bh (list_lock); -hlist_for_each_entry_safe (backbone_gw, node_tmp, - head, hash_entry) { -if (now) - goto purge_now; -if (!batadv_has_timed_out (backbone_gw->lasttime, -BATADV_BLA_BACKBONE_TIMEOUT )) -continue ; - -batadv_dbg (BATADV_DBG_BLA , backbone_gw->bat_priv, -"%s(): backbone gw %pM timed out\n" , - __func__, backbone_gw->orig); +do { + purged = false; + +spin_lock_bh (list_lock); +hlist_for_each_entry_safe (backbone_gw, node_tmp, + head, hash_entry) { +if (now) + goto purge_now; +if (!batadv_has_timed_out (backbone_gw->lasttime, +BATADV_BLA_BACKBONE_TIMEOUT )) +continue ; + +batadv_dbg (BATADV_DBG_BLA , backbone_gw->bat_priv, +"%s(): backbone gw %pM timed out\n" , + __func__, backbone_gw->orig); purge_now: -/* don't wait for the pending request anymore */ -if (atomic_read (&backbone_gw->request_sent)) -atomic_dec (&bat_priv->bla.num_requests); - -batadv_bla_del_backbone_claims (backbone_gw); - -hlist_del_rcu (&backbone_gw->hash_entry); -batadv_backbone_gw_put (backbone_gw); - } -spin_unlock_bh (list_lock); + purged = true; + +/* don't wait for the pending request anymore */ +if (atomic_read (&backbone_gw->request_sent)) +atomic_dec (&bat_priv->bla.num_requests); + +batadv_bla_del_backbone_claims (backbone_gw); + +hlist_del_rcu (&backbone_gw->hash_entry); +break ; + } +spin_unlock_bh (list_lock); + +if (purged) { +/* reference for pending report_work */ +if (cancel_work_sync (&backbone_gw->report_work)) +batadv_backbone_gw_put (backbone_gw); + +/* reference for hash_entry */ +batadv_backbone_gw_put (backbone_gw); + } + }while (purged); } }
Greg Kroah-Hartman
maintainerPATCH 83/186 batman-adv: tp_meter: avoid use of uninit sender vars
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit 6c65cf23d4c6170fcf5714c32aa64689718cb142 upstream.
batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior.
This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet.
Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed.
--- net/batman-adv/tp_meter.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
net/batman-adv/tp_meter.c +9 -2
@@ -663,6 +663,9 @@ static void batadv_tp_recv_ack(struct baif (unlikely (!tp_vars))return ; +if (unlikely (tp_vars->role !=BATADV_TP_SENDER )) + goto out; +if (unlikely (atomic_read (&tp_vars->sending) ==0 )) goto out;
@@ -1100,12 +1103,16 @@ void batadv_tp_stop(struct batadv_priv *if (!tp_vars) {batadv_dbg (BATADV_DBG_TP_METER , bat_priv,"Meter: trying to interrupt an already over connection\n" ); - goto out; + goto out_put_orig_node; } +if (unlikely (tp_vars->role !=BATADV_TP_SENDER )) + goto out_put_tp_vars; +batadv_tp_sender_shutdown (tp_vars, return_value); +out_put_tp_vars:batadv_tp_vars_put (tp_vars); -out: +out_put_orig_node:batadv_orig_node_put (orig_node); }
Greg Kroah-Hartman
maintainerPATCH 84/186 batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit 77098e4bea37af51d3962efa88a5af2ea5e1ac57 upstream.
The receiver shutdown timer handler, batadv_tp_receiver_shutdown(), is responsible for releasing the tp_vars reference it holds. However, the existing logic for coordinating this release with batadv_tp_stop_all() was flawed.
timer_shutdown_sync() guarantees the timer will not fire again after it returns, but it returns non-zero only when the timer was pending at the time of the call. If the timer had already expired (and batadv_tp_stop_all() would unsucessfully try to rearm itself), batadv_tp_stop_all() skips its batadv_tp_vars_put(), and batadv_tp_receiver_shutdown() fails to put its own reference as well.
Fix this by introducing a new atomic variable receiving that is set to 1 when the receiver is initialized and cleared atomically with atomic_xchg() by whichever side claims it first. Only the side that observes the transition from 1 to 0 is responsible for releasing the tp_vars timer reference, eliminating the uncertainty.
--- net/batman-adv/tp_meter.c | 13 +++++++++++-- net/batman-adv/types.h | 3 +++ 2 files changed, 14 insertions(+), 2 deletions(-)
net/batman-adv/tp_meter.c +11 -2
@@ -8,6 +8,7 @@#include "main.h" #include <linux/atomic.h> +#include <linux/bug.h> #include <linux/build_bug.h> #include <linux/byteorder/generic.h> #include <linux/cache.h>
@@ -1163,6 +1164,9 @@ static void batadv_tp_receiver_shutdown(spin_unlock_bh (&tp_vars->unacked_lock);/* drop reference of timer */ +if (WARN_ON (atomic_xchg (&tp_vars->receiving,0 ) !=1 )) +return ; +batadv_tp_vars_put (tp_vars); }
@@ -1381,6 +1385,7 @@ batadv_tp_init_recv(struct batadv_priv *ether_addr_copy (tp_vars->other_end, icmp->orig); tp_vars->role =BATADV_TP_RECEIVER ; +atomic_set (&tp_vars->receiving,1 );memcpy (tp_vars->session, icmp->session,sizeof (tp_vars->session)); tp_vars->last_recv =BATADV_TP_FIRST_SEQ ; tp_vars->bat_priv = bat_priv;
@@ -1553,8 +1558,12 @@ void batadv_tp_stop_all(struct batadv_prbreak ;case BATADV_TP_RECEIVER :batadv_tp_list_detach (tp_var); -if (timer_shutdown_sync (&tp_var->timer)) -batadv_tp_vars_put (tp_var); +timer_shutdown_sync (&tp_var->timer); + +if (atomic_xchg (&tp_var->receiving,0 ) !=1 ) +break ; + +batadv_tp_vars_put (tp_var);break ; }
net/batman-adv/types.h +3 -0
@@ -1391,6 +1391,9 @@ struct batadv_tp_vars {/** @sending: sending binary semaphore: 1 if sending, 0 is not */ atomic_t sending; +/** @receiving: receiving binary semaphore: 1 if receiving, 0 is not */ +atomic_t receiving; +/** @reason: reason for a stopped session */ enum batadv_tp_meter_reason reason;
Greg Kroah-Hartman
maintainerPATCH 85/186 batman-adv: tp_meter: fix race condition in send error reporting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit 71dce47f0758537fff78fddb5fb0d4632d29b29f upstream.
batadv_tp_sender_shutdown() previously used two separate variables to track session state: sending (an atomic flag indicating whether the session was active) and reason (a plain enum storing the stop reason). This introduced a race window between the two writes: after sending was cleared to 0, batadv_tp_send() could observe the stopped state and call batadv_tp_sender_end() before reason was written, causing the wrong stop reason to be reported to the caller.
Fix this by consolidating both variables into a single atomic send_result, which holds 0 while the session is running and the stop reason once it ends.
--- net/batman-adv/tp_meter.c | 40 +++++++++++++++++++++++++--------------- net/batman-adv/types.h | 10 +++++----- 2 files changed, 30 insertions(+), 20 deletions(-)
net/batman-adv/tp_meter.c +25 -15
@@ -419,11 +419,14 @@ static void batadv_tp_sender_cleanup(strstatic void batadv_tp_sender_end (struct batadv_priv *bat_priv,struct batadv_tp_vars *tp_vars) { +enum batadv_tp_meter_reason reason;u32 session_cookie; + reason =atomic_read (&tp_vars->send_result); +batadv_dbg (BATADV_DBG_TP_METER , bat_priv,"Test towards %pM finished..shutting down (reason=%d)\n" , - tp_vars->other_end, tp_vars->reason); + tp_vars->other_end, reason); batadv_dbg(BATADV_DBG_TP_METER, bat_priv, "Last timing stats: SRTT=%ums RTTVAR=%ums RTO=%ums\n",
@@ -436,7 +439,7 @@ static void batadv_tp_sender_end(struct session_cookie =batadv_tp_session_cookie (tp_vars->session, tp_vars->icmp_uid); - batadv_tp_batctl_notify(tp_vars->reason, + batadv_tp_batctl_notify(reason, tp_vars->other_end, bat_priv, tp_vars->start_time,
@@ -452,10 +455,18 @@ static void batadv_tp_sender_end(structstatic void batadv_tp_sender_shutdown (struct batadv_tp_vars *tp_vars,enum batadv_tp_meter_reason reason) { -if (atomic_xchg (&tp_vars->sending,0 ) !=1 ) -return ; +atomic_cmpxchg (&tp_vars->send_result,0 , reason); +} - tp_vars->reason = reason; +/** +* batadv_tp_sender_stopped() - check if tp session was stopped with reason +* @tp_vars: the private data of the current TP meter session +* +* Return: whether stop reason was found +*/ +static bool batadv_tp_sender_stopped (struct batadv_tp_vars *tp_vars) +{ +return atomic_read (&tp_vars->send_result) !=0 ; }/**
@@ -485,7 +496,7 @@ static void batadv_tp_reset_sender_timer/* most of the time this function is invoked while normal packet * reception... */ -if (unlikely (atomic_read (&tp_vars->sending) ==0 )) +if (unlikely (batadv_tp_sender_stopped (tp_vars)))/* timer ref will be dropped in batadv_tp_sender_cleanup */ return ;
@@ -505,7 +516,7 @@ static void batadv_tp_sender_timeout(strstruct batadv_tp_vars *tp_vars =from_timer (tp_vars, t, timer);struct batadv_priv *bat_priv = tp_vars->bat_priv; -if (atomic_read (&tp_vars->sending) ==0 ) +if (batadv_tp_sender_stopped (tp_vars))return ;/* if the user waited long enough...shutdown the test */
@@ -667,7 +678,7 @@ static void batadv_tp_recv_ack(struct baif (unlikely (tp_vars->role !=BATADV_TP_SENDER )) goto out; -if (unlikely (atomic_read (&tp_vars->sending) ==0 )) +if (unlikely (batadv_tp_sender_stopped (tp_vars))) goto out;/* old ACK? silently drop it.. */
@@ -833,21 +844,21 @@ static int batadv_tp_send(void *arg)if (unlikely (tp_vars->role !=BATADV_TP_SENDER )) { err =BATADV_TP_REASON_DST_UNREACHABLE ; - tp_vars->reason = err; +batadv_tp_sender_shutdown (tp_vars, err); goto out; } orig_node =batadv_orig_hash_find (bat_priv, tp_vars->other_end);if (unlikely (!orig_node)) { err =BATADV_TP_REASON_DST_UNREACHABLE ; - tp_vars->reason = err; +batadv_tp_sender_shutdown (tp_vars, err); goto out; } primary_if =batadv_primary_if_get_selected (bat_priv);if (unlikely (!primary_if)) { err =BATADV_TP_REASON_DST_UNREACHABLE ; - tp_vars->reason = err; +batadv_tp_sender_shutdown (tp_vars, err); goto out; }
@@ -866,7 +877,7 @@ static int batadv_tp_send(void *arg)queue_delayed_work (batadv_event_workqueue, &tp_vars->finish_work,msecs_to_jiffies (tp_vars->test_length)); -while (atomic_read (&tp_vars->sending) !=0 ) { +while (!batadv_tp_sender_stopped (tp_vars)) {if (unlikely (!batadv_tp_avail (tp_vars, payload_len))) {batadv_tp_wait_available (tp_vars, payload_len);continue ;
@@ -889,8 +900,7 @@ static int batadv_tp_send(void *arg)"Meter: %s() cannot send packets (%d)\n" , __func__, err);/* ensure nobody else tries to stop the thread now */ -if (atomic_xchg (&tp_vars->sending,0 ) ==1 ) - tp_vars->reason = err; +batadv_tp_sender_shutdown (tp_vars, err);break ; }
@@ -1012,7 +1022,7 @@ void batadv_tp_start(struct batadv_privether_addr_copy (tp_vars->other_end, dst);kref_init (&tp_vars->refcount); tp_vars->role =BATADV_TP_SENDER ; -atomic_set (&tp_vars->sending,1 ); +atomic_set (&tp_vars->send_result,0 );memcpy (tp_vars->session, session_id,sizeof (session_id)); tp_vars->icmp_uid = icmp_uid;
net/batman-adv/types.h +5 -5
@@ -1388,15 +1388,15 @@ struct batadv_tp_vars {/** @role: receiver/sender modi */ enum batadv_tp_meter_role role; -/** @sending: sending binary semaphore: 1 if sending, 0 is not */ -atomic_t sending; +/** +* @send_result: 0 when sending is ongoing and otherwise +* enum batadv_tp_meter_reason +*/ +atomic_t send_result;/** @receiving: receiving binary semaphore: 1 if receiving, 0 is not */ atomic_t receiving; -/** @reason: reason for a stopped session */ -enum batadv_tp_meter_reason reason; -/** @finish_work: work item for the finishing procedure */ struct delayed_work finish_work;
Greg Kroah-Hartman
maintainerPATCH 86/186 batman-adv: tt: fix negative last_changeset_len
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit fc92cdfcb295cefa4344d71a527d61b638b7bfc4 upstream.
batadv_piv_tt::last_changeset_len len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer.
In batadv_send_my_tt_response(), last_changeset_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_local_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized.
Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_my_tt_response().
--- net/batman-adv/types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/batman-adv/types.h +1 -1
@@ -994,7 +994,7 @@ struct batadv_priv_tt {* @last_changeset_len: length of last tt changeset this host has * generated */ -s16 last_changeset_len; +u16 last_changeset_len;/** * @last_changeset_lock: lock protecting last_changeset &
Greg Kroah-Hartman
maintainerPATCH 87/186 batman-adv: tt: fix negative tt_buff_len
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit b64963a2ceeb7529310b6cf253a1e540784422f4 upstream.
batadv_orig_node::tt_buff_len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer.
In batadv_send_other_tt_response(), tt_buff_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized.
Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_other_tt_response().
--- net/batman-adv/types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/batman-adv/types.h +1 -1
@@ -446,7 +446,7 @@ struct batadv_orig_node {* @tt_buff_len: length of the last tt changeset this node received * from the orig node */ -s16 tt_buff_len; +u16 tt_buff_len;/** @tt_buff_lock: lock that protects tt_buff and tt_buff_len */ spinlock_t tt_buff_lock;
Greg Kroah-Hartman
maintainerPATCH 88/186 hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdurrahman Hussain <[email protected]>
commit b86095e3d7dcf2bf80c747349a35912a87a85098 upstream.
adm1266_set_rtc() seeds the chip's SET_RTC register from ktime_get_seconds(), which returns CLOCK_MONOTONIC -- i.e. seconds since the host last booted, not seconds since the Unix epoch.
The chip stamps that value into every blackbox record it captures. Userspace reading those timestamps back expects wall-clock seconds:
that's what the SET_RTC frame layout documents (datasheet Rev. D, Table 84) and what every other consumer of "seconds since epoch" assumes. Seeding from CLOCK_MONOTONIC gives blackbox records a timestamp that is only meaningful within a single boot of the host and silently resets to small values on every reboot.
Switch to ktime_get_real_seconds() so the seed matches what the register is documented to hold.
--- drivers/hwmon/pmbus/adm1266.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/pmbus/adm1266.c +1 -1
@@ -432,7 +432,7 @@ static int adm1266_set_rtc(struct adm126char write_buf[6 ];int i; - kt =ktime_get_seconds (); + kt =ktime_get_real_seconds ();memset (write_buf,0 ,sizeof (write_buf));
Greg Kroah-Hartman
maintainerPATCH 89/186 hwmon: (pmbus/adm1266) reject implausible blackbox record_count
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdurrahman Hussain <[email protected]>
commit 4afca954622d672ea65ed961bed01cf91caa034e upstream.
adm1266_nvmem_read_blackbox() loops over a record_count that comes straight from byte 3 of the BLACKBOX_INFO response. The destination buffer is data->dev_mem, sized for the nvmem cell's declared 2048 bytes (ADM1266_BLACKBOX_MAX_RECORDS * ADM1266_BLACKBOX_SIZE = 32 * 64). A device that reports a record_count greater than 32 -- whether due to firmware bugs, bus corruption, or a non-responsive slave returning 0xff -- would walk read_buff past the end of the dev_mem allocation on the trailing iterations.
Cap record_count at ADM1266_BLACKBOX_MAX_RECORDS (introduced here) before entering the loop and return -EIO on any larger value, so a malformed BLACKBOX_INFO response cannot drive the loop out of bounds.
--- drivers/hwmon/pmbus/adm1266.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/hwmon/pmbus/adm1266.c +3 -0
@@ -46,6 +46,7 @@#define ADM1266_BLACKBOX_OFFSET 0#define ADM1266_BLACKBOX_SIZE 64 +#define ADM1266_BLACKBOX_MAX_RECORDS 32#define ADM1266_PMBUS_BLOCK_MAX 255
@@ -360,6 +361,8 @@ static int adm1266_nvmem_read_blackbox(sreturn -EIO ; record_count = buf[3 ]; +if (record_count >ADM1266_BLACKBOX_MAX_RECORDS ) +return -EIO ;for (index =0 ; index < record_count; index++) { ret =adm1266_pmbus_block_xfer (data,ADM1266_READ_BLACKBOX ,1 , &index, read_buff);
Greg Kroah-Hartman
maintainerPATCH 90/186 hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdurrahman Hussain <[email protected]>
commit 487566cb1ccdf3756fdd7bf8d875e612ff3169bb upstream.
adm1266_pmbus_block_xfer() sets up the read transaction with
.buf = data->read_buf, .len = ADM1266_PMBUS_BLOCK_MAX + 2,
but read_buf in struct adm1266_data is declared as
u8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 1];
For a max-length block response (length byte = 255 + up to 1 PEC byte), the i2c controller is told to write 257 bytes into a 256-byte buffer, putting one byte past the end of read_buf. The same response also makes the subsequent PEC compare
if (crc != msgs[1].buf[msgs[1].buf[0] + 1])
read a byte beyond the array.
Bump the read_buf declaration to ADM1266_PMBUS_BLOCK_MAX + 2 so the buffer can hold the length byte, up to 255 payload bytes, and the PEC byte the i2c_msg length already accounts for.
