6.12.96-rc1 review
Greg Kroah-Hartman
maintainercover 6.12.96-rc1 review
This is the start of the stable review cycle for the 6.12.96 release. There are 349 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 18 Jul 2026 13:30:01 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.96-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.96-rc1
Neill Kapron <[email protected]>
usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
Ji'an Zhou <[email protected]>
fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
Joanne Koong <[email protected]>
fuse: re-lock request before returning from fuse_ref_folio()
Alberto Ruiz <[email protected]>
fuse: fix device node leak in cuse_process_init_reply()
Michael Bommarito <[email protected]>
RDMA/siw: bound Read Response placement to the RREAD length
Zhenhao Wan <[email protected]>
RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
Dmitry Torokhov <[email protected]>
Input: maplecontrol - set driver data before registering input device
Dmitry Torokhov <[email protected]>
Input: maplemouse - set driver data before registering input device
Dmitry Torokhov <[email protected]>
Input: maple_keyb - set driver data before registering input device
Dmitry Torokhov <[email protected]>
Input: mms114 - fix multi-touch slot corruption
Florian Fuchs <[email protected]>
Input: maplemouse - fix NULL pointer dereference in open()
Bryam Vargas <[email protected]>
Input: mms114 - reject an oversized device packet size
Bryam Vargas <[email protected]>
Input: touchwin - reset the packet index on every complete packet
Dmitry Torokhov <[email protected]>
Input: mms114 - fix touch indexing for MMS134S and MMS136
Bryam Vargas <[email protected]>
Input: iforce - bound the device-reported force-feedback effect index
Bryam Vargas <[email protected]>
Input: goodix - clamp the device-reported contact count
Ranjan Kumar <[email protected]>
Input: elan_i2c - prevent division by zero and arithmetic underflow
Bryam Vargas <[email protected]>
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
Bryam Vargas <[email protected]>
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
Haoxiang Li <[email protected]>
Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure
Guillermo Rodríguez <[email protected]>
i2c: stm32f7: truncate clock period instead of rounding it
Andy Shevchenko <[email protected]>
i2c: mpc: Fix timeout calculations
Johan Hovold <[email protected]>
i2c: core: fix adapter deregistration race
Johan Hovold <[email protected]>
i2c: core: fix adapter debugfs creation
Johan Hovold <[email protected]>
i2c: core: fix NULL-deref on adapter registration failure
Johan Hovold <[email protected]>
i2c: core: fix irq domain leak on adapter registration failure
Johan Hovold <[email protected]>
i2c: core: fix adapter probe deferral loop
Mikhail Gavrilov <[email protected]>
dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
Mikhail Gavrilov <[email protected]>
udmabuf: fix DMA direction mismatch in release_udmabuf()
Sean Christopherson <[email protected]>
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
Sean Christopherson <[email protected]>
KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits
Sean Christopherson <[email protected]>
KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
Nicolin Chen <[email protected]>
iommufd: Set upper bounds on cache invalidation entry_num and entry_len
Weinan Liu <[email protected]>
iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
Zenghui Yu <[email protected]>
selftests/mm: pagemap_ioctl: use the correct page size for transact_test()
Pedro Falcato <[email protected]>
mm: do file ownership checks with the proper mount idmap
David Hildenbrand (Arm) <[email protected]>
selftests: mm: fix and speedup "droppable" test
Anthony Yznaga <[email protected]>
mm: fix mmap errno value when MAP_DROPPABLE is not supported
Vivian Wang <[email protected]>
riscv: mm: Unconditionally sfence.vma for spurious fault
Vivian Wang <[email protected]>
riscv: mm: Define DIRECT_MAP_PHYSMEM_END
Koichiro Den <[email protected]>
NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
Bryam Vargas <[email protected]>
exfat: bound uniname advance in exfat_find_dir_entry()
Andrii Kuchmenko <[email protected]>
module: decompress: check return value of module_extend_max_pages()
Benjamin Coddington <[email protected]>
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
Ricardo Robaina <[email protected]>
audit: fix potential integer overflow in audit_log_n_hex()
Huihui Huang <[email protected]>
tracing: Prevent out-of-bounds read in glob matching
Johan Hovold <[email protected]>
i2c: core: fix hang on adapter registration failure
Wentao Liang <[email protected]>
regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
Janne Grunau <[email protected]>
watchdog: apple: Add "apple,t8103-wdt" compatible
Vasily Khoruzhick <[email protected]>
EDAC/i10nm: Don't fail probing if ADXL is missing
Carlos Song <[email protected]>
spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
Carlos Song <[email protected]>
spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
Mark Rutland <[email protected]>
arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()
Paul Louvel <[email protected]>
crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation
Paul Louvel <[email protected]>
crypto: talitos/hash - remove useless wrapper
Paul Louvel <[email protected]>
crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request
Paul Louvel <[email protected]>
crypto: talitos/hash - drop workqueue mechanism for SEC1
Paul Louvel <[email protected]>
crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue
Paul Louvel <[email protected]>
crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor
Paul Louvel <[email protected]>
crypto: talitos - move code in current_desc_hdr() into a standalone function
Paul Louvel <[email protected]>
crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function
Paul Louvel <[email protected]>
crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function
Paul Louvel <[email protected]>
crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1
Paul Louvel <[email protected]>
crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
Giovanni Cabiddu <[email protected]>
crypto: qat - validate RSA CRT component lengths
Ahsan Atta <[email protected]>
crypto: qat - protect service table iterations with service_lock
Ahsan Atta <[email protected]>
crypto: qat - notify fatal error before AER reset preparation
Ahsan Atta <[email protected]>
crypto: qat - keep VFs enabled during reset
Eric Biggers <[email protected]>
crypto: drbg - Fix the fips_enabled priority boost
Eric Biggers <[email protected]>
crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
Eric Biggers <[email protected]>
crypto: drbg - Fix returning success on failure in CTR_DRBG
Tycho Andersen (AMD) <[email protected]>
crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)
Tycho Andersen (AMD) <[email protected]>
crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
Tycho Andersen (AMD) <[email protected]>
crypto: ccp - Do not initialize SNP for SEV ioctls
Wentao Liang <[email protected]>
crypto: tegra - fix refcount leak in tegra_se_host1x_submit()
Ruijie Li <[email protected]>
crypto: pcrypt - restore callback for non-parallel fallback
Anastasia Tishchenko <[email protected]>
crypto: ecc - Fix carry overflow in vli multiplication
Thorsten Blum <[email protected]>
crypto: caam - use print_hex_dump_devel to guard key hex dumps again
Thorsten Blum <[email protected]>
crypto: caam - use print_hex_dump_devel to guard key hex dumps
Eric Biggers <[email protected]>
crypto: af_alg - Remove zero-copy support from skcipher and aead
Bryam Vargas <[email protected]>
isofs: bound Rock Ridge symlink components to the SL record
Bryam Vargas <[email protected]>
partitions: aix: bound the pp_count scan to the ppe array
Qu Wenruo <[email protected]>
btrfs: do not trim a device which is not writeable
Tianchu Chen <[email protected]>
nvmet-auth: validate reply message payload bounds against transfer length
Bryam Vargas <[email protected]>
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
Achkinazi, Igor <[email protected]>
nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks
Mikulas Patocka <[email protected]>
dm-ioctl: report an error if a device has no table
Wentao Liang <[email protected]>
nvme: target: rdma: fix ndev refcount leak on queue connect
Wentao Liang <[email protected]>
hwrng: jh7110 - fix refcount leak in starfive_trng_read()
Bryam Vargas <[email protected]>
udf: validate sparing table length as an entry count, not a byte count
Bryam Vargas <[email protected]>
udf: validate VAT header length against the VAT inode size
Michael Bommarito <[email protected]>
udf: validate free block extents against the partition length
Maciej W. Rozycki <[email protected]>
PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
Reinette Chatre <[email protected]>
x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled
Chao Shi <[email protected]>
block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
Paul Cercueil <[email protected]>
usb: gadget: f_fs: Fix DMA fence leak
Paul Menzel <[email protected]>
usb: typec: ucsi: cancel pending work on system suspend
Fan Wu <[email protected]>
usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
Madhu M <[email protected]>
usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode
Andrei Kuchynski <[email protected]>
usb: typec: ucsi: Invert DisplayPort role assignment
Badhri Jagan Sridharan <[email protected]>
usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
Andy Yan <[email protected]>
usb: typec: tcpm: Fix VDM type for Enter Mode commands
Shuangpeng Bai <[email protected]>
usb: typec: class: drop PD lookup reference
Myeonghun Pak <[email protected]>
usb: typec: anx7411: use devm_pm_runtime_enable()
Sam Day <[email protected]>
usbip: vudc: fix NULL deref in vep_dequeue()
Yichong Chen <[email protected]>
usbip: tools: support SuperSpeedPlus devices
Xu Rao <[email protected]>
USB: usb-storage: ene_ub6250: restore media-ready check
Johan Hovold <[email protected]>
USB: ulpi: fix memory leak on registration failure
Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix write buffer corruption
Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix hard lockup on disconnect
Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix broken rx after throttle
Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FE990D50 compositions
Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix information leak
Haoxiang Li <[email protected]>
usb: mtu3: unmap request DMA on queue failure
Myeonghun Pak <[email protected]>
USB: misc: uss720: unregister parport on probe failure
Xu Rao <[email protected]>
USB: storage: include US_FL_NO_SAME in quirks mask
Myeonghun Pak <[email protected]>
usb: sl811-hcd: disable controller wakeup on remove
Johan Hovold <[email protected]>
USB: legousbtower: fix use-after-free on disconnect race
Erich E. Hoover <[email protected]>
USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
Johan Hovold <[email protected]>
USB: iowarrior: fix use-after-free on disconnect
Johan Hovold <[email protected]>
USB: ldusb: fix use-after-free on disconnect race
Johan Hovold <[email protected]>
USB: idmouse: fix use-after-free on disconnect race
Xu Rao <[email protected]>
usb: gadget: f_printer: take kref only for successful open
Jimmy Hu <[email protected]>
usb: gadget: udc: Fix use-after-free in gadget_match_driver
Maoyi Xie <[email protected]>
usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
Dawei Feng <[email protected]>
usb: free iso schedules on failed submit
WenTao Liang <[email protected]>
usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
Rodrigo Lugathe da Conceição Alves <[email protected]>
USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
Haoxiang Li <[email protected]>
usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
Jared Baldridge <[email protected]>
usb: cdc_acm: Add quirk for Uniden BC125AT scanner
Maoyi Xie <[email protected]>
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
Paul Moses <[email protected]>
bpf: Validate BTF repeated field counts before expansion
Dawei Feng <[email protected]>
bpf: Restore sysctl new-value from 1 to 0
Zhao Zhang <[email protected]>
bpf: Reject fragmented frames in devmap
Yingjie Gao <[email protected]>
xfs: fix exchmaps reservation limit check
Darrick J. Wong <[email protected]>
xfs: fix pointer arithmetic error on 32-bit systems
Alexey Nepomnyashih <[email protected]>
xfs: fix unreachable BIGTIME check in dquot flush validation
Yingjie Gao <[email protected]>
xfs: release dquot buffer after dqflush failure
Yousef Alhouseen <[email protected]>
xfs: use null daddr for unset first bad log block
Andy Shevchenko <[email protected]>
serial: 8250_mid: Disable DMA for selected platforms
Louis-Alexis Eyraud <[email protected]>
media: mtk-jpeg: cancel workqueue on release for supported platforms only
Deepanshu Kartikey <[email protected]>
nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
Tristan Madani <[email protected]>
hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
Srinivas Pandruvada <[email protected]>
HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads
Maoyi Xie <[email protected]>
HID: lg-g15: cancel pending work on remove to fix a use-after-free
Manish Khadka <[email protected]>
HID: letsketch: fix UAF on inrange_timer at driver unbind
Myeonghun Pak <[email protected]>
HID: wacom: stop hardware after post-start probe failures
Tianchu Chen <[email protected]>
HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
Yichong Chen <[email protected]>
tools/mm/slabinfo: fix total_objects attribute name
Xuewen Wang <[email protected]>
tools/mm/slabinfo: Fix trace disable logic inversion
Vlastimil Babka (SUSE) <[email protected]>
mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
Lukas Wunner <[email protected]>
X.509: Fix validation of ASN.1 certificate header
Robin Murphy <[email protected]>
perf/arm-cmn: Fix DVM node events
Kartik Rajput <[email protected]>
clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances
Thomas Gleixner <[email protected]>
time/jiffies: Register jiffies clocksource before usage
WenTao Liang <[email protected]>
posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
Yuho Choi <[email protected]>
cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
Tianxiang Chen <[email protected]>
cpufreq: Fix hotplug-suspend race during reboot
Steven Rostedt <[email protected]>
sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
Fushuai Wang <[email protected]>
cpufreq: intel_pstate: Sync policy->cur during CPU offline
Guangshuo Li <[email protected]>
firmware_loader: fix device reference leak in firmware_upload_register()
Guangshuo Li <[email protected]>
cpufreq: qcom-cpufreq-hw: Fix possible double free
Abdun Nihaal <[email protected]>
OPP: of: Fix potential memory leak in opp_parse_supplies()
Baokun Li <[email protected]>
writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
Norbert Manthey <[email protected]>
smb: client: mask server-provided mode to 07777 in modefromsid
Xu Rao <[email protected]>
smb: client: fix atime clamp check in read completion
Zihan Xi <[email protected]>
smb: client: harden POSIX SID length parsing
Zihan Xi <[email protected]>
smb: client: use unaligned reads in parse_posix_ctxt()
Haoxiang Li <[email protected]>
smb: client: Fix next buffer leak in receive_encrypted_standard()
Henrique Carvalho <[email protected]>
smb: client: fix double-free in SMB2_close() replay
Henrique Carvalho <[email protected]>
smb: client: fix double-free in SMB2_open() replay
Zhao Zhang <[email protected]>
smb: client: fix double-free in SMB2_flush() replay
Henrique Carvalho <[email protected]>
smb: client: fix change notify replay double-free
Henrique Carvalho <[email protected]>
smb: client: fix double-free in SMB2_ioctl() replay
Henrique Carvalho <[email protected]>
smb: client: fix query_info() replay double-free
Henrique Carvalho <[email protected]>
smb: client: fix query directory replay double-free
Namjae Jeon <[email protected]>
ksmbd: use opener credentials for ADS I/O
Namjae Jeon <[email protected]>
ksmbd: use opener credentials for delete-on-close
Gil Portnoy <[email protected]>
ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
Gil Portnoy <[email protected]>
ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
Namjae Jeon <[email protected]>
ksmbd: run set info with opener credentials
Gil Portnoy <[email protected]>
ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
Namjae Jeon <[email protected]>
ksmbd: require source read access for duplicate extents
Davide Ornaghi <[email protected]>
ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
Namjae Jeon <[email protected]>
ksmbd: serialize QUERY_DIRECTORY requests per file
Gil Portnoy <[email protected]>
ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
Gil Portnoy <[email protected]>
ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
Dan Carpenter <[email protected]>
smb/client: Fix error code in smb2_aead_req_alloc()
Junrui Luo <[email protected]>
coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
Deepanshu Kartikey <[email protected]>
fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
Konstantin Komarov <[email protected]>
fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()
Konstantin Komarov <[email protected]>
fs/ntfs3: fsync files by syncing parent inodes
Konstantin Komarov <[email protected]>
fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr
Muhammad Bilal <[email protected]>
Bluetooth: L2CAP: validate option length before reading conf opt value
Muhammad Bilal <[email protected]>
Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
Pauli Virtanen <[email protected]>
Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
Yousef Alhouseen <[email protected]>
Bluetooth: fix UAF in bt_accept_dequeue()
Maoyi Xie <[email protected]>
Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
Yousef Alhouseen <[email protected]>
Bluetooth: bnep: pin L2CAP connection during netdev registration
Sergey Senozhatsky <[email protected]>
Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
Xiang Mei <[email protected]>
netfilter: ebtables: terminate table name before find_table_lock()
Florian Westphal <[email protected]>
netfilter: ebtables: module names must be null-terminated
Florian Westphal <[email protected]>
netfilter: handle unreadable frags
Pratham Gupta <[email protected]>
netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
Zijiang Huang <[email protected]>
mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup
Qi Zheng <[email protected]>
mm: shrinker: fix NULL pointer dereference in debugfs
Qi Zheng <[email protected]>
mm: shrinker: fix shrinker_info teardown race with expansion
Shakeel Butt <[email protected]>
mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
Andrei Kuchynski <[email protected]>
mfd: cros_ec: Delay dev_set_drvdata() until probe success
Wyatt Feng <[email protected]>
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
Yuyang Huang <[email protected]>
ipv4: igmp: remove multicast group from hash table on device destruction
Breno Leitao <[email protected]>
netpoll: fix a use-after-free on shutdown path
Runyu Xiao <[email protected]>
io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
Runyu Xiao <[email protected]>
gpio: eic-sprd: use raw_spinlock_t in the irq startup path
Koichiro Den <[email protected]>
NTB: epf: Avoid calling pci_irq_vector() from hardirq context
Yunpeng Tian <[email protected]>
fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
Thomas Gleixner <[email protected]>
debugobjects: Plug race against a concurrent OOM disable
Runyu Xiao <[email protected]>
coresight: etb10: restore atomic_t for shared reading state
Samuel Page <[email protected]>
Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
Chi Wang <[email protected]>
audit: Fix data races of skb_queue_len() readers on audit_queue
Zijing Yin <[email protected]>
net: af_key: initialize alg_key_len for IPComp states
Gil Portnoy <[email protected]>
ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
Dawei Feng <[email protected]>
crypto: amlogic - avoid double cleanup in meson_crypto_probe()
Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB write in HT_caps_handler()
Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
Arnd Bergmann <[email protected]>
staging: media: atomisp: reduce load_primary_binaries() stack usage
Ricardo Ribalda <[email protected]>
media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
Hao-Qun Huang <[email protected]>
staging: vme_user: fix location monitor leak in tsi148 bridge
Hao-Qun Huang <[email protected]>
staging: vme_user: fix location monitor leak in fake bridge
Shoichiro Miyamoto <[email protected]>
smb: client: restrict implied bcc[0] exemption to responses without data area
Michael Tautschnig <[email protected]>
staging: vme_user: bound slave read/write to the kern_buf size
Samuel Page <[email protected]>
tipc: fix out-of-bounds read in broadcast Gap ACK blocks
Yizhou Zhao <[email protected]>
6lowpan: fix NHC entry use-after-free on error path
Runyu Xiao <[email protected]>
usb: dwc3: run gadget disconnect from sleepable suspend context
Alan Stern <[email protected]>
USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
Michael Bommarito <[email protected]>
hwrng: virtio: clamp device-reported used.len at copy_data()
Johan Hovold <[email protected]>
virtio-mmio: fix device release warning on module unload
Ammar Faizi <[email protected]>
virtio_pci: fix vq info pointer lookup via wrong index
Xiang Mei <[email protected]>
netfilter: ipset: fix race between dump and ip_set_list resize
SeongJae Park <[email protected]>
mm/damon/ops-common: handle extreme intervals in damon_hot_score()
Richard Zhu <[email protected]>
PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
Ratheesh Kannoth <[email protected]>
PCI: host-common: Request bus reassignment when not probe-only
Mahesh Vaidya <[email protected]>
PCI: altera: Do not dispose parent IRQ mapping
Ziyao Li <[email protected]>
PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series
Myeonghun Pak <[email protected]>
usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
胡连勤 <[email protected]>
usb: xhci: Fix sleep in atomic context in xhci_free_streams()
Carlos Llamas <[email protected]>
binder: fix UAF in binder_free_transaction()
Carlos Llamas <[email protected]>
binder: fix UAF in binder_thread_release()
Johan Hovold <[email protected]>
Bluetooth: btusb: fix wakeup source leak on probe failure
Johan Hovold <[email protected]>
Bluetooth: btusb: fix use-after-free on marvell probe failure
Johan Hovold <[email protected]>
Bluetooth: btusb: fix use-after-free on registration failure
Zenm Chen <[email protected]>
Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
Alex Williamson <[email protected]>
vfio: Remove device debugfs before releasing devres
Junrui Luo <[email protected]>
vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
Alex Williamson <[email protected]>
vfio/pci: Fix racy bitfields and tighten struct layout
Alex Williamson <[email protected]>
vfio/pci: Release the VGA arbiter client on register_device() failure
Alex Williamson <[email protected]>
vfio/pci: Latch disable_idle_d3 per device
Raghavendra Rao Ananta <[email protected]>
vfio/pci: Use a private flag to prevent power state change with VFs
Cássio Gabriel <[email protected]>
ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
Cássio Gabriel <[email protected]>
ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
Cássio Gabriel <[email protected]>
ALSA: usb-audio: Roll back quirk control caches on write errors
Cássio Gabriel <[email protected]>
ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
Cássio Gabriel <[email protected]>
ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
Darvell Long <[email protected]>
ALSA: usb-audio: avoid kobject path lookup in DualSense match
HyeongJun An <[email protected]>
ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
Zhao Dongdong <[email protected]>
ALSA: ice1712: check snd_ctl_new1() return value
Zhao Dongdong <[email protected]>
ALSA: gus: check snd_ctl_new1() return value
Maoyi Xie <[email protected]>
ALSA: firewire: isight: bound the sample count to the packet payload
Zhao Dongdong <[email protected]>
ALSA: es1938: check snd_ctl_new1() return value
Zhao Dongdong <[email protected]>
ALSA: cmipci: check snd_ctl_new1() return value
Maoyi Xie <[email protected]>
ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
Zhao Dongdong <[email protected]>
ALSA: ymfpci: check snd_ctl_new1() return value
Cássio Gabriel <[email protected]>
ALSA: virtio: Validate control metadata from the device
Cássio Gabriel <[email protected]>
ALSA: virtio: Add missing 384 kHz PCM rate mapping
Liviu Stan <[email protected]>
iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
Liviu Stan <[email protected]>
iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
Pengpeng Hou <[email protected]>
iio: temperature: Build mlx90635 with CONFIG_MLX90635
Stepan Ionichev <[email protected]>
iio: resolver: ad2s1210: notify trigger and clear state on fault read error
Andy Shevchenko <[email protected]>
iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
Javier Carrasco <[email protected]>
iio: light: veml6030: fix channel type when pushing events
Stepan Ionichev <[email protected]>
iio: light: tsl2591: return actual error from probe IRQ failure
Joshua Crofts <[email protected]>
iio: light: opt3001: fix missing state reset on timeout
Biren Pandya <[email protected]>
iio: light: gp2ap002: fix runtime PM leak on read error
Vidhu Sarwal <[email protected]>
iio: light: al3010: fix incorrect scale for the highest gain range
Andreas Kempe <[email protected]>
iio: imu: st_lsm6dsx: deselect shub page before reading whoami
Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix timestamp clock period by using lower value
Runyu Xiao <[email protected]>
iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
Runyu Xiao <[email protected]>
iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
Stepan Ionichev <[email protected]>
iio: gyro: bmg160: wait full startup time after mode change at probe
Stepan Ionichev <[email protected]>
iio: gyro: bmg160: bail out when bandwidth/filter is not in table
Lars-Peter Clausen <[email protected]>
iio: event: Fix event FIFO reset race
Herman van Hazendonk <[email protected]>
iio: common: st_sensors: honour channel endianness in read_axis_data
Maxwell Doose <[email protected]>
iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
Dan Carpenter <[email protected]>
iio: backend: fix uninitialized data in debugfs
Pengpeng Hou <[email protected]>
iio: adc: ti-ads124s08: Return reset GPIO lookup errors
Guangshuo Li <[email protected]>
iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
Maxwell Doose <[email protected]>
iio: adc: spear: Initialize completion before requesting IRQ
Maxwell Doose <[email protected]>
iio: adc: lpc32xx: Initialize completion before requesting IRQ
Biren Pandya <[email protected]>
iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
Bryam Vargas <[email protected]>
iio: accel: bmc150: clamp the device-reported FIFO frame count
Griffin Kroah-Hartman <[email protected]>
usb: gadget: function: rndis: add length check for header
Griffin Kroah-Hartman <[email protected]>
usb: gadget: function: rndis: add length check to response query
Krzysztof Karas <[email protected]>
drm/i915: ensure segment offset never exceeds allowed max
Alice Ryhl <[email protected]>
rust: kasan: KASAN+RUST requires clang
Taeyang Lee <[email protected]>
perf/core: Detach event groups during remove_on_exec
Alice Ryhl <[email protected]>
rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER
Huacai Chen <[email protected]>
LoongArch: Add PIO for early access before ACPI PCI root register
HyeongJun An <[email protected]>
platform/x86: intel-hid: Protect ACPI notify handler against recursion
Rafael J. Wysocki <[email protected]>
ACPI: NFIT: core: Fix possible NULL pointer dereference
Jeremy Linton <[email protected]>
ACPI: CPPC: Suppress UBSAN warning caused by field misuse
Florian Fainelli <[email protected]>
perf trace beauty fcntl: Fix build with older kernel headers
Pedro Falcato <[email protected]>
mm/khugepaged: write all dirty file folios when collapsing
Christoph Hellwig <[email protected]>
block: fix queue freeze vs limits lock order in sysfs store methods
Christoph Hellwig <[email protected]>
block: add a store_limit operations for sysfs entries
Hangbin Liu <[email protected]>
bonding: fix xfrm offload feature setup on active-backup mode
NeilBrown <[email protected]>
nfsd: change nfs4_client_to_reclaim() to allocate data
NeilBrown <[email protected]>
nfsd: move name lookup out of nfsd4_list_rec_dir()
John Johansen <[email protected]>
apparmor: advertise the tcp fast open fix is applied
John Stultz <[email protected]>
locking/rtmutex: Make sure we wake anything on the wake_q when we release the lock->wait_lock
Michael Bommarito <[email protected]>
NFSv4/flexfiles: reject zero filehandle version count
Jonathan Curley <[email protected]>
NFSv4/flexfiles: Add data structure support for striped layouts
Jonathan Curley <[email protected]>
NFSv4/flexfiles: Remove cred local variable dependency
Mike Snitzer <[email protected]>
nfs_common: rename functions that invalidate LOCALIO nfs_clients
Mike Snitzer <[email protected]>
nfsd: add nfsd_file_{get,put} to 'nfs_to' nfsd_localio_operations
Mingyu Wang <[email protected]>
fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
Keshav Verma <[email protected]>
f2fs: fix listxattr handling of corrupted xattr entries
Chao Yu <[email protected]>
f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
Ruipeng Qi <[email protected]>
f2fs: fix potential deadlock in f2fs_balance_fs()
Bryam Vargas <[email protected]>
f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
Chao Yu <[email protected]>
f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
Wenjie Qi <[email protected]>
f2fs: validate orphan inode entry count
Bartosz Golaszewski <[email protected]>
device property: initialize the remaining fields of fwnode_handle in fwnode_init()
Uladzislau Rezki (Sony) <[email protected]>
mm/vmalloc: take vmap_purge_lock in shrinker
Marco Scardovi <[email protected]>
gpio: rockchip: fix generic IRQ chip leak on remove
Marco Scardovi <[email protected]>
gpio: rockchip: teardown bugs and resource leaks
Ye Zhang <[email protected]>
gpio: rockchip: change the GPIO version judgment logic
Tiezhu Yang <[email protected]>
drm/amd: Fix set but not used warnings
Mikhail Dmitrichenko <[email protected]>
bcachefs: avoid truncating fiemap extent length
Wentao Guan <[email protected]>
perf: Fix dangling cgroup pointer in cpuctx backport
Kiryl Shutsemau <[email protected]>
userfaultfd: gate must_wait writability check on pte_present()
Chris Mason <[email protected]>
nfsd: release layout stid on setlease failure
Scott Mayhew <[email protected]>
nfsd: fix file change detection in CB_GETATTR
Daniel Borkmann <[email protected]>
bpf, arm64: Reject out-of-range B.cond targets
-------------
Diffstat:
Documentation/crypto/userspace-if.rst | 31 +- Makefile | 7 +- arch/arm64/kernel/entry-fpsimd.S | 8 +- arch/arm64/lib/insn.c | 2 + arch/loongarch/include/asm/acpi.h | 2 + arch/loongarch/kernel/acpi.c | 28 + arch/loongarch/kernel/setup.c | 2 + arch/loongarch/pci/acpi.c | 2 + arch/riscv/include/asm/pgtable.h | 10 + arch/riscv/kernel/entry.S | 7 +- arch/x86/kernel/cpu/resctrl/monitor.c | 45 +- arch/x86/kvm/svm/svm.c | 3 + arch/x86/kvm/vmx/vmx.c | 41 +- arch/x86/kvm/x86.c | 3 - block/bdev.c | 8 +- block/blk-sysfs.c | 108 ++-- block/partitions/aix.c | 9 + crypto/af_alg.c | 69 +-- crypto/algif_aead.c | 8 +- crypto/asymmetric_keys/x509_loader.c | 2 +- crypto/drbg.c | 4 +- crypto/ecc.c | 31 +- crypto/pcrypt.c | 4 + drivers/acpi/cppc_acpi.c | 11 +- drivers/acpi/nfit/core.c | 3 + drivers/android/binder.c | 19 +- drivers/base/firmware_loader/sysfs_upload.c | 8 +- drivers/bluetooth/btmtksdio.c | 2 +- drivers/bluetooth/btnxpuart.c | 6 + drivers/bluetooth/btusb.c | 39 +- drivers/bluetooth/hci_ldisc.c | 14 +- drivers/char/hw_random/jh7110-trng.c | 13 +- drivers/char/hw_random/virtio-rng.c | 23 +- drivers/clocksource/timer-tegra186.c | 3 +- drivers/cpufreq/cpufreq.c | 2 + drivers/cpufreq/intel_pstate.c | 6 +- drivers/cpufreq/pcc-cpufreq.c | 2 + drivers/cpufreq/qcom-cpufreq-hw.c | 1 - drivers/crypto/amlogic/amlogic-gxl-core.c | 2 +- drivers/crypto/caam/caamalg.c | 12 +- drivers/crypto/caam/caamalg_qi.c | 12 +- drivers/crypto/caam/caamalg_qi2.c | 12 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/caam/key_gen.c | 4 +- drivers/crypto/ccp/sev-dev.c | 37 +- drivers/crypto/intel/qat/qat_common/adf_aer.c | 4 +- drivers/crypto/intel/qat/qat_common/adf_init.c | 16 + drivers/crypto/intel/qat/qat_common/adf_sriov.c | 12 +- .../crypto/intel/qat/qat_common/qat_asym_algs.c | 10 +- drivers/crypto/talitos.c | 561 +++++++++++---------- drivers/crypto/talitos.h | 12 + drivers/crypto/tegra/tegra-se-main.c | 2 +- drivers/dma-buf/udmabuf.c | 9 +- drivers/edac/i10nm_base.c | 14 +- drivers/gpio/gpio-eic-sprd.c | 8 +- drivers/gpio/gpio-rockchip.c | 31 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 6 +- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 9 +- drivers/gpu/drm/i915/i915_mm.c | 4 +- drivers/hid/hid-goodix-spi.c | 3 + drivers/hid/hid-letsketch.c | 36 +- drivers/hid/hid-lg-g15.c | 16 + drivers/hid/hid-sensor-hub.c | 77 ++- drivers/hid/wacom_sys.c | 12 +- drivers/hwtracing/coresight/coresight-etb10.c | 6 +- drivers/hwtracing/coresight/ultrasoc-smb.c | 1 + drivers/i2c/busses/i2c-mpc.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 9 +- drivers/i2c/i2c-core-base.c | 81 +-- drivers/iio/accel/bmc150-accel-core.c | 2 + drivers/iio/accel/kxsd9.c | 5 +- drivers/iio/adc/lpc32xx_adc.c | 4 +- drivers/iio/adc/spear_adc.c | 3 +- drivers/iio/adc/ti-ads1119.c | 6 +- drivers/iio/adc/ti-ads124s08.c | 3 +- drivers/iio/chemical/scd30_core.c | 19 +- drivers/iio/common/st_sensors/st_sensors_core.c | 23 +- drivers/iio/gyro/bmg160_core.c | 16 +- drivers/iio/imu/adis_trigger.c | 2 +- drivers/iio/imu/bmi160/bmi160_core.c | 3 +- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 9 +- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 1 + drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 21 +- drivers/iio/industrialio-backend.c | 2 +- drivers/iio/industrialio-event.c | 5 +- drivers/iio/light/al3010.c | 2 +- drivers/iio/light/gp2ap002.c | 2 +- drivers/iio/light/opt3001.c | 6 +- drivers/iio/light/tsl2591.c | 6 +- drivers/iio/light/veml6030.c | 8 +- drivers/iio/magnetometer/ak8975.c | 1 + drivers/iio/resolver/ad2s1210.c | 2 +- drivers/iio/temperature/Makefile | 2 +- drivers/iio/temperature/ltc2983.c | 5 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 9 + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +- drivers/input/joystick/iforce/iforce-packets.c | 18 +- drivers/input/joystick/maplecontrol.c | 3 +- drivers/input/keyboard/maple_keyb.c | 4 +- drivers/input/mouse/elan_i2c_core.c | 36 +- drivers/input/mouse/maplemouse.c | 9 +- drivers/input/rmi4/rmi_bus.c | 4 +- drivers/input/rmi4/rmi_f30.c | 2 +- drivers/input/rmi4/rmi_f3a.c | 2 +- drivers/input/touchscreen/goodix.c | 3 +- drivers/input/touchscreen/mms114.c | 26 +- drivers/input/touchscreen/touchwin.c | 15 +- drivers/iommu/amd/iommu.c | 3 +- drivers/iommu/iommufd/hw_pagetable.c | 11 +- drivers/md/dm-ioctl.c | 5 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 3 +- drivers/mfd/cros_ec_dev.c | 3 +- drivers/net/bonding/bond_main.c | 2 +- drivers/net/bonding/bond_netlink.c | 16 +- drivers/net/usb/kalmia.c | 8 + drivers/ntb/hw/epf/ntb_hw_epf.c | 14 +- drivers/nvme/host/multipath.c | 6 + drivers/nvme/target/discovery.c | 23 +- drivers/nvme/target/fabrics-cmd-auth.c | 15 +- drivers/nvme/target/rdma.c | 6 +- drivers/opp/of.c | 3 +- drivers/pci/controller/dwc/pci-imx6.c | 12 +- drivers/pci/controller/pci-host-common.c | 4 + drivers/pci/controller/pci-loongson.c | 36 ++ drivers/pci/controller/pcie-altera.c | 1 - drivers/pci/quirks.c | 51 +- drivers/perf/arm-cmn.c | 23 +- drivers/platform/x86/intel/hid.c | 9 + drivers/regulator/scmi-regulator.c | 4 +- drivers/spi/spi-fsl-lpspi.c | 18 +- drivers/staging/media/atomisp/pci/sh_css.c | 6 +- drivers/staging/media/ipu3/ipu3-css-params.c | 8 +- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 20 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 23 +- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 + drivers/staging/vme_user/vme_fake.c | 8 + drivers/staging/vme_user/vme_tsi148.c | 8 + drivers/staging/vme_user/vme_user.c | 22 + drivers/tty/serial/8250/8250_mid.c | 13 +- drivers/usb/cdns3/cdnsp-mem.c | 2 + drivers/usb/class/cdc-acm.c | 3 + drivers/usb/common/ulpi.c | 23 +- drivers/usb/core/quirks.c | 6 + drivers/usb/dwc3/dwc3-meson-g12a.c | 14 +- drivers/usb/dwc3/gadget.c | 43 +- drivers/usb/fotg210/fotg210-hcd.c | 6 +- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 3 +- drivers/usb/gadget/function/f_printer.c | 3 +- drivers/usb/gadget/function/rndis.c | 20 +- drivers/usb/gadget/udc/core.c | 29 +- drivers/usb/host/ehci-sched.c | 11 +- drivers/usb/host/sl811-hcd.c | 1 + drivers/usb/host/xhci.c | 11 +- drivers/usb/misc/chaoskey.c | 1 - drivers/usb/misc/idmouse.c | 45 +- drivers/usb/misc/iowarrior.c | 4 +- drivers/usb/misc/ldusb.c | 38 +- drivers/usb/misc/legousbtower.c | 37 +- drivers/usb/misc/uss720.c | 5 +- drivers/usb/mtu3/mtu3_gadget.c | 1 + drivers/usb/serial/digi_acceleport.c | 43 +- drivers/usb/serial/keyspan_pda.c | 2 +- drivers/usb/serial/option.c | 16 + drivers/usb/storage/ene_ub6250.c | 3 +- drivers/usb/storage/usb.c | 2 +- drivers/usb/typec/anx7411.c | 4 +- drivers/usb/typec/class.c | 1 + drivers/usb/typec/tcpm/tcpci_rt1711h.c | 13 +- drivers/usb/typec/tcpm/tcpm.c | 9 +- drivers/usb/typec/ucsi/displayport.c | 7 +- drivers/usb/typec/ucsi/ucsi.c | 20 + drivers/usb/typec/ucsi/ucsi.h | 1 + drivers/usb/typec/ucsi/ucsi_acpi.c | 10 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 2 +- drivers/usb/usbip/vudc.h | 1 - drivers/usb/usbip/vudc_dev.c | 4 +- drivers/vfio/debugfs.c | 1 + drivers/vfio/pci/vfio_pci_core.c | 37 +- drivers/vfio/vfio_main.c | 11 +- drivers/video/fbdev/core/fbcon.c | 7 + drivers/virtio/virtio_mmio.c | 26 +- drivers/virtio/virtio_pci_common.c | 10 +- drivers/watchdog/apple_wdt.c | 1 + fs/bcachefs/fs.c | 8 +- fs/btrfs/extent-tree.c | 12 +- fs/exfat/dir.c | 13 +- fs/f2fs/checkpoint.c | 14 +- fs/f2fs/data.c | 29 ++ fs/f2fs/f2fs.h | 1 + fs/f2fs/gc.c | 50 +- fs/f2fs/inode.c | 30 +- fs/f2fs/segment.c | 8 + fs/f2fs/xattr.c | 6 +- fs/fs-writeback.c | 31 +- fs/fuse/cuse.c | 4 +- fs/fuse/dev.c | 11 +- fs/hfs/bnode.c | 2 + fs/hfsplus/bnode.c | 2 + fs/isofs/rock.c | 11 + fs/nfs/dir.c | 2 + fs/nfs/flexfilelayout/flexfilelayout.c | 153 +++--- fs/nfs/flexfilelayout/flexfilelayout.h | 27 +- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 54 +- fs/nfs/localio.c | 2 +- fs/nfs_common/nfslocalio.c | 8 +- fs/nfsd/localio.c | 2 + fs/nfsd/nfs4layouts.c | 4 +- fs/nfsd/nfs4recover.c | 118 ++--- fs/nfsd/nfs4state.c | 35 +- fs/nfsd/nfsctl.c | 4 +- fs/nilfs2/segment.c | 22 + fs/ntfs3/attrib.c | 14 + fs/ntfs3/dir.c | 2 +- fs/ntfs3/file.c | 30 +- fs/ntfs3/frecord.c | 59 ++- fs/ntfs3/fslog.c | 20 +- fs/ntfs3/inode.c | 10 +- fs/ntfs3/ntfs_fs.h | 4 +- fs/smb/client/cifsacl.c | 2 +- fs/smb/client/file.c | 2 +- fs/smb/client/smb2misc.c | 32 +- fs/smb/client/smb2ops.c | 18 +- fs/smb/client/smb2pdu.c | 22 +- fs/smb/server/smb2pdu.c | 101 ++-- fs/smb/server/vfs.c | 18 +- fs/smb/server/vfs_cache.c | 5 + fs/smb/server/vfs_cache.h | 2 + fs/udf/balloc.c | 5 +- fs/udf/super.c | 11 +- fs/userfaultfd.c | 14 +- fs/xfs/libxfs/xfs_bmap_btree.h | 2 +- fs/xfs/libxfs/xfs_exchmaps.c | 2 +- fs/xfs/xfs_dquot.c | 16 +- fs/xfs/xfs_log_recover.c | 6 +- fs/xfs/xfs_qm.c | 5 +- include/crypto/drbg.h | 18 +- include/linux/damon.h | 8 +- include/linux/f2fs_fs.h | 1 + include/linux/fs.h | 5 + include/linux/fwnode.h | 2 + include/linux/glob.h | 1 + include/linux/hid-sensor-hub.h | 25 + include/linux/nfslocalio.h | 7 +- include/linux/vfio_pci_core.h | 15 +- include/net/bonding.h | 1 + init/Kconfig | 1 + io_uring/io-wq.c | 2 +- kernel/audit.c | 21 +- kernel/bpf/btf.c | 9 +- kernel/bpf/cgroup.c | 2 +- kernel/bpf/devmap.c | 7 + kernel/events/core.c | 19 +- kernel/locking/rtmutex.c | 18 +- kernel/locking/rtmutex_api.c | 2 +- kernel/module/decompress.c | 2 + kernel/sched/features.h | 8 + kernel/time/jiffies.c | 11 +- kernel/time/posix-cpu-timers.c | 1 + kernel/trace/trace_events_filter.c | 6 +- lib/debugobjects.c | 17 + lib/glob.c | 31 +- mm/damon/ops-common.c | 1 + mm/filemap.c | 2 +- mm/khugepaged.c | 41 +- mm/madvise.c | 3 +- mm/mincore.c | 3 +- mm/mmap.c | 2 +- mm/shrinker.c | 13 +- mm/shrinker_debug.c | 14 +- mm/slub.c | 18 +- mm/swapfile.c | 1 + mm/vmalloc.c | 1 + net/6lowpan/nhc.c | 2 +- net/bluetooth/af_bluetooth.c | 17 +- net/bluetooth/bnep/core.c | 27 +- net/bluetooth/iso.c | 13 +- net/bluetooth/l2cap_core.c | 36 +- net/bluetooth/l2cap_sock.c | 4 +- net/bluetooth/mgmt.c | 3 + net/bridge/netfilter/ebtables.c | 9 + net/core/netpoll.c | 9 +- net/ipv4/igmp.c | 1 + net/ipv4/sysctl_net_ipv4.c | 10 +- net/ipv4/tcp_output.c | 4 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/key/af_key.c | 1 + net/netfilter/ipset/ip_set_core.c | 8 +- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nfnetlink_log.c | 26 +- net/netfilter/nfnetlink_queue.c | 16 +- net/netfilter/xt_u32.c | 16 +- net/tipc/bcast.c | 22 +- net/tipc/bcast.h | 2 +- net/tipc/node.c | 15 +- security/apparmor/net.c | 1 + sound/core/seq/seq_memory.c | 2 +- sound/firewire/isight.c | 3 +- sound/isa/gus/gus_pcm.c | 2 + sound/pci/cmipci.c | 6 + sound/pci/es1938.c | 2 + sound/pci/ice1712/aureon.c | 2 + sound/pci/ice1712/ice1712.c | 8 + sound/pci/ice1712/ice1724.c | 6 + sound/pci/ymfpci/ymfpci_main.c | 6 + sound/usb/caiaq/input.c | 2 +- sound/usb/mixer_quirks.c | 101 ++-- sound/usb/mixer_scarlett.c | 4 +- sound/usb/mixer_us16x08.c | 127 +++-- sound/virtio/virtio_kctl.c | 50 ++ sound/virtio/virtio_pcm.c | 3 +- sound/virtio/virtio_pcm_ops.c | 3 +- tools/mm/slabinfo.c | 6 +- tools/perf/trace/beauty/fcntl.c | 16 + tools/testing/selftests/mm/droppable.c | 48 +- tools/testing/selftests/mm/pagemap_ioctl.c | 12 +- tools/usb/usbip/libsrc/usbip_common.c | 2 + tools/usb/usbip/libsrc/usbip_device_driver.c | 4 + tools/usb/usbip/libsrc/vhci_driver.c | 1 + 322 files changed, 3289 insertions(+), 1627 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/349 bpf, arm64: Reject out-of-range B.cond targets
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
commit 48d83d94930eb4db4c93d2de44838b9455cff626 upstream.
aarch64_insn_gen_cond_branch_imm() calls label_imm_common() to compute a 19-bit signed byte offset for a conditional branch, but unlike its siblings aarch64_insn_gen_branch_imm() and aarch64_insn_gen_comp_branch_imm(), it does not check whether label_imm_common() returned its out-of-range sentinel (range) before feeding the value to aarch64_insn_encode_immediate().
aarch64_insn_encode_immediate() unconditionally masks the value with the 19-bit field mask, so an offset that was rejected by label_imm_common() gets silently truncated. With the sentinel value SZ_1M, the resulting field ends up with bit 18 (the sign bit of the 19-bit signed displacement) set, and the CPU decodes it as a ~1 MiB *backward* branch, producing an incorrectly targeted B.cond instruction. For code-gen locations like the emit_bpf_tail_call() this function is the only barrier between an overflowing displacement and a silently miscompiled branch.
Fix it by returning AARCH64_BREAK_FAULT when the offset is out of range, so callers see a loud failure instead of a silently misencoded branch. validate_code() scans the generated image for any AARCH64_BREAK_FAULT and then lets the JIT fail.
--- arch/arm64/lib/insn.c | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/lib/insn.c +2 -0
@@ -338,6 +338,8 @@ u32 aarch64_insn_gen_cond_branch_imm(unsigned long pc, unsigned long addr,long offset; offset =label_imm_common (pc, addr,SZ_1M ); +if (offset >=SZ_1M ) +return AARCH64_BREAK_FAULT ; insn =aarch64_insn_get_bcond_value ();
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 2/349 nfsd: fix file change detection in CB_GETATTR
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Mayhew <[email protected]>
commit 304d81a2fbf2b454def4debcb38ea173911b72cd upstream.
RFC 8881, section 10.4.3 doesn't say anything about caching the file size in the delegation record, nor does it say anything about comparing a cached file size with the size reported by the client in the CB_GETATTR reply for the purpose of determining if the client holds modified data for the file.
What section 10.4.3 of RFC 8881 does say is that the server should compare the *current* file size with the size reported by the client holding the delegation in the CB_GETATTR reply, and if they differ to treat it as a modification regardless of the change attribute retrieved via the CB_GETATTR.
Doing otherwise would cause the server to believe the client holding the delegation has a modified version of the file, even if the client flushed the modifications to the server prior to the CB_GETATTR. This would have the added side effect of subsequent CB_GETATTRs causing updates to the mtime, ctime, and change attribute even if the client holding the delegation makes no further updates to the file.
Modify nfsd4_deleg_getattr_conflict() to obtain the current file size via i_size_read(). Retain the ncf_cur_fsize field, since it's a convenient way to return the file size back to nfsd4_encode_fattr4(), but don't use it for the purpose of detecting file changes. Remove the unnecessary initialization of ncf_cur_fsize in nfs4_open_delegation().
Also, if we recall the delegation (because the client didn't respond to the CB_GETATTR), then skip the logic that checks the nfs4_cb_fattr fields.
--- fs/nfsd/nfs4state.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
fs/nfsd/nfs4state.c +8 -5
@@ -6086,7 +6086,6 @@ nfs4_open_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp, goto out_no_deleg; } open->op_delegate_type =NFS4_OPEN_DELEGATE_WRITE ; - dp->dl_cb_fattr.ncf_cur_fsize = stat.size; dp->dl_cb_fattr.ncf_initial_cinfo =nfsd4_change_attribute (&stat);trace_nfsd_deleg_write (&dp->dl_stid.sc_stateid); }else {
@@ -9040,11 +9039,15 @@ nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct dentry *dentry,if (status != nfserr_jukebox || !nfsd_wait_for_delegreturn (rqstp, inode)) goto out_status; + status = nfs_ok; + goto out_status; + } +if (!ncf->ncf_file_modified) { +if (ncf->ncf_initial_cinfo != ncf->ncf_cb_change) + ncf->ncf_file_modified = true; +else if (i_size_read (inode) != ncf->ncf_cb_fsize) + ncf->ncf_file_modified = true; } -if (!ncf->ncf_file_modified && - (ncf->ncf_initial_cinfo != ncf->ncf_cb_change || - ncf->ncf_cur_fsize != ncf->ncf_cb_fsize)) - ncf->ncf_file_modified = true;if (ncf->ncf_file_modified) {int err;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 3/349 nfsd: release layout stid on setlease failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <[email protected]>
commit 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 upstream.
nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then fails, the error path frees the layout stateid directly with kmem_cache_free() without ever calling idr_remove(), leaving the IDR slot pointing at freed slab memory. Any subsequent IDR walker (states_show, client teardown) dereferences the dangling pointer.
The correct teardown for an IDR-published stid is nfs4_put_stid(), which removes the IDR slot under cl_lock, dispatches sc_free (nfsd4_free_layout_stateid) to release ls->ls_file via nfsd4_close_layout(), and drops the nfs4_file reference in its tail.
Replace the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup with a single nfs4_put_stid(stp).
--- fs/nfsd/nfs4layouts.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/nfsd/nfs4layouts.c +1 -3
@@ -256,9 +256,7 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate,BUG_ON (!ls->ls_file);if (nfsd4_layout_setlease (ls)) { -nfsd_file_put (ls->ls_file); -put_nfs4_file (fp); -kmem_cache_free (nfs4_layout_stateid_cache, ls); +nfs4_put_stid (stp);return NULL ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 4/349 userfaultfd: gate must_wait writability check on pte_present()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiryl Shutsemau <[email protected]>
[ Upstream commit 8e80af52db652fbc41320eee45a4f73bc029faf2 ]
userfaultfd_must_wait() and userfaultfd_huge_must_wait() read the PTE without taking the page table lock and then apply pte_write() / huge_pte_write() to it. Those accessors decode bits from the present encoding only; on a swap or migration entry they read the offset bits that happen to share the same position and return an undefined result.
The intent of the check is "is this fault still WP-blocked?". A non-marker swap entry means the page is in transit -- the userfault context the original fault delivered against is no longer the same, and the swap-in or migration completion path will re-deliver a fresh fault if userspace still needs to handle it. Worst case under the current code the garbage write bit says "wait", and the thread stays asleep until a UFFDIO_WAKE that may never arrive.
Gate the writability check on pte_present() so the lockless re-check only inspects present-PTE bits when the entry is actually present. The non-present, non-marker case returns "don't wait" and lets the fault path retry.
[ kas: apply to fs/userfaultfd.c and fold the pte_present()/
huge_pte_present() gate into the existing writability checks; this tree predates the marker/return-style refactor of these functions ]
--- fs/userfaultfd.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
fs/userfaultfd.c +12 -2
@@ -251,7 +251,12 @@ static inline bool userfaultfd_huge_must_wait(struct userfaultfd_ctx *ctx,*/ if (huge_pte_none_mostly (pte)) ret = true; -if (!huge_pte_write (pte) && (reason &VM_UFFD_WP )) +/* +* Gate the writability check on pte_present(): huge_pte_write() on a +* non-present migration entry decodes random offset bits. The +* migration completion path re-delivers the fault if still needed. +*/ +if (pte_present (pte) && !huge_pte_write (pte) && (reason &VM_UFFD_WP )) ret = true; out:return ret;
@@ -326,7 +331,12 @@ static inline bool userfaultfd_must_wait(struct userfaultfd_ctx *ctx, ptent =ptep_get (pte);if (pte_none_mostly (ptent)) ret = true; -if (!pte_write (ptent) && (reason &VM_UFFD_WP )) +/* +* Gate the writability check on pte_present(): pte_write() on a +* non-present swap/migration entry decodes random offset bits. The +* page-in path re-delivers the fault if it still needs userspace. +*/ +if (pte_present (ptent) && !pte_write (ptent) && (reason &VM_UFFD_WP )) ret = true;pte_unmap (pte);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 5/349 perf: Fix dangling cgroup pointer in cpuctx backport
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Guan <[email protected]>
recently backport of ("perf: Fix dangling cgroup pointer in cpuctx") use a middle version, so aligned with the upstream commit:
commit 3b7a34aebbdf ("perf: Fix dangling cgroup pointer in cpuctx")
This is a fix for stable v6.12.94 backport commit, so no upstream commit.
--- kernel/events/core.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
kernel/events/core.c +2 -3
@@ -2440,10 +2440,9 @@ __perf_remove_from_context(struct perf_event *event,*/ if (flags &DETACH_EXIT ) state =PERF_EVENT_STATE_EXIT ; -if (flags &DETACH_DEAD ) { - event->pending_disable =1 ; +if (flags &DETACH_DEAD ) state =PERF_EVENT_STATE_DEAD ; - } +event_sched_out (event, ctx);if (event->state >PERF_EVENT_STATE_OFF )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 6/349 bcachefs: avoid truncating fiemap extent length
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Dmitrichenko <[email protected]>
No upstream commit exists for this patch.
bkey sizes are stored in sectors as u32, while fiemap reports byte lengths as u64. Shifting k.k->size before widening performs the conversion in 32 bits, so an extent of 4 GiB or larger can wrap before it is passed to fiemap_fill_next_extent().
Compute the byte length after casting the sector count to u64 and reuse it for all bch2_fill_extent() cases.
The same issue was fixed in bcachefs-tools, but there is no Linux upstream commit to backport to 6.12. The affected 6.12 implementation lives in fs/bcachefs/fs.c, while the bcachefs-tools fix touches fs/bcachefs/vfs/fiemap.c.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- fs/bcachefs/fs.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
fs/bcachefs/fs.c +5 -3
@@ -1184,6 +1184,8 @@ static int bch2_fill_extent(struct bch_fstruct fiemap_extent_info *info, struct bkey_s_c k, unsigned flags) { + u64 len = (u64)k.k->size << 9; +if (bkey_extent_is_direct_data (k.k)) {struct bkey_ptrs_c ptrs =bch2_bkey_ptrs_c (k);const union bch_extent_entry *entry;
@@ -1212,7 +1214,7 @@ static int bch2_fill_extent(struct bch_f ret =fiemap_fill_next_extent (info,bkey_start_offset (k.k) <<9 , offset <<9 , - k.k->size <<9 , flags|flags2); + len, flags | flags2);if (ret)return ret; }
@@ -1221,13 +1223,13 @@ static int bch2_fill_extent(struct bch_f }else if (bkey_extent_is_inline_data (k.k)) {return fiemap_fill_next_extent (info,bkey_start_offset (k.k) <<9 , -0 , k.k->size <<9 , +0 , len, flags|FIEMAP_EXTENT_DATA_INLINE ); }else if (k.k->type == KEY_TYPE_reservation) {return fiemap_fill_next_extent (info,bkey_start_offset (k.k) <<9 , -0 , k.k->size <<9 , +0 , len, flags|FIEMAP_EXTENT_DELALLOC |FIEMAP_EXTENT_UNWRITTEN );
Greg Kroah-Hartman
maintainerPATCH 7/349 drm/amd: Fix set but not used warnings
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
[ Upstream commit 46791d147d3ab3262298478106ef2a52fc7192e2 ]
There are many set but not used warnings under drivers/gpu/drm/amd when compiling with the latest upstream mainline GCC:
drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c:305:18: warning: variable ‘p’ set but not used [-Wunused-but-set-variable=] drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h:103:26: warning: variable ‘internal_reg_offset’ set but not used [-Wunused-but-set-variable=]
...
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h:164:26: warning: variable ‘internal_reg_offset’ set but not used [-Wunused-but-set-variable=]
...
drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:445:13: warning: variable ‘pipe_idx’ set but not used [-Wunused-but-set-variable=] drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:875:21: warning: variable ‘pipe_idx’ set but not used [-Wunused-but-set-variable=]
Remove the variables actually not used or add __maybe_unused attribute for the variables actually used to fix them, compile tested only.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 4 +--- drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 6 ++++-- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 9 +++------ 3 files changed, 8 insertions(+), 11 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c +1 -3
@@ -307,7 +307,6 @@ void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset, int pages) {unsigned t; -unsigned p;int i, j;u64 page_base;/* Starting from VEGA10, system bit must be 0 to mean invalid. */
@@ -321,8 +320,7 @@ void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset,return ; t = offset /AMDGPU_GPU_PAGE_SIZE ; - p = t /AMDGPU_GPU_PAGES_IN_CPU_PAGE ; -for (i =0 ; i < pages; i++, p++) { +for (i =0 ; i < pages; i++) { page_base = adev->dummy_page_addr;if (!adev->gart.ptr)continue ;
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h +4 -2
@@ -100,7 +100,8 @@ #define SOC15_DPG_MODE_OFFSET(ip, inst_idx, reg) \ ({ \ - uint32_t internal_reg_offset, addr; \ + /* To avoid a -Wunused-but-set-variable warning. */ \ + uint32_t internal_reg_offset __maybe_unused, addr; \ bool video_range, video1_range, aon_range, aon1_range; \ \ addr = (adev->reg_offset[ip##_HWIP][inst_idx][reg##_BASE_IDX] + reg); \
@@ -161,7 +162,8 @@ #define SOC24_DPG_MODE_OFFSET(ip, inst_idx, reg) \ ({ \ - uint32_t internal_reg_offset, addr; \ + /* To avoid a -Wunused-but-set-variable warning. */ \ + uint32_t internal_reg_offset __maybe_unused, addr; \ bool video_range, aon_range; \ \ addr = (adev->reg_offset[ip##_HWIP][inst_idx][reg##_BASE_IDX] + reg); \
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c +3 -6
@@ -428,7 +428,6 @@ bool dc_dmub_srv_p_state_delegate(struct dc *dc, bool should_manage_pstate, struint i =0 , k =0 ;int ramp_up_num_steps =1 ;// TODO: Ramp is currently disabled. Reenable it. uint8_t visual_confirm_enabled; -int pipe_idx =0 ;struct dc_stream_status *stream_status =NULL ;if (dc ==NULL )
@@ -443,7 +442,7 @@ bool dc_dmub_srv_p_state_delegate(struct dc *dc, bool should_manage_pstate, stru cmd.fw_assisted_mclk_switch.config_data.visual_confirm_enabled = visual_confirm_enabled;if (should_manage_pstate) { -for (i =0 , pipe_idx =0 ; i < dc->res_pool->pipe_count; i++) { +for (i =0 ; i < dc->res_pool->pipe_count; i++) {struct pipe_ctx *pipe = &context->res_ctx.pipe_ctx[i];if (!pipe->stream)
@@ -458,7 +457,6 @@ bool dc_dmub_srv_p_state_delegate(struct dc *dc, bool should_manage_pstate, stru cmd.fw_assisted_mclk_switch.config_data.vactive_stretch_margin_us = dc->debug.fpo_vactive_margin_us;break ; } - pipe_idx++; } }
@@ -857,7 +855,7 @@ void dc_dmub_setup_subvp_dmub_command(struct dc *dc, bool enable) {uint8_t cmd_pipe_index =0 ; -uint32_t i, pipe_idx; +uint32_t i;uint8_t subvp_count =0 ;union dmub_rb_cmd cmd;struct pipe_ctx *subvp_pipes[2 ];
@@ -884,7 +882,7 @@ void dc_dmub_setup_subvp_dmub_command(struct dc *dc,if (enable) {// For each pipe that is a "main" SUBVP pipe, fill in pipe data for DMUB SUBVP cmd -for (i =0 , pipe_idx =0 ; i < dc->res_pool->pipe_count; i++) { +for (i =0 ; i < dc->res_pool->pipe_count; i++) {struct pipe_ctx *pipe = &context->res_ctx.pipe_ctx[i]; pipe_mall_type =dc_state_get_pipe_subvp_type (context, pipe);
@@ -907,7 +905,6 @@ void dc_dmub_setup_subvp_dmub_command(struct dc *dc,populate_subvp_cmd_vblank_pipe_info (dc, context, &cmd, pipe, cmd_pipe_index++); } - pipe_idx++; }if (subvp_count ==2 ) {update_subvp_prefetch_end_to_mall_start (dc, context, &cmd, subvp_pipes);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 8/349 gpio: rockchip: change the GPIO version judgment logic
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Zhang <[email protected]>
[ Upstream commit 41209307cad7f14c387c68375a93b50e54261a53 ]
Have a list of valid IDs and default to -ENODEV.
--- drivers/gpio/gpio-rockchip.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/gpio/gpio-rockchip.c +9 -3
@@ -653,8 +653,9 @@ static int rockchip_get_bank_data(struct rockchip_pin_bank *bank) id =readl (bank->reg_base + gpio_regs_v2.version_id); -/* If not gpio v2, that is default to v1. */ -if (id ==GPIO_TYPE_V2 || id ==GPIO_TYPE_V2_1 ) { +switch (id) { +case GPIO_TYPE_V2 : +case GPIO_TYPE_V2_1 : bank->gpio_regs = &gpio_regs_v2; bank->gpio_type =GPIO_TYPE_V2 ; bank->db_clk =of_clk_get (bank->of_node,1 );
@@ -662,9 +663,14 @@ static int rockchip_get_bank_data(struct rockchip_pin_bank *bank)dev_err (bank->dev,"cannot find debounce clk\n" );return -EINVAL ; } - }else { +break ; +case GPIO_TYPE_V1 : bank->gpio_regs = &gpio_regs_v1; bank->gpio_type =GPIO_TYPE_V1 ; +break ; +default : +dev_err (bank->dev,"unsupported version ID: 0x%08x\n" , id); +return -ENODEV ; }return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 9/349 gpio: rockchip: teardown bugs and resource leaks
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Scardovi <[email protected]>
[ Upstream commit 9500077678230e36d22bf16d2b9539c13e59a801 ]
Address several teardown issues and resource leaks in the driver's remove path and error handling:
1. Debounce clock reference leak: The debounce clock (bank->db_clk) is obtained using of_clk_get() which increments the clock's reference count, but clk_put() is never called. Register a devm action to cleanly release it on unbind. Note that of_clk_get(..., 1) remains necessary over devm_clk_get() because the DT binding does not define clock-names, precluding name-based lookup.
2. Unregistered chained IRQ handler: The chained IRQ handler is not disconnected in remove(). If a stray interrupt fires after the driver is removed, the kernel attempts to execute a stale handler, leading to a panic. Fix this by clearing the handler in remove().
3. IRQ domain leak: The linear IRQ domain and its generic chips are allocated manually during probe but never removed. Remove the IRQ domain during driver teardown to free the associated generic chips and mappings.
--- drivers/gpio/gpio-rockchip.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
drivers/gpio/gpio-rockchip.c +16 -1
@@ -629,10 +629,17 @@ static int rockchip_gpiolib_register(struct rockchip_pin_bank *bank)return ret; } +static void rockchip_clk_put (void *data) +{ +struct clk *clk = data; + +clk_put (clk); +} +static int rockchip_get_bank_data (struct rockchip_pin_bank *bank) {struct resource res; -int id =0 ; +int id =0 , ret;if (of_address_to_resource (bank->of_node,0 , &res)) {dev_err (bank->dev,"cannot find IO resource for bank\n" );
@@ -663,6 +670,11 @@ static int rockchip_get_bank_data(struct rockchip_pin_bank *bank)dev_err (bank->dev,"cannot find debounce clk\n" );return -EINVAL ; } + + ret =devm_add_action_or_reset (bank->dev, rockchip_clk_put, + bank->db_clk); +if (ret) +return ret;break ;case GPIO_TYPE_V1 : bank->gpio_regs = &gpio_regs_v1;
@@ -779,6 +791,9 @@ static void rockchip_gpio_remove(struct platform_device *pdev) {struct rockchip_pin_bank *bank =platform_get_drvdata (pdev); +irq_set_chained_handler_and_data (bank->irq,NULL ,NULL ); +if (bank->domain) +irq_domain_remove (bank->domain);gpiochip_remove (&bank->gpio_chip); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 10/349 gpio: rockchip: fix generic IRQ chip leak on remove
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Scardovi <[email protected]>
[ Upstream commit 1c1e0fc88d6ef65bf15d517853251f75ab9d18c3 ]
The driver allocates domain generic chips using irq_alloc_domain_generic_chips() during probe. However, on driver remove/teardown, the generic chips are not automatically freed when the IRQ domain is removed because the domain flags do not include IRQ_DOMAIN_FLAG_DESTROY_GC.
This causes both the domain generic chips structure and the associated generic chips to be leaked. Additionally, the generic chips remain on the global gc_list and may later be visited by generic IRQ chip suspend, resume, or shutdown callbacks after the GPIO bank has been removed, potentially resulting in a use-after-free and kernel crash.
Fix the resource leak by explicitly calling irq_domain_remove_generic_chips() before removing the IRQ domain in rockchip_gpio_remove().
--- drivers/gpio/gpio-rockchip.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpio/gpio-rockchip.c +3 -1
@@ -792,8 +792,10 @@ static void rockchip_gpio_remove(struct platform_device *pdev)struct rockchip_pin_bank *bank =platform_get_drvdata (pdev);irq_set_chained_handler_and_data (bank->irq,NULL ,NULL ); -if (bank->domain) +if (bank->domain) { +irq_domain_remove_generic_chips (bank->domain);irq_domain_remove (bank->domain); + }gpiochip_remove (&bank->gpio_chip); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 11/349 mm/vmalloc: take vmap_purge_lock in shrinker
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uladzislau Rezki (Sony) <[email protected]>
[ Upstream commit ec05f51f1e65bce95528543eb73fda56fd201d94 ]
decay_va_pool_node() can be invoked concurrently from two paths:__purge_vmap_area_lazy() when pools are being purged, and the shrinker via vmap_node_shrink_scan().
However, decay_va_pool_node() is not safe to run concurrently, and the shrinker path currently lacks serialization, leading to races and possible leaks.
Protect decay_va_pool_node() by taking vmap_purge_lock in the shrinker path to ensure serialization with purge users.
--- mm/vmalloc.c | 1 + 1 file changed, 1 insertion(+)
mm/vmalloc.c +1 -0
@@ -5204,6 +5204,7 @@ vmap_node_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) {int i; +guard (mutex)(&vmap_purge_lock);for (i =0 ; i < nr_vmap_nodes; i++)decay_va_pool_node (&vmap_nodes[i], true);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 12/349 device property: initialize the remaining fields of fwnode_handle in fwnode_init()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit 7eba000621fff223dd7bab484d48918c7c77a307 ]
If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitialized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization. While at it: initialize the remaining fields of struct fwnode_handle too just to be sure.
--- include/linux/fwnode.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/fwnode.h +2 -0
@@ -202,8 +202,10 @@ static inline void fwnode_init(struct fw { fwnode->secondary =NULL ; fwnode->ops = ops; + fwnode->dev =NULL ;INIT_LIST_HEAD (&fwnode->consumers);INIT_LIST_HEAD (&fwnode->suppliers); + fwnode->flags =0 ; } static inline void fwnode_set_flag(struct fwnode_handle *fwnode,
Greg Kroah-Hartman
maintainerPATCH 13/349 f2fs: validate orphan inode entry count
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenjie Qi <[email protected]>
[ Upstream commit 846c499a65816d13f1186e3090e825e8bb8bcb8b ]
f2fs_recover_orphan_inodes() trusts the orphan block entry_count when replaying orphan inodes from the checkpoint pack. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the ino[] array and interpret footer or following data as inode numbers.
On a crafted image, mounting an unpatched kernel can drive orphan recovery into f2fs_bug_on() and panic the kernel. Validate entry_count before consuming entries so corrupted checkpoint data fails the mount with -EFSCORRUPTED and requests fsck instead.
Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be recorded in the superblock s_errors[] field. This gives fsck a persistent hint even though mount-time orphan recovery failure may leave no chance to persist SBI_NEED_FSCK through a checkpoint.