--- drivers/hwmon/pmbus/adm1266.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/pmbus/adm1266.c +1 -1
@@ -61,7 +61,7 @@ struct adm1266_data {u8 *dev_mem;struct mutex buf_mutex;u8 write_buf[ADM1266_PMBUS_BLOCK_MAX +1 ]____cacheline_aligned ; -u8 read_buf[ADM1266_PMBUS_BLOCK_MAX +1 ]____cacheline_aligned ; +u8 read_buf[ADM1266_PMBUS_BLOCK_MAX +2 ]____cacheline_aligned ; };static const struct nvmem_cell_info adm1266_nvmem_cells[] = {
Greg Kroah-Hartman
maintainerPATCH 91/186 hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdurrahman Hussain <[email protected]>
commit 43cae21424ff8e33894a0f86c6b80b840c049fd7 upstream.
adm1266_pmbus_block_xfer() copies the device-supplied block payload into the caller-provided buffer using the device-supplied length:
memcpy(data_r, &msgs[1].buf[1], msgs[1].buf[0]);
The helper does not know how large data_r is and trusts the device to return at most one record's worth of bytes. adm1266_nvmem_read_blackbox() violates that contract: it advances read_buff inside data->dev_mem in ADM1266_BLACKBOX_SIZE (64-byte) strides while the helper is willing to write up to ADM1266_PMBUS_BLOCK_MAX (255) bytes. A device that returns more than 64 bytes on the trailing record (read_buff offset 1984 in the 2048-byte dev_mem allocation) overflows dev_mem by up to 191 bytes before the post-call
if (ret != ADM1266_BLACKBOX_SIZE) return -EIO;
can reject the response.
Contain the fix in the caller without changing the helper signature:
read each record into a 255-byte local bounce buffer that matches the helper's maximum output, validate the returned length, and only then copy exactly ADM1266_BLACKBOX_SIZE bytes into the dev_mem slot.
--- drivers/hwmon/pmbus/adm1266.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hwmon/pmbus/adm1266.c +3 -1
@@ -348,6 +348,7 @@ static void adm1266_init_debugfs(structstatic int adm1266_nvmem_read_blackbox (struct adm1266_data *data,u8 *read_buff) { +u8 record[ADM1266_PMBUS_BLOCK_MAX ];int record_count;char index;u8 buf[I2C_SMBUS_BLOCK_MAX ];
@@ -365,13 +366,14 @@ static int adm1266_nvmem_read_blackbox(sreturn -EIO ;for (index =0 ; index < record_count; index++) { - ret =adm1266_pmbus_block_xfer (data,ADM1266_READ_BLACKBOX ,1 , &index, read_buff); + ret =adm1266_pmbus_block_xfer (data,ADM1266_READ_BLACKBOX ,1 , &index, record);if (ret <0 )return ret;if (ret !=ADM1266_BLACKBOX_SIZE )return -EIO ; +memcpy (read_buff, record,ADM1266_BLACKBOX_SIZE ); read_buff +=ADM1266_BLACKBOX_SIZE ; }
Greg Kroah-Hartman
maintainerPATCH 92/186 hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdurrahman Hussain <[email protected]>
commit d7834d92251baade796812876e95555e2066fa9f upstream.
adm1266_gpio_get_multiple() iterates the PDIO portion of the caller-supplied mask using
for_each_set_bit_from(gpio_nr, mask,
ADM1266_GPIO_NR + ADM1266_PDIO_STATUS) {
...
}where ADM1266_PDIO_STATUS is the PMBus command code (0xE9, i.e. 233), not the number of PDIO pins. The intended upper bound is ADM1266_GPIO_NR + ADM1266_PDIO_NR = 25.
gpiolib hands in a mask sized for gc.ngpio (= 25 bits on this chip), so the iteration walks find_next_bit() up to 242, reading up to 217 extra bits (a handful of unsigned-long words: four on 64-bit, seven on 32-bit) of whatever lives past the end of the mask in the caller's stack. Any incidental set bit in that range then drives a set_bit(gpio_nr, bits) call that writes past the end of the caller-supplied bits array too -- both out-of-bounds.
Substitute ADM1266_PDIO_NR for the constant so the scan stops at the last real PDIO bit.
--- drivers/hwmon/pmbus/adm1266.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/pmbus/adm1266.c +1 -1
@@ -212,7 +212,7 @@ static int adm1266_gpio_get_multiple(str status = read_buf[0 ] + (read_buf[1 ] <<8 ); *bits =0 ; -for_each_set_bit_from (gpio_nr, mask,ADM1266_GPIO_NR +ADM1266_PDIO_STATUS ) { +for_each_set_bit_from (gpio_nr, mask,ADM1266_GPIO_NR +ADM1266_PDIO_NR ) {if (test_bit (gpio_nr -ADM1266_GPIO_NR , &status))set_bit (gpio_nr, bits); }
Greg Kroah-Hartman
maintainerPATCH 93/186 hwmon: (pmbus/adm1266) dont clobber GPIO bits before PDIO read in get_multiple
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdurrahman Hussain <[email protected]>
commit 3327a12aee9e10ffa903e28b8445dfd1af5307c0 upstream.
adm1266_gpio_get_multiple() zeroes *bits before the GPIO_STATUS loop and then a second time before the PDIO_STATUS loop:
*bits = 0;
for_each_set_bit(gpio_nr, mask, ADM1266_GPIO_NR) {
...
set_bit(gpio_nr, bits);
}
ret = i2c_smbus_read_block_data(data->client, ADM1266_PDIO_STATUS, ...);
...
*bits = 0;
for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_NR) {
...
set_bit(gpio_nr, bits);
}The second *bits = 0 throws away every GPIO bit the first loop just populated, so callers asking for any combination of GPIO and PDIO pins always see the GPIO portion of the returned bits as zero.
Drop the redundant second assignment so both halves of the result survive.
--- drivers/hwmon/pmbus/adm1266.c | 1 - 1 file changed, 1 deletion(-)
drivers/hwmon/pmbus/adm1266.c +0 -1
@@ -211,7 +211,6 @@ static int adm1266_gpio_get_multiple(str status = read_buf[0 ] + (read_buf[1 ] <<8 ); - *bits =0 ;for_each_set_bit_from (gpio_nr, mask,ADM1266_GPIO_NR +ADM1266_PDIO_NR ) {if (test_bit (gpio_nr -ADM1266_GPIO_NR , &status))set_bit (gpio_nr, bits);
Greg Kroah-Hartman
maintainerPATCH 94/186 hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdurrahman Hussain <[email protected]>
commit 491403b9b76cf66abd81301c5901aa4a4549f1e8 upstream.
adm1266_probe() calls adm1266_config_gpio() -- which goes on to devm_gpiochip_add_data() and exposes the gpio_chip callbacks to gpiolib -- before pmbus_do_probe() has initialised the per-client PMBus state (notably the pmbus_lock mutex the core hands out via pmbus_get_data()).
That ordering is already a latent hazard: any GPIO access that lands between adm1266_config_gpio() and the end of pmbus_do_probe() (for example a sysfs read from a user space agent that opens the gpiochip the instant gpiolib advertises it) races pmbus_do_probe()'s own device accesses with no serialisation.
Move adm1266_config_gpio() down past pmbus_do_probe() so the chip isn't reachable from userspace until the PMBus state it depends on is fully initialised.
--- drivers/hwmon/pmbus/adm1266.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/hwmon/pmbus/adm1266.c +4 -4
@@ -466,10 +466,6 @@ static int adm1266_probe(struct i2c_cliecrc8_populate_msb (pmbus_crc_table,0x7 );mutex_init (&data->buf_mutex); - ret =adm1266_config_gpio (data); -if (ret <0 ) -return ret; - ret =adm1266_set_rtc (data);if (ret <0 )return ret;
@@ -482,6 +478,10 @@ static int adm1266_probe(struct i2c_clieif (ret)return ret; + ret =adm1266_config_gpio (data); +if (ret <0 ) +return ret; +adm1266_init_debugfs (data);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 95/186 hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdurrahman Hussain <[email protected]>
commit 6af713af91d5c34ec049eb3cc2c5b3f5eba953b8 upstream.
adm1266_probe() calls adm1266_config_nvmem() -- which goes on to devm_nvmem_register() and exposes adm1266_nvmem_read() to userspace -- before pmbus_do_probe() has initialised the per-client PMBus state.
Same latent hazard as the gpio_chip one fixed in the previous patch:
once the nvmem device is registered, gpiolib's nvmem char-dev / sysfs interface is reachable, and any concurrent read triggers adm1266_nvmem_read() -> adm1266_nvmem_read_blackbox(), which issues PMBus traffic that races pmbus_do_probe()'s own device accesses with no serialisation.
Move adm1266_config_nvmem() down past pmbus_do_probe() so the nvmem device isn't reachable from userspace until the PMBus state the nvmem accessors depend on is fully initialised.
--- drivers/hwmon/pmbus/adm1266.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/hwmon/pmbus/adm1266.c +4 -4
@@ -470,14 +470,14 @@ static int adm1266_probe(struct i2c_clieif (ret <0 )return ret; - ret =adm1266_config_nvmem (data); -if (ret <0 ) -return ret; - ret =pmbus_do_probe (client, &data->info);if (ret)return ret; + ret =adm1266_config_nvmem (data); +if (ret <0 ) +return ret; + ret =adm1266_config_gpio (data);if (ret <0 )return ret;
Greg Kroah-Hartman
maintainerPATCH 96/186 hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdurrahman Hussain <[email protected]>
commit a7232f68c43ca62f545049b7f5fbfc75137b843b upstream.
adm1266_gpio_get() and adm1266_gpio_get_multiple() both compose the pin-status word as
pins_status = read_buf[0] + (read_buf[1] << 8);
right after i2c_smbus_read_block_data(), guarding only against an error return. A well-behaved device returns 2 bytes for GPIO_STATUS/PDIO_STATUS, but the helper happily reports a 0- or 1-byte response too. If the device returns 0 bytes, both read_buf slots are uninitialized stack memory; if it returns 1 byte, read_buf[1] is.
The composed value then flows through set_bit() into the caller's *bits in adm1266_gpio_get_multiple(), or into the return value of adm1266_gpio_get(), and ends up in userspace via gpiolib (sysfs and the char-dev ioctls). That leaks a few bits of kernel stack per request on any device whose firmware glitch, bus error, or hostile slave produces a short block-read response.
Add the missing length check to both call sites and surface a short response as -EIO.
--- drivers/hwmon/pmbus/adm1266.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/hwmon/pmbus/adm1266.c +6 -0
@@ -176,6 +176,8 @@ static int adm1266_gpio_get(struct gpio_ ret =i2c_smbus_read_block_data (data->client, pmbus_cmd, read_buf);if (ret <0 )return ret; +if (ret <2 ) +return -EIO ; pins_status = read_buf[0 ] + (read_buf[1 ] <<8 );if (offset <ADM1266_GPIO_NR )
@@ -196,6 +198,8 @@ static int adm1266_gpio_get_multiple(str ret =i2c_smbus_read_block_data (data->client,ADM1266_GPIO_STATUS , read_buf);if (ret <0 )return ret; +if (ret <2 ) +return -EIO ; status = read_buf[0 ] + (read_buf[1 ] <<8 );
@@ -208,6 +212,8 @@ static int adm1266_gpio_get_multiple(str ret =i2c_smbus_read_block_data (data->client,ADM1266_PDIO_STATUS , read_buf);if (ret <0 )return ret; +if (ret <2 ) +return -EIO ; status = read_buf[0 ] + (read_buf[1 ] <<8 );
Greg Kroah-Hartman
maintainerPATCH 97/186 HID: uclogic: Fix regression of input name assignment
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 487359284509a6745e14b8c0518768bc277809b0 ]
The previous fix for adding the devm_kasprintf() return check in the commit bd07f751208b ("HID: uclogic: Add NULL check in uclogic_input_configured()") changed the condition of hi->input->name assignment, and it resulted in missing the proper input device name when no custom suffix is defined.
Restore the conditional to the original content to address the regression.
--- drivers/hid/hid-uclogic-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hid/hid-uclogic-core.c +3 -1
@@ -142,7 +142,9 @@ static int uclogic_input_configured(struct hid_device *hdev, suffix ="System Control" ;break ; } - }else { + } + +if (suffix) { hi->input->name =devm_kasprintf (&hdev->dev,GFP_KERNEL ,"%s %s" , hdev->name, suffix);if (!hi->input->name)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 98/186 firmware: arm_ffa: Check for NULL FF-A ID table while driver registration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
[ Upstream commit 0a5e695095c557d2380131b613dea4e8d90371be ]
The bus match callback assumes that every FF-A driver provides an id_table and dereferences it unconditionally. Enforce that contract at registration time so a buggy client driver cannot crash the bus during match.
--- drivers/firmware/arm_ffa/bus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/firmware/arm_ffa/bus.c +3 -1
@@ -24,6 +24,8 @@ static int ffa_device_match(struct device *dev, struct device_driver *drv) id_table =to_ffa_driver (drv)->id_table; ffa_dev =to_ffa_dev (dev); +if (!id_table) +return 0 ;while (!uuid_is_null (&id_table->uuid)) {/*
@@ -107,7 +109,7 @@ int ffa_driver_register(struct ffa_driver *driver, struct module *owner, {int ret; -if (!driver->probe) +if (!driver->probe || !driver->id_table)return -EINVAL ; driver->driver.bus = &ffa_bus_type;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 99/186 firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
[ Upstream commit 09527e2c534911619d7e098729711100290bc3e1 ]
If the RX buffer allocation fails in ffa_init(), the error path jumps to free_pages even though no buffer has been allocated yet. Route that case directly to free_drv_info so the cleanup path is only used after at least one RX/TX buffer allocation has succeeded.
--- drivers/firmware/arm_ffa/driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/arm_ffa/driver.c +1 -1
@@ -743,7 +743,7 @@ static int __init ffa_init(void) drv_info->rx_buffer =alloc_pages_exact (RXTX_BUFFER_SIZE ,GFP_KERNEL );if (!drv_info->rx_buffer) { ret = -ENOMEM ; - goto free_pages; + goto free_drv_info; } drv_info->tx_buffer =alloc_pages_exact (RXTX_BUFFER_SIZE ,GFP_KERNEL );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 100/186 kunit: config: Enable KUNIT_DEBUGFS by default
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Gow <[email protected]>
[ Upstream commit 17e4c68ff35090d8cb743e3c82c09f92fda1ebda ]
The KUNIT_DEBUGFS option is currently enabled based on the value of KUNIT_ALL_TESTS, but it really doesn't have anything to do with the set of enabled tests, so just enable it by default anyway. In particular, this shouldn't be only visible if KUNIT_ALL_TESTS is set, which is quite confusing.
--- lib/kunit/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
lib/kunit/Kconfig +2 -2
@@ -16,8 +16,8 @@ menuconfig KUNIT if KUNIT config KUNIT_DEBUGFS - bool "KUnit - Enable /sys/kernel/debug/kunit debugfs representation" if !KUNIT_ALL_TESTS - default KUNIT_ALL_TESTS + bool "KUnit - Enable /sys/kernel/debug/kunit debugfs representation" + default y help Enable debugfs representation for kunit. Currently this consists of /sys/kernel/debug/kunit/<test_suite>/results files for each
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 101/186 kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Gow <[email protected]>
[ Upstream commit 8f80b5b227ef9ea422080487715c841856339aed ]
CONFIG_KUNIT_DEBUGFS is totally useless without debugfs, so it should depend on CONFIG_DEBUG_FS.
--- lib/kunit/Kconfig | 1 + 1 file changed, 1 insertion(+)
lib/kunit/Kconfig +1 -0
@@ -17,6 +17,7 @@ if KUNIT config KUNIT_DEBUGFS bool "KUnit - Enable /sys/kernel/debug/kunit debugfs representation" + depends on DEBUG_FS default y help Enable debugfs representation for kunit. Currently this consists
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 102/186 pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maulik Shah <[email protected]>
[ Upstream commit 52ac35b8a151446481496404af3a8e5e889b3c5a ]
PDC interrupts 122-125 were meant for ibi_i3c wakeup but sm8150 do not support i3c. GPIOs 39,51,88 and 144 are also connected to different PDC pin and already reflected in the wake irq map.
Remove the unsupported wakeup interrupts from the map.
--- drivers/pinctrl/qcom/pinctrl-sm8150.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/pinctrl/qcom/pinctrl-sm8150.c +4 -4
@@ -1496,18 +1496,18 @@ static const struct msm_gpio_wakeirq_map sm8150_pdc_map[] = { { 3, 31 }, { 5, 32 }, { 8, 33 }, { 9, 34 }, { 10, 100 }, { 12, 104 }, { 24, 37 }, { 26, 38 }, { 27, 41 }, { 28, 42 }, { 30, 39 }, { 36, 43 }, { 37, 44 }, { 38, 30 }, { 39, 118 }, - { 39, 125 }, { 41, 47 }, { 42, 48 }, { 46, 50 }, { 47, 49 }, - { 48, 51 }, { 49, 53 }, { 50, 52 }, { 51, 116 }, { 51, 123 }, + { 41, 47 }, { 42, 48 }, { 46, 50 }, { 47, 49 }, + { 48, 51 }, { 49, 53 }, { 50, 52 }, { 51, 116 }, { 53, 54 }, { 54, 55 }, { 55, 56 }, { 56, 57 }, { 58, 58 }, { 60, 60 }, { 61, 61 }, { 68, 62 }, { 70, 63 }, { 76, 71 }, { 77, 66 }, { 81, 64 }, { 83, 65 }, { 86, 67 }, { 87, 84 }, - { 88, 117 }, { 88, 124 }, { 90, 69 }, { 91, 70 }, { 93, 75 }, + { 88, 117 }, { 90, 69 }, { 91, 70 }, { 93, 75 }, { 95, 72 }, { 96, 73 }, { 97, 74 }, { 101, 40 }, { 103, 77 }, { 104, 78 }, { 108, 79 }, { 112, 80 }, { 113, 81 }, { 114, 82 }, { 117, 85 }, { 118, 101 }, { 119, 87 }, { 120, 88 }, { 121, 89 }, { 122, 90 }, { 123, 91 }, { 124, 92 }, { 125, 93 }, { 129, 94 }, { 132, 105 }, { 133, 83 }, { 134, 36 }, { 136, 97 }, { 142, 103 }, - { 144, 115 }, { 144, 122 }, { 147, 102 }, { 150, 107 }, + { 144, 115 }, { 147, 102 }, { 150, 107 }, { 152, 108 }, { 153, 109 } };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 103/186 ARM: integrator: Fix early initialization
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 90d77b30a666049ad24df463f52e5d529c44e8cd ]
Starting with commit bdb249fce9ad4 ("ARM: integrator: read counter using syscon/regmap"), intcp_init_early calls syscon_regmap_lookup_by_compatible which in turn calls of_syscon_register. This function allocates memory. Since the memory management code has not been initialized at that time, the call always fails. It either returns -ENOMEM or crashes as follows.
Unable to handle kernel NULL pointer dereference at virtual address 0000000c when read [0000000c] *pgd=00000000 Internal error: Oops: 5 [#1] ARM Modules linked in: CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 6.15.0-rc5-00026-g5fcc9bf84ee5 #1 PREEMPT Hardware name: ARM Integrator/CP (Device Tree) PC is at __kmalloc_cache_noprof+0xec/0x39c LR is at __kmalloc_cache_noprof+0x34/0x39c ... Call trace: __kmalloc_cache_noprof from of_syscon_register+0x7c/0x310 of_syscon_register from device_node_get_regmap+0xa4/0xb0 device_node_get_regmap from intcp_init_early+0xc/0x40 intcp_init_early from start_kernel+0x60/0x688 start_kernel from 0x0
The crash is seen due to a dereferenced pointer which is not supposed to be NULL but is NULL if the memory management subsystem has not been initialized. The crash is not seen with all versions of gcc. Some versions such as gcc 9.x apparently do not dereference the pointer, presumably if tracing is disabled. The problem has been reproduced with gcc 10.x, 11.x, and 13.x. Either case, if the crash is not seen, the call to syscon_regmap_lookup_by_compatible returns -ENOMEM, and sched_clock_register is never called.