--- fs/f2fs/checkpoint.c | 14 +++++++++++++- include/linux/f2fs_fs.h | 1 + 2 files changed, 14 insertions(+), 1 deletion(-)
fs/f2fs/checkpoint.c +13 -1
@@ -759,6 +759,7 @@ int f2fs_recover_orphan_inodes(struct f2for (i =0 ; i < orphan_blocks; i++) {struct page *page;struct f2fs_orphan_block *orphan_blk; +unsigned int entry_count; page =f2fs_get_meta_page (sbi, start_blk + i);if (IS_ERR (page)) {
@@ -767,7 +768,18 @@ int f2fs_recover_orphan_inodes(struct f2 } orphan_blk = (struct f2fs_orphan_block *)page_address (page); -for (j =0 ; j <le32_to_cpu (orphan_blk->entry_count); j++) { + entry_count =le32_to_cpu (orphan_blk->entry_count); +if (entry_count >F2FS_ORPHANS_PER_BLOCK ) { +f2fs_err (sbi,"invalid orphan inode entry count %u" , + entry_count); +set_sbi_flag (sbi,SBI_NEED_FSCK ); +f2fs_handle_error (sbi,ERROR_INCONSISTENT_ORPHAN ); + err = -EFSCORRUPTED ; +f2fs_put_page (page,1 ); + goto out; + } + +for (j =0 ; j < entry_count; j++) {nid_t ino =le32_to_cpu (orphan_blk->ino[j]); err =recover_orphan_inode (sbi, ino);
include/linux/f2fs_fs.h +1 -0
@@ -104,6 +104,7 @@ enum f2fs_error {ERROR_CORRUPTED_XATTR ,ERROR_INVALID_NODE_REFERENCE ,ERROR_INCONSISTENT_NAT , +ERROR_INCONSISTENT_ORPHAN , ERROR_MAX, };
Greg Kroah-Hartman
maintainerPATCH 14/349 f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit e0288584baa5dc41df4a829a023c4c1b33fe53d7 ]
- ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) - shrink
- f2fs_gc
- gc_data_segment
- ra_data_block(cow_inode)
- mapping = F2FS_I(inode)->atomic_inode->i_mapping
: f2fs_is_cow_file(cow_inode) is true
- f2fs_evict_inode(atomic_inode)
- clear_inode_flag(fi->cow_inode, FI_COW_FILE)
- F2FS_I(fi->cow_inode)->atomic_inode = NULL
...
- truncate_inode_pages_final(atomic_inode)
- f2fs_grab_cache_folio(mapping)
: create folio in atomic_inode->mapping
- clear_inode(atomic_inode)
- BUG_ON(atomic_inode->i_data.nrpages)
We need to add a reference on fi->atomic_inode before using its mapping field during garbage collection, otherwise, it will cause UAF issue.
--- fs/f2fs/gc.c | 50 ++++++++++++++++++++++++++++++++++++++++++-------- fs/f2fs/inode.c | 11 ++++++++--- 2 files changed, 50 insertions(+), 11 deletions(-)
fs/f2fs/gc.c +42 -8
@@ -1213,8 +1213,8 @@ static bool is_alive(struct f2fs_sb_infostatic int ra_data_block (struct inode *inode,pgoff_t index) {struct f2fs_sb_info *sbi =F2FS_I_SB (inode); -struct address_space *mapping =f2fs_is_cow_file (inode) ? -F2FS_I (inode)->atomic_inode->i_mapping : inode->i_mapping; +struct address_space *mapping = inode->i_mapping; +struct inode *atomic_inode =NULL ;struct dnode_of_data dn;struct page *page;struct f2fs_io_info fio = {
@@ -1229,9 +1229,22 @@ static int ra_data_block(struct inode *i };int err; +f2fs_down_read (&F2FS_I (inode)->i_sem); +if (f2fs_is_cow_file (inode)) { + atomic_inode =igrab (F2FS_I (inode)->atomic_inode); +if (!atomic_inode) { +f2fs_up_read (&F2FS_I (inode)->i_sem); +return -EBUSY ; + } + mapping = atomic_inode->i_mapping; + } +f2fs_up_read (&F2FS_I (inode)->i_sem); + page =f2fs_grab_cache_page (mapping, index, true); -if (!page) -return -ENOMEM ; +if (!page) { + err = -ENOMEM ; + goto out_iput; + }if (f2fs_lookup_read_extent_cache_block (inode, index, &dn.data_blkaddr)) {
@@ -1288,11 +1301,16 @@ got_it:f2fs_update_iostat (sbi, inode,FS_DATA_READ_IO ,F2FS_BLKSIZE );f2fs_update_iostat (sbi,NULL ,FS_GDATA_READ_IO ,F2FS_BLKSIZE ); +if (atomic_inode) +iput (atomic_inode);return 0 ; put_encrypted_page:f2fs_put_page (fio.encrypted_page,1 ); put_page:f2fs_put_page (page,1 ); +out_iput: +if (atomic_inode) +iput (atomic_inode);return err; }
@@ -1303,8 +1321,8 @@ put_page:static int move_data_block (struct inode *inode,block_t bidx,int gc_type,unsigned int segno,int off) { -struct address_space *mapping =f2fs_is_cow_file (inode) ? -F2FS_I (inode)->atomic_inode->i_mapping : inode->i_mapping; +struct address_space *mapping = inode->i_mapping; +struct inode *atomic_inode =NULL ;struct f2fs_io_info fio = { .sbi =F2FS_I_SB (inode), .ino = inode->i_ino,
@@ -1326,10 +1344,23 @@ static int move_data_block(struct inode (fio.sbi->gc_mode !=GC_URGENT_HIGH ) ?CURSEG_ALL_DATA_ATGC :CURSEG_COLD_DATA ; +f2fs_down_read (&F2FS_I (inode)->i_sem); +if (f2fs_is_cow_file (inode)) { + atomic_inode =igrab (F2FS_I (inode)->atomic_inode); +if (!atomic_inode) { +f2fs_up_read (&F2FS_I (inode)->i_sem); +return -EBUSY ; + } + mapping = atomic_inode->i_mapping; + } +f2fs_up_read (&F2FS_I (inode)->i_sem); +/* do not read out */ page =f2fs_grab_cache_page (mapping, bidx, false); -if (!page) -return -ENOMEM ; +if (!page) { + err = -ENOMEM ; + goto out_iput; + }if (!check_valid_map (F2FS_I_SB (inode), segno, off)) { err = -ENOENT ;
@@ -1456,6 +1487,9 @@ put_out:f2fs_put_dnode (&dn); out:f2fs_put_page (page,1 ); +out_iput: +if (atomic_inode) +iput (atomic_inode);return err; }
fs/f2fs/inode.c +8 -3
@@ -839,10 +839,15 @@ void f2fs_evict_inode(struct inode *inodf2fs_abort_atomic_write (inode, true);if (fi->cow_inode &&f2fs_is_cow_file (fi->cow_inode)) { -clear_inode_flag (fi->cow_inode,FI_COW_FILE ); -F2FS_I (fi->cow_inode)->atomic_inode =NULL ; -iput (fi->cow_inode); +struct inode *cow_inode = fi->cow_inode; + +f2fs_down_write (&F2FS_I (cow_inode)->i_sem); +clear_inode_flag (cow_inode,FI_COW_FILE ); +F2FS_I (cow_inode)->atomic_inode =NULL ; fi->cow_inode =NULL ; +f2fs_up_write (&F2FS_I (cow_inode)->i_sem); + +iput (cow_inode); }trace_f2fs_evict_inode (inode);
Greg Kroah-Hartman
maintainerPATCH 15/349 f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
[ Upstream commit 378acf3cf19b6af6cba55e8dd1154c4e1504bae8 ]
When the flexible_inline_xattr feature is enabled, do_read_inode() loads the on-disk i_inline_xattr_size unconditionally:
if (f2fs_sb_has_flexible_inline_xattr(sbi)) fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size);
but sanity_check_inode() only range-checks it when the inode also has the FI_INLINE_XATTR flag set. An inode that carries an inline dentry or inline data but not FI_INLINE_XATTR -- the normal layout for an inline directory -- therefore keeps a fully attacker-controlled i_inline_xattr_size from a crafted image.
get_inline_xattr_addrs() returns that value with no flag gating, so it feeds the inode geometry:
MAX_INLINE_DATA() = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1) NR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...)
addrs_per_page() = CUR_ADDRS_PER_INODE - i_inline_xattr_size
A large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY() negative, so make_dentry_ptr_inline() sets d->max (int) to a negative value. The inline directory walk then compares an unsigned long bit_pos against that negative d->max, which is promoted to a huge unsigned bound, and reads far past the inline area:
while (bit_pos < d->max) /* fs/f2fs/dir.c */ ... test_bit_le(bit_pos, d->bitmap) / d->dentry[bit_pos] ...
Mounting a crafted image and reading such a directory triggers an out-of-bounds read in f2fs_fill_dentries(); the same underflow also corrupts ADDRS_PER_INODE for regular files.
Validate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the flexible_inline_xattr feature is enabled -- i.e. whenever the value is loaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE bound gated on inodes that actually carry an inline xattr, so legitimate inodes with i_inline_xattr_size == 0 are still accepted.
--- fs/f2fs/inode.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
fs/f2fs/inode.c +10 -9
@@ -308,15 +308,6 @@ static bool sanity_check_inode(struct in F2FS_TOTAL_EXTRA_ATTR_SIZE);return false; } -if (f2fs_sb_has_flexible_inline_xattr (sbi) && -f2fs_has_inline_xattr (inode) && - (!fi->i_inline_xattr_size || - fi->i_inline_xattr_size >MAX_INLINE_XATTR_SIZE )) { -f2fs_warn (sbi,"%s: inode (ino=%lx) has corrupted i_inline_xattr_size: %d, max: %lu" , - __func__, inode->i_ino, fi->i_inline_xattr_size, -MAX_INLINE_XATTR_SIZE ); -return false; - }if (f2fs_sb_has_compression (sbi) && fi->i_flags &F2FS_COMPR_FL && F2FS_FITS_IN_INODE(ri, fi->i_extra_isize,
@@ -326,6 +317,16 @@ static bool sanity_check_inode(struct in } } +if (f2fs_sb_has_flexible_inline_xattr (sbi) && + (fi->i_inline_xattr_size >MAX_INLINE_XATTR_SIZE || + (f2fs_has_inline_xattr (inode) && + fi->i_inline_xattr_size <MIN_INLINE_XATTR_SIZE ))) { +f2fs_warn (sbi,"%s: inode (ino=%lx) has corrupted i_inline_xattr_size: %d, min: %zu, max: %lu" , + __func__, inode->i_ino, fi->i_inline_xattr_size, +MIN_INLINE_XATTR_SIZE ,MAX_INLINE_XATTR_SIZE ); +return false; + } +if (!f2fs_sb_has_extra_attr (sbi)) {if (f2fs_sb_has_project_quota (sbi)) { f2fs_warn(sbi, "%s: corrupted inode ino=%lx, wrong feature flag: %u, run fsck to fix.",
Greg Kroah-Hartman
maintainerPATCH 16/349 f2fs: fix potential deadlock in f2fs_balance_fs()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruipeng Qi <[email protected]>
[ Upstream commit dd3114870771562036fdcf5abe813956f36d224d ]
When the f2fs filesystem space is nearly exhausted, we encounter deadlock issues as below:
INFO: task A:1890 blocked for more than 120 seconds.
Tainted: G O 6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:A state:D stack:0 pid:1890 tgid:1626 ppid:1153 flags:0x00000204
Call trace:
__switch_to+0xf4/0x158
__schedule+0x27c/0x908
schedule+0x3c/0x118
io_schedule+0x44/0x68
folio_wait_bit_common+0x174/0x370
folio_wait_bit+0x20/0x38
folio_wait_writeback+0x54/0xc8
truncate_inode_partial_folio+0x70/0x1e0
truncate_inode_pages_range+0x1b0/0x450
truncate_pagecache+0x54/0x88
f2fs_file_write_iter+0x3e8/0xb80
do_iter_readv_writev+0xf0/0x1e0
vfs_writev+0x138/0x2c8
do_writev+0x88/0x130
__arm64_sys_writev+0x28/0x40
invoke_syscall+0x50/0x120
el0_svc_common.constprop.0+0xc8/0xf0
do_el0_svc+0x24/0x38
el0_svc+0x30/0xf8
el0t_64_sync_handler+0x120/0x130
el0t_64_sync+0x190/0x198
INFO: task kworker/u8:11:2680853 blocked for more than 120 seconds.
Tainted: G O 6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:11 state:D stack:0 pid:2680853 tgid:2680853 ppid:2 flags:0x00000208
Workqueue: writeback wb_workfn (flush-254:0)
Call trace:
__switch_to+0xf4/0x158
__schedule+0x27c/0x908
schedule+0x3c/0x118
io_schedule+0x44/0x68
folio_wait_bit_common+0x174/0x370
__filemap_get_folio+0x214/0x348
pagecache_get_page+0x20/0x70
f2fs_get_read_data_page+0x150/0x3e8
f2fs_get_lock_data_page+0x2c/0x160
move_data_page+0x50/0x478
do_garbage_collect+0xd38/0x1528
f2fs_gc+0x240/0x7e0
f2fs_balance_fs+0x1a0/0x208
f2fs_write_single_data_page+0x6e4/0x730
f2fs_write_cache_pages+0x378/0x9b0
f2fs_write_data_pages+0x2e4/0x388
do_writepages+0x8c/0x2c8
__writeback_single_inode+0x4c/0x498
writeback_sb_inodes+0x234/0x4a8
__writeback_inodes_wb+0x58/0x118
wb_writeback+0x2f8/0x3c0
wb_workfn+0x2c4/0x508
process_one_work+0x180/0x408
worker_thread+0x258/0x368
kthread+0x118/0x128
ret_from_fork+0x10/0x200
INFO: task kworker/u8:8:2641297 blocked for more than 120 seconds.
Tainted: G O 6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:8 state:D stack:0 pid:2641297 tgid:2641297 ppid:2 flags:0x00000208
Workqueue: writeback wb_workfn (flush-254:0)
Call trace:
__switch_to+0xf4/0x158
__schedule+0x27c/0x908
rt_mutex_schedule+0x30/0x60
__rt_mutex_slowlock_locked.constprop.0+0x460/0x8a8
rwbase_write_lock+0x24c/0x378
down_write+0x1c/0x30
f2fs_balance_fs+0x184/0x208
f2fs_write_inode+0xf4/0x328
__writeback_single_inode+0x370/0x498
writeback_sb_inodes+0x234/0x4a8
__writeback_inodes_wb+0x58/0x118
wb_writeback+0x2f8/0x3c0
wb_workfn+0x2c4/0x508
process_one_work+0x180/0x408
worker_thread+0x258/0x368
kthread+0x118/0x128
ret_from_fork+0x10/0x20
INFO: task B:1902 blocked for more than 120 seconds.
Tainted: G O 6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:B state:D stack:0 pid:1902 tgid:1626 ppid:1153 flags:0x0000020c
Call trace:
__switch_to+0xf4/0x158
__schedule+0x27c/0x908
rt_mutex_schedule+0x30/0x60
__rt_mutex_slowlock_locked.constprop.0+0x460/0x8a8
rwbase_write_lock+0x24c/0x378
down_write+0x1c/0x30
f2fs_balance_fs+0x184/0x208
f2fs_map_blocks+0x94c/0x1110
f2fs_file_write_iter+0x228/0xb80
do_iter_readv_writev+0xf0/0x1e0
vfs_writev+0x138/0x2c8
do_writev+0x88/0x130
__arm64_sys_writev+0x28/0x40
invoke_syscall+0x50/0x120
el0_svc_common.constprop.0+0xc8/0xf0
do_el0_svc+0x24/0x38
el0_svc+0x30/0xf8
el0t_64_sync_handler+0x120/0x130
el0t_64_sync+0x190/0x198
INFO: task sync:2769849 blocked for more than 120 seconds.
Tainted: G O 6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:sync state:D stack:0 pid:2769849 tgid:2769849 ppid:736 flags:0x0000020c
Call trace:
__switch_to+0xf4/0x158
__schedule+0x27c/0x908
schedule+0x3c/0x118
wb_wait_for_completion+0xb0/0xe8
sync_inodes_sb+0xc8/0x2b0
sync_inodes_one_sb+0x24/0x38
iterate_supers+0xa8/0x138
ksys_sync+0x54/0xc8
__arm64_sys_sync+0x18/0x30
invoke_syscall+0x50/0x120
el0_svc_common.constprop.0+0xc8/0xf0
do_el0_svc+0x24/0x38
el0_svc+0x30/0xf8
el0t_64_sync_handler+0x120/0x130
el0t_64_sync+0x190/0x198The root cause is a potential deadlock between the following tasks:
kworker/u8:11 Thread A
- f2fs_write_single_data_page
- f2fs_do_write_data_page
- folio_start_writeback(X)
- f2fs_outplace_write_data
- bio_add_folio(X)
- folio_unlock(X)
- truncate_inode_pages_range
- __filemap_get_folio(X, FGP_LOCK)
- truncate_inode_partial_folio(X)
- folio_wait_writeback(X)
- f2fs_balance_fs
- f2fs_gc
- do_garbage_collect
- move_data_page
- f2fs_get_lock_data_page
- __filemap_get_folio(X, FGP_LOCK)
Both threads try to access folio X. Thread A holds the lock but waits for writeback, while kworker waits for the lock. This causes a deadlock.
Other threads also enter D state, waiting for locks such as gc_lock and writepages.
OPU/IPU DATA folio are all affected by this issue. To avoid such potential deadlocks, always commit these cached folios before triggering f2fs_gc() in f2fs_balance_fs().
Stable-dep-of: 8b4468ec023d ("f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()")
--- fs/f2fs/data.c | 29 +++++++++++++++++++++++++++++ fs/f2fs/f2fs.h | 1 + fs/f2fs/segment.c | 8 ++++++++ 3 files changed, 38 insertions(+)
fs/f2fs/data.c +29 -0
@@ -890,6 +890,35 @@ void f2fs_submit_merged_ipu_write(struct } } +void f2fs_submit_all_merged_ipu_writes (struct f2fs_sb_info *sbi) +{ +struct bio_entry *be, *tmp; +struct f2fs_bio_info *io; +enum temp_type temp; + +for (temp =HOT ; temp <NR_TEMP_TYPE ; temp++) { +LIST_HEAD (list); + + io = sbi->write_io[DATA ] + temp; + +/* A lockless list_empty() check is safe here: any bios from +* other kworkers that we miss will be submitted by those +* kworkers accordingly. +*/ +if (list_empty (&io->bio_list)) +continue ; + +f2fs_down_write (&io->bio_list_lock); +list_splice_init (&io->bio_list, &list); +f2fs_up_write (&io->bio_list_lock); + +list_for_each_entry_safe (be, tmp, &list, list) { +f2fs_submit_write_bio (sbi, be->bio,DATA ); +del_bio_entry (be); + } + } +} +int f2fs_merge_page_bio (struct f2fs_io_info *fio) {struct bio *bio = *fio->bio;
fs/f2fs/f2fs.h +1 -0
@@ -3929,6 +3929,7 @@ void f2fs_submit_merged_write_cond(struc nid_t ino, enum page_type type);void f2fs_submit_merged_ipu_write (struct f2fs_sb_info *sbi,struct bio **bio,struct page *page); +void f2fs_submit_all_merged_ipu_writes (struct f2fs_sb_info *sbi);void f2fs_flush_merged_writes (struct f2fs_sb_info *sbi);int f2fs_submit_page_bio (struct f2fs_io_info *fio);int f2fs_merge_page_bio (struct f2fs_io_info *fio);
fs/f2fs/segment.c +8 -0
@@ -451,6 +451,14 @@ void f2fs_balance_fs(struct f2fs_sb_info .should_migrate_blocks = false, .err_gc_skipped = false, .nr_free_secs = 1 }; + +/* +* Submit all cached OPU/IPU DATA bios before triggering +* foreground GC to avoid potential deadlocks. +*/ +f2fs_submit_merged_write (sbi,DATA ); +f2fs_submit_all_merged_ipu_writes (sbi); +f2fs_down_write (&sbi->gc_lock);stat_inc_gc_call_count (sbi,FOREGROUND );f2fs_gc (sbi, &gc_control);
Greg Kroah-Hartman
maintainerPATCH 17/349 f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 8b4468ec023d0d1b4669dfb867588997cc03a06b ]
When we mount device w/ gc_merge mount option, we may suffer below potential deadlock:
Kworker GC trehad Truncator
- f2fs_write_cache_pages
- f2fs_write_single_data_page
- f2fs_do_write_data_page
- folio_start_writeback --- set writeback flag on folio
- f2fs_outplace_write_data
: cached folio in internal bio cache
- f2fs_balance_fs
- wake_up(gc_thread)
: wake up gc thread to run foreground GC
- finish_wait(fggc_wq)
: wait on the waitqueue --- wait on GC thread to finish the work
- truncate_inode_pages_range
- __filemap_get_folio(, FGP_LOCK) --- lock folio
- truncate_inode_partial_folio
- folio_wait_writeback --- wait on writeback being cleared
- do_garbage_collect
- move_data_page
- f2fs_get_lock_data_folio
- lock on folio --- blocked on folio's lock
In order to avoid such deadlock, let's call below functions to commit cached bios in GC_MERGE path of f2fs_balance_fs() as the same as we did in NOGC_MERGE path.
- f2fs_submit_merged_write(sbi, DATA);
- f2fs_submit_all_merged_ipu_writes(sbi);
Reported: Sandeep Dhavale <[email protected]>
--- fs/f2fs/segment.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
fs/f2fs/segment.c +7 -7
@@ -434,6 +434,13 @@ void f2fs_balance_fs(struct f2fs_sb_infoif (has_enough_free_secs (sbi,0 ,0 ))return ; +/* +* Submit all cached OPU/IPU DATA bios before triggering +* foreground GC to avoid potential deadlocks. +*/ +f2fs_submit_merged_write (sbi,DATA ); +f2fs_submit_all_merged_ipu_writes (sbi); +if (test_opt (sbi,GC_MERGE ) && sbi->gc_thread && sbi->gc_thread->f2fs_gc_task) {DEFINE_WAIT (wait);
@@ -452,13 +459,6 @@ void f2fs_balance_fs(struct f2fs_sb_info .err_gc_skipped = false, .nr_free_secs = 1 }; -/* -* Submit all cached OPU/IPU DATA bios before triggering -* foreground GC to avoid potential deadlocks. -*/ -f2fs_submit_merged_write (sbi,DATA ); -f2fs_submit_all_merged_ipu_writes (sbi); -f2fs_down_write (&sbi->gc_lock);stat_inc_gc_call_count (sbi,FOREGROUND );f2fs_gc (sbi, &gc_control);
Greg Kroah-Hartman
maintainerPATCH 18/349 f2fs: fix listxattr handling of corrupted xattr entries
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keshav Verma <[email protected]>
[ Upstream commit 5ef5bc304f23c3fe255d4936472378dcb74d0e94 ]
Validate the xattr entry before reading its fields in f2fs_listxattr(). Return -EFSCORRUPTED when the entry is outside the valid xattr storage area instead of returning a successful partial result.
--- fs/f2fs/xattr.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/f2fs/xattr.c +3 -3
@@ -581,8 +581,6 @@ ssize_t f2fs_listxattr(struct dentry *desize_t prefix_len;size_t size; - prefix =f2fs_xattr_prefix (entry->e_name_index, dentry); -if ((void *)(entry) +sizeof (__u32) > last_base_addr || (void *)XATTR_NEXT_ENTRY (entry) > last_base_addr) { f2fs_err(F2FS_I_SB(inode), "list inode (%lu) has corrupted xattr",
@@ -590,9 +588,11 @@ ssize_t f2fs_listxattr(struct dentry *deset_sbi_flag (F2FS_I_SB (inode),SBI_NEED_FSCK );f2fs_handle_error (F2FS_I_SB (inode),ERROR_CORRUPTED_XATTR ); -break ; + error = -EFSCORRUPTED ; + goto cleanup; } + prefix =f2fs_xattr_prefix (entry->e_name_index, dentry);if (!prefix)continue ;
Greg Kroah-Hartman
maintainerPATCH 19/349 fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mingyu Wang <[email protected]>
[ Upstream commit 8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2 ]
When fbcon_do_set_font() fails (e.g., due to a memory allocation failure inside vc_resize() under heavy memory pressure), it jumps to the err_out label to roll back the console state. However, the current rollback logic forgets to restore the hi_font state, leading to a severe state machine corruption.
Earlier in the function, set_vc_hi_font() might be called to change vc->vc_hi_font_mask and mutate the screen buffer. If vc_resize() subsequently fails, the err_out path restores vc_font.charcount but entirely skips rolling back the vc_hi_font_mask and the screen buffer.
This mismatch leaves the terminal in a desynchronized state. Because vc_hi_font_mask remains set, the VT subsystem will still accept character indices greater than 255 from userspace and write them to the screen buffer. Subsequent rendering calls (e.g., fbcon_putcs()) will then use these inflated indices to access the reverted, 256-character font array, leading to a deterministic out-of-bounds read and potential kernel memory disclosure.
Fix this by adding the missing rollback logic for the hi_font mask and screen buffer in the error path.
--- drivers/video/fbdev/core/fbcon.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/video/fbdev/core/fbcon.c +7 -0
@@ -2427,6 +2427,7 @@ static int fbcon_do_set_font(struct vc_dstruct fbcon_display *p = &fb_display[vc->vc_num];int resize, ret, old_userfont, old_width, old_height, old_charcount;u8 *old_data = vc->vc_font.data; +unsigned short old_hi_font_mask = vc->vc_hi_font_mask; resize = (w != vc->vc_font.width) || (h != vc->vc_font.height); vc->vc_font.data = (void *)(p->fontdata = data);
@@ -2480,6 +2481,12 @@ err_out: vc->vc_font.height = old_height; vc->vc_font.charcount = old_charcount; +/* Restore the hi_font state and screen buffer */ +if (old_hi_font_mask && !vc->vc_hi_font_mask) +set_vc_hi_font (vc, true); +else if (!old_hi_font_mask && vc->vc_hi_font_mask) +set_vc_hi_font (vc, false); +return ret; }
Greg Kroah-Hartman
maintainerPATCH 20/349 nfsd: add nfsd_file_{get,put} to nfs_to nfsd_localio_operations
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
[ Upstream commit a61466315d7afca032342183a57e62d5e3a3157c ]
In later a commit LOCALIO must call both nfsd_file_get and nfsd_file_put to manage extra nfsd_file references.
Stable-dep-of: 2c6bb3c40bc2 ("NFSv4/flexfiles: reject zero filehandle version count")
--- fs/nfsd/localio.c | 2 ++ include/linux/nfslocalio.h | 2 ++ 2 files changed, 4 insertions(+)
fs/nfsd/localio.c +2 -0
@@ -29,6 +29,8 @@ static const struct nfsd_localio_operati .nfsd_net_put = nfsd_net_put, .nfsd_open_local_fh = nfsd_open_local_fh, .nfsd_file_put_local = nfsd_file_put_local, + .nfsd_file_get = nfsd_file_get, + .nfsd_file_put = nfsd_file_put, .nfsd_file_file = nfsd_file_file, };
include/linux/nfslocalio.h +2 -0
@@ -56,6 +56,8 @@ struct nfsd_localio_operations { const struct nfs_fh *, const fmode_t);struct net *(*nfsd_file_put_local)(struct nfsd_file *); +struct nfsd_file *(*nfsd_file_get)(struct nfsd_file *); +void (*nfsd_file_put)(struct nfsd_file *);struct file *(*nfsd_file_file)(struct nfsd_file *); }____cacheline_aligned ;
Greg Kroah-Hartman
maintainerPATCH 21/349 nfs_common: rename functions that invalidate LOCALIO nfs_clients
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
[ Upstream commit b49f049a22227df701bfbca083d6cc859496e615 ]
Rename nfs_uuid_invalidate_one_client to nfs_localio_disable_client. Rename nfs_uuid_invalidate_clients to nfs_localio_invalidate_clients.
Stable-dep-of: 2c6bb3c40bc2 ("NFSv4/flexfiles: reject zero filehandle version count")
--- fs/nfs/localio.c | 2 +- fs/nfs_common/nfslocalio.c | 8 ++++---- fs/nfsd/nfsctl.c | 4 ++-- include/linux/nfslocalio.h | 5 +++-- 4 files changed, 10 insertions(+), 9 deletions(-)
fs/nfs/localio.c +1 -1
@@ -141,7 +141,7 @@ void nfs_local_disable(struct nfs_clientspin_lock (&clp->cl_localio_lock);if (test_and_clear_bit (NFS_CS_LOCAL_IO , &clp->cl_flags)) {trace_nfs_local_disable (clp); -nfs_uuid_invalidate_one_client (&clp->cl_uuid); +nfs_localio_disable_client (&clp->cl_uuid); }spin_unlock (&clp->cl_localio_lock); }
fs/nfs_common/nfslocalio.c +4 -4
@@ -107,7 +107,7 @@ static void nfs_uuid_put_locked(nfs_uuidlist_del_init (&nfs_uuid->list); } -void nfs_uuid_invalidate_clients (struct list_head *list) +void nfs_localio_invalidate_clients (struct list_head *list) {nfs_uuid_t *nfs_uuid, *tmp;
@@ -116,9 +116,9 @@ void nfs_uuid_invalidate_clients(structnfs_uuid_put_locked (nfs_uuid);spin_unlock (&nfs_uuid_lock); } -EXPORT_SYMBOL_GPL (nfs_uuid_invalidate_clients); +EXPORT_SYMBOL_GPL (nfs_localio_invalidate_clients); -void nfs_uuid_invalidate_one_client (nfs_uuid_t *nfs_uuid) +void nfs_localio_disable_client (nfs_uuid_t *nfs_uuid) {if (nfs_uuid->net) {spin_lock (&nfs_uuid_lock);
@@ -126,7 +126,7 @@ void nfs_uuid_invalidate_one_client(nfs_spin_unlock (&nfs_uuid_lock); } } -EXPORT_SYMBOL_GPL (nfs_uuid_invalidate_one_client); +EXPORT_SYMBOL_GPL (nfs_localio_disable_client);/* * Caller is responsible for calling nfsd_net_put and
fs/nfsd/nfsctl.c +2 -2
@@ -2296,14 +2296,14 @@ out_export_error:* nfsd_net_pre_exit - Disconnect localio clients from net namespace * @net: a network namespace that is about to be destroyed * -* This invalidated ->net pointers held by localio clients +* This invalidates ->net pointers held by localio clients * while they can still safely access nn->counter. */ static __net_exit void nfsd_net_pre_exit(struct net *net) {struct nfsd_net *nn =net_generic (net, nfsd_net_id); -nfs_uuid_invalidate_clients (&nn->local_clients); +nfs_localio_invalidate_clients (&nn->local_clients); }#endif
include/linux/nfslocalio.h +3 -2
@@ -37,8 +37,9 @@ bool nfs_uuid_begin(nfs_uuid_t *);void nfs_uuid_end (nfs_uuid_t *);void nfs_uuid_is_local (const uuid_t *,struct list_head *,struct net *,struct auth_domain *,struct module *); -void nfs_uuid_invalidate_clients (struct list_head *list); -void nfs_uuid_invalidate_one_client (nfs_uuid_t *nfs_uuid); + +void nfs_localio_disable_client (nfs_uuid_t *nfs_uuid); +void nfs_localio_invalidate_clients (struct list_head *list);/* localio needs to map filehandle -> struct nfsd_file */ extern struct nfsd_file *
Greg Kroah-Hartman
maintainerPATCH 22/349 NFSv4/flexfiles: Remove cred local variable dependency
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Curley <[email protected]>
[ Upstream commit fec80afc41afa3016421115427df8d00dc491ee5 ]
No-op preparation change to remove dependency on cred local variable. Subsequent striping diff has a cred per stripe so this local variable can't be trusted to be the same.
Stable-dep-of: 2c6bb3c40bc2 ("NFSv4/flexfiles: reject zero filehandle version count")
--- fs/nfs/flexfilelayout/flexfilelayout.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/nfs/flexfilelayout/flexfilelayout.c +2 -2
@@ -531,10 +531,10 @@ ff_layout_alloc_lseg(struct pnfs_layout_if (mirror != fls->mirror_array[i]) {/* swap cred ptrs so free_mirror will clean up old */ if (lgr->range.iomode ==IOMODE_READ ) { - cred =xchg (&mirror->ro_cred, cred); + cred =xchg (&mirror->ro_cred, fls->mirror_array[i]->ro_cred);rcu_assign_pointer (fls->mirror_array[i]->ro_cred, cred); }else { - cred =xchg (&mirror->rw_cred, cred); + cred =xchg (&mirror->rw_cred, fls->mirror_array[i]->rw_cred);rcu_assign_pointer (fls->mirror_array[i]->rw_cred, cred); }ff_layout_free_mirror (fls->mirror_array[i]);
Greg Kroah-Hartman
maintainerPATCH 23/349 NFSv4/flexfiles: Add data structure support for striped layouts
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Curley <[email protected]>
[ Upstream commit d442670c0f63c46b7f348f68fb2002af597708f2 ]
Adds a new struct nfs4_ff_layout_ds_stripe that represents a data server stripe within a layout. A new dynamically allocated array of this type has been added to nfs4_ff_layout_mirror and per stripe configuration information has been moved from the mirror type to the stripe based on the RFC.
Stable-dep-of: 2c6bb3c40bc2 ("NFSv4/flexfiles: reject zero filehandle version count")
--- fs/nfs/flexfilelayout/flexfilelayout.c | 149 ++++++++++++++++-------------- fs/nfs/flexfilelayout/flexfilelayout.h | 27 +++-- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 54 +++++----- 3 files changed, 128 insertions(+), 102 deletions(-)
fs/nfs/flexfilelayout/flexfilelayout.c +84 -65
@@ -183,13 +183,13 @@ static bool ff_mirror_match_fh(const str {int i, j; -if (m1->fh_versions_cnt != m2->fh_versions_cnt) +if (m1->dss[0 ].fh_versions_cnt != m2->dss[0 ].fh_versions_cnt)return false; -for (i =0 ; i < m1->fh_versions_cnt; i++) { +for (i =0 ; i < m1->dss[0 ].fh_versions_cnt; i++) {bool found_fh = false; -for (j =0 ; j < m2->fh_versions_cnt; j++) { -if (nfs_compare_fh (&m1->fh_versions[i], - &m2->fh_versions[j]) ==0 ) { +for (j =0 ; j < m2->dss[0 ].fh_versions_cnt; j++) { +if (nfs_compare_fh (&m1->dss[0 ].fh_versions[i], + &m2->dss[0 ].fh_versions[j]) ==0 ) { found_fh = true;break ; }
@@ -210,7 +210,8 @@ ff_layout_add_mirror(struct pnfs_layout_spin_lock (&inode->i_lock);list_for_each_entry (pos, &ff_layout->mirrors, mirrors) { -if (memcmp (&mirror->devid, &pos->devid,sizeof (pos->devid)) !=0 ) +if (memcmp (&mirror->dss[0 ].devid, &pos->dss[0 ].devid, +sizeof (pos->dss[0 ].devid)) !=0 )continue ;if (!ff_mirror_match_fh (mirror, pos))continue ;
@@ -238,30 +239,46 @@ ff_layout_remove_mirror(struct nfs4_ff_l mirror->layout =NULL ; } -static struct nfs4_ff_layout_mirror *ff_layout_alloc_mirror (gfp_t gfp_flags) +static struct nfs4_ff_layout_mirror *ff_layout_alloc_mirror (u32 dss_count, +gfp_t gfp_flags) {struct nfs4_ff_layout_mirror *mirror; mirror =kzalloc (sizeof (*mirror), gfp_flags); -if (mirror !=NULL ) { -spin_lock_init (&mirror->lock); -refcount_set (&mirror->ref,1 ); -INIT_LIST_HEAD (&mirror->mirrors); +if (mirror ==NULL ) +return NULL ; + +spin_lock_init (&mirror->lock); +refcount_set (&mirror->ref,1 ); +INIT_LIST_HEAD (&mirror->mirrors); + + mirror->dss_count = dss_count; + mirror->dss = +kcalloc (dss_count,sizeof (struct nfs4_ff_layout_ds_stripe ), + gfp_flags); +if (mirror->dss ==NULL ) { +kfree (mirror); +return NULL ; } +return mirror; }static void ff_layout_free_mirror (struct nfs4_ff_layout_mirror *mirror) { -const struct cred *cred; +const struct cred *cred; +int dss_id =0 ;ff_layout_remove_mirror (mirror); -kfree (mirror->fh_versions); - cred =rcu_access_pointer (mirror->ro_cred); + +kfree (mirror->dss[dss_id].fh_versions); + cred =rcu_access_pointer (mirror->dss[dss_id].ro_cred);put_cred (cred); - cred =rcu_access_pointer (mirror->rw_cred); + cred =rcu_access_pointer (mirror->dss[dss_id].rw_cred);put_cred (cred); -nfs4_ff_layout_put_deviceid (mirror->mirror_ds); +nfs4_ff_layout_put_deviceid (mirror->dss[dss_id].mirror_ds); + +kfree (mirror->dss);kfree (mirror); }
@@ -371,8 +388,8 @@ static void ff_layout_sort_mirrors(strucfor (i =0 ; i < fls->mirror_array_cnt -1 ; i++) {for (j = i +1 ; j < fls->mirror_array_cnt; j++) -if (fls->mirror_array[i]->efficiency < - fls->mirror_array[j]->efficiency) +if (fls->mirror_array[i]->dss[0 ].efficiency < + fls->mirror_array[j]->dss[0 ].efficiency)swap (fls->mirror_array[i], fls->mirror_array[j]); }
@@ -426,35 +443,35 @@ ff_layout_alloc_lseg(struct pnfs_layout_ fls->mirror_array_cnt = mirror_array_cnt; fls->stripe_unit = stripe_unit; +u32 dss_count =0 ;for (i =0 ; i < fls->mirror_array_cnt; i++) {struct nfs4_ff_layout_mirror *mirror;struct cred *kcred;const struct cred __rcu *cred;kuid_t uid;kgid_t gid; -u32 ds_count, fh_count, id; -int j; +u32 fh_count, id; +int j, dss_id =0 ; rc = -EIO ; p =xdr_inline_decode (&stream,4 );if (!p) goto out_err_free; - ds_count =be32_to_cpup (p); + + dss_count =be32_to_cpup (p);/* FIXME: allow for striping? */ -if (ds_count !=1 ) +if (dss_count !=1 ) goto out_err_free; - fls->mirror_array[i] =ff_layout_alloc_mirror (gfp_flags); + fls->mirror_array[i] =ff_layout_alloc_mirror (dss_count, gfp_flags);if (fls->mirror_array[i] ==NULL ) { rc = -ENOMEM ; goto out_err_free; } - fls->mirror_array[i]->ds_count = ds_count; -/* deviceid */ - rc =decode_deviceid (&stream, &fls->mirror_array[i]->devid); + rc =decode_deviceid (&stream, &fls->mirror_array[i]->dss[dss_id].devid);if (rc) goto out_err_free;
@@ -463,10 +480,10 @@ ff_layout_alloc_lseg(struct pnfs_layout_ p =xdr_inline_decode (&stream,4 );if (!p) goto out_err_free; - fls->mirror_array[i]->efficiency =be32_to_cpup (p); + fls->mirror_array[i]->dss[dss_id].efficiency =be32_to_cpup (p);/* stateid */ - rc =decode_pnfs_stateid (&stream, &fls->mirror_array[i]->stateid); + rc =decode_pnfs_stateid (&stream, &fls->mirror_array[i]->dss[dss_id].stateid);if (rc) goto out_err_free;
@@ -477,22 +494,22 @@ ff_layout_alloc_lseg(struct pnfs_layout_ goto out_err_free; fh_count =be32_to_cpup (p); - fls->mirror_array[i]->fh_versions = -kcalloc (fh_count,sizeof (struct nfs_fh ), - gfp_flags); -if (fls->mirror_array[i]->fh_versions ==NULL ) { + fls->mirror_array[i]->dss[dss_id].fh_versions = +kcalloc (fh_count,sizeof (struct nfs_fh ), + gfp_flags); +if (fls->mirror_array[i]->dss[dss_id].fh_versions ==NULL ) { rc = -ENOMEM ; goto out_err_free; }for (j =0 ; j < fh_count; j++) { rc =decode_nfs_fh (&stream, - &fls->mirror_array[i]->fh_versions[j]); + &fls->mirror_array[i]->dss[dss_id].fh_versions[j]);if (rc) goto out_err_free; } - fls->mirror_array[i]->fh_versions_cnt = fh_count; + fls->mirror_array[i]->dss[dss_id].fh_versions_cnt = fh_count;/* user */ rc =decode_name (&stream, &id);
@@ -523,19 +540,21 @@ ff_layout_alloc_lseg(struct pnfs_layout_ cred =RCU_INITIALIZER (kcred);if (lgr->range.iomode ==IOMODE_READ ) -rcu_assign_pointer (fls->mirror_array[i]->ro_cred, cred); +rcu_assign_pointer (fls->mirror_array[i]->dss[dss_id].ro_cred, cred);else -rcu_assign_pointer (fls->mirror_array[i]->rw_cred, cred); +rcu_assign_pointer (fls->mirror_array[i]->dss[dss_id].rw_cred, cred); mirror =ff_layout_add_mirror (lh, fls->mirror_array[i]);if (mirror != fls->mirror_array[i]) {/* swap cred ptrs so free_mirror will clean up old */ if (lgr->range.iomode ==IOMODE_READ ) { - cred =xchg (&mirror->ro_cred, fls->mirror_array[i]->ro_cred); -rcu_assign_pointer (fls->mirror_array[i]->ro_cred, cred); + cred =xchg (&mirror->dss[dss_id].ro_cred, + fls->mirror_array[i]->dss[dss_id].ro_cred); +rcu_assign_pointer (fls->mirror_array[i]->dss[dss_id].ro_cred, cred); }else { - cred =xchg (&mirror->rw_cred, fls->mirror_array[i]->rw_cred); -rcu_assign_pointer (fls->mirror_array[i]->rw_cred, cred); + cred =xchg (&mirror->dss[dss_id].rw_cred, + fls->mirror_array[i]->dss[dss_id].rw_cred); +rcu_assign_pointer (fls->mirror_array[i]->dss[dss_id].rw_cred, cred); }ff_layout_free_mirror (fls->mirror_array[i]); fls->mirror_array[i] = mirror;
@@ -623,8 +642,8 @@ nfs4_ff_layoutstat_start_io(struct nfs4_struct nfs4_flexfile_layout *ffl =FF_LAYOUT_FROM_HDR (mirror->layout);nfs4_ff_start_busy_timer (&layoutstat->busy_timer, now); -if (!mirror->start_time) - mirror->start_time = now; +if (!mirror->dss[0 ].start_time) + mirror->dss[0 ].start_time = now;if (mirror->report_interval !=0 ) report_interval = (s64 )mirror->report_interval *1000LL ;else if (layoutstats_timer !=0 )
@@ -679,8 +698,8 @@ nfs4_ff_layout_stat_io_start_read(structbool report;spin_lock (&mirror->lock); - report =nfs4_ff_layoutstat_start_io (mirror, &mirror->read_stat, now); -nfs4_ff_layout_stat_io_update_requested (&mirror->read_stat, requested); + report =nfs4_ff_layoutstat_start_io (mirror, &mirror->dss[0 ].read_stat, now); +nfs4_ff_layout_stat_io_update_requested (&mirror->dss[0 ].read_stat, requested);set_bit (NFS4_FF_MIRROR_STAT_AVAIL , &mirror->flags);spin_unlock (&mirror->lock);
@@ -695,7 +714,7 @@ nfs4_ff_layout_stat_io_end_read(struct r __u64 completed) {spin_lock (&mirror->lock); -nfs4_ff_layout_stat_io_update_completed (&mirror->read_stat, +nfs4_ff_layout_stat_io_update_completed (&mirror->dss[0 ].read_stat, requested, completed,ktime_get (), task->tk_start);set_bit (NFS4_FF_MIRROR_STAT_AVAIL , &mirror->flags);
@@ -710,8 +729,8 @@ nfs4_ff_layout_stat_io_start_write(strucbool report;spin_lock (&mirror->lock); - report =nfs4_ff_layoutstat_start_io (mirror , &mirror->write_stat, now); -nfs4_ff_layout_stat_io_update_requested (&mirror->write_stat, requested); + report =nfs4_ff_layoutstat_start_io (mirror, &mirror->dss[0 ].write_stat, now); +nfs4_ff_layout_stat_io_update_requested (&mirror->dss[0 ].write_stat, requested);set_bit (NFS4_FF_MIRROR_STAT_AVAIL , &mirror->flags);spin_unlock (&mirror->lock);
@@ -730,7 +749,7 @@ nfs4_ff_layout_stat_io_end_write(struct requested = completed =0 ;spin_lock (&mirror->lock); -nfs4_ff_layout_stat_io_update_completed (&mirror->write_stat, +nfs4_ff_layout_stat_io_update_completed (&mirror->dss[0 ].write_stat, requested, completed,ktime_get (), task->tk_start);set_bit (NFS4_FF_MIRROR_STAT_AVAIL , &mirror->flags);spin_unlock (&mirror->lock);
@@ -772,7 +791,7 @@ ff_layout_choose_ds_for_read(struct pnfscontinue ;if (check_device && -nfs4_test_deviceid_unavailable (&mirror->mirror_ds->id_node)) { +nfs4_test_deviceid_unavailable (&mirror->dss[0 ].mirror_ds->id_node)) {// reinitialize the error state in case if this is the last iteration ds =ERR_PTR (-EINVAL );continue ;
@@ -881,7 +900,7 @@ retry: mirror =FF_LAYOUT_COMP (pgio->pg_lseg, ds_idx); pgm = &pgio->pg_mirrors[0 ]; - pgm->pg_bsize = mirror->mirror_ds->ds_versions[0 ].rsize; + pgm->pg_bsize = mirror->dss[0 ].mirror_ds->ds_versions[0 ].rsize; pgio->pg_mirror_idx = ds_idx;return ;
@@ -953,7 +972,7 @@ retry: goto retry; } pgm = &pgio->pg_mirrors[i]; - pgm->pg_bsize = mirror->mirror_ds->ds_versions[0 ].wsize; + pgm->pg_bsize = mirror->dss[0 ].mirror_ds->ds_versions[0 ].wsize; } if (NFS_SERVER(pgio->pg_inode)->flags &
@@ -2013,7 +2032,7 @@ select_ds_fh_from_commit(struct pnfs_lay/* FIXME: Assume that there is only one NFS version available * for the DS. */ -return &flseg->mirror_array[i]->fh_versions[0 ]; +return &flseg->mirror_array[i]->dss[0 ].fh_versions[0 ]; }static int ff_layout_initiate_commit (struct nfs_commit_data *data,int how)
@@ -2129,10 +2148,10 @@ static void ff_layout_cancel_io(struct pfor (idx =0 ; idx < flseg->mirror_array_cnt; idx++) { mirror = flseg->mirror_array[idx]; - mirror_ds = mirror->mirror_ds; + mirror_ds = mirror->dss[0 ].mirror_ds;if (IS_ERR_OR_NULL (mirror_ds))continue ; - ds = mirror->mirror_ds->ds; + ds = mirror->dss[0 ].mirror_ds->ds;if (!ds)continue ; ds_clp = ds->ds_clp;
@@ -2533,8 +2552,8 @@ ff_layout_encode_ff_layoutupdate(struct struct nfs4_ff_layout_mirror *mirror) {struct nfs4_pnfs_ds_addr *da; -struct nfs4_pnfs_ds *ds = mirror->mirror_ds->ds; -struct nfs_fh *fh = &mirror->fh_versions[0 ]; +struct nfs4_pnfs_ds *ds = mirror->dss[0 ].mirror_ds->ds; +struct nfs_fh *fh = &mirror->dss[0 ].fh_versions[0 ];__be32 *p; da = list_first_entry(&ds->ds_addrs, struct nfs4_pnfs_ds_addr, da_node);
@@ -2547,12 +2566,12 @@ ff_layout_encode_ff_layoutupdate(structxdr_encode_opaque (p, fh->data, fh->size);/* ff_io_latency4 read */ spin_lock (&mirror->lock); -ff_layout_encode_io_latency (xdr, &mirror->read_stat.io_stat); +ff_layout_encode_io_latency (xdr, &mirror->dss[0 ].read_stat.io_stat);/* ff_io_latency4 write */ -ff_layout_encode_io_latency (xdr, &mirror->write_stat.io_stat); +ff_layout_encode_io_latency (xdr, &mirror->dss[0 ].write_stat.io_stat);spin_unlock (&mirror->lock);/* nfstime4 */ -ff_layout_encode_nfstime (xdr,ktime_sub (ktime_get (), mirror->start_time)); +ff_layout_encode_nfstime (xdr,ktime_sub (ktime_get (), mirror->dss[0 ].start_time));/* bool */ p =xdr_reserve_space (xdr,4 ); *p =cpu_to_be32 (false);
@@ -2599,7 +2618,7 @@ ff_layout_mirror_prepare_stats(struct pnlist_for_each_entry (mirror, &ff_layout->mirrors, mirrors) {if (i >= dev_limit)break ; -if (IS_ERR_OR_NULL (mirror->mirror_ds)) +if (IS_ERR_OR_NULL (mirror->dss[0 ].mirror_ds))continue ; if (!test_and_clear_bit(NFS4_FF_MIRROR_STAT_AVAIL, &mirror->flags) &&
@@ -2608,15 +2627,15 @@ ff_layout_mirror_prepare_stats(struct pn/* mirror refcount put in cleanup_layoutstats */ if (!refcount_inc_not_zero (&mirror->ref))continue ; - dev = &mirror->mirror_ds->id_node; + dev = &mirror->dss[0 ].mirror_ds->id_node;memcpy (&devinfo->dev_id, &dev->deviceid,NFS4_DEVICEID4_SIZE ); devinfo->offset =0 ; devinfo->length =NFS4_MAX_UINT64 ;spin_lock (&mirror->lock); - devinfo->read_count = mirror->read_stat.io_stat.ops_completed; - devinfo->read_bytes = mirror->read_stat.io_stat.bytes_completed; - devinfo->write_count = mirror->write_stat.io_stat.ops_completed; - devinfo->write_bytes = mirror->write_stat.io_stat.bytes_completed; + devinfo->read_count = mirror->dss[0 ].read_stat.io_stat.ops_completed; + devinfo->read_bytes = mirror->dss[0 ].read_stat.io_stat.bytes_completed; + devinfo->write_count = mirror->dss[0 ].write_stat.io_stat.ops_completed; + devinfo->write_bytes = mirror->dss[0 ].write_stat.io_stat.bytes_completed;spin_unlock (&mirror->lock); devinfo->layout_type =LAYOUT_FLEX_FILES ; devinfo->ld_private.ops = &layoutstat_ops;
fs/nfs/flexfilelayout/flexfilelayout.h +17 -10
@@ -71,24 +71,31 @@ struct nfs4_ff_layoutstat {struct nfs4_ff_busy_timer busy_timer; }; -struct nfs4_ff_layout_mirror { -struct pnfs_layout_hdr *layout; -struct list_head mirrors; -u32 ds_count; -u32 efficiency; +struct nfs4_ff_layout_mirror ; + +struct nfs4_ff_layout_ds_stripe { +struct nfs4_ff_layout_mirror *mirror;struct nfs4_deviceid devid; +u32 efficiency;struct nfs4_ff_layout_ds *mirror_ds;u32 fh_versions_cnt;struct nfs_fh *fh_versions;nfs4_stateid stateid;const struct cred __rcu *ro_cred;const struct cred __rcu *rw_cred; -refcount_t ref; -spinlock_t lock; -unsigned long flags;struct nfs4_ff_layoutstat read_stat;struct nfs4_ff_layoutstat write_stat;ktime_t start_time; +}; + +struct nfs4_ff_layout_mirror { +struct pnfs_layout_hdr *layout; +struct list_head mirrors; +u32 dss_count; +struct nfs4_ff_layout_ds_stripe *dss; +refcount_t ref; +spinlock_t lock; +unsigned long flags;u32 report_interval; };
@@ -154,7 +161,7 @@ FF_LAYOUT_DEVID_NODE(struct pnfs_layout_struct nfs4_ff_layout_mirror *mirror =FF_LAYOUT_COMP (lseg, idx);if (mirror !=NULL ) { -struct nfs4_ff_layout_ds *mirror_ds = mirror->mirror_ds; +struct nfs4_ff_layout_ds *mirror_ds = mirror->dss[0 ].mirror_ds;if (!IS_ERR_OR_NULL (mirror_ds))return &mirror_ds->id_node;
@@ -183,7 +190,7 @@ ff_layout_no_read_on_rw(struct pnfs_layostatic inline int nfs4_ff_layout_ds_version (const struct nfs4_ff_layout_mirror *mirror) { -return mirror->mirror_ds->ds_versions[0 ].version; +return mirror->dss[0 ].mirror_ds->ds_versions[0 ].version; } struct nfs4_ff_layout_ds *
fs/nfs/flexfilelayout/flexfilelayoutdev.c +27 -27
151 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 24/349 NFSv4/flexfiles: reject zero filehandle version count
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
[ Upstream commit 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2 ]
ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL.
A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even though later flexfiles paths assume that at least one filehandle version exists.
Reject fh_count == 0 before the allocation, matching the existing zero version_count validation in the flexfiles GETDEVICEINFO parser.
A QEMU/KASAN run with a malformed flexfiles layout hit:
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750 ff_layout_encode_layoutreturn+0x683/0x970 nfs4_xdr_enc_layoutreturn+0x278/0x3a0 Kernel panic - not syncing: Fatal exception
The patched kernel rejects the malformed layout without KASAN/oops/panic, and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.
--- fs/nfs/flexfilelayout/flexfilelayout.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/nfs/flexfilelayout/flexfilelayout.c +4 -0
@@ -493,6 +493,10 @@ ff_layout_alloc_lseg(struct pnfs_layout_if (!p) goto out_err_free; fh_count =be32_to_cpup (p); +if (fh_count ==0 ) { + rc = -EINVAL ; + goto out_err_free; + } fls->mirror_array[i]->dss[dss_id].fh_versions = kcalloc(fh_count, sizeof(struct nfs_fh),
Greg Kroah-Hartman
maintainerPATCH 25/349 locking/rtmutex: Make sure we wake anything on the wake_q when we release the lock->wait_lock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Stultz <[email protected]>
[ Upstream commit 4a077914578183ec397ad09f7156a357e00e5d72 ]
Bert reported seeing occasional boot hangs when running with PREEPT_RT and bisected it down to commit 894d1b3db41c ("locking/mutex: Remove wakeups from under mutex::wait_lock").
It looks like I missed a few spots where we drop the wait_lock and potentially call into schedule without waking up the tasks on the wake_q structure. Since the tasks being woken are ww_mutex tasks they need to be able to run to release the mutex and unblock the task that currently is planning to wake them. Thus we can deadlock.
So make sure we wake the wake_q tasks when we unlock the wait_lock.
--- kernel/locking/rtmutex.c | 18 ++++++++++++++++-- kernel/locking/rtmutex_api.c | 2 +- 2 files changed, 17 insertions(+), 3 deletions(-)
kernel/locking/rtmutex.c +16 -2
@@ -1292,7 +1292,13 @@ static int __sched task_blocks_on_rt_mut*/ get_task_struct (owner); +preempt_disable ();raw_spin_unlock_irq (&lock->wait_lock); +/* wake up any tasks on the wake_q before calling rt_mutex_adjust_prio_chain */ +wake_up_q (wake_q); +wake_q_init (wake_q); +preempt_enable (); + res =rt_mutex_adjust_prio_chain (owner, chwalk, lock, next_lock, waiter, task);
@@ -1602,6 +1608,7 @@ static void __sched remove_waiter(struct* or TASK_UNINTERRUPTIBLE) * @timeout: the pre-initialized and started timer, or NULL for none * @waiter: the pre-initialized rt_mutex_waiter +* @wake_q: wake_q of tasks to wake when we drop the lock->wait_lock * * Must be called with lock->wait_lock held and interrupts disabled */
@@ -1609,7 +1616,8 @@ static int __sched rt_mutex_slowlock_blostruct ww_acquire_ctx *ww_ctx, unsigned int state, struct hrtimer_sleeper *timeout, - struct rt_mutex_waiter *waiter) + struct rt_mutex_waiter *waiter, + struct wake_q_head *wake_q) { struct rt_mutex *rtm = container_of(lock, struct rt_mutex, rtmutex);struct task_struct *owner;
@@ -1639,7 +1647,13 @@ static int __sched rt_mutex_slowlock_blo owner =rt_mutex_owner (lock); else owner =NULL ; +preempt_disable ();raw_spin_unlock_irq (&lock->wait_lock); +if (wake_q) { +wake_up_q (wake_q); +wake_q_init (wake_q); + } +preempt_enable ();if (!owner || !rtmutex_spin_on_owner (lock, waiter, owner))rt_mutex_schedule ();
@@ -1713,7 +1727,7 @@ static int __sched __rt_mutex_slowlock(s ret =task_blocks_on_rt_mutex (lock, waiter, current, ww_ctx, chwalk, wake_q);if (likely (!ret)) - ret =rt_mutex_slowlock_block (lock, ww_ctx, state,NULL , waiter); + ret =rt_mutex_slowlock_block (lock, ww_ctx, state,NULL , waiter, wake_q);if (likely (!ret)) {/* acquired the lock */
kernel/locking/rtmutex_api.c +1 -1
@@ -383,7 +383,7 @@ int __sched rt_mutex_wait_proxy_lock(strraw_spin_lock_irq (&lock->wait_lock);/* sleep on the mutex */ set_current_state (TASK_INTERRUPTIBLE ); - ret =rt_mutex_slowlock_block (lock,NULL ,TASK_INTERRUPTIBLE , to, waiter); + ret =rt_mutex_slowlock_block (lock,NULL ,TASK_INTERRUPTIBLE , to, waiter,NULL );/* * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might * have to fix that up.
Greg Kroah-Hartman
maintainerPATCH 26/349 apparmor: advertise the tcp fast open fix is applied
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <[email protected]>
[ Upstream commit 2f6701a5ce6257ae7a64ddc6d89d0a08d2a034f8 ]
The fix for tcp-fast-open ensures that the connect permission is being mediated correctly but it didn't add an artifact to the feature set to advertise the fix is available. Add an artifact so that the test suite can identify if the fix has not been properly applied or a new unexpected regression has occurred.
--- security/apparmor/net.c | 1 + 1 file changed, 1 insertion(+)
security/apparmor/net.c +1 -0
@@ -21,6 +21,7 @@struct aa_sfs_entry aa_sfs_entry_network[] = {AA_SFS_FILE_STRING ("af_mask" ,AA_SFS_AF_MASK ), +AA_SFS_FILE_BOOLEAN ("tcp-fast-open" ,1 ), { } };
Greg Kroah-Hartman
maintainerPATCH 27/349 nfsd: move name lookup out of nfsd4_list_rec_dir()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
[ Upstream commit 89bd77cf436bf25e448817a662ebf76515f22863 ]
nfsd4_list_rec_dir() is called with two different callbacks. One of the callbacks uses vfs_rmdir() to remove the directory. The other doesn't use the dentry at all, just the name.
As only one callback needs the dentry, this patch moves the lookup into that callback. This prepares of changes to how directory operations are locked.
Stable-dep-of: 4552f4e3f2c9 ("nfsd: change nfs4_client_to_reclaim() to allocate data")
--- fs/nfsd/nfs4recover.c | 53 +++++++++++++++++++++---------------------- 1 file changed, 26 insertions(+), 27 deletions(-)
fs/nfsd/nfs4recover.c +26 -27
@@ -255,7 +255,7 @@ nfsd4_create_clid_dir(struct nfs4_client *clp)nfs4_reset_creds (original_cred); } -typedef int (recdir_func )(struct dentry *,struct dentry *,struct nfsd_net *); +typedef int (recdir_func )(struct dentry *,char *,struct nfsd_net *);struct name_list {char name[HEXDIR_LEN ];
@@ -309,23 +309,14 @@ nfsd4_list_rec_dir(recdir_func *f, struct nfsd_net *nn) } status =iterate_dir (nn->rec_file, &ctx.ctx); -inode_lock_nested (d_inode (dir),I_MUTEX_PARENT );list_for_each_entry_safe (entry, tmp, &ctx.names, list) { -if (!status) { -struct dentry *dentry; - dentry =lookup_one_len (entry->name, dir,HEXDIR_LEN -1 ); -if (IS_ERR (dentry)) { - status =PTR_ERR (dentry); -break ; - } - status =f (dir, dentry, nn); -dput (dentry); - } +if (!status) + status =f (dir, entry->name, nn); +list_del (&entry->list);kfree (entry); } -inode_unlock (d_inode (dir));nfs4_reset_creds (original_cred);list_for_each_entry_safe (entry, tmp, &ctx.names, list) {
@@ -423,18 +414,19 @@ nfsd4_remove_clid_dir(struct nfs4_client *clp) }static int -purge_old (struct dentry *parent,struct dentry *child,struct nfsd_net *nn) +purge_old (struct dentry *parent,char *cname,struct nfsd_net *nn) {int status; +struct dentry *child;struct xdr_netobj name; -if (child->d_name.len !=HEXDIR_LEN -1 ) { -printk ("%s: illegal name %pd in recovery directory\n" , - __func__, child); +if (strlen (cname) !=HEXDIR_LEN -1 ) { +printk ("%s: illegal name %s in recovery directory\n" , + __func__, cname);/* Keep trying; maybe the others are OK: */ return 0 ; } - name.data =kmemdup_nul (child->d_name.name, child->d_name.len,GFP_KERNEL ); + name.data =kstrdup (cname,GFP_KERNEL );if (!name.data) {dprintk ("%s: failed to allocate memory for name.data!\n" , __func__);
@@ -444,10 +436,17 @@ purge_old(struct dentry *parent, struct dentry *child, struct nfsd_net *nn)if (nfs4_has_reclaimed_state (name, nn)) goto out_free; - status =vfs_rmdir (&nop_mnt_idmap,d_inode (parent), child); -if (status) -printk ("failed to remove client recovery directory %pd\n" , - child); +inode_lock_nested (d_inode (parent),I_MUTEX_PARENT ); + child =lookup_one_len (cname, parent,HEXDIR_LEN -1 ); +if (!IS_ERR (child)) { + status =vfs_rmdir (&nop_mnt_idmap,d_inode (parent), child); +if (status) +printk ("failed to remove client recovery directory %pd\n" , + child); +dput (child); + } +inode_unlock (d_inode (parent)); + out_free:kfree (name.data); out:
@@ -478,18 +477,18 @@ nfsd4_recdir_purge_old(struct nfsd_net *nn) }static int -load_recdir (struct dentry *parent,struct dentry *child,struct nfsd_net *nn) +load_recdir (struct dentry *parent,char *cname,struct nfsd_net *nn) {struct xdr_netobj name;struct xdr_netobj princhash = { .len =0 , .data =NULL }; -if (child->d_name.len !=HEXDIR_LEN -1 ) { -printk ("%s: illegal name %pd in recovery directory\n" , - __func__, child); +if (strlen (cname) !=HEXDIR_LEN -1 ) { +printk ("%s: illegal name %s in recovery directory\n" , + __func__, cname);/* Keep trying; maybe the others are OK: */ return 0 ; } - name.data =kmemdup_nul (child->d_name.name, child->d_name.len,GFP_KERNEL ); + name.data =kstrdup (cname,GFP_KERNEL );if (!name.data) {dprintk ("%s: failed to allocate memory for name.data!\n" , __func__);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 28/349 nfsd: change nfs4_client_to_reclaim() to allocate data
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
[ Upstream commit 4552f4e3f2c96597914f07b060d5c5db84420ddd ]
The calling convention for nfs4_client_to_reclaim() is clumsy in that the caller needs to free memory if the function fails. It is much cleaner if the function frees its own memory.
This patch changes nfs4_client_to_reclaim() to re-allocate the .data fields to be stored in the newly allocated struct nfs4_client_reclaim, and to free everything on failure.
__cld_pipe_inprogress_downcall() needs to allocate the data anyway to copy it from user-space, so now that data is allocated twice. I think that is a small price to pay for a cleaner interface.
--- fs/nfsd/nfs4recover.c | 67 +++++++++++++++---------------------------- fs/nfsd/nfs4state.c | 22 ++++++++++++-- 2 files changed, 42 insertions(+), 47 deletions(-)
fs/nfsd/nfs4recover.c +23 -44
@@ -168,24 +168,13 @@ legacy_recdir_name_error(struct nfs4_client *clp, int error)static void __nfsd4_create_reclaim_record_grace (struct nfs4_client *clp, -const char *dname,int len,struct nfsd_net *nn) +char *dname,struct nfsd_net *nn) { -struct xdr_netobj name; +struct xdr_netobj name = { .len =strlen (dname), .data = dname };struct xdr_netobj princhash = { .len =0 , .data =NULL };struct nfs4_client_reclaim *crp; - name.data =kmemdup (dname, len,GFP_KERNEL ); -if (!name.data) { -dprintk ("%s: failed to allocate memory for name.data!\n" , - __func__); -return ; - } - name.len = len; crp =nfs4_client_to_reclaim (name, princhash, nn); -if (!crp) { -kfree (name.data); -return ; - } crp->cr_clp = clp; }
@@ -241,8 +230,7 @@ nfsd4_create_clid_dir(struct nfs4_client *clp)inode_unlock (d_inode (dir));if (status ==0 ) {if (nn->in_grace) -__nfsd4_create_reclaim_record_grace (clp, dname, -HEXDIR_LEN , nn); +__nfsd4_create_reclaim_record_grace (clp, dname, nn);vfs_fsync (nn->rec_file,0 ); }else { printk(KERN_ERR "NFSD: failed to write recovery record"
@@ -479,7 +467,7 @@ nfsd4_recdir_purge_old(struct nfsd_net *nn)static int load_recdir (struct dentry *parent,char *cname,struct nfsd_net *nn) { -struct xdr_netobj name; +struct xdr_netobj name = { .len =HEXDIR_LEN , .data = cname };struct xdr_netobj princhash = { .len =0 , .data =NULL };if (strlen (cname) !=HEXDIR_LEN -1 ) {
@@ -488,16 +476,7 @@ load_recdir(struct dentry *parent, char *cname, struct nfsd_net *nn)/* Keep trying; maybe the others are OK: */ return 0 ; } - name.data =kstrdup (cname,GFP_KERNEL ); -if (!name.data) { -dprintk ("%s: failed to allocate memory for name.data!\n" , - __func__); - goto out; - } - name.len =HEXDIR_LEN ; -if (!nfs4_client_to_reclaim (name, princhash, nn)) -kfree (name.data); -out: +nfs4_client_to_reclaim (name, princhash, nn);return 0 ; }
@@ -796,6 +775,8 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg, {uint8_t cmd, princhashlen;struct xdr_netobj name, princhash = { .len =0 , .data =NULL }; + char *namecopy __free(kfree) = NULL; + char *princhashcopy __free(kfree) = NULL;uint16_t namelen;if (get_user (cmd, &cmsg->cm_cmd)) {
@@ -813,20 +794,20 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,dprintk ("%s: invalid namelen (%u)" , __func__, namelen);return -EINVAL ; } - name.data =memdup_user (&ci->cc_name.cn_id, namelen); -if (IS_ERR (name.data)) -return PTR_ERR (name.data); + namecopy =memdup_user (&ci->cc_name.cn_id, namelen); +if (IS_ERR (namecopy)) +return PTR_ERR (namecopy); + name.data = namecopy; name.len = namelen;if (get_user (princhashlen, &ci->cc_princhash.cp_len))return -EFAULT ;if (princhashlen >0 ) { - princhash.data =memdup_user ( - &ci->cc_princhash.cp_data, - princhashlen); -if (IS_ERR (princhash.data)) { -kfree (name.data); -return PTR_ERR (princhash.data); - } + princhashcopy =memdup_user ( + &ci->cc_princhash.cp_data, + princhashlen); +if (IS_ERR (princhashcopy)) +return PTR_ERR (princhashcopy); + princhash.data = princhashcopy; princhash.len = princhashlen; }else princhash.len =0 ;
@@ -840,9 +821,10 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,dprintk ("%s: invalid namelen (%u)" , __func__, namelen);return -EINVAL ; } - name.data =memdup_user (&cnm->cn_id, namelen); -if (IS_ERR (name.data)) -return PTR_ERR (name.data); + namecopy =memdup_user (&cnm->cn_id, namelen); +if (IS_ERR (namecopy)) +return PTR_ERR (namecopy); + name.data = namecopy; name.len = namelen; }#ifdef CONFIG_NFSD_LEGACY_CLIENT_TRACKING
@@ -850,15 +832,12 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,struct cld_net *cn = nn->cld_net; name.len = name.len -5 ; -memmove (name.data, name.data +5 , name.len); + name.data = name.data +5 ; cn->cn_has_legacy = true; }#endif -if (!nfs4_client_to_reclaim (name, princhash, nn)) { -kfree (name.data); -kfree (princhash.data); +if (!nfs4_client_to_reclaim (name, princhash, nn))return -EFAULT ; - }return nn->client_tracking_ops->msglen; }return -EFAULT ;
fs/nfsd/nfs4state.c +19 -3
@@ -8557,9 +8557,6 @@ nfs4_has_reclaimed_state(struct xdr_netobj name, struct nfsd_net *nn)/* * failure => all reset bets are off, nfserr_no_grace... -* -* The caller is responsible for freeing name.data if NULL is returned (it -* will be freed in nfs4_remove_reclaim_record in the normal case). */ struct nfs4_client_reclaim * nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,
@@ -8568,6 +8565,22 @@ nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,unsigned int strhashval;struct nfs4_client_reclaim *crp; + name.data =kmemdup (name.data, name.len,GFP_KERNEL ); +if (!name.data) { +dprintk ("%s: failed to allocate memory for name.data!\n" , + __func__); +return NULL ; + } +if (princhash.len) { + princhash.data =kmemdup (princhash.data, princhash.len,GFP_KERNEL ); +if (!princhash.data) { +dprintk ("%s: failed to allocate memory for princhash.data!\n" , + __func__); +kfree (name.data); +return NULL ; + } + }else + princhash.data =NULL ; crp =alloc_reclaim ();if (crp) { strhashval =clientstr_hashval (name);
@@ -8579,6 +8592,9 @@ nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash, crp->cr_princhash.len = princhash.len; crp->cr_clp =NULL ; nn->reclaim_str_hashtbl_size++; + }else { +kfree (name.data); +kfree (princhash.data); }return crp; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 29/349 bonding: fix xfrm offload feature setup on active-backup mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 5b66169f6be4847008c0aea50885ff0632151479 ]
The active-backup bonding mode supports XFRM ESP offload. However, when a bond is added using command like ip link add bond0 type bond mode 1 miimon 100, the ethtool -k command shows that the XFRM ESP offload is disabled. This occurs because, in bond_newlink(), we change bond link first and register bond device later. So the XFRM feature update in bond_option_mode_set() is not called as the bond device is not yet registered, leading to the offload feature not being set successfully.