Fix the problem by moving the early initialization code into the standard machine initialization code.
--- arch/arm/mach-versatile/integrator_cp.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-)
arch/arm/mach-versatile/integrator_cp.c +4 -9
@@ -86,14 +86,6 @@ static u64 notrace intcp_read_sched_clock(void)return val; } -static void __init intcp_init_early (void ) -{ - cm_map =syscon_regmap_lookup_by_compatible ("arm,core-module-integrator" ); -if (IS_ERR (cm_map)) -return ; -sched_clock_register (intcp_read_sched_clock,32 ,24000000 ); -} -static void __init intcp_init_irq_of (void ) {cm_init ();
@@ -119,6 +111,10 @@ static void __init intcp_init_of(void) {struct device_node *cpcon; + cm_map =syscon_regmap_lookup_by_compatible ("arm,core-module-integrator" ); +if (!IS_ERR (cm_map)) +sched_clock_register (intcp_read_sched_clock,32 ,24000000 ); + cpcon =of_find_matching_node (NULL , intcp_syscon_match);if (!cpcon)return ;
@@ -138,7 +134,6 @@ static const char * intcp_dt_board_compat[] = {DT_MACHINE_START (INTEGRATOR_CP_DT ,"ARM Integrator/CP (Device Tree)" ) .reserve = integrator_reserve, .map_io = intcp_map_io, - .init_early = intcp_init_early, .init_irq = intcp_init_irq_of, .init_machine = intcp_init_of, .dt_compat = intcp_dt_board_compat,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 104/186 ALSA: hda: cs35l56: Put ACPI device after setting companion
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuhao Fu <[email protected]>
[ Upstream commit aa2fbece1b07954ef26488c800d126a36a8ab93e ]
acpi_dev_get_first_match_dev() returns a refcounted ACPI device and callers are expected to balance it with acpi_dev_put().
When no companion is already attached, cs35l56_hda_read_acpi() looks up an ACPI device and sets it with ACPI_COMPANION_SET(), but leaves the lookup reference held.
ACPI_COMPANION_SET() does not take ownership of that reference, so drop it with acpi_dev_put() after attaching the companion.
--- sound/pci/hda/cs35l56_hda.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/cs35l56_hda.c +1 -0
@@ -855,6 +855,7 @@ static int cs35l56_hda_read_acpi(struct cs35l56_hda *cs35l56, int id)return -ENODEV ; }ACPI_COMPANION_SET (cs35l56->base.dev, adev); +acpi_dev_put (adev); } property ="cirrus,dev-index" ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 105/186 btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit c73370c677646e86fc4b1780fb07027bdf847375 ]
The trace event btrfs_sync_file() is called in an atomic context (all trace events are) and its call to dput(), which is needed due to the call to dget_parent(), can sleep, triggering a kernel splat.
This can be reproduced by enabling the trace event and running btrfs/056 from fstests for example. The splat shown in dmesg is the following:
[53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970 [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io [53.988] preempt_count: 2, expected: 0 [53.967] RCU nest depth: 0, expected: 0 [53.943] Preemption disabled at: [53.944] [<0000000000000000>] 0x0 [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full) [54.070] Tainted: [W]=WARN [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [54.072] Call Trace: [54.074] <TASK> [54.076] dump_stack_lvl+0x56/0x80 [54.079] __might_resched.cold+0xd6/0x10f [54.072] dput.part.0+0x24/0x110 [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs] [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs] [54.087] ? __handle_mm_fault+0x8ae/0xed0 [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs] [54.091] vfs_write+0x21f/0x450 [54.094] __x64_sys_pwrite64+0x8d/0xc0 [54.096] ? do_user_addr_fault+0x20c/0x670 [54.099] do_syscall_64+0x60/0xf20 [54.092] ? clear_bhb_loop+0x60/0xb0 [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e
So stop using dget_parent() and dput() and access the parent dentry directly as dentry->d_parent. This is also what ext4 is doing in its equivalent trace event ext4_sync_file_enter().
--- include/trace/events/btrfs.h | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
include/trace/events/btrfs.h +1 -3
@@ -791,10 +791,8 @@ TRACE_EVENT(btrfs_sync_file,TP_fast_assign ( struct dentry *dentry = file_dentry(file);struct inode *inode =file_inode (file); -struct dentry *parent =dget_parent (dentry); -struct inode *parent_inode =d_inode (parent); +struct inode *parent_inode =d_inode (dentry->d_parent); -dput (parent);TP_fast_assign_fsid (btrfs_sb (inode->i_sb)); __entry->ino =btrfs_ino (BTRFS_I (inode)); __entry->parent =btrfs_ino (BTRFS_I (parent_inode));
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 106/186 netfilter: x_tables: unregister the templates first
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit d338693d778579b676a61346849bebd892427158 ]
When the module is going away we need to zap the template first. Else there is a small race window where userspace could instantiate a new table after the pernet exit function has removed the current table.
--- net/ipv4/netfilter/arptable_filter.c | 2 +- net/ipv4/netfilter/iptable_filter.c | 2 +- net/ipv4/netfilter/iptable_mangle.c | 2 +- net/ipv4/netfilter/iptable_raw.c | 2 +- net/ipv4/netfilter/iptable_security.c | 2 +- net/ipv6/netfilter/ip6table_filter.c | 2 +- net/ipv6/netfilter/ip6table_mangle.c | 2 +- net/ipv6/netfilter/ip6table_raw.c | 2 +- net/ipv6/netfilter/ip6table_security.c | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-)
net/ipv4/netfilter/arptable_filter.c +1 -1
@@ -82,8 +82,8 @@ static int __init arptable_filter_init(void) static void __exit arptable_filter_fini(void) { -unregister_pernet_subsys (&arptable_filter_net_ops);xt_unregister_template (&packet_filter); +unregister_pernet_subsys (&arptable_filter_net_ops);kfree (arpfilter_ops); }
net/ipv4/netfilter/iptable_filter.c +1 -1
@@ -101,8 +101,8 @@ static int __init iptable_filter_init(void) static void __exit iptable_filter_fini(void) { -unregister_pernet_subsys (&iptable_filter_net_ops);xt_unregister_template (&packet_filter); +unregister_pernet_subsys (&iptable_filter_net_ops);kfree (filter_ops); }
net/ipv4/netfilter/iptable_mangle.c +1 -1
@@ -134,8 +134,8 @@ static int __init iptable_mangle_init(void) static void __exit iptable_mangle_fini(void) { -unregister_pernet_subsys (&iptable_mangle_net_ops);xt_unregister_template (&packet_mangler); +unregister_pernet_subsys (&iptable_mangle_net_ops);kfree (mangle_ops); }
net/ipv4/netfilter/iptable_raw.c +1 -1
@@ -100,9 +100,9 @@ static int __init iptable_raw_init(void) static void __exit iptable_raw_fini(void) { +xt_unregister_template (&packet_raw);unregister_pernet_subsys (&iptable_raw_net_ops);kfree (rawtable_ops); -xt_unregister_template (&packet_raw); }module_init (iptable_raw_init);
net/ipv4/netfilter/iptable_security.c +1 -1
@@ -89,9 +89,9 @@ static int __init iptable_security_init(void) static void __exit iptable_security_fini(void) { +xt_unregister_template (&security_table);unregister_pernet_subsys (&iptable_security_net_ops);kfree (sectbl_ops); -xt_unregister_template (&security_table); }module_init (iptable_security_init);
net/ipv6/netfilter/ip6table_filter.c +1 -1
@@ -100,8 +100,8 @@ static int __init ip6table_filter_init(void) static void __exit ip6table_filter_fini(void) { -unregister_pernet_subsys (&ip6table_filter_net_ops);xt_unregister_template (&packet_filter); +unregister_pernet_subsys (&ip6table_filter_net_ops);kfree (filter_ops); }
net/ipv6/netfilter/ip6table_mangle.c +1 -1
@@ -127,8 +127,8 @@ static int __init ip6table_mangle_init(void) static void __exit ip6table_mangle_fini(void) { -unregister_pernet_subsys (&ip6table_mangle_net_ops);xt_unregister_template (&packet_mangler); +unregister_pernet_subsys (&ip6table_mangle_net_ops);kfree (mangle_ops); }
net/ipv6/netfilter/ip6table_raw.c +1 -1
@@ -98,8 +98,8 @@ static int __init ip6table_raw_init(void) static void __exit ip6table_raw_fini(void) { -unregister_pernet_subsys (&ip6table_raw_net_ops);xt_unregister_template (&packet_raw); +unregister_pernet_subsys (&ip6table_raw_net_ops);kfree (rawtable_ops); }
net/ipv6/netfilter/ip6table_security.c +1 -1
@@ -88,8 +88,8 @@ static int __init ip6table_security_init(void) static void __exit ip6table_security_fini(void) { -unregister_pernet_subsys (&ip6table_security_net_ops);xt_unregister_template (&security_table); +unregister_pernet_subsys (&ip6table_security_net_ops);kfree (sectbl_ops); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 107/186 netfilter: arptables: allow xtables-nft only builds
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 4654467dc7e111e84f43ed1b70322873ae77e7be ]
Allows to build kernel that supports the arptables mangle target via nftables' compat infra but without the arptables get/setsockopt interface or the old arptables filter interpreter.
IOW, setting IP_NF_ARPFILTER=n will break arptables-legacy, but arptables-nft will continue to work as long as nftables compat support is enabled.
Stable-dep-of: b4597d5fd7d2 ("netfilter: x_tables: add and use xtables_unregister_table_exit")
--- net/ipv4/netfilter/Kconfig | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-)
net/ipv4/netfilter/Kconfig +13 -15
@@ -309,36 +309,34 @@ endif # IP_NF_IPTABLES # ARP tables config IP_NF_ARPTABLES - tristate "ARP tables support" - select NETFILTER_XTABLES - select NETFILTER_FAMILY_ARP - depends on NETFILTER_ADVANCED - help - arptables is a general, extensible packet identification framework. - The ARP packet filtering and mangling (manipulation)subsystems - use this: say Y or M here if you want to use either of those. - - To compile it as a module, choose M here. If unsure, say N. + tristate -if IP_NF_ARPTABLES +config NFT_COMPAT_ARP + tristate + depends on NF_TABLES_ARP && NFT_COMPAT + default m if NFT_COMPAT=m + default y if NFT_COMPAT=y config IP_NF_ARPFILTER - tristate "ARP packet filtering" + tristate "arptables-legacy packet filtering support" + select IP_NF_ARPTABLES help ARP packet filtering defines a table `filter', which has a series of rules for simple ARP packet filtering at local input and - local output. On a bridge, you can also specify filtering rules - for forwarded ARP packets. See the man page for arptables(8). + local output. This is only needed for arptables-legacy(8). + Neither arptables-nft nor nftables need this to work. To compile it as a module, choose M here. If unsure, say N. config IP_NF_ARP_MANGLE tristate "ARP payload mangling" + depends on IP_NF_ARPTABLES || NFT_COMPAT_ARP help Allows altering the ARP packet payload: source and destination hardware and network addresses. -endif # IP_NF_ARPTABLES + This option is needed by both arptables-legacy and arptables-nft. + It is not used by nftables. endmenu
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 108/186 netfilter: xtables: allow xtables-nft only builds
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit a9525c7f6219cee9284c0031c5930e8d41384677 ]
Add hidden IP(6)_NF_IPTABLES_LEGACY symbol.
When any of the "old" builtin tables are enabled the "old" iptables interface will be supported.
To disable the old set/getsockopt interface the existing options for the builtin tables need to be turned off:
CONFIG_IP_NF_IPTABLES=mCONFIG_IP_NF_FILTER is not setCONFIG_IP_NF_NAT is not setCONFIG_IP_NF_MANGLE is not setCONFIG_IP_NF_RAW is not setCONFIG_IP_NF_SECURITY is not set
Same for CONFIG_IP6_NF_ variants.
This allows to build a kernel that only supports ip(6)tables-nft (iptables-over-nftables api).
In the future the _LEGACY symbol will become visible and the select statements will be turned into 'depends on', but for now be on safe side so "make oldconfig" won't break things.
Stable-dep-of: b4597d5fd7d2 ("netfilter: x_tables: add and use xtables_unregister_table_exit")
--- net/ipv4/netfilter/Kconfig | 15 ++++++++++++--- net/ipv4/netfilter/Makefile | 2 +- net/ipv6/netfilter/Kconfig | 20 ++++++++++++++------ net/ipv6/netfilter/Makefile | 2 +- net/netfilter/Kconfig | 12 ++++++------ 5 files changed, 34 insertions(+), 17 deletions(-)
net/ipv4/netfilter/Kconfig +12 -3
@@ -10,6 +10,10 @@ config NF_DEFRAG_IPV4 tristate default n +# old sockopt interface and eval loop +config IP_NF_IPTABLES_LEGACY + tristate + config NF_SOCKET_IPV4 tristate "IPv4 socket lookup support" help
@@ -152,7 +156,7 @@ config IP_NF_MATCH_ECN config IP_NF_MATCH_RPFILTER tristate '"rpfilter" reverse path filter match support' depends on NETFILTER_ADVANCED - depends on IP_NF_MANGLE || IP_NF_RAW + depends on IP_NF_MANGLE || IP_NF_RAW || NFT_COMPAT help This option allows you to match packets whose replies would go out via the interface the packet came in.
@@ -173,6 +177,7 @@ config IP_NF_MATCH_TTL config IP_NF_FILTER tristate "Packet filtering" default m if NETFILTER_ADVANCED=n + select IP_NF_IPTABLES_LEGACY help Packet filtering defines a table `filter', which has a series of rules for simple packet filtering at local input, forwarding and
@@ -182,7 +187,7 @@ config IP_NF_FILTER config IP_NF_TARGET_REJECT tristate "REJECT target support" - depends on IP_NF_FILTER + depends on IP_NF_FILTER || NFT_COMPAT select NF_REJECT_IPV4 default m if NETFILTER_ADVANCED=n help
@@ -212,6 +217,7 @@ config IP_NF_NAT default m if NETFILTER_ADVANCED=n select NF_NAT select NETFILTER_XT_NAT + select IP6_NF_IPTABLES_LEGACY help This enables the `nat' table in iptables. This allows masquerading, port forwarding and other forms of full Network Address Port
@@ -252,6 +258,7 @@ endif # IP_NF_NAT config IP_NF_MANGLE tristate "Packet mangling" default m if NETFILTER_ADVANCED=n + select IP_NF_IPTABLES_LEGACY help This option adds a `mangle' table to iptables: see the man page for iptables(8). This table is used for various packet alterations
@@ -261,7 +268,7 @@ config IP_NF_MANGLE config IP_NF_TARGET_ECN tristate "ECN target support" - depends on IP_NF_MANGLE + depends on IP_NF_MANGLE || NFT_COMPAT depends on NETFILTER_ADVANCED help This option adds a `ECN' target, which can be used in the iptables mangle
@@ -286,6 +293,7 @@ config IP_NF_TARGET_TTL # raw + specific targets config IP_NF_RAW tristate 'raw table support (required for NOTRACK/TRACE)' + select IP_NF_IPTABLES_LEGACY help This option adds a `raw' table to iptables. This table is the very first in the netfilter framework and hooks in at the PREROUTING
@@ -299,6 +307,7 @@ config IP_NF_SECURITY tristate "Security table" depends on SECURITY depends on NETFILTER_ADVANCED + select IP_NF_IPTABLES_LEGACY help This option adds a `security' table to iptables, for use with Mandatory Access Control (MAC) policy.
net/ipv4/netfilter/Makefile +1 -1
@@ -25,7 +25,7 @@ obj-$(CONFIG_NFT_FIB_IPV4) += nft_fib_ipv4.o obj-$(CONFIG_NFT_DUP_IPV4) += nft_dup_ipv4.o # generic IP tables -obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o +obj-$(CONFIG_IP_NF_IPTABLES_LEGACY) += ip_tables.o # the three instances of ip_tables obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
net/ipv6/netfilter/Kconfig +14 -6
@@ -6,6 +6,10 @@ menu "IPv6: Netfilter Configuration" depends on INET && IPV6 && NETFILTER +# old sockopt interface and eval loop +config IP6_NF_IPTABLES_LEGACY + tristate + config NF_SOCKET_IPV6 tristate "IPv6 socket lookup support" help
@@ -147,7 +151,7 @@ config IP6_NF_MATCH_MH config IP6_NF_MATCH_RPFILTER tristate '"rpfilter" reverse path filter match support' depends on NETFILTER_ADVANCED - depends on IP6_NF_MANGLE || IP6_NF_RAW + depends on IP6_NF_MANGLE || IP6_NF_RAW || NFT_COMPAT help This option allows you to match packets whose replies would go out via the interface the packet came in.
@@ -186,6 +190,8 @@ config IP6_NF_TARGET_HL config IP6_NF_FILTER tristate "Packet filtering" default m if NETFILTER_ADVANCED=n + select IP6_NF_IPTABLES_LEGACY + tristate help Packet filtering defines a table `filter', which has a series of rules for simple packet filtering at local input, forwarding and
@@ -195,7 +201,7 @@ config IP6_NF_FILTER config IP6_NF_TARGET_REJECT tristate "REJECT target support" - depends on IP6_NF_FILTER + depends on IP6_NF_FILTER || NFT_COMPAT select NF_REJECT_IPV6 default m if NETFILTER_ADVANCED=n help
@@ -221,6 +227,7 @@ config IP6_NF_TARGET_SYNPROXY config IP6_NF_MANGLE tristate "Packet mangling" default m if NETFILTER_ADVANCED=n + select IP6_NF_IPTABLES_LEGACY help This option adds a `mangle' table to iptables: see the man page for iptables(8). This table is used for various packet alterations
@@ -230,6 +237,7 @@ config IP6_NF_MANGLE config IP6_NF_RAW tristate 'raw table support (required for TRACE)' + select IP6_NF_IPTABLES_LEGACY help This option adds a `raw' table to ip6tables. This table is the very first in the netfilter framework and hooks in at the PREROUTING
@@ -243,6 +251,7 @@ config IP6_NF_SECURITY tristate "Security table" depends on SECURITY depends on NETFILTER_ADVANCED + select IP6_NF_IPTABLES_LEGACY help This option adds a `security' table to iptables, for use with Mandatory Access Control (MAC) policy.
@@ -254,6 +263,7 @@ config IP6_NF_NAT depends on NF_CONNTRACK depends on NETFILTER_ADVANCED select NF_NAT + select IP6_NF_IPTABLES_LEGACY select NETFILTER_XT_NAT help This enables the `nat' table in ip6tables. This allows masquerading,
@@ -262,25 +272,23 @@ config IP6_NF_NAT To compile it as a module, choose M here. If unsure, say N. -if IP6_NF_NAT - config IP6_NF_TARGET_MASQUERADE tristate "MASQUERADE target support" select NETFILTER_XT_TARGET_MASQUERADE + depends on IP6_NF_NAT help This is a backwards-compat option for the user's convenience (e.g. when running oldconfig). It selects NETFILTER_XT_TARGET_MASQUERADE. config IP6_NF_TARGET_NPT tristate "NPT (Network Prefix translation) target support" + depends on IP6_NF_NAT || NFT_COMPAT help This option adds the `SNPT' and `DNPT' target, which perform stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296. To compile it as a module, choose M here. If unsure, say N. -endif # IP6_NF_NAT - endif # IP6_NF_IPTABLES endmenu
net/ipv6/netfilter/Makefile +1 -1
@@ -4,7 +4,7 @@ # # Link order matters here. -obj-$(CONFIG_IP6_NF_IPTABLES) += ip6_tables.o +obj-$(CONFIG_IP6_NF_IPTABLES_LEGACY) += ip6_tables.o obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
net/netfilter/Kconfig +6 -6
@@ -818,7 +818,7 @@ config NETFILTER_XT_TARGET_AUDIT config NETFILTER_XT_TARGET_CHECKSUM tristate "CHECKSUM target support" - depends on IP_NF_MANGLE || IP6_NF_MANGLE + depends on IP_NF_MANGLE || IP6_NF_MANGLE || NFT_COMPAT depends on NETFILTER_ADVANCED help This option adds a `CHECKSUM' target, which can be used in the iptables mangle
@@ -869,7 +869,7 @@ config NETFILTER_XT_TARGET_CONNSECMARK config NETFILTER_XT_TARGET_CT tristate '"CT" target support' depends on NF_CONNTRACK - depends on IP_NF_RAW || IP6_NF_RAW + depends on IP_NF_RAW || IP6_NF_RAW || NFT_COMPAT depends on NETFILTER_ADVANCED help This options adds a `CT' target, which allows to specify initial
@@ -880,7 +880,7 @@ config NETFILTER_XT_TARGET_CT config NETFILTER_XT_TARGET_DSCP tristate '"DSCP" and "TOS" target support' - depends on IP_NF_MANGLE || IP6_NF_MANGLE + depends on IP_NF_MANGLE || IP6_NF_MANGLE || NFT_COMPAT depends on NETFILTER_ADVANCED help This option adds a `DSCP' target, which allows you to manipulate
@@ -896,7 +896,7 @@ config NETFILTER_XT_TARGET_DSCP config NETFILTER_XT_TARGET_HL tristate '"HL" hoplimit target support' - depends on IP_NF_MANGLE || IP6_NF_MANGLE + depends on IP_NF_MANGLE || IP6_NF_MANGLE || NFT_COMPAT depends on NETFILTER_ADVANCED help This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
@@ -1080,7 +1080,7 @@ config NETFILTER_XT_TARGET_TPROXY depends on NETFILTER_ADVANCED depends on IPV6 || IPV6=n depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n - depends on IP_NF_MANGLE + depends on IP_NF_MANGLE || NFT_COMPAT select NF_DEFRAG_IPV4 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n select NF_TPROXY_IPV4
@@ -1147,7 +1147,7 @@ config NETFILTER_XT_TARGET_TCPMSS config NETFILTER_XT_TARGET_TCPOPTSTRIP tristate '"TCPOPTSTRIP" target support' - depends on IP_NF_MANGLE || IP6_NF_MANGLE + depends on IP_NF_MANGLE || IP6_NF_MANGLE || NFT_COMPAT depends on NETFILTER_ADVANCED help This option adds a "TCPOPTSTRIP" target, which allows you to strip
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 109/186 netfilter: ebtables: allow xtables-nft only builds
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 7ad269787b6615ca56bb161063331991fce51abf ]
Same patch as previous one, but for ebtables.
To build a kernel that only supports ebtables-nft, the builtin tables need to be disabled, i.e.:
CONFIG_BRIDGE_EBT_BROUTE=nCONFIG_BRIDGE_EBT_T_FILTER=nCONFIG_BRIDGE_EBT_T_NAT=n
The ebtables specific extensions can then be used nftables' NFT_COMPAT interface.
Stable-dep-of: b4597d5fd7d2 ("netfilter: x_tables: add and use xtables_unregister_table_exit")
--- net/bridge/netfilter/Kconfig | 7 +++++++ net/bridge/netfilter/Makefile | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-)
net/bridge/netfilter/Kconfig +7 -0
@@ -39,6 +39,10 @@ config NF_CONNTRACK_BRIDGE To compile it as a module, choose M here. If unsure, say N. +# old sockopt interface and eval loop +config BRIDGE_NF_EBTABLES_LEGACY + tristate + menuconfig BRIDGE_NF_EBTABLES tristate "Ethernet Bridge tables (ebtables) support" depends on BRIDGE && NETFILTER && NETFILTER_XTABLES
@@ -55,6 +59,7 @@ if BRIDGE_NF_EBTABLES # config BRIDGE_EBT_BROUTE tristate "ebt: broute table support" + select BRIDGE_NF_EBTABLES_LEGACY help The ebtables broute table is used to define rules that decide between bridging and routing frames, giving Linux the functionality of a
@@ -65,6 +70,7 @@ config BRIDGE_EBT_BROUTE config BRIDGE_EBT_T_FILTER tristate "ebt: filter table support" + select BRIDGE_NF_EBTABLES_LEGACY help The ebtables filter table is used to define frame filtering rules at local input, forwarding and local output. See the man page for
@@ -74,6 +80,7 @@ config BRIDGE_EBT_T_FILTER config BRIDGE_EBT_T_NAT tristate "ebt: nat table support" + select BRIDGE_NF_EBTABLES_LEGACY help The ebtables nat table is used to define rules that alter the MAC source address (MAC SNAT) or the MAC destination address (MAC DNAT).
net/bridge/netfilter/Makefile +1 -1
@@ -9,7 +9,7 @@ obj-$(CONFIG_NFT_BRIDGE_REJECT) += nft_reject_bridge.o # connection tracking obj-$(CONFIG_NF_CONNTRACK_BRIDGE) += nf_conntrack_bridge.o -obj-$(CONFIG_BRIDGE_NF_EBTABLES) += ebtables.o +obj-$(CONFIG_BRIDGE_NF_EBTABLES_LEGACY) += ebtables.o # tables obj-$(CONFIG_BRIDGE_EBT_BROUTE) += ebtable_broute.o
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 110/186 netfilter: xtables: fix up kconfig dependencies
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 749d4ef0868c5d8a98e07073791b2198178c93b4 ]
Randy Dunlap reports arptables build failure:
arp_tables.c:(.text+0x20): undefined reference to `xt_find_table'
... because recent change removed a 'select' on the xtables core. Add a "depends" clause on arptables to resolve this.
Kernel test robot reports another build breakage:
iptable_nat.c:(.text+0x8): undefined reference to `ipt_unregister_table_exit'
... because of a typo, the nat table selected ip6tables.
Stable-dep-of: b4597d5fd7d2 ("netfilter: x_tables: add and use xtables_unregister_table_exit")
--- net/ipv4/netfilter/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv4/netfilter/Kconfig +2 -1
@@ -217,7 +217,7 @@ config IP_NF_NAT default m if NETFILTER_ADVANCED=n select NF_NAT select NETFILTER_XT_NAT - select IP6_NF_IPTABLES_LEGACY + select IP_NF_IPTABLES_LEGACY help This enables the `nat' table in iptables. This allows masquerading, port forwarding and other forms of full Network Address Port
@@ -329,6 +329,7 @@ config NFT_COMPAT_ARP config IP_NF_ARPFILTER tristate "arptables-legacy packet filtering support" select IP_NF_ARPTABLES + depends on NETFILTER_XTABLES help ARP packet filtering defines a table `filter', which has a series of rules for simple ARP packet filtering at local input and
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 111/186 netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp_tables.c
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 15fba562f7a9f04322b8bfc8f392e04bb93d81be ]
syzkaller started to report a warning below [0] after consuming the commit 4654467dc7e1 ("netfilter: arptables: allow xtables-nft only builds").
The change accidentally removed the dependency on NETFILTER_FAMILY_ARP from IP_NF_ARPTABLES.
If NF_TABLES_ARP is not enabled on Kconfig, NETFILTER_FAMILY_ARP will be removed and some code necessary for arptables will not be compiled.
$ grep -E "(NETFILTER_FAMILY_ARP|IP_NF_ARPTABLES|NF_TABLES_ARP)" .config CONFIG_NETFILTER_FAMILY_ARP=y # CONFIG_NF_TABLES_ARP is not set CONFIG_IP_NF_ARPTABLES=y
$ make olddefconfig
$ grep -E "(NETFILTER_FAMILY_ARP|IP_NF_ARPTABLES|NF_TABLES_ARP)" .config # CONFIG_NF_TABLES_ARP is not set CONFIG_IP_NF_ARPTABLES=y
So, when nf_register_net_hooks() is called for arptables, it will trigger the splat below.
Now IP_NF_ARPTABLES is only enabled by IP_NF_ARPFILTER, so let's restore the dependency on NETFILTER_FAMILY_ARP in IP_NF_ARPFILTER.
[0]:
WARNING: CPU: 0 PID: 242 at net/netfilter/core.c:316 nf_hook_entry_head+0x1e1/0x2c0 net/netfilter/core.c:316 Modules linked in: CPU: 0 PID: 242 Comm: syz-executor.0 Not tainted 6.8.0-12821-g537c2e91d354 #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:nf_hook_entry_head+0x1e1/0x2c0 net/netfilter/core.c:316 Code: 83 fd 04 0f 87 bc 00 00 00 e8 5b 84 83 fd 4d 8d ac ec a8 0b 00 00 e8 4e 84 83 fd 4c 89 e8 5b 5d 41 5c 41 5d c3 e8 3f 84 83 fd <0f> 0b e8 38 84 83 fd 45 31 ed 5b 5d 4c 89 e8 41 5c 41 5d c3 e8 26 RSP: 0018:ffffc90000b8f6e8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff83c42164 RDX: ffff888106851180 RSI: ffffffff83c42321 RDI: 0000000000000005 RBP: 0000000000000000 R08: 0000000000000005 R09: 000000000000000a R10: 0000000000000003 R11: ffff8881055c2f00 R12: ffff888112b78000 R13: 0000000000000000 R14: ffff8881055c2f00 R15: ffff8881055c2f00 FS: 00007f377bd78800(0000) GS:ffff88811b000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000496068 CR3: 000000011298b003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> __nf_register_net_hook+0xcd/0x7a0 net/netfilter/core.c:428 nf_register_net_hook+0x116/0x170 net/netfilter/core.c:578 nf_register_net_hooks+0x5d/0xc0 net/netfilter/core.c:594 arpt_register_table+0x250/0x420 net/ipv4/netfilter/arp_tables.c:1553 arptable_filter_table_init+0x41/0x60 net/ipv4/netfilter/arptable_filter.c:39 xt_find_table_lock+0x2e9/0x4b0 net/netfilter/x_tables.c:1260 xt_request_find_table_lock+0x2b/0xe0 net/netfilter/x_tables.c:1285 get_info+0x169/0x5c0 net/ipv4/netfilter/arp_tables.c:808 do_arpt_get_ctl+0x3f9/0x830 net/ipv4/netfilter/arp_tables.c:1444 nf_getsockopt+0x76/0xd0 net/netfilter/nf_sockopt.c:116 ip_getsockopt+0x17d/0x1c0 net/ipv4/ip_sockglue.c:1777 tcp_getsockopt+0x99/0x100 net/ipv4/tcp.c:4373 do_sock_getsockopt+0x279/0x360 net/socket.c:2373 __sys_getsockopt+0x115/0x1e0 net/socket.c:2402 __do_sys_getsockopt net/socket.c:2412 [inline] __se_sys_getsockopt net/socket.c:2409 [inline] __x64_sys_getsockopt+0xbd/0x150 net/socket.c:2409 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x4f/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x46/0x4e RIP: 0033:0x7f377beca6fe Code: 1f 44 00 00 48 8b 15 01 97 0a 00 f7 d8 64 89 02 b8 ff ff ff ff eb b8 0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 c9 RSP: 002b:00000000005df728 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 RAX: ffffffffffffffda RBX: 00000000004966e0 RCX: 00007f377beca6fe RDX: 0000000000000060 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 000000000042938a R08: 00000000005df73c R09: 00000000005df800 R10: 00000000004966e8 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000496068 R14: 0000000000000003 R15: 00000000004bc9d8 </TASK>
Stable-dep-of: b4597d5fd7d2 ("netfilter: x_tables: add and use xtables_unregister_table_exit")
--- net/ipv4/netfilter/Kconfig | 1 + 1 file changed, 1 insertion(+)
net/ipv4/netfilter/Kconfig +1 -0
@@ -329,6 +329,7 @@ config NFT_COMPAT_ARP config IP_NF_ARPFILTER tristate "arptables-legacy packet filtering support" select IP_NF_ARPTABLES + select NETFILTER_FAMILY_ARP depends on NETFILTER_XTABLES help ARP packet filtering defines a table `filter', which has a series of
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 112/186 netfilter: Make legacy configs user selectable
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit 6c959fd5e17387201dba3619b2e6af213939a0a7 ]
This option makes legacy Netfilter Kconfig user selectable, giving users the option to configure iptables without enabling any other config.
Make the following KConfig entries user selectable:
* BRIDGE_NF_EBTABLES_LEGACY
* IP_NF_ARPTABLES
* IP_NF_IPTABLES_LEGACY
* IP6_NF_IPTABLES_LEGACY
Stable-dep-of: b4597d5fd7d2 ("netfilter: x_tables: add and use xtables_unregister_table_exit")
--- net/bridge/netfilter/Kconfig | 8 +++++++- net/ipv4/netfilter/Kconfig | 16 ++++++++++++++-- net/ipv6/netfilter/Kconfig | 9 ++++++++- 3 files changed, 29 insertions(+), 4 deletions(-)
net/bridge/netfilter/Kconfig +7 -1
@@ -41,7 +41,13 @@ config NF_CONNTRACK_BRIDGE # old sockopt interface and eval loop config BRIDGE_NF_EBTABLES_LEGACY - tristate + tristate "Legacy EBTABLES support" + depends on BRIDGE && NETFILTER_XTABLES + default n + help + Legacy ebtables packet/frame classifier. + This is not needed if you are using ebtables over nftables + (iptables-nft). menuconfig BRIDGE_NF_EBTABLES tristate "Ethernet Bridge tables (ebtables) support"
net/ipv4/netfilter/Kconfig +14 -2
@@ -12,7 +12,13 @@ config NF_DEFRAG_IPV4 # old sockopt interface and eval loop config IP_NF_IPTABLES_LEGACY - tristate + tristate "Legacy IP tables support" + default n + select NETFILTER_XTABLES + help + iptables is a legacy packet classifier. + This is not needed if you are using iptables over nftables + (iptables-nft). config NF_SOCKET_IPV4 tristate "IPv4 socket lookup support"
@@ -318,7 +324,13 @@ endif # IP_NF_IPTABLES # ARP tables config IP_NF_ARPTABLES - tristate + tristate "Legacy ARPTABLES support" + depends on NETFILTER_XTABLES + default n + help + arptables is a legacy packet classifier. + This is not needed if you are using arptables over nftables + (iptables-nft). config NFT_COMPAT_ARP tristate
net/ipv6/netfilter/Kconfig +8 -1
@@ -8,7 +8,14 @@ menu "IPv6: Netfilter Configuration" # old sockopt interface and eval loop config IP6_NF_IPTABLES_LEGACY - tristate + tristate "Legacy IP6 tables support" + depends on INET && IPV6 + select NETFILTER_XTABLES + default n + help + ip6tables is a legacy packet classifier. + This is not needed if you are using iptables over nftables + (iptables-nft). config NF_SOCKET_IPV6 tristate "IPv6 socket lookup support"
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 113/186 netfilter: Exclude LEGACY TABLES on PREEMPT_RT.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 9fce66583f06c212e95e4b76dd61d8432ffa56b6 ]
The seqcount xt_recseq is used to synchronize the replacement of xt_table::private in xt_replace_table() against all readers such as ipt_do_table()
To ensure that there is only one writer, the writing side disables bottom halves. The sequence counter can be acquired recursively. Only the first invocation modifies the sequence counter (signaling that a writer is in progress) while the following (recursive) writer does not modify the counter.
The lack of a proper locking mechanism for the sequence counter can lead to live lock on PREEMPT_RT if the high prior reader preempts the writer. Additionally if the per-CPU lock on PREEMPT_RT is removed from local_bh_disable() then there is no synchronisation for the per-CPU sequence counter.
The affected code is "just" the legacy netfilter code which is replaced by "netfilter tables". That code can be disabled without sacrificing functionality because everything is provided by the newer implementation. This will only requires the usage of the "-nft" tools instead of the "-legacy" ones.
The long term plan is to remove the legacy code so lets accelerate the progress.
Relax dependencies on iptables legacy, replace select with depends on, this should cause no harm to existing kernel configs and users can still toggle IP{6}_NF_IPTABLES_LEGACY in any case.
Make EBTABLES_LEGACY, IPTABLES_LEGACY and ARPTABLES depend on NETFILTER_XTABLES_LEGACY. Hide xt_recseq and its users, xt_register_table() and xt_percpu_counter_alloc() behind NETFILTER_XTABLES_LEGACY. Let NETFILTER_XTABLES_LEGACY depend on !PREEMPT_RT.
This will break selftest expecing the legacy options enabled and will be addressed in a following patch.