To resolve this issue, we can modify the code order in bond_newlink() to ensure that the bond device is registered first before changing the bond link parameters. This change will allow the XFRM ESP offload feature to be correctly enabled.
--- drivers/net/bonding/bond_main.c | 2 +- drivers/net/bonding/bond_netlink.c | 16 +++++++++------- include/net/bonding.h | 1 + 3 files changed, 11 insertions(+), 8 deletions(-)
drivers/net/bonding/bond_main.c +1 -1
@@ -4388,7 +4388,7 @@ void bond_work_init_all(struct bonding *bond)INIT_DELAYED_WORK (&bond->slave_arr_work, bond_slave_arr_handler); } -static void bond_work_cancel_all (struct bonding *bond) +void bond_work_cancel_all (struct bonding *bond) {cancel_delayed_work_sync (&bond->mii_work);cancel_delayed_work_sync (&bond->arp_work);
drivers/net/bonding/bond_netlink.c +9 -7
@@ -597,18 +597,20 @@ static int bond_newlink(struct net *src_net, struct net_device *bond_dev, struct nlattr *tb[], struct nlattr *data[], struct netlink_ext_ack *extack) { + struct bonding *bond = netdev_priv(bond_dev);int err; - err =bond_changelink (bond_dev, tb, data, extack); -if (err <0 ) + err =register_netdevice (bond_dev); +if (err)return err; - err =register_netdevice (bond_dev); -if (!err) { -struct bonding *bond =netdev_priv (bond_dev); +netif_carrier_off (bond_dev); +bond_work_init_all (bond); -netif_carrier_off (bond_dev); -bond_work_init_all (bond); + err =bond_changelink (bond_dev, tb, data, extack); +if (err) { +bond_work_cancel_all (bond); +unregister_netdevice (bond_dev); }return err;
include/net/bonding.h +1 -0
@@ -713,6 +713,7 @@ struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev,int bond_update_slave_arr (struct bonding *bond,struct slave *skipslave);void bond_slave_arr_work_rearm (struct bonding *bond,unsigned long delay);void bond_work_init_all (struct bonding *bond); +void bond_work_cancel_all (struct bonding *bond);#ifdef CONFIG_PROC_FS void bond_create_proc_entry (struct bonding *bond);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 30/349 block: add a store_limit operations for sysfs entries
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit a16230649ce27f8ac7dd8a5b079d9657aa96de16 ]
De-duplicate the code for updating queue limits by adding a store_limit method that allows having common code handle the actual queue limits update.
Note that this is a pure refactoring patch and does not address the existing freeze vs limits lock order problem in the refactored code, which will be addressed next.
[6.12.y-backport note: dropped "iostats_passthrough" queue limit parameter from the upstream commit,
as this parameter does not exist in the 6.12 kernel branch]
Stable-dep-of: c99f66e4084a ("block: fix queue freeze vs limits lock order in sysfs store methods")
--- block/blk-sysfs.c | 108 +++++++++++++++++++++++----------------------- 1 file changed, 54 insertions(+), 54 deletions(-)
block/blk-sysfs.c +54 -54
@@ -25,6 +25,8 @@ struct queue_sysfs_entry {ssize_t (*show)(struct gendisk *disk,char *page);int (*load_module)(struct gendisk *disk,const char *page,size_t count);ssize_t (*store)(struct gendisk *disk,const char *page,size_t count); +int (*store_limit)(struct gendisk *disk,const char *page, +size_t count,struct queue_limits *lim); }; static ssize_t
@@ -152,13 +154,11 @@ QUEUE_SYSFS_SHOW_CONST(discard_zeroes_data, 0) QUEUE_SYSFS_SHOW_CONST(write_same_max, 0) QUEUE_SYSFS_SHOW_CONST(poll_delay, -1) -static ssize_t queue_max_discard_sectors_store (struct gendisk *disk, -const char *page,size_t count) +static int queue_max_discard_sectors_store (struct gendisk *disk, +const char *page,size_t count,struct queue_limits *lim) {unsigned long max_discard_bytes; -struct queue_limits lim;ssize_t ret; -int err; ret =queue_var_store (&max_discard_bytes, page, count);if (ret <0 )
@@ -170,12 +170,8 @@ static ssize_t queue_max_discard_sectors_store(struct gendisk *disk,if ((max_discard_bytes >>SECTOR_SHIFT ) >UINT_MAX )return -EINVAL ; - lim =queue_limits_start_update (disk->queue); - lim.max_user_discard_sectors = max_discard_bytes >>SECTOR_SHIFT ; - err =queue_limits_commit_update (disk->queue, &lim); -if (err) -return err; -return ret; + lim->max_user_discard_sectors = max_discard_bytes >>SECTOR_SHIFT ; +return 0 ; }/*
@@ -190,30 +186,24 @@ static ssize_t queue_zone_append_max_show(struct gendisk *disk, char *page) SECTOR_SHIFT); } -static ssize_t -queue_max_sectors_store (struct gendisk *disk,const char *page,size_t count) +static int +queue_max_sectors_store (struct gendisk *disk,const char *page,size_t count, +struct queue_limits *lim) {unsigned long max_sectors_kb; -struct queue_limits lim;ssize_t ret; -int err; ret =queue_var_store (&max_sectors_kb, page, count);if (ret <0 )return ret; - lim =queue_limits_start_update (disk->queue); - lim.max_user_sectors = max_sectors_kb <<1 ; - err =queue_limits_commit_update (disk->queue, &lim); -if (err) -return err; -return ret; + lim->max_user_sectors = max_sectors_kb <<1 ; +return 0 ; }static ssize_t queue_feature_store (struct gendisk *disk,const char *page, -size_t count,blk_features_t feature) +size_t count,struct queue_limits *lim,blk_features_t feature) { -struct queue_limits lim;unsigned long val;ssize_t ret;
@@ -221,15 +211,11 @@ static ssize_t queue_feature_store(struct gendisk *disk, const char *page,if (ret <0 )return ret; - lim =queue_limits_start_update (disk->queue);if (val) - lim.features |= feature; + lim->features |= feature;else - lim.features &= ~feature; - ret =queue_limits_commit_update (disk->queue, &lim); -if (ret) -return ret; -return count; + lim->features &= ~feature; +return 0 ; }#define QUEUE_SYSFS_FEATURE (_name, _feature) \
@@ -238,10 +224,10 @@ static ssize_t queue_##_name##_show(struct gendisk *disk, char *page) \return sprintf (page,"%u\n" , \ !!(disk->queue->limits.features & _feature)); \ } \ -static ssize_t queue_##_name##_store(struct gendisk *disk, \ -const char *page,size_t count) \ +static int queue_##_name##_store(struct gendisk *disk, \ +const char *page,size_t count,struct queue_limits *lim) \ { \ -return queue_feature_store (disk, page, count, _feature); \ +return queue_feature_store (disk, page, count, lim, _feature); \ }QUEUE_SYSFS_FEATURE (rotational,BLK_FEAT_ROTATIONAL )
@@ -381,12 +367,10 @@ static ssize_t queue_wc_show(struct gendisk *disk, char *page)return sprintf (page,"write through\n" ); } -static ssize_t queue_wc_store (struct gendisk *disk,const char *page, -size_t count) +static int queue_wc_store (struct gendisk *disk,const char *page, +size_t count,struct queue_limits *lim) { -struct queue_limits lim;bool disable; -int err;if (!strncmp (page,"write back" ,10 )) { disable = false;
@@ -397,15 +381,11 @@ static ssize_t queue_wc_store(struct gendisk *disk, const char *page,return -EINVAL ; } - lim =queue_limits_start_update (disk->queue);if (disable) - lim.flags |=BLK_FLAG_WRITE_CACHE_DISABLED ; + lim->flags |=BLK_FLAG_WRITE_CACHE_DISABLED ;else - lim.flags &= ~BLK_FLAG_WRITE_CACHE_DISABLED ; - err =queue_limits_commit_update (disk->queue, &lim); -if (err) -return err; -return count; + lim->flags &= ~BLK_FLAG_WRITE_CACHE_DISABLED ; +return 0 ; }#define QUEUE_RO_ENTRY (_prefix, _name) \
@@ -421,6 +401,13 @@ static struct queue_sysfs_entry _prefix##_entry = { \ .store = _prefix##_store, \ }; +#define QUEUE_LIM_RW_ENTRY (_prefix, _name) \ +static struct queue_sysfs_entry _prefix##_entry = { \ + .attr = { .name = _name, .mode = 0644 }, \ + .show = _prefix##_show, \ + .store_limit = _prefix##_store, \ +} +#define QUEUE_RW_LOAD_MODULE_ENTRY (_prefix, _name) \ static struct queue_sysfs_entry _prefix##_entry = { \ .attr = { .name = _name, .mode = 0644 }, \
@@ -431,7 +418,7 @@ static struct queue_sysfs_entry _prefix##_entry = { \QUEUE_RW_ENTRY (queue_requests,"nr_requests" );QUEUE_RW_ENTRY (queue_ra,"read_ahead_kb" ); -QUEUE_RW_ENTRY (queue_max_sectors,"max_sectors_kb" ); +QUEUE_LIM_RW_ENTRY (queue_max_sectors,"max_sectors_kb" );QUEUE_RO_ENTRY (queue_max_hw_sectors,"max_hw_sectors_kb" );QUEUE_RO_ENTRY (queue_max_segments,"max_segments" );QUEUE_RO_ENTRY (queue_max_integrity_segments,"max_integrity_segments" );
@@ -447,7 +434,7 @@ QUEUE_RO_ENTRY(queue_io_opt, "optimal_io_size");QUEUE_RO_ENTRY (queue_max_discard_segments,"max_discard_segments" );QUEUE_RO_ENTRY (queue_discard_granularity,"discard_granularity" );QUEUE_RO_ENTRY (queue_max_hw_discard_sectors,"discard_max_hw_bytes" ); -QUEUE_RW_ENTRY (queue_max_discard_sectors,"discard_max_bytes" ); +QUEUE_LIM_RW_ENTRY (queue_max_discard_sectors,"discard_max_bytes" );QUEUE_RO_ENTRY (queue_discard_zeroes_data,"discard_zeroes_data" );QUEUE_RO_ENTRY (queue_atomic_write_max_sectors,"atomic_write_max_bytes" );
@@ -470,7 +457,7 @@ QUEUE_RW_ENTRY(queue_nomerges, "nomerges");QUEUE_RW_ENTRY (queue_rq_affinity,"rq_affinity" );QUEUE_RW_ENTRY (queue_poll,"io_poll" );QUEUE_RW_ENTRY (queue_poll_delay,"io_poll_delay" ); -QUEUE_RW_ENTRY (queue_wc,"write_cache" ); +QUEUE_LIM_RW_ENTRY (queue_wc,"write_cache" );QUEUE_RO_ENTRY (queue_fua,"fua" );QUEUE_RO_ENTRY (queue_dax,"dax" );QUEUE_RW_ENTRY (queue_io_timeout,"io_timeout" );
@@ -483,10 +470,10 @@ static struct queue_sysfs_entry queue_hw_sector_size_entry = { .show = queue_logical_block_size_show, }; -QUEUE_RW_ENTRY (queue_rotational,"rotational" ); -QUEUE_RW_ENTRY (queue_iostats,"iostats" ); -QUEUE_RW_ENTRY (queue_add_random,"add_random" ); -QUEUE_RW_ENTRY (queue_stable_writes,"stable_writes" ); +QUEUE_LIM_RW_ENTRY (queue_rotational,"rotational" ); +QUEUE_LIM_RW_ENTRY (queue_iostats,"iostats" ); +QUEUE_LIM_RW_ENTRY (queue_add_random,"add_random" ); +QUEUE_LIM_RW_ENTRY (queue_stable_writes,"stable_writes" );#ifdef CONFIG_BLK_WBT static ssize_t queue_var_store64 (s64 *var,const char *page)
@@ -683,7 +670,7 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr,struct request_queue *q = disk->queue;ssize_t res; -if (!entry->store) +if (!entry->store_limit && !entry->store)return -EIO ;/*
@@ -697,11 +684,24 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr,return res; } -blk_mq_freeze_queue (q);mutex_lock (&q->sysfs_lock); - res = entry->store (disk, page, length); -mutex_unlock (&q->sysfs_lock); +blk_mq_freeze_queue (q); +if (entry->store_limit) { +struct queue_limits lim =queue_limits_start_update (q); + + res = entry->store_limit (disk, page, length, &lim); +if (res <0 ) { +queue_limits_cancel_update (q); + }else { + res =queue_limits_commit_update (q, &lim); +if (!res) + res = length; + } + }else { + res = entry->store (disk, page, length); + }blk_mq_unfreeze_queue (q); +mutex_unlock (&q->sysfs_lock);return res; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 31/349 block: fix queue freeze vs limits lock order in sysfs store methods
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit c99f66e4084a62a2cc401c4704a84328aeddc9ec ]
queue_attr_store() always freezes a device queue before calling the attribute store operation. For attributes that control queue limits, the store operation will also lock the queue limits with a call to queue_limits_start_update(). However, some drivers (e.g. SCSI sd) may need to issue commands to a device to obtain limit values from the hardware with the queue limits locked. This creates a potential ABBA deadlock situation if a user attempts to modify a limit (thus freezing the device queue) while the device driver starts a revalidation of the device queue limits.
Avoid such deadlock by not freezing the queue before calling the ->store_limit() method in struct queue_sysfs_entry and instead use the queue_limits_commit_update_frozen helper to freeze the queue after taking the limits lock.
This also removes taking the sysfs lock for the store_limit method as it doesn't protect anything here, but creates even more nesting. Hopefully it will go away from the actual sysfs methods entirely soon.
(commit log adapted from a similar patch from Damien Le Moal)
--- block/blk-sysfs.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
block/blk-sysfs.c +10 -8
@@ -684,22 +684,24 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr,return res; } -mutex_lock (&q->sysfs_lock); -blk_mq_freeze_queue (q);if (entry->store_limit) {struct queue_limits lim =queue_limits_start_update (q); res = entry->store_limit (disk, page, length, &lim);if (res <0 ) {queue_limits_cancel_update (q); - }else { - res =queue_limits_commit_update (q, &lim); -if (!res) - res = length; +return res; } - }else { - res = entry->store (disk, page, length); + + res =queue_limits_commit_update_frozen (q, &lim); +if (res) +return res; +return length; } + +mutex_lock (&q->sysfs_lock); +blk_mq_freeze_queue (q); + res = entry->store (disk, page, length);blk_mq_unfreeze_queue (q);mutex_unlock (&q->sysfs_lock);return res;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 32/349 mm/khugepaged: write all dirty file folios when collapsing
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pedro Falcato <[email protected]>
[There is no upstream commit, as this code was removed by upstream
commit 044925f9b565 ("mm: fs: remove filemap_nr_thps*() functions and their users")]
As-is, khugepaged and writable-file opening exclude each other. A file cannot be open writeable and have THPs (because the filesystem is not aware of them). khugepaged will never collapse file pages for files that are opened writeable. On an open(O_RDWR/O_WRONLY), the page cache for that particular file is dropped. This is fine because nothing could've been dirtied.
However, there is an edge-case: collapse_file() might not be able to coexist with concurrent writers, but it can coexist with dirty folios (from previous writers). Therefore, the following can happen:
open(file, O_RDWR)
write(file)
close(file)madvise(file_mapping, MADV_COLLAPSE, some non-dirty range) open(file, O_RDWR)
nr_thps > 0
truncate_inode_pages()
/* THPs are cleared out, but so are the dirty folios */
When this edge-case happens, there is data loss, as the dirty folios are fully discarded.
Fix it by fully writing back the page cache (and waiting) when collapsing file THPs. Doing so provides the guarantee that no dirty folio will be observed while there are active THPs. To fully ensure this is safe, the invalidate_lock needs to be held while doing the writeout, so that do_dentry_open()'s page cache truncation excludes this write-and-wait.
As a side effect, move the nr_thps counter bumping outside the i_pages lock. This is correct since the counter itself is an atomic_t and the producer <-> consumer correctness is provided by a full memory barrier:smp_mb() in collapse_file()/memory barrier implied by full ordering in get_write_access() -> atomic_inc_unless_negative().
--- mm/khugepaged.c | 39 +++++++++++++++++++++++++-------------- 1 file changed, 25 insertions(+), 14 deletions(-)
mm/khugepaged.c +25 -14
@@ -2017,32 +2017,43 @@ static int collapse_file(struct mm_struct *mm, unsigned long addr, goto xa_unlocked; } -if (!is_shmem) { +xa_locked: +xas_unlock_irq (&xas); +xa_unlocked: + +/* +* If collapse is successful, flush must be done now before copying. +* If collapse is unsuccessful, does flush actually need to be done? +* Do it anyway, to clear the state. +*/ +try_to_unmap_flush (); + +if (result ==SCAN_SUCCEED && !is_shmem && !mapping_large_folio_support (mapping)) { +/* +* invalidate_lock as shared excludes against concurrent opens +* in do_dentry_open() truncating the page cache. This is +* particularly important if there are dirty folios in transit. +*/ +filemap_invalidate_lock_shared (mapping);filemap_nr_thps_inc (mapping);/* * Paired with the fence in do_dentry_open() -> get_write_access() * to ensure i_writecount is up to date and the update to nr_thps * is visible. Ensures the page cache will be truncated if the -* file is opened writable. +* file is opened writable. If collapse looks to be successful, +* flush any dirty pages out the page cache. With the nr_thps +* incremented, there won't be any new writers (nor new dirties). */ smp_mb (); -if (inode_is_open_for_write (mapping->host)) { +if (inode_is_open_for_write (mapping->host) ||filemap_write_and_wait (mapping)) { result =SCAN_FAIL ;filemap_nr_thps_dec (mapping); +filemap_invalidate_unlock_shared (mapping); + goto rollback; } +filemap_invalidate_unlock_shared (mapping); } -xa_locked: -xas_unlock_irq (&xas); -xa_unlocked: - -/* -* If collapse is successful, flush must be done now before copying. -* If collapse is unsuccessful, does flush actually need to be done? -* Do it anyway, to clear the state. -*/ -try_to_unmap_flush (); -if (result ==SCAN_SUCCEED && nr_none && !shmem_charge (mapping->host, nr_none)) result =SCAN_FAIL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 33/349 perf trace beauty fcntl: Fix build with older kernel headers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
commit 7ee7f48413c42b90230de4a8e40898b757bc8e82 upstream.
Toolchains with older kernel headers that do not include upstream commit c75b1d9421f80f41 ("fs: add fcntl() interface for setting/getting write life time hints") will now fail to build perf due to missing definitions for F_GET_RW_HINT/F_SET_RW_HINT/F_GET_FILE_RW_HINT/F_SET_FILE_RW_HINT.
Provide a fallback definition for these when they are not already defined.
--- tools/perf/trace/beauty/fcntl.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
tools/perf/trace/beauty/fcntl.c +16 -0
@@ -9,6 +9,22 @@#include <linux/kernel.h> #include <linux/fcntl.h> +#ifndef F_GET_RW_HINT +#define F_GET_RW_HINT (F_LINUX_SPECIFIC_BASE + 11) +#endif + +#ifndef F_SET_RW_HINT +#define F_SET_RW_HINT (F_LINUX_SPECIFIC_BASE + 12) +#endif + +#ifndef F_GET_FILE_RW_HINT +#define F_GET_FILE_RW_HINT (F_LINUX_SPECIFIC_BASE + 13) +#endif + +#ifndef F_SET_FILE_RW_HINT +#define F_SET_FILE_RW_HINT (F_LINUX_SPECIFIC_BASE + 14) +#endif +static size_t fcntl__scnprintf_getfd (unsigned long val,char *bf,size_t size,bool show_prefix) { return val ? scnprintf(bf, size, "%s", "0") :
Greg Kroah-Hartman
maintainerPATCH 34/349 ACPI: CPPC: Suppress UBSAN warning caused by field misuse
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Linton <[email protected]>
commit 1b1acf2dada0cc3931bb2cb9ff8832edfbee46a1 upstream.
The definition of reg->access_width changes depending on the reg->space_id type. Type ACPI_ADR_SPACE_PLATFORM_COMM uses access_width to indicate the PCC region, which can result in a UBSAN if the value is greater than 4.
For example:
UBSAN: shift-out-of-bounds in drivers/acpi/cppc_acpi.c:1090:9 shift exponent 32 is too large for 32-bit type 'int' CPU: 61 UID: 0 PID: 1220 Comm: (udev-worker) Not tainted 7.0.10-201.fc44.aarch64 #1 PREEMPT(lazy) Hardware name: To be filled by O.E.M. Call trace: ...(trimming) ubsan_epilogue+0x10/0x48 __ubsan_handle_shift_out_of_bounds+0xdc/0x1e0 cpc_write+0x4d0/0x670 cppc_set_perf+0x18c/0x490 cppc_cpufreq_cpu_init+0x1c8/0x380 [cppc_cpufreq] ... (trimming)
Lets fix this by validating the region type, as well as whether access_width has a value. Then since we are returning bit_width directly for ACPI_ADR_SPACE_PLATFORM_COMM, drop the code correcting the size.
--- drivers/acpi/cppc_acpi.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/acpi/cppc_acpi.c +7 -4
@@ -172,8 +172,13 @@ show_cppc_data(cppc_get_perf_caps, cppc_show_cppc_data (cppc_get_perf_ctrs, cppc_perf_fb_ctrs, reference_perf);show_cppc_data (cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time); -/* Check for valid access_width, otherwise, fallback to using bit_width */ -#define GET_BIT_WIDTH (reg) ((reg)->access_width ? (8 << ((reg)->access_width - 1)) : (reg)->bit_width) +/* +* PCC reuses the access_width field as the subspace id, so only decode access +* size for non-PCC registers. Otherwise, use the bit_width. +*/ +#define GET_BIT_WIDTH (reg) (((reg)->access_width && \ + (reg)->space_id != ACPI_ADR_SPACE_PLATFORM_COMM) ? \ + (8 << ((reg)->access_width - 1)) : (reg)->bit_width)/* Shift and apply the mask for CPC reads/writes */ #define MASK_VAL_READ (reg, val) (((val) >> (reg)->bit_offset) & \
@@ -1031,7 +1036,6 @@ static int cpc_read(int cpu, struct cpc_* by the bit width field; the access size is used to indicate * the PCC subspace id. */ - size = reg->bit_width; vaddr =GET_PCC_VADDR (reg->address, pcc_ss_id); }else if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY )
@@ -1103,7 +1107,6 @@ static int cpc_write(int cpu, struct cpc* by the bit width field; the access size is used to indicate * the PCC subspace id. */ - size = reg->bit_width; vaddr =GET_PCC_VADDR (reg->address, pcc_ss_id); }else if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY )
Greg Kroah-Hartman
maintainerPATCH 35/349 ACPI: NFIT: core: Fix possible NULL pointer dereference
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit 027e128abb82788189d6d45b68e3e8e7329b67be upstream.
After commit 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before getting NFIT table"), acpi_nfit_probe() installs an ACPI notify handler for the NFIT device before checking the presence of the NFIT table. If that table is not there, 0 is returned without allocating the acpi_desc object and setting the driver data pointer of the NFIT device. If the platform firmware triggers an NFIT_NOTIFY_UC_MEMORY_ERROR notification on the NFIT device at that point, acpi_nfit_uc_error_notify() will dereference a NULL pointer.
Prevent that from occurring by adding an acpi_desc check against NULL to acpi_nfit_uc_error_notify().
--- drivers/acpi/nfit/core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/acpi/nfit/core.c +3 -0
@@ -3447,6 +3447,9 @@ static void acpi_nfit_uc_error_notify(st {struct acpi_nfit_desc *acpi_desc =dev_get_drvdata (dev); +if (!acpi_desc) +return ; +if (acpi_desc->scrub_mode ==HW_ERROR_SCRUB_ON )acpi_nfit_ars_rescan (acpi_desc,ARS_REQ_LONG );else
Greg Kroah-Hartman
maintainerPATCH 36/349 platform/x86: intel-hid: Protect ACPI notify handler against recursion
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <[email protected]>
commit c085d82613d5618814b84406c8b2d64f1bc305e7 upstream.
Since commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on all CPUs") ACPI notify handlers like the intel-hid notify_handler() may run on multiple CPU cores racing with themselves.
On convertibles and detachables (matched by DMI chassis-type 31 and 32 in dmi_auto_add_switch[]) the SW_TABLET_MODE input device is registered lazily from notify_handler() on the first tablet-mode event, via intel_hid_switches_setup(). When two such events race on different CPUs both can pass the !priv->switches check and register the priv->switches input device twice, resulting in a duplicate sysfs entry and a subsequent NULL pointer dereference.
This is the same class of bug fixed by commit e075c3b13a0a ("platform/x86:
intel-vbtn: Protect ACPI notify handler against recursion") for the sibling intel-vbtn driver.
Protect intel-hid notify_handler() from racing with itself with a mutex to fix this.
--- drivers/platform/x86/intel/hid.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/platform/x86/intel/hid.c +9 -0
@@ -7,11 +7,13 @@*/ #include <linux/acpi.h> +#include <linux/cleanup.h> #include <linux/dmi.h> #include <linux/input.h> #include <linux/input/sparse-keymap.h> #include <linux/kernel.h> #include <linux/module.h> +#include <linux/mutex.h> #include <linux/platform_device.h> #include <linux/string_choices.h> #include <linux/suspend.h>
@@ -215,6 +217,7 @@ static const struct dmi_system_id dmi_au };struct intel_hid_priv { +struct mutex mutex;/* Avoid notify_handler() racing with itself */ struct input_dev *input_dev;struct input_dev *array;struct input_dev *switches;
@@ -550,6 +553,8 @@ static void notify_handler(acpi_handle hstruct key_entry *ke;int err; +guard (mutex)(&priv->mutex); +/* * Some convertible have unreliable VGBS return which could cause incorrect * SW_TABLET_MODE report, in these cases we enable support when receiving
@@ -705,6 +710,10 @@ static int intel_hid_probe(struct platforeturn -ENOMEM ;dev_set_drvdata (&device->dev, priv); + err =devm_mutex_init (&device->dev, &priv->mutex); +if (err) +return err; +/* See dual_accel_detect.h for more info on the dual_accel check. */ if (enable_sw_tablet_mode ==TABLET_SW_AUTO ) {if (dmi_check_system (dmi_vgbs_allow_list))
Greg Kroah-Hartman
maintainerPATCH 37/349 LoongArch: Add PIO for early access before ACPI PCI root register
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 6061e65f95713b01f4313cda6637dfe3aa5412b4 upstream.
For ACPI system we suppose the ISA/LPC PIO range is registered together with PCI root bridge. But the fact is there may be some early access to the ISA/LPC PIO range before ACPI PCI root register (most of them are due to abnormal BIOS). Unconditionally register the ISA/LPC PIO range usually causes ACPI PCI root register fail because of the address range confliction. So we add a pair of helpers: acpi_add_early_pio() to add PIO for early access, and acpi_remove_early_pio() to remove PIO before PCI root register. Since acpi_remove_early_pio() may be called multiple times, we add an acpi_pio flag to ensure PIO be removed only once.
--- arch/loongarch/include/asm/acpi.h | 2 ++ arch/loongarch/kernel/acpi.c | 28 ++++++++++++++++++++++++++++ arch/loongarch/kernel/setup.c | 2 ++ arch/loongarch/pci/acpi.c | 2 ++ 4 files changed, 34 insertions(+)
arch/loongarch/include/asm/acpi.h +2 -0
@@ -38,6 +38,8 @@ static inline bool acpi_has_cpu_in_madt(extern struct list_head acpi_wakeup_device_list;extern struct acpi_madt_core_pic acpi_core_pic[MAX_CORE_PIC ]; +extern void acpi_add_early_pio (void ); +extern void acpi_remove_early_pio (void );extern int __init parse_acpi_topology (void );static inline u32 get_acpi_id_for_cpu (unsigned int cpu)
arch/loongarch/kernel/acpi.c +28 -0
@@ -15,6 +15,7 @@#include <linux/memblock.h> #include <linux/of_fdt.h> #include <linux/serial_core.h> +#include <linux/vmalloc.h> #include <asm/io.h> #include <asm/numa.h> #include <asm/loongson.h>
@@ -58,6 +59,33 @@ void __iomem *acpi_os_ioremap(acpi_physireturn ioremap_cache (phys, size); } +#define PIO_BASE (unsigned long)PCI_IOBASE +#define PIO_SIZE ALIGN(ISA_IOSIZE, PAGE_SIZE) + +static bool acpi_pio; + +/* Add PIO for early access */ +void acpi_add_early_pio (void ) +{ +if (!acpi_disabled) { + acpi_pio = true; +vmap_page_range (PIO_BASE ,PIO_BASE +PIO_SIZE , +LOONGSON_LIO_BASE ,pgprot_device (PAGE_KERNEL )); + } +} + +/* Remove PIO for PCI register */ +void acpi_remove_early_pio (void ) +{ +if (!acpi_pio) +return ; + +if (!acpi_disabled) { + acpi_pio = false; +vunmap_range (PIO_BASE ,PIO_BASE +PIO_SIZE ); + } +} +#ifdef CONFIG_SMP static int set_processor_mask (u32 id,u32 pass) {
arch/loongarch/kernel/setup.c +2 -0
@@ -510,6 +510,8 @@ static __init int arch_reserve_pio_range {struct device_node *np; +acpi_add_early_pio (); +for_each_node_by_name (np,"isa" ) {struct of_range range;struct of_range_parser parser;
arch/loongarch/pci/acpi.c +2 -0
@@ -65,6 +65,8 @@ static int acpi_prepare_root_resources(sstruct resource_entry *entry, *tmp;struct acpi_device *device = ci->bridge; +acpi_remove_early_pio (); + status =acpi_pci_probe_root_resources (ci);if (status >0 ) {acpi_evaluate_integer (device->handle,"PCIH" ,NULL , &pci_h);
Greg Kroah-Hartman
maintainerPATCH 38/349 rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
commit 191f49f1e38b1c10eb44b0f967c6175c884ef7db upstream.
Due to a rustc bug, the -Cforce-frame-pointers=y flag only emits the frame-pointer annotation for functions, but not for the module. This means that functions generated by the LLVM backend such as 'asan.module_ctor' do not receive the frame-pointer annotation.
This is likely to lead to broken backtraces and may also cause issues with ftrace if these features are used with functions generated by the LLVM backend.
Thus, use -Zllvm_module_flag to work around this rustc bug if using a rustc without the fix.
[ The fix [1] has landed for Rust 1.98.0 (expected release on
2026-08-20). - Miguel ]
[ - Adjusted Cc: stable@ as discussed.
- Added comment with link to the PR, similar to what we did in commit ac35b5580ace ("rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES").
- Miguel ]
--- Makefile | 3 +++ 1 file changed, 3 insertions(+)
Makefile +3 -0
@@ -851,6 +851,9 @@ KBUILD_RUSTFLAGS += $(KBUILD_RUSTFLAGS-y ifdef CONFIG_FRAME_POINTER KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls KBUILD_RUSTFLAGS += -Cforce-frame-pointers=y +# Work around rustc bug on compilers without +# https://github.com/rust-lang/rust/pull/156980. +KBUILD_RUSTFLAGS += $(if $(call rustc-min-version,109800),,-Zllvm_module_flag=frame-pointer:u32:2:max) else # Some targets (ARM with Thumb2, for example), can't be built with frame # pointers. For those, we don't have FUNCTION_TRACER automatically
Re: [PATCH 6.12 038/349] rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER
Quoted 10 lines · Greg Kroah-Hartman
[ - Adjusted Cc: stable@ as discussed.
Signed-off-by Greg Kroah-Hartman <[email protected]>- Added comment with link to the PR, similar to what we did in commit
ac35b5580ace("rust: arm64: set uwtable llvm module flag forCONFIG_UNWIND_TABLES").- Miguel ]
Signed-off-by Miguel Ojeda <[email protected]>
Ditto -- a script got confused by the brackets + dashes maybe?
Cheers,
Miguel
Greg Kroah-Hartman
maintainerPATCH 39/349 perf/core: Detach event groups during remove_on_exec
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taeyang Lee <[email protected]>
[ Upstream commit 037a3c43edfb597665dd34457cd22b14692f2ba3 ]
perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the context with DETACH_EXIT only.
This can leave inconsistent group state when a removed event is a group leader and the group contains siblings without remove_on_exec. If the group was active, the surviving siblings can remain active and attached to the removed leader's sibling list, but are no longer represented by a valid group leader on the PMU context active lists.
A later close of the removed leader uses DETACH_GROUP and can promote the still-active siblings from this stale group state. The next schedule-in can then add an already-linked active_list entry again, corrupting the PMU context active list.