Stable-dep-of: b4597d5fd7d2 ("netfilter: x_tables: add and use xtables_unregister_table_exit")
--- net/bridge/netfilter/Kconfig | 10 +++++----- net/ipv4/netfilter/Kconfig | 24 ++++++++++++------------ net/ipv6/netfilter/Kconfig | 19 +++++++++---------- net/netfilter/Kconfig | 10 ++++++++++ net/netfilter/x_tables.c | 16 +++++++++++----- 5 files changed, 47 insertions(+), 32 deletions(-)
net/bridge/netfilter/Kconfig +5 -5
@@ -42,8 +42,8 @@ config NF_CONNTRACK_BRIDGE # old sockopt interface and eval loop config BRIDGE_NF_EBTABLES_LEGACY tristate "Legacy EBTABLES support" - depends on BRIDGE && NETFILTER_XTABLES - default n + depends on BRIDGE && NETFILTER_XTABLES_LEGACY + default n help Legacy ebtables packet/frame classifier. This is not needed if you are using ebtables over nftables
@@ -65,7 +65,7 @@ if BRIDGE_NF_EBTABLES # config BRIDGE_EBT_BROUTE tristate "ebt: broute table support" - select BRIDGE_NF_EBTABLES_LEGACY + depends on BRIDGE_NF_EBTABLES_LEGACY help The ebtables broute table is used to define rules that decide between bridging and routing frames, giving Linux the functionality of a
@@ -76,7 +76,7 @@ config BRIDGE_EBT_BROUTE config BRIDGE_EBT_T_FILTER tristate "ebt: filter table support" - select BRIDGE_NF_EBTABLES_LEGACY + depends on BRIDGE_NF_EBTABLES_LEGACY help The ebtables filter table is used to define frame filtering rules at local input, forwarding and local output. See the man page for
@@ -86,7 +86,7 @@ config BRIDGE_EBT_T_FILTER config BRIDGE_EBT_T_NAT tristate "ebt: nat table support" - select BRIDGE_NF_EBTABLES_LEGACY + depends on BRIDGE_NF_EBTABLES_LEGACY help The ebtables nat table is used to define rules that alter the MAC source address (MAC SNAT) or the MAC destination address (MAC DNAT).
net/ipv4/netfilter/Kconfig +12 -12
@@ -13,8 +13,8 @@ config NF_DEFRAG_IPV4 # old sockopt interface and eval loop config IP_NF_IPTABLES_LEGACY tristate "Legacy IP tables support" - default n - select NETFILTER_XTABLES + depends on NETFILTER_XTABLES_LEGACY + default m if NETFILTER_XTABLES_LEGACY help iptables is a legacy packet classifier. This is not needed if you are using iptables over nftables
@@ -182,8 +182,8 @@ config IP_NF_MATCH_TTL # `filter', generic and specific targets config IP_NF_FILTER tristate "Packet filtering" - default m if NETFILTER_ADVANCED=n - select IP_NF_IPTABLES_LEGACY + default m if NETFILTER_ADVANCED=n || IP_NF_IPTABLES_LEGACY + depends on IP_NF_IPTABLES_LEGACY help Packet filtering defines a table `filter', which has a series of rules for simple packet filtering at local input, forwarding and
@@ -220,10 +220,10 @@ config IP_NF_TARGET_SYNPROXY config IP_NF_NAT tristate "iptables NAT support" depends on NF_CONNTRACK + depends on IP_NF_IPTABLES_LEGACY default m if NETFILTER_ADVANCED=n select NF_NAT select NETFILTER_XT_NAT - select IP_NF_IPTABLES_LEGACY help This enables the `nat' table in iptables. This allows masquerading, port forwarding and other forms of full Network Address Port
@@ -263,8 +263,8 @@ endif # IP_NF_NAT # mangle + specific targets config IP_NF_MANGLE tristate "Packet mangling" - default m if NETFILTER_ADVANCED=n - select IP_NF_IPTABLES_LEGACY + default m if NETFILTER_ADVANCED=n || IP_NF_IPTABLES_LEGACY + depends on IP_NF_IPTABLES_LEGACY help This option adds a `mangle' table to iptables: see the man page for iptables(8). This table is used for various packet alterations
@@ -299,7 +299,7 @@ config IP_NF_TARGET_TTL # raw + specific targets config IP_NF_RAW tristate 'raw table support (required for NOTRACK/TRACE)' - select IP_NF_IPTABLES_LEGACY + depends on IP_NF_IPTABLES_LEGACY help This option adds a `raw' table to iptables. This table is the very first in the netfilter framework and hooks in at the PREROUTING
@@ -313,7 +313,7 @@ config IP_NF_SECURITY tristate "Security table" depends on SECURITY depends on NETFILTER_ADVANCED - select IP_NF_IPTABLES_LEGACY + depends on IP_NF_IPTABLES_LEGACY help This option adds a `security' table to iptables, for use with Mandatory Access Control (MAC) policy.
@@ -325,8 +325,8 @@ endif # IP_NF_IPTABLES # ARP tables config IP_NF_ARPTABLES tristate "Legacy ARPTABLES support" - depends on NETFILTER_XTABLES - default n + depends on NETFILTER_XTABLES_LEGACY + default n help arptables is a legacy packet classifier. This is not needed if you are using arptables over nftables
@@ -342,7 +342,7 @@ config IP_NF_ARPFILTER tristate "arptables-legacy packet filtering support" select IP_NF_ARPTABLES select NETFILTER_FAMILY_ARP - depends on NETFILTER_XTABLES + depends on NETFILTER_XTABLES_LEGACY help ARP packet filtering defines a table `filter', which has a series of rules for simple ARP packet filtering at local input and
net/ipv6/netfilter/Kconfig +9 -10
@@ -9,9 +9,8 @@ menu "IPv6: Netfilter Configuration" # old sockopt interface and eval loop config IP6_NF_IPTABLES_LEGACY tristate "Legacy IP6 tables support" - depends on INET && IPV6 - select NETFILTER_XTABLES - default n + depends on INET && IPV6 && NETFILTER_XTABLES_LEGACY + default m if NETFILTER_XTABLES_LEGACY help ip6tables is a legacy packet classifier. This is not needed if you are using iptables over nftables
@@ -196,8 +195,8 @@ config IP6_NF_TARGET_HL config IP6_NF_FILTER tristate "Packet filtering" - default m if NETFILTER_ADVANCED=n - select IP6_NF_IPTABLES_LEGACY + default m if NETFILTER_ADVANCED=n || IP6_NF_IPTABLES_LEGACY + depends on IP6_NF_IPTABLES_LEGACY tristate help Packet filtering defines a table `filter', which has a series of
@@ -233,8 +232,8 @@ config IP6_NF_TARGET_SYNPROXY config IP6_NF_MANGLE tristate "Packet mangling" - default m if NETFILTER_ADVANCED=n - select IP6_NF_IPTABLES_LEGACY + default m if NETFILTER_ADVANCED=n || IP6_NF_IPTABLES_LEGACY + depends on IP6_NF_IPTABLES_LEGACY help This option adds a `mangle' table to iptables: see the man page for iptables(8). This table is used for various packet alterations
@@ -244,7 +243,7 @@ config IP6_NF_MANGLE config IP6_NF_RAW tristate 'raw table support (required for TRACE)' - select IP6_NF_IPTABLES_LEGACY + depends on IP6_NF_IPTABLES_LEGACY help This option adds a `raw' table to ip6tables. This table is the very first in the netfilter framework and hooks in at the PREROUTING
@@ -258,7 +257,7 @@ config IP6_NF_SECURITY tristate "Security table" depends on SECURITY depends on NETFILTER_ADVANCED - select IP6_NF_IPTABLES_LEGACY + depends on IP6_NF_IPTABLES_LEGACY help This option adds a `security' table to iptables, for use with Mandatory Access Control (MAC) policy.
@@ -269,8 +268,8 @@ config IP6_NF_NAT tristate "ip6tables NAT support" depends on NF_CONNTRACK depends on NETFILTER_ADVANCED + depends on IP6_NF_IPTABLES_LEGACY select NF_NAT - select IP6_NF_IPTABLES_LEGACY select NETFILTER_XT_NAT help This enables the `nat' table in ip6tables. This allows masquerading,
net/netfilter/Kconfig +10 -0
@@ -762,6 +762,16 @@ config NETFILTER_XTABLES_COMPAT If unsure, say N. +config NETFILTER_XTABLES_LEGACY + bool "Netfilter legacy tables support" + depends on !PREEMPT_RT + help + Say Y here if you still require support for legacy tables. This is + required by the legacy tools (iptables-legacy) and is not needed if + you use iptables over nftables (iptables-nft). + Legacy support is not limited to IP, it also includes EBTABLES and + ARPTABLES. + comment "Xtables combined modules" config NETFILTER_XT_MARK
net/netfilter/x_tables.c +11 -5
@@ -1339,12 +1339,13 @@ void xt_compat_unlock(u_int8_t af)EXPORT_SYMBOL_GPL (xt_compat_unlock);#endif -DEFINE_PER_CPU (seqcount_t, xt_recseq); -EXPORT_PER_CPU_SYMBOL_GPL (xt_recseq); -struct static_key xt_tee_enabled__read_mostly ;EXPORT_SYMBOL_GPL (xt_tee_enabled); +#ifdef CONFIG_NETFILTER_XTABLES_LEGACY +DEFINE_PER_CPU (seqcount_t, xt_recseq); +EXPORT_PER_CPU_SYMBOL_GPL (xt_recseq); +static int xt_jumpstack_alloc (struct xt_table_info *i) {unsigned int size;
@@ -1536,6 +1537,7 @@ void *xt_unregister_table(struct xt_table *table) return private; }EXPORT_SYMBOL_GPL (xt_unregister_table); +#endif #ifdef CONFIG_PROC_FS static void *xt_table_seq_start (struct seq_file *seq,loff_t *pos)
@@ -1919,6 +1921,7 @@ void xt_proto_fini(struct net *net, u_int8_t af) }EXPORT_SYMBOL_GPL (xt_proto_fini); +#ifdef CONFIG_NETFILTER_XTABLES_LEGACY /** * xt_percpu_counter_alloc - allocate x_tables rule counter *
@@ -1973,6 +1976,7 @@ void xt_percpu_counter_free(struct xt_counters *counters) free_percpu((void __percpu *)pcnt); }EXPORT_SYMBOL_GPL (xt_percpu_counter_free); +#endif static int __net_init xt_net_init (struct net *net) {
@@ -2005,8 +2009,10 @@ static int __init xt_init(void)unsigned int i;int rv; -for_each_possible_cpu (i) { -seqcount_init (&per_cpu (xt_recseq, i)); +if (IS_ENABLED (CONFIG_NETFILTER_XTABLES_LEGACY )) { +for_each_possible_cpu (i) { +seqcount_init (&per_cpu (xt_recseq, i)); + } } xt =kcalloc (NFPROTO_NUMPROTO ,sizeof (struct xt_af ),GFP_KERNEL );
Signature · 1 line
2.53.0
Re: [PATCH 6.6 113/186] netfilter: Exclude LEGACY TABLES on PREEMPT_RT.
Hi Greg, Sasha,
Quoted 40 lines · Greg Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit
9fce66583f06c212e95e4b76dd61d8432ffa56b6]The seqcount
xt_recseqis used to synchronize the replacement ofxt_table::privateinxt_replace_table()against all readers such asipt_do_table()To ensure that there is only one writer, the writing side disables bottom halves. The sequence counter can be acquired recursively. Only the first invocation modifies the sequence counter (signaling that a writer is in progress) while the following (recursive) writer does not modify the counter.
The lack of a proper locking mechanism for the sequence counter can lead to live lock onPREEMPT_RTif the high prior reader preempts the writer. Additionally if the per-CPU lock onPREEMPT_RTis removed fromlocal_bh_disable()then there is no synchronisation for the per-CPU sequence counter.The affected code is "just" the legacy netfilter code which is replaced by "netfilter tables". That code can be disabled without sacrificing functionality because everything is provided by the newer implementation. This will only requires the usage of the "-nft" tools instead of the "-legacy" ones.
The long term plan is to remove the legacy code so lets accelerate the progress.Relax dependencies on iptables legacy, replace select with depends on, this should cause no harm to existing kernel configs and users can still toggle IP{6}_NF_IPTABLES_LEGACY in any case.
MakeEBTABLES_LEGACY,IPTABLES_LEGACYand ARPTABLES depend onNETFILTER_XTABLES_LEGACY. Hidext_recseqand its users,xt_register_table()andxt_percpu_counter_alloc()behindNETFILTER_XTABLES_LEGACY. LetNETFILTER_XTABLES_LEGACYdepend on !PREEMPT_RT.
Quoted 2 lines
This will break selftest expecing the legacy options enabled and will be addressed in a following patch.
It looks like this last sentence is still valid: some net selftests are broken because the mentioned "following patch" -- commit 3c3ab65f00eb ("selftests: net: Enable legacy netfilter legacy options.") -- has not been backported in this 6.6 version. Same for v6.1 and v5.15.
Do you mind adding it in v6.6, v6.1 and v5.15, please?
Cheers,
Matt
Signature · 1 line
Sponsored by the NGI0 Core fund.
Sasha Levin
maintainerRe: [PATCH 6.6 113/186] netfilter: Exclude LEGACY TABLES on PREEMPT_RT.
Quoted 6 lines · Matthieu Baerts
It looks like this last sentence is still valid: some net selftests are broken because the mentioned "following patch" -- commit
3c3ab65f00eb("selftests: net: Enable legacy netfilter legacy options.") -- has not been backported in this 6.6 version. Same for v6.1 and v5.15.Do you mind adding it in v6.6, v6.1 and v5.15, please?
Thanks for the report. Rather than ship this incomplete (it's also missing the build fix 25a8b88f000c that Harshit pointed out on the 6.12 thread), I've dropped the whole netfilter x_tables series from this RC. Because 9fce66583f06 carries Stable-dep-of: b4597d5fd7d2, the table-removal-race patches that depend on it came out with it (6.6/6.1/5.15, and 6.12).
--
Thanks,
Sasha
Greg Kroah-Hartman
maintainerPATCH 114/186 netfilter: x_tables: add and use xt_unregister_table_pre_exit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 527d6931473b75d90e38942aae6537d1a527f1fd ]
Remove the copypasted variants of _pre_exit and add one single function in the xtables core. ebtables is not compatible with x_tables and therefore unchanged.
This is a preparation patch to reduce noise in the followup bug fixes.
Stable-dep-of: b4597d5fd7d2 ("netfilter: x_tables: add and use xtables_unregister_table_exit")
--- include/linux/netfilter/x_tables.h | 1 + include/linux/netfilter_arp/arp_tables.h | 1 - include/linux/netfilter_ipv4/ip_tables.h | 1 - include/linux/netfilter_ipv6/ip6_tables.h | 1 - net/ipv4/netfilter/arp_tables.c | 9 ------- net/ipv4/netfilter/arptable_filter.c | 2 +- net/ipv4/netfilter/ip_tables.c | 9 ------- net/ipv4/netfilter/iptable_filter.c | 2 +- net/ipv4/netfilter/iptable_mangle.c | 2 +- net/ipv4/netfilter/iptable_nat.c | 1 + net/ipv4/netfilter/iptable_raw.c | 2 +- net/ipv4/netfilter/iptable_security.c | 2 +- net/ipv6/netfilter/ip6_tables.c | 9 ------- net/ipv6/netfilter/ip6table_filter.c | 2 +- net/ipv6/netfilter/ip6table_mangle.c | 2 +- net/ipv6/netfilter/ip6table_nat.c | 1 + net/ipv6/netfilter/ip6table_raw.c | 2 +- net/ipv6/netfilter/ip6table_security.c | 2 +- net/netfilter/x_tables.c | 29 +++++++++++++++++++++++ 19 files changed, 41 insertions(+), 39 deletions(-)
include/linux/netfilter/x_tables.h +1 -0
@@ -310,6 +310,7 @@ struct xt_table *xt_register_table(struct net *net,struct xt_table_info *bootstrap, struct xt_table_info *newinfo);void *xt_unregister_table (struct xt_table *table); +void xt_unregister_table_pre_exit (struct net *net,u8 af,const char *name); struct xt_table_info *xt_replace_table(struct xt_table *table, unsigned int num_counters,
include/linux/netfilter_arp/arp_tables.h +0 -1
@@ -53,7 +53,6 @@ int arpt_register_table(struct net *net, const struct xt_table *table,const struct arpt_replace *repl, const struct nf_hook_ops *ops);void arpt_unregister_table (struct net *net,const char *name); -void arpt_unregister_table_pre_exit (struct net *net,const char *name);extern unsigned int arpt_do_table (void *priv,struct sk_buff *skb,const struct nf_hook_state *state);
include/linux/netfilter_ipv4/ip_tables.h +0 -1
@@ -26,7 +26,6 @@ int ipt_register_table(struct net *net, const struct xt_table *table,const struct ipt_replace *repl, const struct nf_hook_ops *ops); -void ipt_unregister_table_pre_exit (struct net *net,const char *name);void ipt_unregister_table_exit (struct net *net,const char *name);/* Standard entry. */
include/linux/netfilter_ipv6/ip6_tables.h +0 -1
@@ -27,7 +27,6 @@ extern void *ip6t_alloc_initial_table(const struct xt_table *);int ip6t_register_table (struct net *net,const struct xt_table *table,const struct ip6t_replace *repl,const struct nf_hook_ops *ops); -void ip6t_unregister_table_pre_exit (struct net *net,const char *name);void ip6t_unregister_table_exit (struct net *net,const char *name);extern unsigned int ip6t_do_table (void *priv,struct sk_buff *skb,const struct nf_hook_state *state);
net/ipv4/netfilter/arp_tables.c +0 -9
@@ -1581,15 +1581,6 @@ int arpt_register_table(struct net *net,return ret; } -void arpt_unregister_table_pre_exit (struct net *net,const char *name) -{ -struct xt_table *table =xt_find_table (net,NFPROTO_ARP , name); - -if (table) -nf_unregister_net_hooks (net, table->ops,hweight32 (table->valid_hooks)); -} -EXPORT_SYMBOL (arpt_unregister_table_pre_exit); -void arpt_unregister_table (struct net *net,const char *name) {struct xt_table *table =xt_find_table (net,NFPROTO_ARP , name);
net/ipv4/netfilter/arptable_filter.c +1 -1
@@ -43,7 +43,7 @@ static int arptable_filter_table_init(struct net *net) static void __net_exit arptable_filter_net_pre_exit(struct net *net) { -arpt_unregister_table_pre_exit (net,"filter" ); +xt_unregister_table_pre_exit (net,NFPROTO_ARP ,"filter" ); } static void __net_exit arptable_filter_net_exit(struct net *net)
net/ipv4/netfilter/ip_tables.c +0 -9
@@ -1789,14 +1789,6 @@ int ipt_register_table(struct net *net, const struct xt_table *table,return ret; } -void ipt_unregister_table_pre_exit (struct net *net,const char *name) -{ -struct xt_table *table =xt_find_table (net,NFPROTO_IPV4 , name); - -if (table) -nf_unregister_net_hooks (net, table->ops,hweight32 (table->valid_hooks)); -} -void ipt_unregister_table_exit (struct net *net,const char *name) {struct xt_table *table =xt_find_table (net,NFPROTO_IPV4 , name);
@@ -1887,7 +1879,6 @@ static void __exit ip_tables_fini(void) }EXPORT_SYMBOL (ipt_register_table); -EXPORT_SYMBOL (ipt_unregister_table_pre_exit);EXPORT_SYMBOL (ipt_unregister_table_exit);EXPORT_SYMBOL (ipt_do_table);module_init (ip_tables_init);
net/ipv4/netfilter/iptable_filter.c +1 -1
@@ -61,7 +61,7 @@ static int __net_init iptable_filter_net_init(struct net *net) static void __net_exit iptable_filter_net_pre_exit(struct net *net) { -ipt_unregister_table_pre_exit (net,"filter" ); +xt_unregister_table_pre_exit (net,NFPROTO_IPV4 ,"filter" ); } static void __net_exit iptable_filter_net_exit(struct net *net)
net/ipv4/netfilter/iptable_mangle.c +1 -1
@@ -95,7 +95,7 @@ static int iptable_mangle_table_init(struct net *net) static void __net_exit iptable_mangle_net_pre_exit(struct net *net) { -ipt_unregister_table_pre_exit (net,"mangle" ); +xt_unregister_table_pre_exit (net,NFPROTO_IPV4 ,"mangle" ); } static void __net_exit iptable_mangle_net_exit(struct net *net)
net/ipv4/netfilter/iptable_nat.c +1 -0
@@ -129,6 +129,7 @@ static int iptable_nat_table_init(struct net *net) static void __net_exit iptable_nat_net_pre_exit(struct net *net) {ipt_nat_unregister_lookups (net); +xt_unregister_table_pre_exit (net,NFPROTO_IPV4 ,"nat" ); } static void __net_exit iptable_nat_net_exit(struct net *net)
net/ipv4/netfilter/iptable_raw.c +1 -1
@@ -53,7 +53,7 @@ static int iptable_raw_table_init(struct net *net) static void __net_exit iptable_raw_net_pre_exit(struct net *net) { -ipt_unregister_table_pre_exit (net,"raw" ); +xt_unregister_table_pre_exit (net,NFPROTO_IPV4 ,"raw" ); } static void __net_exit iptable_raw_net_exit(struct net *net)
net/ipv4/netfilter/iptable_security.c +1 -1
@@ -50,7 +50,7 @@ static int iptable_security_table_init(struct net *net) static void __net_exit iptable_security_net_pre_exit(struct net *net) { -ipt_unregister_table_pre_exit (net,"security" ); +xt_unregister_table_pre_exit (net,NFPROTO_IPV4 ,"security" ); } static void __net_exit iptable_security_net_exit(struct net *net)
net/ipv6/netfilter/ip6_tables.c +0 -9
@@ -1795,14 +1795,6 @@ int ip6t_register_table(struct net *net, const struct xt_table *table,return ret; } -void ip6t_unregister_table_pre_exit (struct net *net,const char *name) -{ -struct xt_table *table =xt_find_table (net,NFPROTO_IPV6 , name); - -if (table) -nf_unregister_net_hooks (net, table->ops,hweight32 (table->valid_hooks)); -} -void ip6t_unregister_table_exit (struct net *net,const char *name) {struct xt_table *table =xt_find_table (net,NFPROTO_IPV6 , name);
@@ -1894,7 +1886,6 @@ static void __exit ip6_tables_fini(void) }EXPORT_SYMBOL (ip6t_register_table); -EXPORT_SYMBOL (ip6t_unregister_table_pre_exit);EXPORT_SYMBOL (ip6t_unregister_table_exit);EXPORT_SYMBOL (ip6t_do_table);
net/ipv6/netfilter/ip6table_filter.c +1 -1
@@ -60,7 +60,7 @@ static int __net_init ip6table_filter_net_init(struct net *net) static void __net_exit ip6table_filter_net_pre_exit(struct net *net) { -ip6t_unregister_table_pre_exit (net,"filter" ); +xt_unregister_table_pre_exit (net,NFPROTO_IPV6 ,"filter" ); } static void __net_exit ip6table_filter_net_exit(struct net *net)
net/ipv6/netfilter/ip6table_mangle.c +1 -1
@@ -88,7 +88,7 @@ static int ip6table_mangle_table_init(struct net *net) static void __net_exit ip6table_mangle_net_pre_exit(struct net *net) { -ip6t_unregister_table_pre_exit (net,"mangle" ); +xt_unregister_table_pre_exit (net,NFPROTO_IPV6 ,"mangle" ); } static void __net_exit ip6table_mangle_net_exit(struct net *net)
net/ipv6/netfilter/ip6table_nat.c +1 -0
@@ -131,6 +131,7 @@ static int ip6table_nat_table_init(struct net *net) static void __net_exit ip6table_nat_net_pre_exit(struct net *net) {ip6t_nat_unregister_lookups (net); +xt_unregister_table_pre_exit (net,NFPROTO_IPV6 ,"nat" ); } static void __net_exit ip6table_nat_net_exit(struct net *net)
net/ipv6/netfilter/ip6table_raw.c +1 -1
@@ -52,7 +52,7 @@ static int ip6table_raw_table_init(struct net *net) static void __net_exit ip6table_raw_net_pre_exit(struct net *net) { -ip6t_unregister_table_pre_exit (net,"raw" ); +xt_unregister_table_pre_exit (net,NFPROTO_IPV6 ,"raw" ); } static void __net_exit ip6table_raw_net_exit(struct net *net)
net/ipv6/netfilter/ip6table_security.c +1 -1
@@ -49,7 +49,7 @@ static int ip6table_security_table_init(struct net *net) static void __net_exit ip6table_security_net_pre_exit(struct net *net) { -ip6t_unregister_table_pre_exit (net,"security" ); +xt_unregister_table_pre_exit (net,NFPROTO_IPV6 ,"security" ); } static void __net_exit ip6table_security_net_exit(struct net *net)
net/netfilter/x_tables.c +29 -0
@@ -1537,6 +1537,35 @@ void *xt_unregister_table(struct xt_table *table)return private; }EXPORT_SYMBOL_GPL (xt_unregister_table); + +/** +* xt_unregister_table_pre_exit - pre-shutdown unregister of a table +* @net: network namespace +* @af: address family (e.g., NFPROTO_IPV4, NFPROTO_IPV6) +* @name: name of the table to unregister +* +* Unregisters the specified netfilter table from the given network namespace +* and also unregisters the hooks from netfilter core: no new packets will be +* processed. +*/ +void xt_unregister_table_pre_exit (struct net *net,u8 af,const char *name) +{ +struct xt_pernet *xt_net =net_generic (net, xt_pernet_id); +struct xt_table *t; + +mutex_lock (&xt[af].mutex); +list_for_each_entry (t, &xt_net->tables[af], list) { +if (strcmp (t->name, name) ==0 ) { +mutex_unlock (&xt[af].mutex); + +if (t->ops)/* nat table registers with nat core, t->ops is NULL. */ +nf_unregister_net_hooks (net, t->ops,hweight32 (t->valid_hooks)); +return ; + } + } +mutex_unlock (&xt[af].mutex); +} +EXPORT_SYMBOL (xt_unregister_table_pre_exit);#endif #ifdef CONFIG_PROC_FS
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 115/186 netfilter: x_tables: add and use xtables_unregister_table_exit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit b4597d5fd7d2f8cebfffd40dffb5e003cc78964c ]
Previous change added xtables_unregister_table_pre_exit to detach the table from the packetpath and to unlink it from the active table list. In case of rmmod, userspace that is doing set/getsockopt for this table will not be able to re-instantiate the table:
1. The larval table has been removed already
2. existing instantiated table is no longer on the xt pernet table list.
This adds the second stage helper:
unlink the table from the dying list, free the hook ops (if any) and do the audit notification. It replaces xt_unregister_table().
--- include/linux/netfilter/x_tables.h | 2 +- net/ipv4/netfilter/arp_tables.c | 9 ++-- net/ipv4/netfilter/ip_tables.c | 9 ++-- net/ipv4/netfilter/iptable_nat.c | 5 +- net/ipv6/netfilter/ip6_tables.c | 9 ++-- net/ipv6/netfilter/ip6table_nat.c | 5 +- net/netfilter/x_tables.c | 81 +++++++++++++++++++++++------- 7 files changed, 83 insertions(+), 37 deletions(-)
include/linux/netfilter/x_tables.h +1 -1
@@ -309,8 +309,8 @@ struct xt_table *xt_register_table(struct net *net,const struct xt_table *table, struct xt_table_info *bootstrap, struct xt_table_info *newinfo); -void *xt_unregister_table (struct xt_table *table);void xt_unregister_table_pre_exit (struct net *net,u8 af,const char *name); +struct xt_table *xt_unregister_table_exit (struct net *net,u8 af,const char *name); struct xt_table_info *xt_replace_table(struct xt_table *table, unsigned int num_counters,
net/ipv4/netfilter/arp_tables.c +4 -5
@@ -1501,13 +1501,11 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *lenstatic void __arpt_unregister_table (struct net *net,struct xt_table *table) { -struct xt_table_info *private; -void *loc_cpu_entry; +struct xt_table_info *private = table->private;struct module *table_owner = table->me; +void *loc_cpu_entry;struct arpt_entry *iter; - private =xt_unregister_table (table); -/* Decrease module usage counts and free resources */ loc_cpu_entry = private->entries;xt_entry_foreach (iter, loc_cpu_entry, private->size)
@@ -1515,6 +1513,7 @@ static void __arpt_unregister_table(struct net *net, struct xt_table *table)if (private->number > private->initial_entries)module_put (table_owner);xt_free_table_info (private); +kfree (table); } int arpt_register_table(struct net *net,
@@ -1583,7 +1582,7 @@ int arpt_register_table(struct net *net,void arpt_unregister_table (struct net *net,const char *name) { -struct xt_table *table =xt_find_table (net,NFPROTO_ARP , name); +struct xt_table *table =xt_unregister_table_exit (net,NFPROTO_ARP , name);if (table)__arpt_unregister_table (net, table);
net/ipv4/netfilter/ip_tables.c +4 -5
@@ -1704,12 +1704,10 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)static void __ipt_unregister_table (struct net *net,struct xt_table *table) { -struct xt_table_info *private; -void *loc_cpu_entry; +struct xt_table_info *private = table->private;struct module *table_owner = table->me;struct ipt_entry *iter; - - private =xt_unregister_table (table); +void *loc_cpu_entry;/* Decrease module usage counts and free resources */ loc_cpu_entry = private->entries;
@@ -1718,6 +1716,7 @@ static void __ipt_unregister_table(struct net *net, struct xt_table *table)if (private->number > private->initial_entries)module_put (table_owner);xt_free_table_info (private); +kfree (table); } int ipt_register_table(struct net *net, const struct xt_table *table,
@@ -1791,7 +1790,7 @@ int ipt_register_table(struct net *net, const struct xt_table *table,void ipt_unregister_table_exit (struct net *net,const char *name) { -struct xt_table *table =xt_find_table (net,NFPROTO_IPV4 , name); +struct xt_table *table =xt_unregister_table_exit (net,NFPROTO_IPV4 , name);if (table)__ipt_unregister_table (net, table);
net/ipv4/netfilter/iptable_nat.c +4 -1
@@ -119,8 +119,11 @@ static int iptable_nat_table_init(struct net *net) } ret =ipt_nat_register_lookups (net); -if (ret <0 ) +if (ret <0 ) { +xt_unregister_table_pre_exit (net,NFPROTO_IPV4 ,"nat" ); +synchronize_rcu ();ipt_unregister_table_exit (net,"nat" ); + }kfree (repl);return ret;
net/ipv6/netfilter/ip6_tables.c +4 -5
@@ -1713,12 +1713,10 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)static void __ip6t_unregister_table (struct net *net,struct xt_table *table) { -struct xt_table_info *private; -void *loc_cpu_entry; +struct xt_table_info *private = table->private;struct module *table_owner = table->me;struct ip6t_entry *iter; - - private =xt_unregister_table (table); +void *loc_cpu_entry;/* Decrease module usage counts and free resources */ loc_cpu_entry = private->entries;
@@ -1727,6 +1725,7 @@ static void __ip6t_unregister_table(struct net *net, struct xt_table *table)if (private->number > private->initial_entries)module_put (table_owner);xt_free_table_info (private); +kfree (table); } int ip6t_register_table(struct net *net, const struct xt_table *table,
@@ -1797,7 +1796,7 @@ int ip6t_register_table(struct net *net, const struct xt_table *table,void ip6t_unregister_table_exit (struct net *net,const char *name) { -struct xt_table *table =xt_find_table (net,NFPROTO_IPV6 , name); +struct xt_table *table =xt_unregister_table_exit (net,NFPROTO_IPV6 , name);if (table)__ip6t_unregister_table (net, table);
net/ipv6/netfilter/ip6table_nat.c +4 -1
@@ -121,8 +121,11 @@ static int ip6table_nat_table_init(struct net *net) } ret =ip6t_nat_register_lookups (net); -if (ret <0 ) +if (ret <0 ) { +xt_unregister_table_pre_exit (net,NFPROTO_IPV6 ,"nat" ); +synchronize_rcu ();ip6t_unregister_table_exit (net,"nat" ); + }kfree (repl);return ret;
net/netfilter/x_tables.c +62 -19
125 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 116/186 netfilter: ebtables: move to two-stage removal scheme
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit b7f0544d86d439cb946515d2ef6a0a75e8626710 ]
Like previous patches for x_tables, follow same pattern in ebtables. We can't reuse xt helpers: ebt_table struct layout is incompatible.
table->ops assignment is now done while still holding the ebt mutex to make sure we never expose partially-filled table struct.
--- net/bridge/netfilter/ebtable_broute.c | 2 +- net/bridge/netfilter/ebtable_filter.c | 2 +- net/bridge/netfilter/ebtable_nat.c | 2 +- net/bridge/netfilter/ebtables.c | 60 +++++++++++++++++---------- 4 files changed, 40 insertions(+), 26 deletions(-)
net/bridge/netfilter/ebtable_broute.c +1 -1
@@ -128,8 +128,8 @@ static int __init ebtable_broute_init(void) static void __exit ebtable_broute_fini(void) { -unregister_pernet_subsys (&broute_net_ops);ebt_unregister_template (&broute_table); +unregister_pernet_subsys (&broute_net_ops); }module_init (ebtable_broute_init);
net/bridge/netfilter/ebtable_filter.c +1 -1
@@ -109,8 +109,8 @@ static int __init ebtable_filter_init(void) static void __exit ebtable_filter_fini(void) { -unregister_pernet_subsys (&frame_filter_net_ops);ebt_unregister_template (&frame_filter); +unregister_pernet_subsys (&frame_filter_net_ops); }module_init (ebtable_filter_init);
net/bridge/netfilter/ebtable_nat.c +1 -1
@@ -109,8 +109,8 @@ static int __init ebtable_nat_init(void) static void __exit ebtable_nat_fini(void) { -unregister_pernet_subsys (&frame_nat_net_ops);ebt_unregister_template (&frame_nat); +unregister_pernet_subsys (&frame_nat_net_ops); }module_init (ebtable_nat_init);
net/bridge/netfilter/ebtables.c +37 -23
115 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 117/186 netfilter: ebtables: close dangling table module init race
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 92c603fa07bc0d6a17345de3ad7954730b8de44b ]
sashiko reported for a related patch:
In modules like iptable_raw.c, [..], if register_pernet_subsys() fails, the rollback might call kfree(rawtable_ops) before [..]
During this window, could a concurrent userspace process find the globally visible template, trigger table_init(), [..]
The table init functions must always register the template last.
Otherwise, set/getsockopt can instantiate a table in a namespace while the required pernet ops (contain the destructor) isn't available. This change is also required in x_tables, handled in followup change.
--- net/bridge/netfilter/ebtable_broute.c | 12 +++++------- net/bridge/netfilter/ebtable_filter.c | 12 +++++------- net/bridge/netfilter/ebtable_nat.c | 10 ++++------ 3 files changed, 14 insertions(+), 20 deletions(-)
net/bridge/netfilter/ebtable_broute.c +5 -7
@@ -112,18 +112,16 @@ static struct pernet_operations broute_net_ops = {static int __init ebtable_broute_init (void ) { -int ret =ebt_register_template (&broute_table, broute_table_init); +int ret =register_pernet_subsys (&broute_net_ops);if (ret)return ret; - ret =register_pernet_subsys (&broute_net_ops); -if (ret) { -ebt_unregister_template (&broute_table); -return ret; - } + ret =ebt_register_template (&broute_table, broute_table_init); +if (ret) +unregister_pernet_subsys (&broute_net_ops); -return 0 ; +return ret; } static void __exit ebtable_broute_fini(void)
net/bridge/netfilter/ebtable_filter.c +5 -7
@@ -93,18 +93,16 @@ static struct pernet_operations frame_filter_net_ops = {static int __init ebtable_filter_init (void ) { -int ret =ebt_register_template (&frame_filter, frame_filter_table_init); +int ret =register_pernet_subsys (&frame_filter_net_ops);if (ret)return ret; - ret =register_pernet_subsys (&frame_filter_net_ops); -if (ret) { -ebt_unregister_template (&frame_filter); -return ret; - } + ret =ebt_register_template (&frame_filter, frame_filter_table_init); +if (ret) +unregister_pernet_subsys (&frame_filter_net_ops); -return 0 ; +return ret; } static void __exit ebtable_filter_fini(void)
net/bridge/netfilter/ebtable_nat.c +4 -6
@@ -93,16 +93,14 @@ static struct pernet_operations frame_nat_net_ops = {static int __init ebtable_nat_init (void ) { -int ret =ebt_register_template (&frame_nat, frame_nat_table_init); +int ret =register_pernet_subsys (&frame_nat_net_ops);if (ret)return ret; - ret =register_pernet_subsys (&frame_nat_net_ops); -if (ret) { -ebt_unregister_template (&frame_nat); -return ret; - } + ret =ebt_register_template (&frame_nat, frame_nat_table_init); +if (ret) +unregister_pernet_subsys (&frame_nat_net_ops);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 118/186 netfilter: x_tables: close dangling table module init race
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 16bc4b6686b2c112c10e67d6b493adc3607256d3 ]
Similar to the previous ebtables patch:
template add exposes the table to userspace, we must do this last to rnsure the pernet ops are set up (contain the destructors).