With DEBUG_LIST enabled, this is caught as a list_add double-add in merge_sched_in().
Fix this by detaching group relationships when remove_on_exec removes an event. This preserves the existing task-exit and revoke behavior, while ensuring surviving siblings are ungrouped before the removed event leaves the context.
--- kernel/events/core.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
kernel/events/core.c +8 -6
@@ -4536,7 +4536,8 @@ static void perf_event_enable_on_exec(struct perf_event_context *ctx)static void perf_remove_from_owner (struct perf_event *event);static void perf_event_exit_event (struct perf_event *event, -struct perf_event_context *ctx); +struct perf_event_context *ctx, +unsigned long detach_flags);/* * Removes all events from the current task that have been marked
@@ -4563,7 +4564,7 @@ static void perf_event_remove_on_exec(struct perf_event_context *ctx) modified = true; -perf_event_exit_event (event, ctx); +perf_event_exit_event (event, ctx,DETACH_GROUP ); }raw_spin_lock_irqsave (&ctx->lock, flags);
@@ -13477,10 +13478,11 @@ static void sync_child_event(struct perf_event *child_event) }static void -perf_event_exit_event (struct perf_event *event,struct perf_event_context *ctx) +perf_event_exit_event (struct perf_event *event, +struct perf_event_context *ctx, +unsigned long detach_flags) {struct perf_event *parent_event = event->parent; -unsigned long detach_flags =0 ;if (parent_event) {/*
@@ -13495,7 +13497,7 @@ perf_event_exit_event(struct perf_event *event, struct perf_event_context *ctx)* Do destroy all inherited groups, we don't care about those * and being thorough is better. */ - detach_flags =DETACH_GROUP |DETACH_CHILD ; + detach_flags |=DETACH_GROUP |DETACH_CHILD ;mutex_lock (&parent_event->child_mutex); }
@@ -13574,7 +13576,7 @@ static void perf_event_exit_task_context(struct task_struct *child)perf_event_task (child, child_ctx,0 );list_for_each_entry_safe (child_event, next, &child_ctx->event_list, event_entry) -perf_event_exit_event (child_event, child_ctx); +perf_event_exit_event (child_event, child_ctx,0 );mutex_unlock (&child_ctx->mutex);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 40/349 rust: kasan: KASAN+RUST requires clang
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
[ Upstream commit 5b271543d0f08e9733d4732721e960e285f6448f ]
Kernel KASAN involves passing various llvm/gcc specific arguments to the C and Rust compiler. Since these arguments differ between llvm and gcc, it's not safe to mix an llvm-based rustc with a gcc build when kasan is enabled.
--- init/Kconfig | 1 + 1 file changed, 1 insertion(+)
init/Kconfig +1 -0
@@ -1974,6 +1974,7 @@ config RUST depends on !CFI_CLANG || HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC select CFI_ICALL_NORMALIZE_INTEGERS if CFI_CLANG depends on !CALL_PADDING || RUSTC_VERSION >= 108100 + depends on !KASAN || CC_IS_CLANG depends on !KASAN_SW_TAGS depends on !(MITIGATION_RETHUNK && KASAN) || RUSTC_VERSION >= 108300 help
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 41/349 drm/i915: ensure segment offset never exceeds allowed max
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Karas <[email protected]>
[ Upstream commit 2e0438f9c3d25eea8bc8e9b4dcff7edfb64cb9e7 ]
Commit 255fc1703e42 ("drm/i915/gem: Calculate object page offset for partial memory mapping") introduced a new offset, which accounts for userspace mapping not starting from the beginning of object's scatterlist.
This works fine for cases where first object pte is larger than the new offset - "r->sgt.curr" counter is set to the offset to match the difference in the number of total pages. However, if object's first pte's size is equal to or smaller than the offset, then information about the offset in userspace is covered up by moving "r->sgt" pointer in remap_sg():
r->sgt.curr += PAGE_SIZE; if (r->sgt.curr >= r->sgt.max) r->sgt = __sgt_iter(__sg_next(r->sgt.sgp), use_dma(r->iobase));
This means that two or more pages from virtual memory are counted for only one page in object's memory, because after moving "r->sgt" pointer "r->sgt.curr" will be 0.
We should account for this mismatch by moving "r->sgt" pointer to the next pte. For that we may use "r.sgt.max", which already holds the max allowed size. This change also eliminates possible confusion, when looking at i915_scatterlist.h and remap_io_sg() code: former has scatterlist pointer definition, which differentiates "s.max" value based on "dma" flag (sg_dma_len() is used only when the flag is enabled), while latter uses sg_dma_len() indiscriminately.
This patch aims to resolve issue:
https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12031
v3:
- instead of checking if r.sgt.curr would exceed allowed max, changed
the value in the while loop to be aligned with dma value
v4:
- remove unnecessary parent relation
v5:
- update commit message with explanation about page counting mismatch and link to the issue
--- drivers/gpu/drm/i915/i915_mm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/i915_mm.c +2 -2
@@ -143,8 +143,8 @@ int remap_io_sg(struct vm_area_struct *vma,/* We rely on prevalidation of the io-mapping to skip track_pfn(). */ GEM_BUG_ON ((vma->vm_flags &EXPECTED_FLAGS ) !=EXPECTED_FLAGS ); -while (offset >=sg_dma_len (r.sgt.sgp) >>PAGE_SHIFT ) { - offset -=sg_dma_len (r.sgt.sgp) >>PAGE_SHIFT ; +while (offset >= r.sgt.max >>PAGE_SHIFT ) { + offset -= r.sgt.max >>PAGE_SHIFT ; r.sgt =__sgt_iter (__sg_next (r.sgt.sgp),use_dma (iobase));if (!r.sgt.sgp)return -EINVAL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 42/349 usb: gadget: function: rndis: add length check to response query
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Griffin Kroah-Hartman <[email protected]>
commit 95f90eea070837f7c72207d5520f805bdefc3bc5 upstream.
Add variable representations for BufLength and BufOffset in rndis_query_response(), and perform a length check on them.
This is identical to how rndis_set_response() handles these parameters.
--- drivers/usb/gadget/function/rndis.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/usb/gadget/function/rndis.c +10 -4
@@ -591,6 +591,7 @@ static int rndis_init_response(struct rnstatic int rndis_query_response (struct rndis_params *params,rndis_query_msg_type *buf) { +u32 BufLength, BufOffset;rndis_query_cmplt_type *resp;rndis_resp_t *r;
@@ -598,6 +599,13 @@ static int rndis_query_response(struct rif (!params->dev)return -ENOTSUPP ; + BufLength =le32_to_cpu (buf->InformationBufferLength); + BufOffset =le32_to_cpu (buf->InformationBufferOffset); +if ((BufLength >RNDIS_MAX_TOTAL_SIZE ) || + (BufOffset >RNDIS_MAX_TOTAL_SIZE ) || + (BufOffset +8 >=RNDIS_MAX_TOTAL_SIZE )) +return -EINVAL ; +/* * we need more memory: * gen_ndis_query_resp expects enough space for
@@ -614,10 +622,8 @@ static int rndis_query_response(struct r resp->RequestID = buf->RequestID;/* Still LE in msg buffer */ if (gen_ndis_query_resp (params,le32_to_cpu (buf->OID), -le32_to_cpu (buf->InformationBufferOffset) - +8 + (u8 *)buf, -le32_to_cpu (buf->InformationBufferLength), - r)) { + BufOffset +8 + (u8 *)buf, + BufLength, r)) {/* OID not supported */ resp->Status =cpu_to_le32 (RNDIS_STATUS_NOT_SUPPORTED ); resp->MessageLength =cpu_to_le32 (sizeof *resp);
Greg Kroah-Hartman
maintainerPATCH 43/349 usb: gadget: function: rndis: add length check for header
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Griffin Kroah-Hartman <[email protected]>
commit 21b5bf155435008e0fb0736795289788e63d426f upstream.
Add a length check for the rndis header in rndis_rm_hdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed.
--- drivers/usb/gadget/function/rndis.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/gadget/function/rndis.c +6 -0
@@ -1080,6 +1080,12 @@ int rndis_rm_hdr(struct gether *port,/* tmp points to a struct rndis_packet_msg_type */ __le32 *tmp = (void *)skb->data; +/* Need at least MessageType, MessageLength, DataOffset, DataLength */ +if (skb->len <16 ) { +dev_kfree_skb_any (skb); +return -EINVAL ; + } +/* MessageType, MessageLength */ if (cpu_to_le32 (RNDIS_MSG_PACKET ) !=get_unaligned (tmp++)) {
Greg Kroah-Hartman
maintainerPATCH 44/349 iio: accel: bmc150: clamp the device-reported FIFO frame count
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
commit ce0e1cae26096fe959a0da5563a6d6d5a801d5fb upstream.
__bmc150_accel_fifo_flush() copies the number of samples the device reports in its hardware FIFO into an on-stack buffer
u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3];
which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The frame count is read from the FIFO_STATUS register and only masked to its 7 valid bits:
count = val & 0x7F;
so it can be 0..127. The only other limit applied to it is the optional caller-supplied sample budget:
if (samples && count > samples) count = samples;
which does not constrain count on the flush-all path (samples == 0), and leaves it well above 32 whenever samples is larger. count samples are then transferred into buffer[]:
bmc150_accel_fifo_transfer(data, (u8 *)buffer, count);
bmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a malfunctioning, malicious or counterfeit accelerometer (or an attacker tampering with the I2C/SPI bus) that reports up to 127 frames writes up to 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up to 570 bytes that clobbers the stack canary, saved registers and the return address.
Clamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[] is sized for, before the transfer, mirroring the watermark clamp already done in bmc150_accel_set_watermark(). A well-formed flush reports at most BMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected.
--- drivers/iio/accel/bmc150-accel-core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/iio/accel/bmc150-accel-core.c +2 -0
@@ -997,6 +997,8 @@ static int __bmc150_accel_fifo_flush(strif (samples && count > samples) count = samples; + count =min_t (u8, count,BMC150_ACCEL_FIFO_LENGTH ); + ret =bmc150_accel_fifo_transfer (data, (u8 *)buffer, count);if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 45/349 iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biren Pandya <[email protected]>
commit 44a5fd874bb6873bdaec59f722c1d57832fbc9df upstream.
kxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync() but returns -EINVAL directly when a scale with a non-zero integer part is requested, skipping the matching pm_runtime_put_autosuspend(). This leaks a runtime PM usage-counter reference on every such write, after which the device can no longer autosuspend.
Set the error code and fall through to the existing put instead of returning early.
--- drivers/iio/accel/kxsd9.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/iio/accel/kxsd9.c +3 -2
@@ -146,8 +146,9 @@ static int kxsd9_write_raw(struct iio_deif (mask ==IIO_CHAN_INFO_SCALE ) {/* Check no integer component */ if (val) -return -EINVAL ; - ret =kxsd9_write_scale (indio_dev, val2); + ret = -EINVAL ; +else + ret =kxsd9_write_scale (indio_dev, val2); }pm_runtime_mark_last_busy (st->dev);
Greg Kroah-Hartman
maintainerPATCH 46/349 iio: adc: lpc32xx: Initialize completion before requesting IRQ
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxwell Doose <[email protected]>
commit e561b35633f450ee607e87a6401d97f156a0cd54 upstream.
In the report from Jaeyoung Chung:
"lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its interrupt handler with devm_request_irq() before it initializes st->completion with init_completion(). If an interrupt arrives after devm_request_irq() and before init_completion(), the handler calls complete() on an uninitialized completion, causing a kernel panic.
The probe path, in lpc32xx_adc_probe():
iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */
...
retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0,
LPC32XXAD_NAME, st); /* register handler */
...
init_completion(&st->completion); /* initialize completion */lpc32xx_adc_isr() calls complete():
complete(&st->completion);
If the device raises an interrupt before init_completion() runs, complete() acquires the uninitialized wait.lock and walks the zeroed task_list in swake_up_locked(). The zeroed task_list makes list_empty() return false, so swake_up_locked() dereferences a NULL list entry, triggering a KASAN wild-memory-access."
Fix the chance of a spurious IRQ causing an uninitialized pointer dereference by moving init_completion() above devm_request_irq().
--- drivers/iio/adc/lpc32xx_adc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/adc/lpc32xx_adc.c +2 -2
@@ -179,6 +179,8 @@ static int lpc32xx_adc_probe(struct platif (irq <0 )return irq; +init_completion (&st->completion); + retval =devm_request_irq (&pdev->dev, irq, lpc32xx_adc_isr,0 ,LPC32XXAD_NAME , st);if (retval <0 ) {
@@ -197,8 +199,6 @@ static int lpc32xx_adc_probe(struct platplatform_set_drvdata (pdev, iodev); -init_completion (&st->completion); - iodev->name =LPC32XXAD_NAME ; iodev->info = &lpc32xx_adc_iio_info; iodev->modes =INDIO_DIRECT_MODE ;
Greg Kroah-Hartman
maintainerPATCH 47/349 iio: adc: spear: Initialize completion before requesting IRQ
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxwell Doose <[email protected]>
commit 3ee2128b6f0eb0be7b6cb8f6e0f1f113a65201a0 upstream.
In the report from Jaeyoung Chung:
"spear_adc_probe() in drivers/iio/adc/spear_adc.c registers its interrupt handler with devm_request_irq() before it initializes st->completion with init_completion(). If an interrupt arrives after devm_request_irq() and before init_completion(), the handler calls complete() on an uninitialized completion, causing a kernel panic.
The probe path, in spear_adc_probe():
iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */
...
retval = devm_request_irq(&pdev->dev, irq, spear_adc_isr, 0,
LPC32XXAD_NAME, st); /* register handler */
...
init_completion(&st->completion); /* initialize completion */spear_adc_isr() calls complete():
complete(&st->completion);
If the device raises an interrupt before init_completion() runs, complete() acquires the uninitialized wait.lock and walks the zeroed task_list in swake_up_locked(). The zeroed task_list makes list_empty() return false, so swake_up_locked() dereferences a NULL list entry, triggering a KASAN wild-memory-access."
Fix the chance of a spurious IRQ causing an uninitialized pointer dereference by moving init_completion() above devm_request_irq().
--- drivers/iio/adc/spear_adc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/iio/adc/spear_adc.c +1 -2
@@ -281,6 +281,7 @@ static int spear_adc_probe(struct platfo st =iio_priv (indio_dev); st->dev = dev; +init_completion (&st->completion);mutex_init (&st->lock);/*
@@ -327,8 +328,6 @@ static int spear_adc_probe(struct platfospear_adc_configure (st); -init_completion (&st->completion); - indio_dev->name =SPEAR_ADC_MOD_NAME ; indio_dev->info = &spear_adc_info; indio_dev->modes =INDIO_DIRECT_MODE ;
Greg Kroah-Hartman
maintainerPATCH 48/349 iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <[email protected]>
commit adf4bc07f814da8329278d32600147f5a150938c upstream.
ads1119_triggered_buffer_preenable() resumes the device with pm_runtime_resume_and_get() before starting a conversion.
If i2c_smbus_write_byte() fails, the function returns the error directly and leaves the runtime PM usage counter elevated. The matching postdisable callback is not called when preenable fails, so the reference is leaked and the device may remain runtime-active indefinitely.
Store the I2C transfer result in ret and drop the runtime PM reference on failure before returning the error.
--- drivers/iio/adc/ti-ads1119.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/iio/adc/ti-ads1119.c +5 -1
@@ -455,7 +455,11 @@ static int ads1119_triggered_buffer_preeif (ret)return ret; -return i2c_smbus_write_byte (st->client,ADS1119_CMD_START_SYNC ); + ret =i2c_smbus_write_byte (st->client,ADS1119_CMD_START_SYNC ); +if (ret) +pm_runtime_put_autosuspend (dev); + +return ret; }static int ads1119_triggered_buffer_postdisable (struct iio_dev *indio_dev)
Greg Kroah-Hartman
maintainerPATCH 49/349 iio: adc: ti-ads124s08: Return reset GPIO lookup errors
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
commit 7dc4de2aa6316f1d044cde21f5acfec5f3ec6b47 upstream.
devm_gpiod_get_optional() returns NULL when the optional GPIO is absent, but returns an ERR_PTR when the GPIO provider lookup fails, including probe deferral.
Probe currently logs the ERR_PTR case as if the reset GPIO were simply absent and keeps the error pointer in reset_gpio. Later ads124s_reset() treats any non-NULL reset_gpio as a valid descriptor and passes it to gpiod_set_value_cansleep().
Return the lookup error instead of retaining the ERR_PTR.
--- drivers/iio/adc/ti-ads124s08.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/iio/adc/ti-ads124s08.c +2 -1
@@ -321,7 +321,8 @@ static int ads124s_probe(struct spi_devi ads124s_priv->reset_gpio =devm_gpiod_get_optional (&spi->dev,"reset" ,GPIOD_OUT_LOW );if (IS_ERR (ads124s_priv->reset_gpio)) -dev_info (&spi->dev,"Reset GPIO not defined\n" ); +return dev_err_probe (&spi->dev,PTR_ERR (ads124s_priv->reset_gpio), +"Failed to get reset GPIO\n" ); ads124s_priv->chip_info = &ads124s_chip_info_tbl[spi_id->driver_data];
Greg Kroah-Hartman
maintainerPATCH 50/349 iio: backend: fix uninitialized data in debugfs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit a6e8b14a4897d0b6df9744f33d0a30e6b92368eb upstream.
If the *ppos value is non-zero then simple_write_to_buffer() will not initialize the start of the buf[] buffer. Non-zero ppos values aren't going to work at all. Check for that at the start of the function and return -ENOSPC.
--- drivers/iio/industrialio-backend.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/industrialio-backend.c +1 -1
@@ -155,7 +155,7 @@ static ssize_t iio_backend_debugfs_writessize_t rc;int ret; -if (count >=sizeof (buf)) +if (*ppos !=0 || count >=sizeof (buf))return -ENOSPC ; rc =simple_write_to_buffer (buf,sizeof (buf) -1 , ppos, userbuf, count);
Greg Kroah-Hartman
maintainerPATCH 51/349 iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxwell Doose <[email protected]>
commit 60d877910a43c305b5165131b258a17b1d772d57 upstream.
Include linux/bitfield.h for FIELD_GET().
Create new macros for bit manipulation in combination with manual bit manipulation being replaced with FIELD_GET().
The current variable declaration and initializations are barely readable and use comma separations across multiple lines. Refactor the initializations so that mantissa and exp have separate declarations and sign gets initialized later.
In addition (and due to the nature of the cleanup), fix a sign-extension bug where, float32 would get bitwise anded with ~BIT(31) (which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent.
--- drivers/iio/chemical/scd30_core.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
drivers/iio/chemical/scd30_core.c +15 -4
@@ -4,6 +4,8 @@* * Copyright (c) 2020 Tomasz Duszynski <[email protected]> */ + +#include <linux/bitfield.h> #include <linux/bits.h> #include <linux/cleanup.h> #include <linux/completion.h>
@@ -43,6 +45,11 @@#define SCD30_TEMP_OFFSET_MAX 655360#define SCD30_EXTRA_TIMEOUT_PER_S 250 +/* Floating point arithmetic macros */ +#define SCD30_FLOAT_MANTISSA_MSK GENMASK(22, 0) +#define SCD30_FLOAT_EXP_MSK GENMASK(30, 23) +#define SCD30_FLOAT_SIGN_MSK BIT(31) +enum {SCD30_CONC ,SCD30_TEMP ,
@@ -89,10 +96,14 @@ static int scd30_reset(struct scd30_stat/* simplified float to fixed point conversion with a scaling factor of 0.01 */ static int scd30_float_to_fp (int float32) { -int fraction, shift, - mantissa = float32 &GENMASK (22 ,0 ), - sign = (float32 &BIT (31 )) ?-1 :1 , - exp = (float32 & ~BIT (31 )) >>23 ; +int fraction, shift, sign; +int mantissa =FIELD_GET (SCD30_FLOAT_MANTISSA_MSK , float32); +int exp =FIELD_GET (SCD30_FLOAT_EXP_MSK , float32); + +if (float32 &SCD30_FLOAT_SIGN_MSK ) + sign =-1 ; +else + sign =1 ;/* special case 0 */ if (!exp && !mantissa)
Greg Kroah-Hartman
maintainerPATCH 52/349 iio: common: st_sensors: honour channel endianness in read_axis_data
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herman van Hazendonk <[email protected]>
commit 55052184ac9011db2ea983e54d6c21f0b1079a12 upstream.
st_sensors_read_axis_data() unconditionally decoded multi-byte results with get_unaligned_le16() / get_unaligned_le24() regardless of the channel's declared scan_type.endianness.
For every ST sensor that has used this helper since it was introduced this happened to be fine because the ST IMU/accel/gyro/pressure families publish their data registers as little-endian and the channel specs in those drivers declare IIO_LE accordingly.
The LSM303DLH magnetometer however publishes its X/Y/Z output as a pair of big-endian bytes (the H register sits at the lower address, 0x03/0x05/0x07, and the L register immediately after), and its channel specs in st_magn_core.c correctly declare IIO_BE -- but read_axis_data() ignored that and decoded as little-endian, swapping the high and low bytes of every magnetometer sample. The LSM303DLHC and LSM303DLM share the same st_magn_16bit_channels (IIO_BE) and were therefore byte-swapped by the same bug; users of those parts will see different in_magn_*_raw values after this fix lands.
The bug is most visible on a stationary chip: in earth's field the true X reading is small and the high byte sits at 0x00, so swapping the bytes pins sysfs X at exactly the low byte's pattern (e.g. 0x00F0 = 240). Y and Z still appear "to vary" because their magnitudes are larger and the noise in the low byte produces big swings in the swapped high byte:
before (LSM303DLH flat, sysfs in_magn_*_raw):
X=240 (stuck), Y= 12032..23296, Z=-16128..-9728
after (direct i2c-dev big-endian decode, same chip same orientation):
X≈-4096, Y≈210, Z≈80 (sensible values reflecting earth's
ambient field at low gauss range)
Fix read_axis_data() to dispatch on ch->scan_type.endianness and call get_unaligned_be16() / get_unaligned_be24() when the channel declares IIO_BE. Existing IIO_LE consumers (st_accel, st_gyro, st_pressure, st_lsm6dsx and others) are unaffected because their channel specs already declare IIO_LE and the LE path is unchanged.
While restructuring the branches, replace the previously implicit silent-success-with-uninitialised-*data fall-through for byte_for_channel outside 1..3 with an explicit return -EINVAL. No in-tree ST sensor publishes such a channel, but the new behaviour is strictly safer than handing userspace garbage.
--- drivers/iio/common/st_sensors/st_sensors_core.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-)
drivers/iio/common/st_sensors/st_sensors_core.c +17 -6
@@ -498,6 +498,7 @@ static int st_sensors_read_axis_data(stru8 *outdata;struct st_sensor_data *sdata =iio_priv (indio_dev);unsigned int byte_for_channel; +u32 tmp; byte_for_channel =DIV_ROUND_UP (ch->scan_type.realbits + ch->scan_type.shift,8 );
@@ -510,12 +511,22 @@ static int st_sensors_read_axis_data(strif (err <0 ) goto st_sensors_free_memory; -if (byte_for_channel ==1 ) - *data = (s8)*outdata; -else if (byte_for_channel ==2 ) - *data = (s16 )get_unaligned_le16 (outdata); -else if (byte_for_channel ==3 ) - *data = (s32 )sign_extend32 (get_unaligned_le24 (outdata),23 ); +if (byte_for_channel ==1 ) { + tmp = *outdata; + }else if (byte_for_channel ==2 ) { +if (ch->scan_type.endianness ==IIO_BE ) + tmp =get_unaligned_be16 (outdata); +else + tmp =get_unaligned_le16 (outdata); + }else if (byte_for_channel ==3 ) { +if (ch->scan_type.endianness ==IIO_BE ) + tmp =get_unaligned_be24 (outdata); +else + tmp =get_unaligned_le24 (outdata); + }else { +return -EINVAL ; + } + *data =sign_extend32 (tmp,BYTES_TO_BITS (byte_for_channel) -1 ); st_sensors_free_memory:kfree (outdata);
Greg Kroah-Hartman
maintainerPATCH 53/349 iio: event: Fix event FIFO reset race
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <[email protected]>
commit af791d295737ea6b6ff2c8d8488462a49c14af01 upstream.
iio_event_getfd() creates the event file descriptor with anon_inode_getfd(), which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the caller.
The IIO code resets the event FIFO after anon_inode_getfd() has returned, but before IIO_GET_EVENT_FD_IOCTL has copied the fd number to userspace. But since fd tables are shared between threads, another thread can guess the newly allocated fd number and issue a read() on it as soon as the fd has been installed.
This means the kfifo_to_user() in iio_event_chrdev_read() can run in parallel with the kfifo_reset_out() in iio_event_getfd().
The kfifo documentation says that kfifo_reset_out() is only safe when it is called from the reader thread and there is only one concurrent reader. Otherwise it is dangerous and must be handled in the same way as kfifo_reset().
If that happens, kfifo_to_user() can advance the FIFO out index based on state from before the reset, after the reset has already moved the out index to the current in index. That can leave the FIFO with an out index past the in index. A later read() can then see an underflowed FIFO length and copy more data than the event FIFO buffer contains. This can result in an out-of-bounds read and leak adjacent kernel memory to userspace.
Move the FIFO reset before anon_inode_getfd(). At that point the event fd is marked busy, but the new fd has not been installed yet, so userspace cannot access it while the FIFO is reset.
--- drivers/iio/industrialio-event.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/iio/industrialio-event.c +2 -3
@@ -207,6 +207,8 @@ static int iio_event_getfd(struct iio_de goto unlock; } +kfifo_reset_out (&ev_int->det_events); +iio_device_get (indio_dev); fd = anon_inode_getfd("iio:event", &iio_event_chrdev_fileops,
@@ -214,10 +216,7 @@ static int iio_event_getfd(struct iio_deif (fd <0 ) {clear_bit (IIO_BUSY_BIT_POS , &ev_int->flags);iio_device_put (indio_dev); - }else { -kfifo_reset_out (&ev_int->det_events); } - unlock:mutex_unlock (&iio_dev_opaque->mlock);return fd;
Greg Kroah-Hartman
maintainerPATCH 54/349 iio: gyro: bmg160: bail out when bandwidth/filter is not in table
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <[email protected]>
commit 8320c77e67382d5d55d77043a5f60a867d408a2b upstream.
bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry matching the bw_bits value read from the chip:
for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) {
if (bmg160_samp_freq_table[i].bw_bits == bw_bits)
break;
}
*val = bmg160_samp_freq_table[i].filter;If no entry matches, i ends up equal to the array size and the next line reads one slot past the end. bmg160_set_filter() has the same shape, driven by 'val' instead of bw_bits.
smatch flags both:
drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error:
buffer overflow 'bmg160_samp_freq_table' 7 <= 7 drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error:
buffer overflow 'bmg160_samp_freq_table' 7 <= 7
Return -EINVAL when no entry matches.
The set_filter() path is reachable from userspace via the sysfs in_anglvel_filter_low_pass_3db_frequency interface, so userspace can trivially trigger the out-of-bounds read with a value that is not in bmg160_samp_freq_table[].filter.
--- drivers/iio/gyro/bmg160_core.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/iio/gyro/bmg160_core.c +6 -0
@@ -204,6 +204,9 @@ static int bmg160_get_filter(struct bmg1break ; } +if (i ==ARRAY_SIZE (bmg160_samp_freq_table)) +return -EINVAL ; + *val = bmg160_samp_freq_table[i].filter;return ret ? ret :IIO_VAL_INT ;
@@ -221,6 +224,9 @@ static int bmg160_set_filter(struct bmg1break ; } +if (i ==ARRAY_SIZE (bmg160_samp_freq_table)) +return -EINVAL ; + ret =regmap_write (data->regmap,BMG160_REG_PMU_BW , bmg160_samp_freq_table[i].bw_bits);if (ret <0 ) {
Greg Kroah-Hartman
maintainerPATCH 55/349 iio: gyro: bmg160: wait full startup time after mode change at probe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <[email protected]>
commit 088fcb9b567f8723074ad9eb1bf5cb46f8a0096b upstream.
bmg160_chip_init() calls bmg160_set_mode(BMG160_MODE_NORMAL) and then waits only 500-1000 us. Per the BMG160 datasheet (BST-BMG160-DS000-07 Rev. 1.0, May 2013), the start-up and wake-up times (tsu, twusm) are 30 ms.
The same file already waits BMG160_MAX_STARTUP_TIME_MS (80 ms) in bmg160_runtime_resume() after the same set_mode(NORMAL) operation. The 500 us value at probe was likely a unit mix-up; the old comment said "500 ms" while the code used microseconds.
Reuse the same constant via msleep() and add a code comment explaining the datasheet basis for the wait. Without this, register writes that follow the mode change can hit the chip before it is ready.
--- drivers/iio/gyro/bmg160_core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/iio/gyro/bmg160_core.c +8 -2
@@ -267,8 +267,14 @@ static int bmg160_chip_init(struct bmg16if (ret <0 )return ret; -/* Wait upto 500 ms to be ready after changing mode */ -usleep_range (500 ,1000 ); +/* +* Wait for the chip to be ready after switching to normal mode. +* The BMG160 datasheet (BST-BMG160-DS000-07 Rev. 1.0, May 2013) +* specifies a start-up / wake-up time (tsu, twusm) of 30 ms; use +* BMG160_MAX_STARTUP_TIME_MS (80 ms) as a safety margin, matching +* what bmg160_runtime_resume() already does. +*/ +msleep (BMG160_MAX_STARTUP_TIME_MS );/* Set Bandwidth */ ret =bmg160_set_bw (data,BMG160_DEF_BW );
Greg Kroah-Hartman
maintainerPATCH 56/349 iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <[email protected]>
commit 6e1b9bff1202da55c464e36bd34a2b6863d7fe30 upstream.
devm_adis_probe_trigger() registers iio_trigger_generic_data_rdy_poll() through devm_request_irq() on the non-FIFO path, but it does not add IRQF_NO_THREAD to the IRQ flags.
When the kernel is booted with forced IRQ threading, the parent IRQ can otherwise be threaded by the IRQ core and the subsequent IIO trigger child IRQ is then dispatched from irq/... thread context instead of hardirq context. Because iio_trigger_generic_data_rdy_poll() immediately drives iio_trigger_poll(), this violates the hardirq-only IIO trigger helper contract and can push downstream trigger consumers through the wrong execution context.
Add IRQF_NO_THREAD on top of the existing adis->irq_flag value for the non-FIFO request_irq() path, while preserving the current trigger polarity and IRQF_NO_AUTOEN behavior.
--- drivers/iio/imu/adis_trigger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/imu/adis_trigger.c +1 -1
@@ -94,7 +94,7 @@ int devm_adis_probe_trigger(struct adiselse ret =devm_request_irq (&adis->spi->dev, adis->spi->irq, &iio_trigger_generic_data_rdy_poll, - adis->irq_flag, + adis->irq_flag |IRQF_NO_THREAD , indio_dev->name, adis->trig);if (ret)
Greg Kroah-Hartman
maintainerPATCH 57/349 iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <[email protected]>
commit cd5a6a5096b246e10600da3ac47a1274ce9573c8 upstream.
bmi160_probe_trigger() registers iio_trigger_generic_data_rdy_poll() through devm_request_irq(), but it passes only irq_type and does not add IRQF_NO_THREAD.
When the kernel is booted with forced IRQ threading, the parent IRQ can otherwise be threaded by the IRQ core and the subsequent IIO trigger child IRQ is dispatched from irq/... thread context instead of hardirq context. Because the handler immediately pushes the event into iio_trigger_poll(), this violates the hardirq-only IIO trigger helper contract and can drive downstream trigger consumers through the wrong execution context.
Add IRQF_NO_THREAD on top of irq_type when registering the BMI160 data- ready trigger handler.
--- drivers/iio/imu/bmi160/bmi160_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/iio/imu/bmi160/bmi160_core.c +2 -1
@@ -797,7 +797,8 @@ int bmi160_probe_trigger(struct iio_dev ret =devm_request_irq (&indio_dev->dev, irq, &iio_trigger_generic_data_rdy_poll, - irq_type,"bmi160" , data->trig); + irq_type |IRQF_NO_THREAD , +"bmi160" , data->trig);if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 58/349 iio: imu: inv_icm42600: fix timestamp clock period by using lower value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <[email protected]>
commit 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 upstream.
Clock period value is used for computing periods of sampling. There is no need for it to be higher than the maximum odr, otherwise we are losing precision in the computation for nothing.
Switch clock period value to maximum odr period (8kHz).
--- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 ++-- drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c +2 -2
@@ -868,10 +868,10 @@ struct iio_dev *inv_icm42600_accel_init( accel_st->filter =INV_ICM42600_FILTER_AVG_16X ;/* -* clock period is 32kHz (31250ns) +* clock period is 8kHz (125000ns) * jitter is +/- 2% (20 per mille) */ - ts_chip.clock_period =31250 ; + ts_chip.clock_period =125000 ; ts_chip.jitter =20 ; ts_chip.init_period =inv_icm42600_odr_to_period (st->conf.accel.odr);inv_sensors_timestamp_init (&accel_st->ts, &ts_chip);
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c +2 -2
@@ -771,10 +771,10 @@ struct iio_dev *inv_icm42600_gyro_init(s }/* -* clock period is 32kHz (31250ns) +* clock period is 8kHz (125000ns) * jitter is +/- 2% (20 per mille) */ - ts_chip.clock_period =31250 ; + ts_chip.clock_period =125000 ; ts_chip.jitter =20 ; ts_chip.init_period =inv_icm42600_odr_to_period (st->conf.accel.odr);inv_sensors_timestamp_init (&gyro_st->ts, &ts_chip);
Greg Kroah-Hartman
maintainerPATCH 59/349 iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <[email protected]>
commit affe3f077d7a4eeb25937f5323ff059a54b4712c upstream.
Timestamps are made by measuring the chip clock using the watermark interrupts. If we read more than watermark samples as done today, we are reducing the period between interrupts and distort the time measurement. Fix that by reading only watermark samples in the interrupt case.
--- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 9 +++++---- drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 1 + 2 files changed, 6 insertions(+), 4 deletions(-)
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c +5 -4
@@ -257,6 +257,7 @@ int inv_icm42600_buffer_update_watermark/* compute watermark value in bytes */ wm_size = watermark * packet_size; + st->fifo.watermark.value = watermark;/* changing FIFO watermark requires to turn off watermark interrupt */ ret = regmap_update_bits_check(st->map, INV_ICM42600_REG_INT_SOURCE0,
@@ -473,11 +474,10 @@ int inv_icm42600_buffer_fifo_read(struct st->fifo.nb.accel =0 ; st->fifo.nb.total =0 ; -/* compute maximum FIFO read size */ +/* compute maximum FIFO read size (watermark for max = 0 interrupt case) */ if (max ==0 ) - max_count =sizeof (st->fifo.data); -else - max_count = max *inv_icm42600_get_packet_size (st->fifo.en); + max = st->fifo.watermark.value; + max_count = max *inv_icm42600_get_packet_size (st->fifo.en);/* read FIFO count value */ raw_fifo_count = (__be16 *)st->buffer;
@@ -593,6 +593,7 @@ int inv_icm42600_buffer_init(struct inv_ st->fifo.watermark.eff_gyro =1 ; st->fifo.watermark.eff_accel =1 ; + st->fifo.watermark.value =1 ;/* * Default FIFO configuration (bits 7 to 5)
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h +1 -0
@@ -34,6 +34,7 @@ struct inv_icm42600_fifo {unsigned int accel;unsigned int eff_gyro;unsigned int eff_accel; +unsigned int value; } watermark;size_t count;struct {
Greg Kroah-Hartman
maintainerPATCH 60/349 iio: imu: st_lsm6dsx: deselect shub page before reading whoami
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Kempe <[email protected]>
commit aede83625ff5d9539508582036df30c809d51058 upstream.
As part of driver initialization, e.g. st_lsm6dsx_init_shub() selects the shub register page using st_lsm6dsx_set_page(). Selecting the shub register page shadows the regular register space so whoami, among other registers, is no longer accessible.
In applications where the IMU is permanently powered separately from the processor, there is a window where a reset of the CPU leaves the IMU in the shub register page. Once this occurs, any subsequent probe attempt fails because of the register shadowing.
Using the ism330dlc, the error typically looks like
st_lsm6dsx_i2c 3-006a: unsupported whoami [10]
with the unknown whoami read from a reserved register in the shub page.
The reset register is also shadowed by the page select, preventing a reset from recovering the chip.
Unconditionally clear the shub page before the whoami readout to ensure normal register access and allow the initialization to proceed.
Place the fix in st_lsm6dsx_check_whoami() before the whoami check because hw->settings, which st_lsm6dsx_set_page() relies on, is first assigned in that function.
Placing the fix in a more logical place than the whoami check would require a bigger restructuring of the code.
--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-)
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +20 -1
@@ -1597,6 +1597,26 @@ static int st_lsm6dsx_check_whoami(strucreturn -ENODEV ; } + hw->settings = &st_lsm6dsx_sensor_settings[i]; + +if (hw->settings->shub_settings.page_mux.addr) { +/* +* If the IMU has the shub page selected on init, for example +* after a CPU watchdog reset while the page is selected, the +* regular register space is shadowed. While the regular +* register space is shadowed, the registers needed for +* initializing the IMU are not available. +* +* Unconditionally clear the shub page selection to ensure +* normal register access. +*/ + err =st_lsm6dsx_set_page (hw, false); +if (err <0 ) { +dev_err (hw->dev,"failed to clear shub page\n" ); +return err; + } + } + err =regmap_read (hw->regmap,ST_LSM6DSX_REG_WHOAMI_ADDR , &data);if (err <0 ) {dev_err (hw->dev,"failed to read whoami register\n" );
@@ -1609,7 +1629,6 @@ static int st_lsm6dsx_check_whoami(struc } *name = st_lsm6dsx_sensor_settings[i].id[j].name; - hw->settings = &st_lsm6dsx_sensor_settings[i];return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 61/349 iio: light: al3010: fix incorrect scale for the highest gain range
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidhu Sarwal <[email protected]>
commit aa411adc6ce40ad1a55ebc965f255a4cfc0005f8 upstream.
al3010_scales[] encodes the highest gain range as {0, 1187200}. For IIO_VAL_INT_PLUS_MICRO, the fractional part must be less than 1000000, so the scale 1.1872 should instead be represented as { 1, 187200 }.
Since write_raw() compares the value from userspace against this table, writing the advertised 1.1872 scale never matches the malformed entry and returns -EINVAL. As a result, the highest gain range cannot be selected. Reading the scale in that state also reports the malformed value.
--- drivers/iio/light/al3010.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/light/al3010.c +1 -1
@@ -43,7 +43,7 @@ enum al3xxxx_range { };static const int al3010_scales[][2 ] = { - {0 ,1187200 }, {0 ,296800 }, {0 ,74200 }, {0 ,18600 } + {1 ,187200 }, {0 ,296800 }, {0 ,74200 }, {0 ,18600 }, };struct al3010_data {
Greg Kroah-Hartman
maintainerPATCH 62/349 iio: light: gp2ap002: fix runtime PM leak on read error
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biren Pandya <[email protected]>
commit 38b72267b7e22768a1f26d9935de4e1752a1dc85 upstream.
gp2ap002_read_raw() calls pm_runtime_get_sync() before reading the lux value, but if gp2ap002_get_lux() fails, it returns directly. This skips the pm_runtime_put_autosuspend() call at the "out" label, permanently leaking a runtime PM reference and preventing the device from autosuspending.
Replace the direct return with a "goto out" to ensure the reference is properly dropped on the error path.
--- drivers/iio/light/gp2ap002.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/light/gp2ap002.c +1 -1
@@ -258,7 +258,7 @@ static int gp2ap002_read_raw(struct iio_case IIO_LIGHT : ret =gp2ap002_get_lux (gp2ap002);if (ret <0 ) -return ret; + goto out; *val = ret; ret =IIO_VAL_INT ; goto out;
Greg Kroah-Hartman
maintainerPATCH 63/349 iio: light: opt3001: fix missing state reset on timeout
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Crofts <[email protected]>
commit c123ca6ee26ad98f70a866ff428b08145c5a24fe upstream.
Currently in the function opt3001_get_processed(), there is a check that directly returns -ETIMEDOUT if the conversion IRQ times out, completely bypassing the err label, leaving ok_to_ignore_lock permanently true, potentially breaking the device's falling threshold interrupt detection.
Assign -ETIMEDOUT to the return variable and jump to the error label to ensure ok_to_ignore_lock is properly reset.
--- drivers/iio/light/opt3001.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/iio/light/opt3001.c +4 -2
@@ -280,8 +280,10 @@ static int opt3001_get_lux(struct opt300 ret =wait_event_timeout (opt->result_ready_queue, opt->result_ready,msecs_to_jiffies (OPT3001_RESULT_READY_LONG )); -if (ret ==0 ) -return -ETIMEDOUT ; +if (ret ==0 ) { + ret = -ETIMEDOUT ; + goto err; + } }else {/* Sleep for result ready time */ timeout = (opt->int_time == OPT3001_INT_TIME_SHORT) ?
Greg Kroah-Hartman
maintainerPATCH 64/349 iio: light: tsl2591: return actual error from probe IRQ failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <[email protected]>
commit a00ffd15674bfaf8b906503c1600e3d8709af56c upstream.
When devm_request_threaded_irq() fails, probe logs the error and then returns -EINVAL, dropping the real error code and breaking the deferred-probe flow for -EPROBE_DEFER.
Return ret directly; the IRQ subsystem already prints on failure.
--- drivers/iio/light/tsl2591.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/iio/light/tsl2591.c +2 -4
@@ -1139,10 +1139,8 @@ static int tsl2591_probe(struct i2c_clieNULL , tsl2591_event_handler,IRQF_TRIGGER_FALLING |IRQF_ONESHOT , "tsl2591_irq", indio_dev); -if (ret) { -dev_err_probe (&client->dev, ret,"IRQ request error\n" ); -return -EINVAL ; - } +if (ret) +return ret; indio_dev->info = &tsl2591_info; }else { indio_dev->info = &tsl2591_info_no_irq;
Greg Kroah-Hartman
maintainerPATCH 65/349 iio: light: veml6030: fix channel type when pushing events
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit c52bb33b641ebaae3e209f97714cb1758206f7d9 upstream.
The events are registered for IIO_LIGHT and not for IIO_INTENSITY. Use the correct channel type.
When at it, fix minor checkpatch code style warning (alignment).
--- drivers/iio/light/veml6030.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/iio/light/veml6030.c +5 -3
@@ -710,9 +710,11 @@ static irqreturn_t veml6030_event_handleelse evtdir =IIO_EV_DIR_FALLING ; -iio_push_event (indio_dev,IIO_UNMOD_EVENT_CODE (IIO_INTENSITY , -0 ,IIO_EV_TYPE_THRESH , evtdir), -iio_get_time_ns (indio_dev)); +iio_push_event (indio_dev,IIO_UNMOD_EVENT_CODE (IIO_LIGHT , +0 , +IIO_EV_TYPE_THRESH , + evtdir), +iio_get_time_ns (indio_dev));return IRQ_HANDLED ; }
Greg Kroah-Hartman
maintainerPATCH 66/349 iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit e94944d7364d3ddb273539492f9bd9c9a622549a upstream.
On the failure in the ak8975_read_axis() the PM runtime gets unbalanced. Balance it by calling pm_runtime_put_autosuspend() on error path as well.
--- drivers/iio/magnetometer/ak8975.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/magnetometer/ak8975.c +1 -0
@@ -785,6 +785,7 @@ static int ak8975_read_axis(struct iio_d exit:mutex_unlock (&data->lock); +pm_runtime_put_autosuspend (&data->client->dev);dev_err (&client->dev,"Error in reading axis\n" );return ret; }
Greg Kroah-Hartman
maintainerPATCH 67/349 iio: resolver: ad2s1210: notify trigger and clear state on fault read error
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <[email protected]>
commit 70247658d0e783c93b48fcbc3b81d99e992ff478 upstream.
ad2s1210_trigger_handler() walks several scan-mask branches and uses "goto error_ret" to land on the iio_trigger_notify_done() teardown at the bottom of the function for every I/O error -- except the MOD_CONFIG fault-register read, which uses a bare "return ret":
if (st->fixed_mode == MOD_CONFIG) {
unsigned int reg_val;
ret = regmap_read(st->regmap, AD2S1210_REG_FAULT, ®_val);
if (ret < 0)
return ret;
...
}Two problems on that path:
- the handler returns a negative errno where the prototype expects an irqreturn_t (IRQ_HANDLED / IRQ_NONE), so the caller in the IIO core sees a value outside the enum;
- iio_trigger_notify_done() is skipped, leaving the trigger busy-flag set. A single transient SPI/regmap error on the fault read then wedges the trigger so subsequent samples are dropped until the consumer is detached.
Convert the error path to "goto error_ret" so the failure path goes through the same notify_done() teardown as every other error in the handler.
--- drivers/iio/resolver/ad2s1210.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/resolver/ad2s1210.c +1 -1
@@ -1334,7 +1334,7 @@ static irqreturn_t ad2s1210_trigger_hand ret =regmap_read (st->regmap,AD2S1210_REG_FAULT , ®_val);if (ret <0 ) -return ret; + goto error_ret; st->sample.fault = reg_val; }
Greg Kroah-Hartman
maintainerPATCH 68/349 iio: temperature: Build mlx90635 with CONFIG_MLX90635
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
commit 63a76e3a587c4143e8e24e8a6b0c232fa0676034 upstream.
drivers/iio/temperature/Kconfig has a dedicated MLX90635 option, but the Makefile currently builds mlx90635.o under CONFIG_MLX90632.
This means enabling CONFIG_MLX90635 alone does not carry its provider object into the build, while enabling CONFIG_MLX90632 unexpectedly also builds mlx90635.o.
Gate mlx90635.o on the matching generated Kconfig symbol.
--- drivers/iio/temperature/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/temperature/Makefile +1 -1
@@ -13,7 +13,7 @@ obj-$(CONFIG_MAX31865) += max31865.o obj-$(CONFIG_MCP9600) += mcp9600.o obj-$(CONFIG_MLX90614) += mlx90614.o obj-$(CONFIG_MLX90632) += mlx90632.o -obj-$(CONFIG_MLX90632) += mlx90635.o +obj-$(CONFIG_MLX90635) += mlx90635.o obj-$(CONFIG_TMP006) += tmp006.o obj-$(CONFIG_TMP007) += tmp007.o obj-$(CONFIG_TMP117) += tmp117.o
Greg Kroah-Hartman
maintainerPATCH 69/349 iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liviu Stan <[email protected]>
commit 434c150752675f44dc52c384a7fa22e5176bc35a upstream.
When adi,number-of-wires is absent, n_wires is left at 0. The binding documents a default of 2 wires, matching the hardware default. However the current-rotate validation checks n_wires == 2 || n_wires == 3, so with n_wires = 0 the guard is bypassed and adi,current-rotate is accepted for a 2-wire RTD.
Initialize n_wires = 2 to match the binding default and ensure the rotation check fires correctly when the property is absent.
--- drivers/iio/temperature/ltc2983.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/temperature/ltc2983.c +1 -1
@@ -741,7 +741,7 @@ ltc2983_rtd_new(const struct fwnode_handstruct ltc2983_rtd *rtd;int ret =0 ;struct device *dev = &st->spi->dev; -u32 excitation_current =0 , n_wires =0 ; +u32 excitation_current =0 , n_wires =2 ; rtd =devm_kzalloc (dev,sizeof (*rtd),GFP_KERNEL );if (!rtd)
Greg Kroah-Hartman
maintainerPATCH 70/349 iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liviu Stan <[email protected]>
commit 5cb9fdb446bfc3ae0524496f53fb68e67051701b upstream.
reinit_completion() was called after regmap_write() initiated the hardware conversion, creating a race window where the interrupt could fire and call complete() before reinit_completion() reset the completion.
Move reinit_completion() before the regmap_write() to close the race. ltc2983_eeprom_cmd() already does it in the correct order.
--- drivers/iio/temperature/ltc2983.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/iio/temperature/ltc2983.c +1 -2
@@ -1177,12 +1177,11 @@ static int ltc2983_chan_read(struct ltc2 start_conversion |=LTC2983_STATUS_CHAN_SEL (sensor->chan);dev_dbg (&st->spi->dev,"Start conversion on chan:%d, status:%02X\n" , sensor->chan, start_conversion); +reinit_completion (&st->completion);/* start conversion */ ret =regmap_write (st->regmap,LTC2983_STATUS_REG , start_conversion);if (ret)return ret; - -reinit_completion (&st->completion);/* * wait for conversion to complete. * 300 ms should be more than enough to complete the conversion.
Greg Kroah-Hartman
maintainerPATCH 71/349 ALSA: virtio: Add missing 384 kHz PCM rate mapping
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
commit 83fbbcb7935ec6d2c8ba3bc133e8a0ead2ab0b2d upstream.
The VirtIO sound UAPI defines VIRTIO_SND_PCM_RATE_384000, and ALSA has SNDRV_PCM_RATE_384000. However, virtio-snd's rate conversion tables stop at 192 kHz.
A device advertising only 384 kHz is rejected as having no supported PCM frame rates. A device advertising 384 kHz together with lower rates does not expose 384 kHz through the ALSA hardware constraints. The selected ALSA rate also needs a reverse mapping for SET_PARAMS.
Add the missing 384 kHz entries to both conversion tables.
--- sound/virtio/virtio_pcm.c | 3 ++- sound/virtio/virtio_pcm_ops.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
sound/virtio/virtio_pcm.c +2 -1
@@ -77,7 +77,8 @@ static const struct virtsnd_v2a_rate g_v [VIRTIO_SND_PCM_RATE_88200] = { SNDRV_PCM_RATE_88200, 88200 }, [VIRTIO_SND_PCM_RATE_96000] = { SNDRV_PCM_RATE_96000, 96000 }, [VIRTIO_SND_PCM_RATE_176400] = { SNDRV_PCM_RATE_176400, 176400 }, - [VIRTIO_SND_PCM_RATE_192000] = { SNDRV_PCM_RATE_192000, 192000 } + [VIRTIO_SND_PCM_RATE_192000] = { SNDRV_PCM_RATE_192000, 192000 }, + [VIRTIO_SND_PCM_RATE_384000 ] = {SNDRV_PCM_RATE_384000 ,384000 } };/**
sound/virtio/virtio_pcm_ops.c +2 -1
@@ -90,7 +90,8 @@ static const struct virtsnd_a2v_rate g_a { 88200, VIRTIO_SND_PCM_RATE_88200 }, { 96000, VIRTIO_SND_PCM_RATE_96000 }, { 176400, VIRTIO_SND_PCM_RATE_176400 }, - { 192000, VIRTIO_SND_PCM_RATE_192000 } + { 192000, VIRTIO_SND_PCM_RATE_192000 }, + { 384000, VIRTIO_SND_PCM_RATE_384000 } };static int virtsnd_pcm_sync_stop (struct snd_pcm_substream *substream);
Greg Kroah-Hartman
maintainerPATCH 72/349 ALSA: virtio: Validate control metadata from the device
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
commit c77a6cbb36ff8cbc1f084d94f8dcda5250935271 upstream.
virtio-snd control handling trusts the device-provided control type and value count returned by the device.
That metadata is then used directly to index g_v2a_type_map[] in virtsnd_kctl_info(), and to size loops and memcpy() operations in virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size virtio_snd_ctl_value and snd_ctl_elem_value arrays.
A buggy or malicious device can therefore trigger out-of-bounds access by advertising an invalid control type or an oversized value count.
Validate control type and count once in virtsnd_kctl_parse_cfg(), before querying enumerated items or exposing the control to ALSA.
--- sound/virtio/virtio_kctl.c | 50 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+)
sound/virtio/virtio_kctl.c +50 -0
@@ -18,6 +18,21 @@ static const snd_ctl_elem_type_t g_v2a_t [VIRTIO_SND_CTL_TYPE_IEC958 ] =SNDRV_CTL_ELEM_TYPE_IEC958 }; +/* Map for converting VirtIO types to maximum value counts. */ +static const unsigned int g_v2a_count_map[] = { + [VIRTIO_SND_CTL_TYPE_BOOLEAN ] = +ARRAY_SIZE (((struct virtio_snd_ctl_value *)0 )->value.integer), + [VIRTIO_SND_CTL_TYPE_INTEGER ] = +ARRAY_SIZE (((struct virtio_snd_ctl_value *)0 )->value.integer), + [VIRTIO_SND_CTL_TYPE_INTEGER64 ] = +ARRAY_SIZE (((struct virtio_snd_ctl_value *)0 )->value.integer64), + [VIRTIO_SND_CTL_TYPE_ENUMERATED ] = +ARRAY_SIZE (((struct virtio_snd_ctl_value *)0 )->value.enumerated), + [VIRTIO_SND_CTL_TYPE_BYTES ] = +ARRAY_SIZE (((struct virtio_snd_ctl_value *)0 )->value.bytes), + [VIRTIO_SND_CTL_TYPE_IEC958 ] =1 +}; +/* Map for converting VirtIO access rights to ALSA access rights. */ static const unsigned int g_v2a_access_map[] = { [VIRTIO_SND_CTL_ACCESS_READ ] =SNDRV_CTL_ELEM_ACCESS_READ ,
@@ -36,6 +51,37 @@ static const unsigned int g_v2a_mask_map [VIRTIO_SND_CTL_EVT_MASK_TLV ] =SNDRV_CTL_EVENT_MASK_TLV }; +static int virtsnd_kctl_validate_info (struct virtio_snd *snd,u32 cid, +struct virtio_snd_ctl_info *kinfo) +{ +struct virtio_device *vdev = snd->vdev; +unsigned int type =le32_to_cpu (kinfo->type); +unsigned int count =le32_to_cpu (kinfo->count); + +if (type >=ARRAY_SIZE (g_v2a_type_map)) { +dev_err (&vdev->dev,"control #%u: unknown type %u\n" , + cid, type); +return -EINVAL ; + } + +if (count > g_v2a_count_map[type] || + (type ==VIRTIO_SND_CTL_TYPE_IEC958 && count !=1 )) { +dev_err (&vdev->dev,"control #%u: invalid count %u for type %u\n" , + cid, count, type); +return -EINVAL ; + } + +if (type ==VIRTIO_SND_CTL_TYPE_ENUMERATED && + !le32_to_cpu (kinfo->value.enumerated.items)) { +dev_err (&vdev->dev, +"control #%u: no items for enumerated control\n" , + cid); +return -EINVAL ; + } + +return 0 ; +} +/** * virtsnd_kctl_info() - Returns information about the control. * @kcontrol: ALSA control element.
@@ -385,6 +431,10 @@ int virtsnd_kctl_parse_cfg(struct virtiostruct virtio_snd_ctl_info *kinfo = &snd->kctl_infos[i];unsigned int type =le32_to_cpu (kinfo->type); + rc =virtsnd_kctl_validate_info (snd, i, kinfo); +if (rc) +return rc; +if (type ==VIRTIO_SND_CTL_TYPE_ENUMERATED ) { rc =virtsnd_kctl_get_enum_items (snd, i);if (rc)
Greg Kroah-Hartman
maintainerPATCH 73/349 ALSA: ymfpci: check snd_ctl_new1() return value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Dongdong <[email protected]>
commit e64d170346d00b580c0043de3e5ccb3e331c47d4 upstream.
snd_ctl_new1() can return NULL when memory allocation fails. snd_ymfpci_create_spdif_controls() does not check the return value before dereferencing kctl->id.device, which can lead to a NULL pointer dereference.
Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.
--- sound/pci/ymfpci/ymfpci_main.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/pci/ymfpci/ymfpci_main.c +6 -0
@@ -1822,16 +1822,22 @@ int snd_ymfpci_mixer(struct snd_ymfpci *if (snd_BUG_ON (!chip->pcm_spdif))return -ENXIO ; kctl =snd_ctl_new1 (&snd_ymfpci_spdif_default, chip); +if (!kctl) +return -ENOMEM ; kctl->id.device = chip->pcm_spdif->device; err =snd_ctl_add (chip->card, kctl);if (err <0 )return err; kctl =snd_ctl_new1 (&snd_ymfpci_spdif_mask, chip); +if (!kctl) +return -ENOMEM ; kctl->id.device = chip->pcm_spdif->device; err =snd_ctl_add (chip->card, kctl);if (err <0 )return err; kctl =snd_ctl_new1 (&snd_ymfpci_spdif_stream, chip); +if (!kctl) +return -ENOMEM ; kctl->id.device = chip->pcm_spdif->device; err =snd_ctl_add (chip->card, kctl);if (err <0 )
Greg Kroah-Hartman
maintainerPATCH 74/349 ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <[email protected]>
commit f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd upstream.
snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every iteration it advances buf and subtracts the block size while looping on "while (len)".
len is urb->actual_length. That value is supplied by the device and is not guaranteed to be a multiple of 16. When a final short block leaves len between 1 and 15, the loop runs once more, reads up to buf[15], and then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows to a huge value. The loop then keeps iterating and walking buf far past the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus block id happens to be hit.
Iterate only while a full message block is available. This stops the unsigned underflow and silently drops any trailing partial block, which carries no complete control value anyway.
The sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1 and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor urb->actual_length before dispatching.
--- sound/usb/caiaq/input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/caiaq/input.c +1 -1
@@ -330,7 +330,7 @@ static void snd_usb_caiaq_tks4_dispatch( {struct device *dev =caiaqdev_to_dev (cdev); -while (len) { +while (len >=TKS4_MSGBLOCK_SIZE ) {unsigned int i, block_id = (buf[0 ] <<8 ) | buf[1 ];switch (block_id) {
Greg Kroah-Hartman
maintainerPATCH 75/349 ALSA: cmipci: check snd_ctl_new1() return value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Dongdong <[email protected]>
commit c205bd1b28fb7e5f1061a4e78813fad7d315cb3e upstream.
snd_ctl_new1() can return NULL when memory allocation fails. snd_cmipci_spdif_controls() does not check the return value before dereferencing kctl->id.device, which can lead to a NULL pointer dereference.
Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.
--- sound/pci/cmipci.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/pci/cmipci.c +6 -0
@@ -2672,16 +2672,22 @@ static int snd_cmipci_mixer_new(struct c }if (cm->can_ac3_hw) { kctl =snd_ctl_new1 (&snd_cmipci_spdif_default, cm); +if (!kctl) +return -ENOMEM ; kctl->id.device = pcm_spdif_device; err =snd_ctl_add (card, kctl);if (err <0 )return err; kctl =snd_ctl_new1 (&snd_cmipci_spdif_mask, cm); +if (!kctl) +return -ENOMEM ; kctl->id.device = pcm_spdif_device; err =snd_ctl_add (card, kctl);if (err <0 )return err; kctl =snd_ctl_new1 (&snd_cmipci_spdif_stream, cm); +if (!kctl) +return -ENOMEM ; kctl->id.device = pcm_spdif_device; err =snd_ctl_add (card, kctl);if (err <0 )
Greg Kroah-Hartman
maintainerPATCH 76/349 ALSA: es1938: check snd_ctl_new1() return value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Dongdong <[email protected]>
commit 1edd1f02dddd20aeb6066ded41017615766ea42f upstream.
snd_ctl_new1() can return NULL when memory allocation fails. snd_es1938_mixer() does not check the return value before dereferencing the pointer, which can lead to a NULL pointer dereference.
Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.
--- sound/pci/es1938.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/es1938.c +2 -0
@@ -1663,6 +1663,8 @@ static int snd_es1938_mixer(struct es193for (idx =0 ; idx <ARRAY_SIZE (snd_es1938_controls); idx++) {struct snd_kcontrol *kctl; kctl =snd_ctl_new1 (&snd_es1938_controls[idx], chip); +if (!kctl) +return -ENOMEM ;switch (idx) {case 0 : chip->master_volume = kctl;
Greg Kroah-Hartman
maintainerPATCH 77/349 ALSA: firewire: isight: bound the sample count to the packet payload
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <[email protected]>
commit 29b9667982e4df2ed7744f86b1144f8bb58eb698 upstream.
isight_packet() takes the frame count from the device iso packet and checks it only against the device claimed iso length.
count = be32_to_cpu(payload->sample_count); if (likely(count <= (length - 16) / 4)) isight_samples(isight, payload->samples, count);
length is the iso header data_length. It can be up to 0xffff. So the gate allows a count up to about 16379. isight_samples() then copies count frames out of payload->samples into the PCM DMA buffer.
payload->samples holds only 2 * MAX_FRAMES_PER_PACKET values. The device multiplexes two samples per frame. A count past MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer size writes past runtime->dma_area. The smallest PCM buffer is larger than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET keeps both the read and the write in range.
A malicious or faulty Apple iSight on the FireWire bus reaches this during a normal capture.
Add the MAX_FRAMES_PER_PACKET bound to the gate.
--- sound/firewire/isight.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/firewire/isight.c +2 -1
@@ -179,7 +179,8 @@ static void isight_packet(struct fw_iso_if (likely (length >=16 && payload->signature ==cpu_to_be32 (0x73676874 /*"sght"*/ ))) { count =be32_to_cpu (payload->sample_count); -if (likely (count <= (length -16 ) /4 )) { +if (likely (count <= (length -16 ) /4 && + count <=MAX_FRAMES_PER_PACKET )) { total =be32_to_cpu (payload->sample_total);if (unlikely (total != isight->total_samples)) {if (!isight->first_packet)
Greg Kroah-Hartman
maintainerPATCH 78/349 ALSA: gus: check snd_ctl_new1() return value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Dongdong <[email protected]>
commit c7fa99d30c7a166a5e5db5a585ce7501ff68326b upstream.
snd_ctl_new1() can return NULL when memory allocation fails. snd_gf1_pcm_volume_control() does not check the return value before dereferencing kctl->id.index, which can lead to a NULL pointer dereference.
Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.
--- sound/isa/gus/gus_pcm.c | 2 ++ 1 file changed, 2 insertions(+)
sound/isa/gus/gus_pcm.c +2 -0
@@ -862,6 +862,8 @@ int snd_gf1_pcm_new(struct snd_gus_card kctl =snd_ctl_new1 (&snd_gf1_pcm_volume_control1, gus); else kctl =snd_ctl_new1 (&snd_gf1_pcm_volume_control, gus); +if (!kctl) +return -ENOMEM ; kctl->id.index = control_index; err =snd_ctl_add (card, kctl);if (err <0 )
Greg Kroah-Hartman
maintainerPATCH 79/349 ALSA: ice1712: check snd_ctl_new1() return value
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Dongdong <[email protected]>
commit 2b929b91b0f3bc6de8a844370049cd99ee8e31ff upstream.
snd_ctl_new1() can return NULL when memory allocation fails. The ice1712 driver calls snd_ctl_new1() without checking the return value before dereferencing the pointer in multiple places (ice1712.c, ice1724.c, aureon.c), which can lead to NULL pointer dereferences.
Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.
--- sound/pci/ice1712/aureon.c | 2 ++ sound/pci/ice1712/ice1712.c | 8 ++++++++ sound/pci/ice1712/ice1724.c | 6 ++++++ 3 files changed, 16 insertions(+)
sound/pci/ice1712/aureon.c +2 -0
@@ -1900,6 +1900,8 @@ static int aureon_add_controls(struct snfor (i =0 ; i <ARRAY_SIZE (cs8415_controls); i++) {struct snd_kcontrol *kctl; kctl =snd_ctl_new1 (&cs8415_controls[i], ice); +if (!kctl) +return -ENOMEM ;if (i >1 ) kctl->id.device = ice->pcm->device; err =snd_ctl_add (ice->card, kctl);
sound/pci/ice1712/ice1712.c +8 -0
@@ -2372,21 +2372,29 @@ int snd_ice1712_spdif_build_controls(strif (snd_BUG_ON (!ice->pcm_pro))return -EIO ; kctl =snd_ctl_new1 (&snd_ice1712_spdif_default, ice); +if (!kctl) +return -ENOMEM ; kctl->id.device = ice->pcm_pro->device; err =snd_ctl_add (ice->card, kctl);if (err <0 )return err; kctl =snd_ctl_new1 (&snd_ice1712_spdif_maskc, ice); +if (!kctl) +return -ENOMEM ; kctl->id.device = ice->pcm_pro->device; err =snd_ctl_add (ice->card, kctl);if (err <0 )return err; kctl =snd_ctl_new1 (&snd_ice1712_spdif_maskp, ice); +if (!kctl) +return -ENOMEM ; kctl->id.device = ice->pcm_pro->device; err =snd_ctl_add (ice->card, kctl);if (err <0 )return err; kctl =snd_ctl_new1 (&snd_ice1712_spdif_stream, ice); +if (!kctl) +return -ENOMEM ; kctl->id.device = ice->pcm_pro->device; err =snd_ctl_add (ice->card, kctl);if (err <0 )
sound/pci/ice1712/ice1724.c +6 -0
@@ -2393,16 +2393,22 @@ static int snd_vt1724_spdif_build_controreturn err; kctl =snd_ctl_new1 (&snd_vt1724_spdif_default, ice); +if (!kctl) +return -ENOMEM ; kctl->id.device = ice->pcm->device; err =snd_ctl_add (ice->card, kctl);if (err <0 )return err; kctl =snd_ctl_new1 (&snd_vt1724_spdif_maskc, ice); +if (!kctl) +return -ENOMEM ; kctl->id.device = ice->pcm->device; err =snd_ctl_add (ice->card, kctl);if (err <0 )return err; kctl =snd_ctl_new1 (&snd_vt1724_spdif_maskp, ice); +if (!kctl) +return -ENOMEM ; kctl->id.device = ice->pcm->device; err =snd_ctl_add (ice->card, kctl);if (err <0 )
Greg Kroah-Hartman
maintainerPATCH 80/349 ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <[email protected]>
commit 435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4 upstream.
snd_seq_event_dup() copies an incoming event into a pool cell and, in the UMP-enabled build, clears the trailing cell->ump.raw.extra word that the memcpy() did not cover. The guard deciding whether to clear it compares the copied size against sizeof(cell->event):
memcpy(&cell->ump, event, size); if (size < sizeof(cell->event)) cell->ump.raw.extra = 0;
For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) == sizeof(cell->event), so the condition is false and the extra word keeps stale data. The cell pool is allocated with kvmalloc() (not zeroed) and cells are reused via a free list, so that word holds uninitialised heap or leftover event data.
When such a cell is delivered to a UMP client (client->midi_version > 0) that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it unconverted -- snd_seq_read() reads it out as the larger struct snd_seq_ump_event and copies the stale word to user space, a 4-byte kernel heap infoleak to an unprivileged /dev/snd/seq client.
Compare against sizeof(cell->ump) instead, so the trailing word is zeroed for every event shorter than the UMP cell.
--- sound/core/seq/seq_memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/seq/seq_memory.c +1 -1
@@ -364,7 +364,7 @@ int snd_seq_event_dup(struct snd_seq_poo size =snd_seq_event_packet_size (event);memcpy (&cell->ump, event, size);#if IS_ENABLED (CONFIG_SND_SEQ_UMP ) -if (size <sizeof (cell->event)) +if (size <sizeof (cell->ump)) cell->ump.raw.extra =0 ;#endif
Greg Kroah-Hartman
maintainerPATCH 81/349 ALSA: usb-audio: avoid kobject path lookup in DualSense match
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darvell Long <[email protected]>
commit 7693c0cc415f3a16a7a3355f245474a5e661be4e upstream.
The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the input device and the USB audio device, then comparing the path prefix.
This was observed when a weak physical connection caused the controller to rapidly disconnect and reconnect. During that repeated hotplug, snd_dualsense_ih_match() can run while the controller's USB device is being disconnected. kobject_get_path() walks ancestor kobjects and dereferences their names; if the USB device kobject name is no longer valid, this can fault in strlen():
RIP: 0010:strlen+0x10/0x30 Call Trace: kobject_get_path+0x34/0x150 snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio] input_register_device+0x566/0x6a0 ps_probe+0xb89/0x1590 [hid_playstation]
The same ownership check can be done without building kobject path strings. The input device is parented below the HID device, USB interface and USB device, so walking the input device parent chain and comparing against the mixer USB device preserves the check without dereferencing kobject names during disconnect.