--- net/ipv4/netfilter/arptable_filter.c | 23 ++++++++++++----------- net/ipv4/netfilter/iptable_filter.c | 23 ++++++++++++----------- net/ipv4/netfilter/iptable_mangle.c | 25 +++++++++++++------------ net/ipv4/netfilter/iptable_raw.c | 22 +++++++++++----------- net/ipv4/netfilter/iptable_security.c | 23 ++++++++++++----------- net/ipv6/netfilter/ip6table_filter.c | 22 +++++++++++----------- net/ipv6/netfilter/ip6table_mangle.c | 23 ++++++++++++----------- net/ipv6/netfilter/ip6table_raw.c | 20 ++++++++++---------- net/ipv6/netfilter/ip6table_security.c | 23 ++++++++++++----------- 9 files changed, 105 insertions(+), 99 deletions(-)
net/ipv4/netfilter/arptable_filter.c +12 -11
@@ -58,25 +58,26 @@ static struct pernet_operations arptable_filter_net_ops = {static int __init arptable_filter_init (void ) { -int ret =xt_register_template (&packet_filter, - arptable_filter_table_init); - -if (ret <0 ) -return ret; +int ret; arpfilter_ops =xt_hook_ops_alloc (&packet_filter, arpt_do_table); -if (IS_ERR (arpfilter_ops)) { -xt_unregister_template (&packet_filter); +if (IS_ERR (arpfilter_ops))return PTR_ERR (arpfilter_ops); - } ret =register_pernet_subsys (&arptable_filter_net_ops); +if (ret <0 ) + goto err_free; + + ret =xt_register_template (&packet_filter, + arptable_filter_table_init);if (ret <0 ) { -xt_unregister_template (&packet_filter); -kfree (arpfilter_ops); -return ret; +unregister_pernet_subsys (&arptable_filter_net_ops); + goto err_free; } +return 0 ; +err_free: +kfree (arpfilter_ops);return ret; }
net/ipv4/netfilter/iptable_filter.c +12 -11
@@ -77,26 +77,27 @@ static struct pernet_operations iptable_filter_net_ops = {static int __init iptable_filter_init (void ) { -int ret =xt_register_template (&packet_filter, - iptable_filter_table_init); - -if (ret <0 ) -return ret; +int ret; filter_ops =xt_hook_ops_alloc (&packet_filter, ipt_do_table); -if (IS_ERR (filter_ops)) { -xt_unregister_template (&packet_filter); +if (IS_ERR (filter_ops))return PTR_ERR (filter_ops); - } ret =register_pernet_subsys (&iptable_filter_net_ops); +if (ret <0 ) + goto err_free; + + ret =xt_register_template (&packet_filter, + iptable_filter_table_init);if (ret <0 ) { -xt_unregister_template (&packet_filter); -kfree (filter_ops); -return ret; +unregister_pernet_subsys (&iptable_filter_net_ops); + goto err_free; }return 0 ; +err_free: +kfree (filter_ops); +return ret; } static void __exit iptable_filter_fini(void)
net/ipv4/netfilter/iptable_mangle.c +13 -12
@@ -110,25 +110,26 @@ static struct pernet_operations iptable_mangle_net_ops = {static int __init iptable_mangle_init (void ) { -int ret =xt_register_template (&packet_mangler, - iptable_mangle_table_init); -if (ret <0 ) -return ret; +int ret; mangle_ops =xt_hook_ops_alloc (&packet_mangler, iptable_mangle_hook); -if (IS_ERR (mangle_ops)) { -xt_unregister_template (&packet_mangler); - ret =PTR_ERR (mangle_ops); -return ret; - } +if (IS_ERR (mangle_ops)) +return PTR_ERR (mangle_ops); ret =register_pernet_subsys (&iptable_mangle_net_ops); +if (ret <0 ) + goto err_free; + + ret =xt_register_template (&packet_mangler, + iptable_mangle_table_init);if (ret <0 ) { -xt_unregister_template (&packet_mangler); -kfree (mangle_ops); -return ret; +unregister_pernet_subsys (&iptable_mangle_net_ops); + goto err_free; } +return 0 ; +err_free: +kfree (mangle_ops);return ret; }
net/ipv4/netfilter/iptable_raw.c +11 -11
@@ -77,24 +77,24 @@ static int __init iptable_raw_init(void)pr_info ("Enabling raw table before defrag\n" ); } - ret =xt_register_template (table, - iptable_raw_table_init); -if (ret <0 ) -return ret; - rawtable_ops =xt_hook_ops_alloc (table, ipt_do_table); -if (IS_ERR (rawtable_ops)) { -xt_unregister_template (table); +if (IS_ERR (rawtable_ops))return PTR_ERR (rawtable_ops); - } ret =register_pernet_subsys (&iptable_raw_net_ops); +if (ret <0 ) + goto err_free; + + ret =xt_register_template (table, + iptable_raw_table_init);if (ret <0 ) { -xt_unregister_template (table); -kfree (rawtable_ops); -return ret; +unregister_pernet_subsys (&iptable_raw_net_ops); + goto err_free; } +return 0 ; +err_free: +kfree (rawtable_ops);return ret; }
net/ipv4/netfilter/iptable_security.c +12 -11
@@ -65,25 +65,26 @@ static struct pernet_operations iptable_security_net_ops = {static int __init iptable_security_init (void ) { -int ret =xt_register_template (&security_table, - iptable_security_table_init); - -if (ret <0 ) -return ret; +int ret; sectbl_ops =xt_hook_ops_alloc (&security_table, ipt_do_table); -if (IS_ERR (sectbl_ops)) { -xt_unregister_template (&security_table); +if (IS_ERR (sectbl_ops))return PTR_ERR (sectbl_ops); - } ret =register_pernet_subsys (&iptable_security_net_ops); +if (ret <0 ) + goto err_free; + + ret =xt_register_template (&security_table, + iptable_security_table_init);if (ret <0 ) { -xt_unregister_template (&security_table); -kfree (sectbl_ops); -return ret; +unregister_pernet_subsys (&iptable_security_net_ops); + goto err_free; } +return 0 ; +err_free: +kfree (sectbl_ops);return ret; }
net/ipv6/netfilter/ip6table_filter.c +11 -11
@@ -76,25 +76,25 @@ static struct pernet_operations ip6table_filter_net_ops = {static int __init ip6table_filter_init (void ) { -int ret =xt_register_template (&packet_filter, - ip6table_filter_table_init); - -if (ret <0 ) -return ret; +int ret; filter_ops =xt_hook_ops_alloc (&packet_filter, ip6t_do_table); -if (IS_ERR (filter_ops)) { -xt_unregister_template (&packet_filter); +if (IS_ERR (filter_ops))return PTR_ERR (filter_ops); - } ret =register_pernet_subsys (&ip6table_filter_net_ops); +if (ret <0 ) + goto err_free; + + ret =xt_register_template (&packet_filter, ip6table_filter_table_init);if (ret <0 ) { -xt_unregister_template (&packet_filter); -kfree (filter_ops); -return ret; +unregister_pernet_subsys (&ip6table_filter_net_ops); + goto err_free; } +return 0 ; +err_free: +kfree (filter_ops);return ret; }
net/ipv6/netfilter/ip6table_mangle.c +12 -11
@@ -103,25 +103,26 @@ static struct pernet_operations ip6table_mangle_net_ops = {static int __init ip6table_mangle_init (void ) { -int ret =xt_register_template (&packet_mangler, - ip6table_mangle_table_init); - -if (ret <0 ) -return ret; +int ret; mangle_ops =xt_hook_ops_alloc (&packet_mangler, ip6table_mangle_hook); -if (IS_ERR (mangle_ops)) { -xt_unregister_template (&packet_mangler); +if (IS_ERR (mangle_ops))return PTR_ERR (mangle_ops); - } ret =register_pernet_subsys (&ip6table_mangle_net_ops); +if (ret <0 ) + goto err_free; + + ret =xt_register_template (&packet_mangler, + ip6table_mangle_table_init);if (ret <0 ) { -xt_unregister_template (&packet_mangler); -kfree (mangle_ops); -return ret; +unregister_pernet_subsys (&ip6table_mangle_net_ops); + goto err_free; } +return 0 ; +err_free: +kfree (mangle_ops);return ret; }
net/ipv6/netfilter/ip6table_raw.c +10 -10
@@ -75,24 +75,24 @@ static int __init ip6table_raw_init(void)pr_info ("Enabling raw table before defrag\n" ); } - ret =xt_register_template (table, ip6table_raw_table_init); -if (ret <0 ) -return ret; -/* Register hooks */ rawtable_ops =xt_hook_ops_alloc (table, ip6t_do_table); -if (IS_ERR (rawtable_ops)) { -xt_unregister_template (table); +if (IS_ERR (rawtable_ops))return PTR_ERR (rawtable_ops); - } ret =register_pernet_subsys (&ip6table_raw_net_ops); +if (ret <0 ) + goto err_free; + + ret =xt_register_template (table, ip6table_raw_table_init);if (ret <0 ) { -kfree (rawtable_ops); -xt_unregister_template (table); -return ret; +unregister_pernet_subsys (&ip6table_raw_net_ops); + goto err_free; } +return 0 ; +err_free: +kfree (rawtable_ops);return ret; }
net/ipv6/netfilter/ip6table_security.c +12 -11
@@ -64,25 +64,26 @@ static struct pernet_operations ip6table_security_net_ops = {static int __init ip6table_security_init (void ) { -int ret =xt_register_template (&security_table, - ip6table_security_table_init); - -if (ret <0 ) -return ret; +int ret; sectbl_ops =xt_hook_ops_alloc (&security_table, ip6t_do_table); -if (IS_ERR (sectbl_ops)) { -xt_unregister_template (&security_table); +if (IS_ERR (sectbl_ops))return PTR_ERR (sectbl_ops); - } ret =register_pernet_subsys (&ip6table_security_net_ops); +if (ret <0 ) + goto err_free; + + ret =xt_register_template (&security_table, + ip6table_security_table_init);if (ret <0 ) { -kfree (sectbl_ops); -xt_unregister_template (&security_table); -return ret; +unregister_pernet_subsys (&ip6table_security_net_ops); + goto err_free; } +return 0 ; +err_free: +kfree (sectbl_ops);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 119/186 netfilter: bridge: eb_tables: close module init race
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 27414ff1b287ea9a2a11675149ec28e05539f3cc ]
sashiko reports for unrelated patch:
Does the core ebtables initialization in ebtables.c suffer from a similar race? Once nf_register_sockopt() completes, the sockopts are exposed globally.
sockopt has to be registered last, just like in ip/ip6/arptables.
--- net/bridge/netfilter/ebtables.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
net/bridge/netfilter/ebtables.c +6 -5
@@ -2583,19 +2583,20 @@ static int __init ebtables_init(void) {int ret; - ret =xt_register_target (&ebt_standard_target); + ret =register_pernet_subsys (&ebt_net_ops);if (ret <0 )return ret; - ret =nf_register_sockopt (&ebt_sockopts); + + ret =xt_register_target (&ebt_standard_target);if (ret <0 ) { -xt_unregister_target (&ebt_standard_target); +unregister_pernet_subsys (&ebt_net_ops);return ret; } - ret =register_pernet_subsys (&ebt_net_ops); + ret =nf_register_sockopt (&ebt_sockopts);if (ret <0 ) { -nf_unregister_sockopt (&ebt_sockopts);xt_unregister_target (&ebt_standard_target); +unregister_pernet_subsys (&ebt_net_ops);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 120/186 kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianpeng Chang <[email protected]>
[ Upstream commit 307abfac04a254c09c5705d816b33354acee97a0 ]
When kprobe_add_area_blacklist() iterates through a section like .kprobes.text, the start address may not correspond to a named symbol. On ARM64 with CONFIG_DYNAMIC_FTRACE_WITH_CALL_OPS=y (introduced by commit baaf553d3bc3 ("arm64: Implement HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS")), the compiler flag -fpatchable-function-entry=4,2 inserts 2 NOPs before each function entry point for ftrace call_ops. These pre-function NOPs sit at the section base address, before the first named function symbol. The compiler emits a $x mapping symbol at offset 0x00 to mark the start of code, but find_kallsyms_symbol() ignores mapping symbols.
Without CONFIG_DYNAMIC_FTRACE_WITH_CALL_OPS (e.g. defconfig), no pre-function NOPs are inserted, the first function starts at offset 0x00, and the bug does not trigger.
This only affects modules that have a .kprobes.text section (i.e. those using the __kprobes annotation). Modules using NOKPROBE_SYMBOL() instead (like kretprobe_example.ko) blacklist exact function addresses via the _kprobe_blacklist section and are not affected.
For kprobe_example.ko on ARM64 with -fpatchable-function-entry=4,2, the .kprobes.text section layout is:
offset 0x00: $x + 2 NOPs (mapping symbol + ftrace preamble) offset 0x08: handler_post (64 bytes) offset 0x50: handler_pre (68 bytes)
kprobe_add_area_blacklist() starts iterating from the section base address (offset 0x00), which only has the $x mapping symbol. kprobe_add_ksym_blacklist() then calls kallsyms_lookup_size_offset() for this address, which goes through:
kallsyms_lookup_size_offset()
-> module_address_lookup()
-> find_kallsyms_symbol()find_kallsyms_symbol() scans all module symbols to find the closest preceding symbol.
Since no named text symbol exists at offset 0x00, find_kallsyms_symbol() picks __UNIQUE_ID_vermagic (a .modinfo symbol whose address is in the temporary image) as the "best" match. The computed "size" = next_text_symbol - modinfo_symbol spans across these two unrelated memory regions, creating a blacklist entry with a bogus range of tens of terabytes.
Whether this causes a visible failure depends on address randomization, here is what happens on Raspberry Pi 4/5:
- On RPi5, the bogus size was ~35 TB. start + size stayed within 64-bit range, so the blacklist entry covered the entire kernel text. register_kprobe() in the module's own init function failed with -EINVAL.
- On RPi4, the bogus size was ~75 TB. start + size overflowed 64 bits and wrapped to a small address near zero. The range check (addr >= start && addr < end) then failed because end wrapped around, so the bogus entry was accidentally harmless and kprobes worked by luck.
The same bug exists on both machines, but randomization determines whether the integer overflow masks it or not.
Fix this by adding notrace to the __kprobes macro. Functions in .kprobes.text are kprobe infrastructure handlers that should never be traced by ftrace. With notrace, the compiler stops inserting them and the non-symbol gap at the section start disappears entirely.
--- include/asm-generic/kprobes.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/asm-generic/kprobes.h +1 -1
@@ -14,7 +14,7 @@ static unsigned long __used \ _kbl_addr_##fname = (unsigned long)fname;# define NOKPROBE_SYMBOL (fname) __NOKPROBE_SYMBOL(fname)/* Use this to forbid a kprobes attach on very low level functions */ -# define __kprobes __section(".kprobes.text") +# define __kprobes notrace __section(".kprobes.text")# define nokprobe_inline __always_inline#else # define NOKPROBE_SYMBOL (fname)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 121/186 test_kprobes: clear kprobes between test runs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kaiser <[email protected]>
[ Upstream commit ef5581bb30efb939cc2bf093475c6cc85258e5cd ]
Running the kprobes sanity tests twice makes all tests fail and eventually crashes the kernel.
[root@martin-riscv-1 ~]# echo 1 > /sys/kernel/debug/kunit/kprobes_test/run
...
# Totals: pass:5 fail:0 skip:0 total:5
ok 1 kprobes_test
[root@martin-riscv-1 ~]# echo 1 > /sys/kernel/debug/kunit/kprobes_test/run
...
# test_kprobe: EXPECTATION FAILED at lib/tests/test_kprobes.c:64 Expected 0 == register_kprobe(&kp), but
register_kprobe(&kp) == -22 (0xffffffffffffffea) ... Unable to handle kernel paging request ...
The testsuite defines several kprobes and kretprobes as static variables that are preserved across test runs.
After register_kprobe and unregister_kprobe, a kprobe contains some leftover data that must be cleared before the kprobe can be registered again. The tests are setting symbol_name to define the probe location. Address and flags must be cleared.
The existing code clears some of the probes between subsequent tests, but not between two test runs. The leftover data from a previous test run makes the registrations fail in the next run.
Move the cleanups for all kprobes into kprobes_test_init, this function is called before each single test (including the first test of a test run).
--- lib/test_kprobes.c | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-)
lib/test_kprobes.c +18 -11
@@ -12,6 +12,12 @@#define div_factor 3 +#define KP_CLEAR (_kp) \ +do { \ + (_kp).addr = NULL; \ + (_kp).flags = 0; \ +} while (0) +static u32 rand1, preh_val, posth_val;static u32 (*target)(u32 value);static u32 (*recursed_target)(u32 value);
@@ -125,10 +131,6 @@ static void test_kprobes(struct kunit *test) current_test = test; -/* addr and flags should be cleard for reusing kprobe. */ - kp.addr =NULL ; - kp.flags =0 ; -KUNIT_EXPECT_EQ (test,0 ,register_kprobes (kps,2 )); preh_val =0 ; posth_val =0 ;
@@ -226,9 +228,6 @@ static void test_kretprobes(struct kunit *test)struct kretprobe *rps[2 ] = {&rp, &rp2}; current_test = test; -/* addr and flags should be cleard for reusing kprobe. */ - rp.kp.addr =NULL ; - rp.kp.flags =0 ;KUNIT_EXPECT_EQ (test,0 ,register_kretprobes (rps,2 )); krph_val =0 ;
@@ -290,8 +289,6 @@ static void test_stacktrace_on_kretprobe(struct kunit *test)unsigned long myretaddr = (unsigned long )__builtin_return_address (0 ); current_test = test; - rp3.kp.addr =NULL ; - rp3.kp.flags =0 ;/* * Run the stacktrace_driver() to record correct return address in
@@ -352,8 +349,6 @@ static void test_stacktrace_on_nested_kretprobe(struct kunit *test)struct kretprobe *rps[2 ] = {&rp3, &rp4}; current_test = test; - rp3.kp.addr =NULL ; - rp3.kp.flags =0 ;//KUNIT_ASSERT_NE(test, myretaddr, stacktrace_driver());
@@ -367,6 +362,18 @@ static void test_stacktrace_on_nested_kretprobe(struct kunit *test)static int kprobes_test_init (struct kunit *test) { +KP_CLEAR (kp); +KP_CLEAR (kp2); +KP_CLEAR (kp_missed); +#ifdef CONFIG_KRETPROBES +KP_CLEAR (rp.kp); +KP_CLEAR (rp2.kp); +#ifdef CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE +KP_CLEAR (rp3.kp); +KP_CLEAR (rp4.kp); +#endif +#endif + target = kprobe_target; target2 = kprobe_target2; recursed_target = kprobe_recursed_target;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 122/186 tcp: Fix imbalanced icsk_accept_queue count.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 7eca3292cac7c26dad4c236f51ba225c39a0523f ]
When TCP socket migration happens in reqsk_timer_handler(), @sk_listener will be updated with the new listener.
When we call __inet_csk_reqsk_queue_drop(), the listener must be the one stored in req->rsk_listener.
The cited commit accidentally replaced oreq->rsk_listener with sk_listener, leading to imbalanced icsk_accept_queue count.
Let's pass the correct listener to __inet_csk_reqsk_queue_drop().
--- net/ipv4/inet_connection_sock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/inet_connection_sock.c +1 -1
@@ -1115,7 +1115,7 @@ static void reqsk_timer_handler(struct timer_list *t) } drop: -__inet_csk_reqsk_queue_drop (sk_listener, oreq, true); +__inet_csk_reqsk_queue_drop (oreq->rsk_listener, oreq, true);reqsk_put (oreq); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 123/186 ice: fix locking in ice_dcb_rebuild()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
[ Upstream commit 0ded1f36ba4021cba50513e80be6b6e173710168 ]
Move the mutex_lock() call up to prevent that DCB settings change after the first ice_query_port_ets() call. The second ice_query_port_ets() call in ice_dcb_rebuild() is already protected by pf->tc_mutex.
This also fixes a bug in an error path, as before taking the first "goto dcb_error" in the function jumped over mutex_lock() to mutex_unlock().
This bug has been detected by the clang thread-safety analyzer.
--- drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/ice/ice_dcb_lib.c +2 -2
@@ -537,14 +537,14 @@ void ice_dcb_rebuild(struct ice_pf *pf)struct ice_dcbx_cfg *err_cfg;int ret; +mutex_lock (&pf->tc_mutex); + ret =ice_query_port_ets (pf->hw.port_info, &buf,sizeof (buf),NULL );if (ret) {dev_err (dev,"Query Port ETS failed\n" ); goto dcb_error; } -mutex_lock (&pf->tc_mutex); -if (!pf->hw.port_info->qos_cfg.is_sw_lldp)ice_cfg_etsrec_defaults (pf->hw.port_info);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 124/186 net: lan966x: avoid unregistering netdev on register failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <[email protected]>
[ Upstream commit c4f3d6eb1fcf6cd9ce4644f604d5aad1ce594dfc ]
lan966x_probe_port() stores the newly allocated net_device in the port before calling register_netdev(). If register_netdev() fails, the probe error path calls lan966x_cleanup_ports(), which sees port->dev and calls unregister_netdev() for a device that was never registered.
Destroy the phylink instance created for this port and clear port->dev before returning the registration error. The common cleanup path now skips ports without port->dev before reaching the registered netdev cleanup, so it only handles ports that reached the registered-netdev lifetime.
This also avoids treating an uninitialized FDMA netdev and the failed port as a NULL == NULL match in the common cleanup path.
--- drivers/net/ethernet/microchip/lan966x/lan966x_main.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/ethernet/microchip/lan966x/lan966x_main.c +5 -3
@@ -750,11 +750,10 @@ static void lan966x_cleanup_ports(struct lan966x *lan966x)for (p =0 ; p < lan966x->num_phys_ports; p++) { port = lan966x->ports[p]; -if (!port) +if (!port || !port->dev)continue ; -if (port->dev) -unregister_netdev (port->dev); +unregister_netdev (port->dev);lan966x_xdp_port_deinit (port);if (lan966x->fdma && lan966x->fdma_ndev == port->dev)
@@ -875,6 +874,9 @@ static int lan966x_probe_port(struct lan966x *lan966x, u32 p, err =register_netdev (dev);if (err) {dev_err (lan966x->dev,"register_netdev failed\n" ); +phylink_destroy (phylink); + port->phylink =NULL ; + port->dev =NULL ;return err; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 125/186 phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
[ Upstream commit 91ddf6f722084383fb05be731c0107814b055c0c ]
The mvebu_a3700_utmi_phy_power_off() function tries to modify the USB2_PHY_CTRL register by using the IO address of the PHY IP block along with the readl/writel IO accessors. However, the register exist in the USB miscellaneous register space, and as such it must be accessed via regmap like it is done in the mvebu_a3700_utmi_phy_power_on() function.
Change the code to use regmap_update_bits() for modífying the register to fix this.
--- drivers/phy/marvell/phy-mvebu-a3700-utmi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/phy/marvell/phy-mvebu-a3700-utmi.c +2 -3
@@ -168,9 +168,8 @@ static int mvebu_a3700_utmi_phy_power_off(struct phy *phy)u32 reg;/* Disable PHY pull-up and enable USB2 suspend */ - reg =readl (utmi->regs +USB2_PHY_CTRL (usb32)); - reg &= ~(RB_USB2PHY_PU |RB_USB2PHY_SUSPM (usb32)); -writel (reg, utmi->regs +USB2_PHY_CTRL (usb32)); +regmap_update_bits (utmi->usb_misc,USB2_PHY_CTRL (usb32), +RB_USB2PHY_PU |RB_USB2PHY_SUSPM (usb32),0 );/* Power down OTG module */ if (usb32) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 126/186 irqchip/ath79-cpu: Remove unused function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit 0fa10fb77069fb67aa51384868ef3702b7791465 ]
ath79_cpu_irq_init() was part of the legacy pre-OF code that got removed a while back.
Remove it to get rid of a missing prototype warning, reported by the kernel test robot.
[ tglx: Fix the subject prefix. Sigh ... ]
--- drivers/irqchip/irq-ath79-cpu.c | 7 ------- 1 file changed, 7 deletions(-)
drivers/irqchip/irq-ath79-cpu.c +0 -7
@@ -85,10 +85,3 @@ static int __init ar79_cpu_intc_of_init( }IRQCHIP_DECLARE (ar79_cpu_intc,"qca,ar7100-cpu-intc" , ar79_cpu_intc_of_init); - -void __init ath79_cpu_irq_init (unsigned irq_wb_chan2,unsigned irq_wb_chan3) -{ - irq_wb_chan[2 ] = irq_wb_chan2; - irq_wb_chan[3 ] = irq_wb_chan3; -mips_cpu_irq_init (); -}
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 127/186 irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 91840be8f710370607f949a627e070896faeddb8 ]
On PREEMPT_RT, non-HARD irq_work runs in per-CPU kthreads via run_irq_workd(), so irq_work_sync() uses rcuwait() to wait for BUSY==0.
After irq_work_single() clears BUSY via atomic_cmpxchg(), it still dereferences @work for irq_work_is_hard() and rcuwait_wake_up().
An irq_work_sync() caller on another CPU that enters after BUSY is cleared can observe BUSY==0 immediately, return, and free the work before those accesses complete — causing a use-after-free.
Fix this by wrapping run_irq_workd() in guard(rcu)() so that the entire irq_work_single() execution is within an RCU read-side critical section. Then add synchronize_rcu() in irq_work_sync() after rcuwait_wait_event() to ensure the caller waits for the RCU grace period before returning, preventing premature frees.
--- kernel/irq_work.c | 7 +++++++ 1 file changed, 7 insertions(+)
kernel/irq_work.c +7 -0
@@ -292,6 +292,12 @@ void irq_work_sync(struct irq_work *work) !arch_irq_work_has_interrupt()) {rcuwait_wait_event (&work->irqwait, !irq_work_is_busy (work),TASK_UNINTERRUPTIBLE ); +/* +* Ensure irq_work_single() does not access @work +* after removing IRQ_WORK_BUSY. It is always +* accessed within a RCU-read section. +*/ +synchronize_rcu ();return ; }
@@ -302,6 +308,7 @@ EXPORT_SYMBOL_GPL(irq_work_sync);static void run_irq_workd (unsigned int cpu) { +guard (rcu)();irq_work_run_list (this_cpu_ptr (&lazy_list)); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 128/186 zonefs: handle integer overflow in zonefs_fname_to_fno
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <[email protected]>
[ Upstream commit 3a8389d42bdf4213730f4067f8bfa78bae6564ef ]
In zonefs the file name in one of the two directories corresponds to the zone number.
Here Alexey reported a possible integer overflow in zonefs_fname_to_fno(), where the parsing of the zone number from the file name can overflow the 'long' data type.
Add a check for integer overflows and if the fno 'long' did overflow return -ENOENT.
--- fs/zonefs/super.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/zonefs/super.c +5 -1
@@ -627,10 +627,14 @@ static long zonefs_fname_to_fno(const struct qstr *fname)return c -'0' ;for (i =0 , rname = name + len -1 ; i < len; i++, rname--) { +long digit; + c = *rname;if (!isdigit (c))return -ENOENT ; - fno += (c -'0' ) * shift; + digit = (c -'0' ) * shift; +if (check_add_overflow (fno, digit, &fno)) +return -ENOENT ; shift *=10 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 129/186 netfs: Fix overrun check in netfs_extract_user_iter()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 0ef37eef83fad3542ee06db2940433ae1a92b39d ]
Fix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills pages[], then those pages don't get included in the iterator constructed at the end of the function. If there was an overfill, memory corruption has already happened.
--- fs/netfs/iterator.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-)
fs/netfs/iterator.c +17 -9
@@ -72,21 +72,24 @@ ssize_t netfs_extract_user_iter(struct iov_iter *orig, size_t orig_len,break ; } -if (ret > count) { -pr_err ("get_pages rc=%zd more than %zu\n" , ret, count); +if (WARN (ret > count, +"%s: extract_pages overrun %zd > %zu bytes\n" , + __func__, ret, count)) { + ret = -EIO ;break ; } - count -= ret; - ret += offset; - cur_npages =DIV_ROUND_UP (ret,PAGE_SIZE ); - -if (npages + cur_npages > max_pages) { -pr_err ("Out of bvec array capacity (%u vs %u)\n" , - npages + cur_npages, max_pages); + cur_npages =DIV_ROUND_UP (offset + ret,PAGE_SIZE ); +if (WARN (cur_npages > max_pages - npages, +"%s: extract_pages overrun %u > %u pages\n" , + __func__, npages + cur_npages, max_pages)) { + ret = -EIO ;break ; } + count -= ret; + ret += offset; +for (i =0 ; i < cur_npages; i++) { len = ret >PAGE_SIZE ?PAGE_SIZE : ret;bvec_set_page (bv + npages + i, *pages++, len - offset, offset);
@@ -97,6 +100,11 @@ ssize_t netfs_extract_user_iter(struct iov_iter *orig, size_t orig_len, npages += cur_npages; } +/* Note: Don't try to clean up after EIO. Either we got no pages, so +* nothing to clean up, or we got a buffer overrun, memory corruption +* and can't trust the stuff in the buffer (a WARN was emitted). +*/ +if (ret <0 && (ret == -ENOMEM || npages ==0 )) {for (i =0 ; i < npages; i++)unpin_user_page (bv[i].bv_page);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 130/186 net: ethernet: cortina: Make RX SKB per-port
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
[ Upstream commit 06937db21ee311ed07eba47954447245041a982d ]
The SKB used to assemble packets from fragments in gmac_rx() is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device is using both.
Make the RX SKB a per-port variable and carry it over between invocations in the port struct instead.
Zero the pointer once we call napi_gro_frags(), on error (after calling napi_free_frags()) or if the port is stopped.
Zero it in some place where not strictly necessary just to emphasize what is going on.
This was found by Sashiko during normal patch review.
--- drivers/net/ethernet/cortina/gemini.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/cortina/gemini.c +6 -1
@@ -121,6 +121,8 @@ struct gemini_ethernet_port {struct napi_struct napi;struct hrtimer rx_coalesce_timer;unsigned int rx_coalesce_nsecs; +struct sk_buff *rx_skb; +unsigned int freeq_refill;struct gmac_txq txq[TX_QUEUE_NUM ];unsigned int txq_order;
@@ -1447,10 +1449,10 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)unsigned short m = (1 << port->rxq_order) -1 ;struct gemini_ethernet *geth = port->geth;void __iomem *ptr_reg = port->rxq_rwptr; +struct sk_buff *skb = port->rx_skb;unsigned int frame_len, frag_len;struct gmac_rxdesc *rx =NULL ;struct gmac_queue_page *gpage; -static struct sk_buff *skb;union gmac_rxdesc_0 word0;union gmac_rxdesc_1 word1;union gmac_rxdesc_3 word3;
@@ -1504,6 +1506,7 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)if (skb) {napi_free_frags (&port->napi); port->stats.rx_dropped++; + skb =NULL ; } skb =gmac_skb_if_good_frame (port, word0, frame_len);
@@ -1554,6 +1557,7 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget) port->stats.rx_dropped++; } + port->rx_skb = skb;writew (r, ptr_reg);return budget; }
@@ -1882,6 +1886,7 @@ static int gmac_stop(struct net_device *netdev)gmac_disable_tx_rx (netdev);gmac_stop_dma (port);napi_disable (&port->napi); + port->rx_skb =NULL ;gmac_enable_irq (netdev,0 );gmac_cleanup_rxq (netdev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 131/186 net: ethernet: cortina: Drop half-assembled SKB
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Haarmann-Thiemann <[email protected]>
[ Upstream commit b266bacba796ff5c4dcd2ae2fc08aacf7ab39153 ]
In gmac_rx() (drivers/net/ethernet/cortina/gemini.c), when gmac_get_queue_page() returns NULL for the second page of a multi-page fragment, the driver logs an error and continues — but does not free the partially assembled skb that was being assembled via napi_build_skb() / napi_get_frags().
Free the in-progress partially assembled skb via napi_free_frags() and increase the number of dropped frames appropriately and assign the skb pointer NULL to make sure it is not lingering around, matching the pattern already used elsewhere in the driver.
--- drivers/net/ethernet/cortina/gemini.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/cortina/gemini.c +5 -0
@@ -1498,6 +1498,11 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget) gpage =gmac_get_queue_page (geth, port, mapping +PAGE_SIZE );if (!gpage) {dev_err (geth->dev,"could not find mapping\n" ); +if (skb) { +napi_free_frags (&port->napi); + port->stats.rx_dropped++; + skb =NULL ; + }continue ; } page = gpage->page;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 132/186 net: ethernet: cortina: Carry over frag counter
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
[ Upstream commit ebd8ec2b309e3a447851b456ccaf8fb39f3661e7 ]
The gmac_rx() NAPI poll function assembles packets in an SKB from a ring buffer.
If the ring buffer gets completely emptied during a poll cycle, we exit gmac_rx(), but the packet is not yet completely assembled in the SKB, yet the fragment counter frag_nr is reset to zero on the next invocation.
Solve this by making the RX fragment counter a part of the port struct, and carry it over between invocations.
Reset the fragment counter only right after calling napi_gro_frags(), on error (after calling napi_free_frags()) or if stopping the port.
Reset it in some place where not strictly necessary just to emphasize what is going on.
This was found by Sashiko during normal patch review.
--- drivers/net/ethernet/cortina/gemini.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/ethernet/cortina/gemini.c +8 -1
@@ -122,6 +122,7 @@ struct gemini_ethernet_port {struct hrtimer rx_coalesce_timer;unsigned int rx_coalesce_nsecs;struct sk_buff *rx_skb; +unsigned int rx_frag_nr;unsigned int freeq_refill;struct gmac_txq txq[TX_QUEUE_NUM ];
@@ -1449,6 +1450,7 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)unsigned short m = (1 << port->rxq_order) -1 ;struct gemini_ethernet *geth = port->geth;void __iomem *ptr_reg = port->rxq_rwptr; +unsigned int frag_nr = port->rx_frag_nr;struct sk_buff *skb = port->rx_skb;unsigned int frame_len, frag_len;struct gmac_rxdesc *rx =NULL ;
@@ -1462,7 +1464,6 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)unsigned short r, w;union dma_rwptr rw;dma_addr_t mapping; -int frag_nr =0 ;spin_lock_irqsave (&geth->irq_lock, flags); rw.bits32 =readl (ptr_reg);
@@ -1502,6 +1503,7 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)napi_free_frags (&port->napi); port->stats.rx_dropped++; skb =NULL ; + frag_nr =0 ; }continue ; }
@@ -1512,6 +1514,7 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)napi_free_frags (&port->napi); port->stats.rx_dropped++; skb =NULL ; + frag_nr =0 ; } skb =gmac_skb_if_good_frame (port, word0, frame_len);
@@ -1546,6 +1549,7 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)if (word3.bits32 &EOF_BIT ) {napi_gro_frags (&port->napi); skb =NULL ; + frag_nr =0 ; --budget; }continue ;
@@ -1554,6 +1558,7 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)if (skb) {napi_free_frags (&port->napi); skb =NULL ; + frag_nr =0 ; }if (mapping)
@@ -1563,6 +1568,7 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget) } port->rx_skb = skb; + port->rx_frag_nr = frag_nr;writew (r, ptr_reg);return budget; }
@@ -1892,6 +1898,7 @@ static int gmac_stop(struct net_device *netdev)gmac_stop_dma (port);napi_disable (&port->napi); port->rx_skb =NULL ; + port->rx_frag_nr =0 ;gmac_enable_irq (netdev,0 );gmac_cleanup_rxq (netdev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 133/186 net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Nelson-Moore <[email protected]>
[ Upstream commit 36a8d04a8293afcb9304cf0cd3741f67698f2a1a ]
The legacy ARM board file for MACH_MX31ADS was removed in commit c93197b0041d ("ARM: imx: Remove i.MX31 board files"), but a reference to it remained in the cs89x0 driver. Drop this unused code.
--- drivers/net/ethernet/cirrus/cs89x0.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/ethernet/cirrus/cs89x0.c +0 -2
@@ -1271,7 +1271,6 @@ static const struct net_device_ops net_ops = {static void __init reset_chip (struct net_device *dev) { -#if !defined(CONFIG_MACH_MX31ADS )struct net_local *lp =netdev_priv (dev);unsigned long reset_start_time;
@@ -1298,7 +1297,6 @@ static void __init reset_chip(struct net_device *dev)while ((readreg (dev, PP_SelfST) &INIT_DONE ) ==0 &&time_before (jiffies, reset_start_time +2 )) ; -#endif /* !CONFIG_MACH_MX31ADS */ }/* This is the real probe routine.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 134/186 wifi: ath11k: fix error path leaks in some WMI WOW calls
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Escande <[email protected]>
[ Upstream commit 55dda532bbc261aef495e403c8900c5e2ab5fa34 ]
Fix two instances where we used to directly return the result of ath11k_wmi_cmd_send(...). Because we did not check the return value, we also did not free the skb in the error path.
--- drivers/net/wireless/ath/ath11k/wmi.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath11k/wmi.c +16 -3
@@ -9090,6 +9090,7 @@ int ath11k_wmi_wow_host_wakeup_ind(struct ath11k *ar)struct wmi_wow_host_wakeup_ind *cmd;struct sk_buff *skb;size_t len; +int ret; len =sizeof (*cmd); skb =ath11k_wmi_alloc_skb (ar->wmi->wmi_ab, len);
@@ -9103,14 +9104,20 @@ int ath11k_wmi_wow_host_wakeup_ind(struct ath11k *ar)ath11k_dbg (ar->ab,ATH11K_DBG_WMI ,"tlv wow host wakeup ind\n" ); -return ath11k_wmi_cmd_send (ar->wmi, skb,WMI_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID ); + ret =ath11k_wmi_cmd_send (ar->wmi, skb,WMI_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID ); +if (ret) { +ath11k_warn (ar->ab,"failed to send WMI_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID\n" ); +dev_kfree_skb (skb); + } + +return ret; }int ath11k_wmi_wow_enable (struct ath11k *ar) {struct wmi_wow_enable_cmd *cmd;struct sk_buff *skb; -int len; +int ret, len; len =sizeof (*cmd); skb =ath11k_wmi_alloc_skb (ar->wmi->wmi_ab, len);
@@ -9125,7 +9132,13 @@ int ath11k_wmi_wow_enable(struct ath11k *ar) cmd->pause_iface_config =WOW_IFACE_PAUSE_ENABLED ;ath11k_dbg (ar->ab,ATH11K_DBG_WMI ,"tlv wow enable\n" ); -return ath11k_wmi_cmd_send (ar->wmi, skb,WMI_WOW_ENABLE_CMDID ); + ret =ath11k_wmi_cmd_send (ar->wmi, skb,WMI_WOW_ENABLE_CMDID ); +if (ret) { +ath11k_warn (ar->ab,"failed to send WMI_WOW_ENABLE_CMDID\n" ); +dev_kfree_skb (skb); + } + +return ret; } int ath11k_wmi_scan_prob_req_oui(struct ath11k *ar,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 135/186 wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Escande <[email protected]>
[ Upstream commit 7320d6eb861e9913193a7801834c661381756a79 ]
This is similar to what was fixed by previous patches. We have a call to ath11k_wmi_cmd_send() which does check the return value, but forgot to free the related skb on error.
--- drivers/net/wireless/ath/ath11k/testmode.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath11k/testmode.c +1 -0
@@ -457,6 +457,7 @@ static int ath11k_tm_cmd_wmi_ftm(struct ath11k *ar, struct nlattr *tb[]) ret =ath11k_wmi_cmd_send (wmi, skb, cmd_id);if (ret) {ath11k_warn (ar->ab,"failed to send wmi ftm command: %d\n" , ret); +dev_kfree_skb (skb); goto out; }
Signature · 1 line
2.53.0