--- sound/usb/mixer_quirks.c | 40 ++++++++++++---------------------------- 1 file changed, 12 insertions(+), 28 deletions(-)
sound/usb/mixer_quirks.c +12 -28
@@ -571,46 +571,30 @@ static bool snd_dualsense_ih_match(struc {struct dualsense_mixer_elem_info *mei;struct usb_device *snd_dev; -char *input_dev_path, *usb_dev_path; -size_t usb_dev_path_len; -bool match = false; +struct device *parent; mei = container_of(handler, struct dualsense_mixer_elem_info, ih); snd_dev = mei->info.head.mixer->chip->dev; - input_dev_path =kobject_get_path (&dev->dev.kobj,GFP_KERNEL ); -if (!input_dev_path) { -dev_warn (&snd_dev->dev,"Failed to get input dev path\n" ); -return false; - } - - usb_dev_path =kobject_get_path (&snd_dev->dev.kobj,GFP_KERNEL ); -if (!usb_dev_path) { -dev_warn (&snd_dev->dev,"Failed to get USB dev path\n" ); - goto free_paths; - } -/* * Ensure the VID:PID matched input device supposedly owned by the * hid-playstation driver belongs to the actual hardware handled by -* the current USB audio device, which implies input_dev_path being -* a subpath of usb_dev_path. +* the current USB audio device. * * This verification is necessary when there is more than one identical * controller attached to the host system. +* +* The input device is registered below the HID device, USB interface and +* USB device, so compare the parent chain directly instead of building +* kobject path strings. This avoids dereferencing kobject names while the +* USB device hierarchy is being torn down during disconnect. */ - usb_dev_path_len =strlen (usb_dev_path); -if (usb_dev_path_len >=strlen (input_dev_path)) - goto free_paths; - - usb_dev_path[usb_dev_path_len] ='/' ; - match = !memcmp (input_dev_path, usb_dev_path, usb_dev_path_len +1 ); - -free_paths: -kfree (input_dev_path); -kfree (usb_dev_path); +for (parent = dev->dev.parent; parent; parent = parent->parent) { +if (parent == &snd_dev->dev) +return true; + } -return match; +return false; } static int snd_dualsense_ih_connect(struct input_handler *handler,
Greg Kroah-Hartman
maintainerPATCH 82/349 ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
commit 0f25cf1f02e3dba626791d949c759a48c0a44996 upstream.
scarlett_ctl_enum_put() ignores the return value from snd_usb_set_cur_mix_value() and reports success whenever the requested enum value differs from the current one.
If the SET_CUR request fails, the callback still returns success even though neither the hardware state nor the cached mixer value changed.
--- sound/usb/mixer_scarlett.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/usb/mixer_scarlett.c +3 -1
@@ -438,7 +438,9 @@ static int scarlett_ctl_enum_put(struct val = ucontrol->value.integer.value[0 ]; val = val + opt->start;if (val != oval) { -snd_usb_set_cur_mix_value (elem,0 ,0 , val); + err =snd_usb_set_cur_mix_value (elem,0 ,0 , val); +if (err <0 ) +return err;return 1 ; }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 83/349 ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
commit 3c06aec8abda6ba068b58a8b7119cdb2a48456b1 upstream.
Several US-16x08 mixer put callbacks log failed control URBs but still return success to userspace. That hides device write failures even though the requested value was not applied.
Return the negative write error instead in the route, master, bus, channel, and EQ switch put callbacks.
--- sound/usb/mixer_us16x08.c | 49 ++++++++++++++++++++++------------------------ 1 file changed, 24 insertions(+), 25 deletions(-)
sound/usb/mixer_us16x08.c +24 -25
@@ -225,14 +225,14 @@ static int snd_us16x08_route_put(struct err =snd_us16x08_send_urb (chip, buf,sizeof (route_msg)); -if (err >0 ) { - elem->cached |=1 << index; - elem->cache_val[index] = val; - }else { +if (err <0 ) {usb_audio_dbg (chip,"Failed to set routing, err:%d\n" , err); +return err; } -return err >0 ?1 :0 ; + elem->cached |=1 << index; + elem->cache_val[index] = val; +return 1 ; } static int snd_us16x08_master_info(struct snd_kcontrol *kcontrol,
@@ -284,14 +284,14 @@ static int snd_us16x08_master_put(struct buf[5 ] = index +1 ; err =snd_us16x08_send_urb (chip, buf,sizeof (mix_msg_out)); -if (err >0 ) { - elem->cached |=1 << index; - elem->cache_val[index] = val; - }else { +if (err <0 ) {usb_audio_dbg (chip,"Failed to set master, err:%d\n" , err); +return err; } -return err >0 ?1 :0 ; + elem->cached |=1 << index; + elem->cache_val[index] = val; +return 1 ; } static int snd_us16x08_bus_put(struct snd_kcontrol *kcontrol,
@@ -325,14 +325,14 @@ static int snd_us16x08_bus_put(struct snbreak ; } -if (err >0 ) { - elem->cached |=1 ; - elem->cache_val[0 ] = val; - }else { +if (err <0 ) {usb_audio_dbg (chip,"Failed to set bus parameter, err:%d\n" , err); +return err; } -return err >0 ?1 :0 ; + elem->cached |=1 ; + elem->cache_val[0 ] = val; +return 1 ; } static int snd_us16x08_bus_get(struct snd_kcontrol *kcontrol,
@@ -393,14 +393,14 @@ static int snd_us16x08_channel_put(struc err =snd_us16x08_send_urb (chip, buf,sizeof (mix_msg_in)); -if (err >0 ) { - elem->cached |=1 << index; - elem->cache_val[index] = val; - }else { +if (err <0 ) {usb_audio_dbg (chip,"Failed to set channel, err:%d\n" , err); +return err; } -return err >0 ?1 :0 ; + elem->cached |=1 << index; + elem->cache_val[index] = val; +return 1 ; } static int snd_us16x08_mix_info(struct snd_kcontrol *kcontrol,
@@ -530,13 +530,13 @@ static int snd_us16x08_eqswitch_put(strumsleep (15 ); } -if (err >0 ) { - elem->cached |=1 << index; - elem->cache_val[index] = val; - }else { +if (err <0 ) {usb_audio_dbg (chip,"Failed to set eq switch, err:%d\n" , err); +return err; } + elem->cached |=1 << index; + elem->cache_val[index] = val;return 1 ; }
@@ -1419,4 +1419,3 @@ int snd_us16x08_controls_create(struct ureturn 0 ; } -
Greg Kroah-Hartman
maintainerPATCH 84/349 ALSA: usb-audio: Roll back quirk control caches on write errors
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
commit 6380957fa24251856a532e48a46a4dc3d1ae26b6 upstream.
Several mixer quirk callbacks cache the requested
control value in kcontrol->private_value before
issuing a single vendor or class write.
Their paired get and resume paths consume that cache directly, so a failed write currently leaves software state changed even though the update did not succeed. That can make later reads report a value the device never accepted and can replay the stale cache on resume.
Restore the previous cached value on failure in
the Audigy2NX LED, Emu0204 channel switch,
Xonar U1 output switch, Native Instruments controls,
FTU effect program switch, and Sound Blaster E1 input source switch.
--- sound/usb/mixer_quirks.c | 45 +++++++++++++++++++++++++++++++++++++-------- 1 file changed, 37 insertions(+), 8 deletions(-)
sound/usb/mixer_quirks.c +37 -8
@@ -333,6 +333,7 @@ static int snd_audigy2nx_led_put(structint index = kcontrol->private_value &0xff ;unsigned int value = ucontrol->value.integer.value[0 ];int old_value = kcontrol->private_value >>8 ; +unsigned long old_pval = kcontrol->private_value;int err;if (value >1 )
@@ -341,7 +342,11 @@ static int snd_audigy2nx_led_put(structreturn 0 ; kcontrol->private_value = (value <<8 ) | index; err =snd_audigy2nx_led_update (mixer, value, index); -return err <0 ? err :1 ; +if (err <0 ) { + kcontrol->private_value = old_pval; +return err; + } +return 1 ; }static int snd_audigy2nx_led_resume (struct usb_mixer_elem_list *list)
@@ -491,6 +496,7 @@ static int snd_emu0204_ch_switch_put(strstruct usb_mixer_elem_list *list =snd_kcontrol_chip (kcontrol);struct usb_mixer_interface *mixer = list->mixer;unsigned int value = ucontrol->value.enumerated.item[0 ]; +unsigned long old_pval = kcontrol->private_value;int err;if (value >1 )
@@ -501,7 +507,11 @@ static int snd_emu0204_ch_switch_put(str kcontrol->private_value = value; err =snd_emu0204_ch_switch_update (mixer, value); -return err <0 ? err :1 ; +if (err <0 ) { + kcontrol->private_value = old_pval; +return err; + } +return 1 ; }static int snd_emu0204_ch_switch_resume (struct usb_mixer_elem_list *list)
@@ -812,7 +822,11 @@ static int snd_xonar_u1_switch_put(struc kcontrol->private_value = new_status; err =snd_xonar_u1_switch_update (list->mixer, new_status); -return err <0 ? err :1 ; +if (err <0 ) { + kcontrol->private_value = old_status; +return err; + } +return 1 ; }static int snd_xonar_u1_switch_resume (struct usb_mixer_elem_list *list)
@@ -1161,7 +1175,8 @@ static int snd_nativeinstruments_control struct snd_ctl_elem_value *ucontrol) {struct usb_mixer_elem_list *list =snd_kcontrol_chip (kcontrol); -u8 oldval = (kcontrol->private_value >>24 ) &0xff ; +unsigned long old_pval = kcontrol->private_value; +u8 oldval = (old_pval >>24 ) &0xff ;u8 newval = ucontrol->value.integer.value[0 ];int err;
@@ -1171,7 +1186,11 @@ static int snd_nativeinstruments_control kcontrol->private_value &= ~(0xff <<24 ); kcontrol->private_value |= (unsigned int )newval <<24 ; err =snd_ni_update_cur_val (list); -return err <0 ? err :1 ; +if (err <0 ) { + kcontrol->private_value = old_pval; +return err; + } +return 1 ; }static const struct snd_kcontrol_new snd_nativeinstruments_ta6_mixers[] = {
@@ -1329,7 +1348,8 @@ static int snd_ftu_eff_switch_put(struct struct snd_ctl_elem_value *ucontrol) {struct usb_mixer_elem_list *list =snd_kcontrol_chip (kctl); -unsigned int pval = list->kctl->private_value; +unsigned long old_pval = list->kctl->private_value; +unsigned int pval = old_pval;int cur_val, err, new_val; cur_val = pval >>24 ;
@@ -1340,7 +1360,11 @@ static int snd_ftu_eff_switch_put(struct kctl->private_value &= ~(0xff <<24 ); kctl->private_value |= new_val <<24 ; err =snd_ftu_eff_switch_update (list); -return err <0 ? err :1 ; +if (err <0 ) { + kctl->private_value = old_pval; +return err; + } +return 1 ; } static int snd_ftu_create_effect_switch(struct usb_mixer_interface *mixer,
@@ -2138,13 +2162,18 @@ static int snd_soundblaster_e1_switch_pu {struct usb_mixer_elem_list *list =snd_kcontrol_chip (kcontrol);unsigned char value = !!ucontrol->value.integer.value[0 ]; +unsigned long old_pval = kcontrol->private_value;int err;if (kcontrol->private_value == value)return 0 ; kcontrol->private_value = value; err =snd_soundblaster_e1_switch_update (list->mixer, value); -return err <0 ? err :1 ; +if (err <0 ) { + kcontrol->private_value = old_pval; +return err; + } +return 1 ; }static int snd_soundblaster_e1_switch_resume (struct usb_mixer_elem_list *list)
Greg Kroah-Hartman
maintainerPATCH 85/349 ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
commit d8f802ccf1fdbeb89d62748d6a0d0fbd442c8127 upstream.
snd_bbfpro_ctl_put() and snd_bbfpro_vol_put() cache the requested packed control state in kcontrol->private_value before issuing the USB write.
Their get and resume paths use that cached value directly, so a failed write can leave the driver reporting and later replaying a setting the hardware never accepted.
Update the cached state only after a successful USB write.
--- sound/usb/mixer_quirks.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
sound/usb/mixer_quirks.c +10 -6
@@ -2958,12 +2958,14 @@ static int snd_bbfpro_ctl_put(struct sndif (val == old_value)return 0 ; + err =snd_bbfpro_ctl_update (mixer, reg, idx, val); +if (err <0 ) +return err; + kcontrol->private_value = reg | ((idx &SND_BBFPRO_CTL_IDX_MASK ) <<SND_BBFPRO_CTL_IDX_SHIFT ) | ((val &SND_BBFPRO_CTL_VAL_MASK ) <<SND_BBFPRO_CTL_VAL_SHIFT ); - - err =snd_bbfpro_ctl_update (mixer, reg, idx, val); -return err <0 ? err :1 ; +return 1 ; }static int snd_bbfpro_ctl_resume (struct usb_mixer_elem_list *list)
@@ -3156,11 +3158,13 @@ static int snd_bbfpro_vol_put(struct snd new_val = uvalue &SND_BBFPRO_MIXER_VAL_MASK ; + err =snd_bbfpro_vol_update (mixer, idx, new_val); +if (err <0 ) +return err; + kcontrol->private_value = idx | (new_val <<SND_BBFPRO_MIXER_VAL_SHIFT ); - - err =snd_bbfpro_vol_update (mixer, idx, new_val); -return err <0 ? err :1 ; +return 1 ; }static int snd_bbfpro_vol_resume (struct usb_mixer_elem_list *list)
Greg Kroah-Hartman
maintainerPATCH 86/349 ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
commit a440c17869ecd71da0f295b62868fc742d09a8ba upstream.
snd_us16x08_comp_put() and snd_us16x08_eq_put() update their software stores before sending the USB write. If the transfer fails, later get callbacks report a value the hardware never accepted.
Build the outgoing message from the current store plus the pending value, then commit the store only after a successful write.
--- sound/usb/mixer_us16x08.c | 78 ++++++++++++++++++++++++++++++---------------- 1 file changed, 52 insertions(+), 26 deletions(-)
sound/usb/mixer_us16x08.c +52 -26
@@ -436,6 +436,7 @@ static int snd_us16x08_comp_put(struct sint index = ucontrol->id.index;char buf[sizeof (comp_msg)];int val_idx, val; +int threshold, ratio, attack, release, gain, switch_on;int err; val = ucontrol->value.integer.value[0 ];
@@ -448,36 +449,61 @@ static int snd_us16x08_comp_put(struct s/* new control value incl. bias*/ val_idx = elem->head.id -SND_US16X08_ID_COMP_BASE ; - store->val[val_idx][index] = ucontrol->value.integer.value[0 ]; + threshold = store->val[COMP_STORE_IDX (SND_US16X08_ID_COMP_THRESHOLD )] + [index]; + ratio = store->val[COMP_STORE_IDX (SND_US16X08_ID_COMP_RATIO )][index]; + attack = store->val[COMP_STORE_IDX (SND_US16X08_ID_COMP_ATTACK )][index]; + release = store->val[COMP_STORE_IDX (SND_US16X08_ID_COMP_RELEASE )] + [index]; + gain = store->val[COMP_STORE_IDX (SND_US16X08_ID_COMP_GAIN )][index]; + switch_on = store->val[COMP_STORE_IDX (SND_US16X08_ID_COMP_SWITCH )] + [index]; + +switch (val_idx) { +case COMP_STORE_IDX (SND_US16X08_ID_COMP_THRESHOLD ): + threshold = val; +break ; +case COMP_STORE_IDX (SND_US16X08_ID_COMP_RATIO ): + ratio = val; +break ; +case COMP_STORE_IDX (SND_US16X08_ID_COMP_ATTACK ): + attack = val; +break ; +case COMP_STORE_IDX (SND_US16X08_ID_COMP_RELEASE ): + release = val; +break ; +case COMP_STORE_IDX (SND_US16X08_ID_COMP_GAIN ): + gain = val; +break ; +case COMP_STORE_IDX (SND_US16X08_ID_COMP_SWITCH ): + switch_on = val; +break ; + }/* prepare compressor URB message from template */ memcpy (buf, comp_msg,sizeof (comp_msg));/* place comp values in message buffer watch bias! */ - buf[8 ] = store->val[ -COMP_STORE_IDX (SND_US16X08_ID_COMP_THRESHOLD )][index] - -SND_US16X08_COMP_THRESHOLD_BIAS ; - buf[11 ] = ratio_map[store->val[ -COMP_STORE_IDX (SND_US16X08_ID_COMP_RATIO )][index]]; - buf[14 ] = store->val[COMP_STORE_IDX (SND_US16X08_ID_COMP_ATTACK )][index] - +SND_US16X08_COMP_ATTACK_BIAS ; - buf[17 ] = store->val[COMP_STORE_IDX (SND_US16X08_ID_COMP_RELEASE )][index] - +SND_US16X08_COMP_RELEASE_BIAS ; - buf[20 ] = store->val[COMP_STORE_IDX (SND_US16X08_ID_COMP_GAIN )][index]; - buf[26 ] = store->val[COMP_STORE_IDX (SND_US16X08_ID_COMP_SWITCH )][index]; + buf[8 ] = threshold -SND_US16X08_COMP_THRESHOLD_BIAS ; + buf[11 ] = ratio_map[ratio]; + buf[14 ] = attack +SND_US16X08_COMP_ATTACK_BIAS ; + buf[17 ] = release +SND_US16X08_COMP_RELEASE_BIAS ; + buf[20 ] = gain; + buf[26 ] = switch_on;/* place channel selector in message buffer */ buf[5 ] = index +1 ; err =snd_us16x08_send_urb (chip, buf,sizeof (comp_msg)); -if (err >0 ) { - elem->cached |=1 << index; - elem->cache_val[index] = val; - }else { +if (err <0 ) {usb_audio_dbg (chip,"Failed to set compressor, err:%d\n" , err); +return err; } + store->val[val_idx][index] = val; + elem->cached |=1 << index; + elem->cache_val[index] = val;return 1 ; }
@@ -579,11 +605,10 @@ static int snd_us16x08_eq_put(struct snd/* copy URB buffer from EQ template */ memcpy (buf, eqs_msq,sizeof (eqs_msq)); - store->val[b_idx][p_idx][index] = val; - buf[20 ] = store->val[b_idx][3 ][index]; - buf[17 ] = store->val[b_idx][2 ][index]; - buf[14 ] = store->val[b_idx][1 ][index]; - buf[11 ] = store->val[b_idx][0 ][index]; + buf[20 ] = p_idx ==3 ? val : store->val[b_idx][3 ][index]; + buf[17 ] = p_idx ==2 ? val : store->val[b_idx][2 ][index]; + buf[14 ] = p_idx ==1 ? val : store->val[b_idx][1 ][index]; + buf[11 ] = p_idx ==0 ? val : store->val[b_idx][0 ][index];/* place channel index in URB buffer */ buf[5 ] = index +1 ;
@@ -593,14 +618,15 @@ static int snd_us16x08_eq_put(struct snd err =snd_us16x08_send_urb (chip, buf,sizeof (eqs_msq)); -if (err >0 ) { -/* store new value in EQ band cache */ - elem->cached |=1 << index; - elem->cache_val[index] = val; - }else { +if (err <0 ) {usb_audio_dbg (chip,"Failed to set eq param, err:%d\n" , err); +return err; } + store->val[b_idx][p_idx][index] = val; +/* store new value in EQ band cache */ + elem->cached |=1 << index; + elem->cache_val[index] = val;return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 87/349 vfio/pci: Use a private flag to prevent power state change with VFs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raghavendra Rao Ananta <[email protected]>
commit 40ef3edf151e184d021917a5c4c771cc0870844a upstream.
The current implementation uses pci_num_vf() while holding the memory_lock to prevent changing the power state of a PF when VFs are enabled. This creates a lockdep circular dependency warning because memory_lock is held during device probing.
[ 286.997167] ======================================================
[ 287.003363] WARNING: possible circular locking dependency detected
[ 287.009562] 7.0.0-dbg-DEV #3 Tainted: G S
[ 287.015074] ------------------------------------------------------
[ 287.021270] vfio_pci_sriov_/18636 is trying to acquire lock:
[ 287.026942] ff45bea2294d4968 (&vdev->memory_lock){+.+.}-{4:4}, at:
vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.036530]
[ 287.036530] but task is already holding lock:
[ 287.042383] ff45bea3a96b8230 (&new_dev_set->lock){+.+.}-{4:4}, at:
vfio_group_fops_unl_ioctl+0x44d/0x7b0
[ 287.051879]
[ 287.051879] which lock already depends on the new lock.
[ 287.051879]
[ 287.060070]
[ 287.060070] the existing dependency chain (in reverse order) is:
[ 287.067568]
[ 287.067568] -> #2 (&new_dev_set->lock){+.+.}-{4:4}:
[ 287.073941] __mutex_lock+0x92/0xb80
[ 287.078058] vfio_assign_device_set+0x66/0x1b0
[ 287.083042] vfio_pci_core_register_device+0xd1/0x2a0
[ 287.088638] vfio_pci_probe+0xd2/0x100
[ 287.092933] local_pci_probe_callback+0x4d/0xa0
[ 287.098001] process_scheduled_works+0x2ca/0x680
[ 287.103158] worker_thread+0x1e8/0x2f0
[ 287.107452] kthread+0x10c/0x140
[ 287.111230] ret_from_fork+0x18e/0x360
[ 287.115519] ret_from_fork_asm+0x1a/0x30
[ 287.119983]
[ 287.119983] -> #1 ((work_completion)(&arg.work)){+.+.}-{0:0}:
[ 287.127219] __flush_work+0x345/0x490
[ 287.131429] pci_device_probe+0x2e3/0x490
[ 287.135979] really_probe+0x1f9/0x4e0
[ 287.140180] __driver_probe_device+0x77/0x100
[ 287.145079] driver_probe_device+0x1e/0x110
[ 287.149803] __device_attach_driver+0xe3/0x170
[ 287.154789] bus_for_each_drv+0x125/0x150
[ 287.159346] __device_attach+0xca/0x1a0
[ 287.163720] device_initial_probe+0x34/0x50
[ 287.168445] pci_bus_add_device+0x6e/0x90
[ 287.172995] pci_iov_add_virtfn+0x3c9/0x3e0
[ 287.177719] sriov_add_vfs+0x2c/0x60
[ 287.181838] sriov_enable+0x306/0x4a0
[ 287.186038] vfio_pci_core_sriov_configure+0x184/0x220
[ 287.191715] sriov_numvfs_store+0xd9/0x1c0
[ 287.196351] kernfs_fop_write_iter+0x13f/0x1d0
[ 287.201338] vfs_write+0x2be/0x3b0
[ 287.205286] ksys_write+0x73/0x100
[ 287.209233] do_syscall_64+0x14d/0x750
[ 287.213529] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 287.219120]
[ 287.219120] -> #0 (&vdev->memory_lock){+.+.}-{4:4}:
[ 287.225491] __lock_acquire+0x14c6/0x2800
[ 287.230048] lock_acquire+0xd3/0x2f0
[ 287.234168] down_write+0x3a/0xc0
[ 287.238019] vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.243436] __rpm_callback+0x8c/0x310
[ 287.247730] rpm_resume+0x529/0x6f0
[ 287.251765] __pm_runtime_resume+0x68/0x90
[ 287.256402] vfio_pci_core_enable+0x44/0x310
[ 287.261216] vfio_pci_open_device+0x1c/0x80
[ 287.265947] vfio_df_open+0x10f/0x150
[ 287.270148] vfio_group_fops_unl_ioctl+0x4a4/0x7b0
[ 287.275476] __se_sys_ioctl+0x71/0xc0
[ 287.279679] do_syscall_64+0x14d/0x750
[ 287.283975] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 287.289559]
[ 287.289559] other info that might help us debug this:
[ 287.289559]
[ 287.297582] Chain exists of:
[ 287.297582] &vdev->memory_lock --> (work_completion)(&arg.work)
--> &new_dev_set->lock
[ 287.297582]
[ 287.310023] Possible unsafe locking scenario:
[ 287.310023]
[ 287.315961] CPU0 CPU1
[ 287.320510] ---- ----
[ 287.325059] lock(&new_dev_set->lock);
[ 287.328917]
lock((work_completion)(&arg.work));
[ 287.336153] lock(&new_dev_set->lock);
[ 287.342523] lock(&vdev->memory_lock);
[ 287.346382]
[ 287.346382] *** DEADLOCK ***
[ 287.346382]
[ 287.352315] 2 locks held by vfio_pci_sriov_/18636:
[ 287.357125] #0: ff45bea208ed3e18 (&group->group_lock){+.+.}-{4:4},
at: vfio_group_fops_unl_ioctl+0x3e3/0x7b0
[ 287.367048] #1: ff45bea3a96b8230 (&new_dev_set->lock){+.+.}-{4:4},
at: vfio_group_fops_unl_ioctl+0x44d/0x7b0
[ 287.376976]
[ 287.376976] stack backtrace:
[ 287.381353] CPU: 191 UID: 0 PID: 18636 Comm: vfio_pci_sriov_
Tainted: G S 7.0.0-dbg-DEV #3 PREEMPTLAZY
[ 287.381355] Tainted: [S]=CPU_OUT_OF_SPEC
[ 287.381356] Call Trace:
[ 287.381357] <TASK>
[ 287.381358] dump_stack_lvl+0x54/0x70
[ 287.381361] print_circular_bug+0x2e1/0x300
[ 287.381363] check_noncircular+0xf9/0x120
[ 287.381364] ? __lock_acquire+0x5b4/0x2800
[ 287.381366] __lock_acquire+0x14c6/0x2800
[ 287.381368] ? pci_mmcfg_read+0x4f/0x220
[ 287.381370] ? pci_mmcfg_write+0x57/0x220
[ 287.381371] ? lock_acquire+0xd3/0x2f0
[ 287.381373] ? pci_mmcfg_write+0x57/0x220
[ 287.381374] ? lock_release+0xef/0x360
[ 287.381376] ? vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.381377] lock_acquire+0xd3/0x2f0
[ 287.381378] ? vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.381379] ? lock_is_held_type+0x76/0x100
[ 287.381382] down_write+0x3a/0xc0
[ 287.381382] ? vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.381383] vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.381384] ? __pfx_pci_pm_runtime_resume+0x10/0x10
[ 287.381385] __rpm_callback+0x8c/0x310
[ 287.381386] ? ktime_get_mono_fast_ns+0x3d/0xb0
[ 287.381389] ? __pfx_pci_pm_runtime_resume+0x10/0x10
[ 287.381390] rpm_resume+0x529/0x6f0
[ 287.381392] ? lock_is_held_type+0x76/0x100
[ 287.381394] __pm_runtime_resume+0x68/0x90
[ 287.381396] vfio_pci_core_enable+0x44/0x310
[ 287.381398] vfio_pci_open_device+0x1c/0x80
[ 287.381399] vfio_df_open+0x10f/0x150
[ 287.381401] vfio_group_fops_unl_ioctl+0x4a4/0x7b0
[ 287.381402] __se_sys_ioctl+0x71/0xc0
[ 287.381404] do_syscall_64+0x14d/0x750
[ 287.381405] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 287.381406] ? trace_irq_disable+0x25/0xd0
[ 287.381409] entry_SYSCALL_64_after_hwframe+0x77/0x7fIntroduce a private flag 'sriov_active' in the vfio_pci_core_device struct. This allows the driver to track the SR-IOV power state requirement without relying on pci_num_vf() while holding the memory_lock. The lock is now only held to set the flag and ensure the device is in D0, after which pci_enable_sriov() can be called without the lock.
--- drivers/vfio/pci/vfio_pci_core.c | 17 ++++++++++++++--- include/linux/vfio_pci_core.h | 1 + 2 files changed, 15 insertions(+), 3 deletions(-)
drivers/vfio/pci/vfio_pci_core.c +14 -3
@@ -272,8 +272,11 @@ int vfio_pci_set_power_state(struct vfioint ret;/* Prevent changing power state for PFs with VFs enabled */ -if (pci_num_vf (pdev) && state >PCI_D0 ) -return -EBUSY ; +if (state >PCI_D0 ) { +lockdep_assert_held_write (&vdev->memory_lock); +if (vdev->sriov_active) +return -EBUSY ; + }if (vdev->needs_pm_restore) {if (pdev->current_state < PCI_D3hot && state >= PCI_D3hot) {
@@ -2315,8 +2318,9 @@ int vfio_pci_core_sriov_configure(structdown_write (&vdev->memory_lock);vfio_pci_set_power_state (vdev,PCI_D0 ); - ret =pci_enable_sriov (pdev, nr_virtfn); + vdev->sriov_active = true;up_write (&vdev->memory_lock); + ret =pci_enable_sriov (pdev, nr_virtfn);if (ret) {pm_runtime_put (&pdev->dev); goto out_del;
@@ -2330,6 +2334,13 @@ int vfio_pci_core_sriov_configure(struct } out_del: +/* +* Avoid taking the memory_lock intentionally. A race with a power +* state transition would at most result in an -EBUSY, leaving the +* device in PCI_D0. +*/ + vdev->sriov_active = false; +mutex_lock (&vfio_pci_sriov_pfs_mutex);list_del_init (&vdev->sriov_pfs_item); out_unlock:
include/linux/vfio_pci_core.h +1 -0
@@ -86,6 +86,7 @@ struct vfio_pci_core_device { bool needs_pm_restore:1; bool pm_intx_masked:1; bool pm_runtime_engaged:1; +bool sriov_active;struct pci_saved_state *pci_saved_state;struct pci_saved_state *pm_save;int ioeventfds_nr;
Greg Kroah-Hartman
maintainerPATCH 88/349 vfio/pci: Latch disable_idle_d3 per device
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
commit 4575e9aac5336d1365138c0284773bf8da4b1fa3 upstream.
When disable_idle_d3 was introduced in vfio-pci, it directly manipulated the device power state with pci_set_power_state(). There were no refcounts to maintain or balanced operations, we could unconditionally bring the device to D0 and conditionally move it to D3hot. Therefore the module parameter was made writable.
Later, in commit c61302aa48f7 ("vfio/pci: Move module parameters to vfio_pci.c"), as part of the vfio-pci-core split, the writable aspect of the module parameter was nullified. The parameter value could still be changed through sysfs, but the vfio-pci driver latched the values into vfio-pci-core globals at module init. Loading the vfio-pci module, or unloading and reloading, with non-default or different values could change the globals relative to existing devices bound to vfio-pci variant drivers.
Runtime PM was introduced in commit 7ab5e10eda02 ("vfio/pci: Move the unused device into low power state with runtime PM"), which marks the point where power states became refcounted. PM get and put operations need to be balanced, but the same module operations noted above can change the global variables relative to those devices already bound to vfio-pci variant drivers. This introduces a window where PM operations can now become unbalanced.
To resolve this with a narrow footprint for stable backports, the disable_idle_d3 flag is latched into the vfio_pci_core_device at the time of initialization, such that the device always operates with a consistent value.
NB. vfio_pci_dev_set_try_reset() now unconditionally raises the runtime PM usage count around bus reset to account for disable_idle_d3 becoming a per-device rather than global flag. When this flag is set, the additional get/put pair is harmless and allows continued use of the shared vfio_pci_dev_set_pm_runtime_get() helper.
--- drivers/vfio/pci/vfio_pci_core.c | 19 ++++++++++--------- include/linux/vfio_pci_core.h | 1 + 2 files changed, 11 insertions(+), 9 deletions(-)
drivers/vfio/pci/vfio_pci_core.c +10 -9
@@ -507,7 +507,7 @@ int vfio_pci_core_enable(struct vfio_pciu16 cmd;u8 msix_pos; -if (!disable_idle_d3) { +if (!vdev->disable_idle_d3) { ret =pm_runtime_resume_and_get (&pdev->dev);if (ret <0 )return ret;
@@ -585,7 +585,7 @@ out_free_state: out_disable_device:pci_disable_device (pdev); out_power: -if (!disable_idle_d3) +if (!vdev->disable_idle_d3)pm_runtime_put (&pdev->dev);return ret; }
@@ -721,7 +721,7 @@ out:vfio_pci_dev_set_try_reset (vdev->vdev.dev_set);/* Put the pm-runtime usage counter acquired during enable */ -if (!disable_idle_d3) +if (!vdev->disable_idle_d3)pm_runtime_put (&pdev->dev); }EXPORT_SYMBOL_GPL (vfio_pci_core_disable);
@@ -2137,6 +2137,8 @@ int vfio_pci_core_init_dev(struct vfio_dinit_rwsem (&vdev->memory_lock);xa_init (&vdev->ctx); + vdev->disable_idle_d3 = disable_idle_d3; +return 0 ; }EXPORT_SYMBOL_GPL (vfio_pci_core_init_dev);
@@ -2228,7 +2230,7 @@ int vfio_pci_core_register_device(struct dev->driver->pm = &vfio_pci_core_pm_ops;pm_runtime_allow (dev); -if (!disable_idle_d3) +if (!vdev->disable_idle_d3)pm_runtime_put (dev); ret =vfio_register_group_dev (&vdev->vdev);
@@ -2237,7 +2239,7 @@ int vfio_pci_core_register_device(structreturn 0 ; out_power: -if (!disable_idle_d3) +if (!vdev->disable_idle_d3)pm_runtime_get_noresume (dev);pm_runtime_forbid (dev);
@@ -2256,7 +2258,7 @@ void vfio_pci_core_unregister_device(strvfio_pci_vf_uninit (vdev);vfio_pci_vga_uninit (vdev); -if (!disable_idle_d3) +if (!vdev->disable_idle_d3)pm_runtime_get_noresume (&vdev->pdev->dev);pm_runtime_forbid (&vdev->pdev->dev);
@@ -2584,7 +2586,7 @@ static void vfio_pci_dev_set_try_reset(s* state. Increment the usage count for all the devices in the dev_set * before reset and decrement the same after reset. */ -if (!disable_idle_d3 &&vfio_pci_dev_set_pm_runtime_get (dev_set)) +if (vfio_pci_dev_set_pm_runtime_get (dev_set))return ;if (!pci_reset_bus (pdev))
@@ -2594,8 +2596,7 @@ static void vfio_pci_dev_set_try_reset(sif (reset_done) cur->needs_reset = false; -if (!disable_idle_d3) -pm_runtime_put (&cur->pdev->dev); +pm_runtime_put (&cur->pdev->dev); } }
include/linux/vfio_pci_core.h +1 -0
@@ -86,6 +86,7 @@ struct vfio_pci_core_device { bool needs_pm_restore:1; bool pm_intx_masked:1; bool pm_runtime_engaged:1; + bool disable_idle_d3:1;bool sriov_active;struct pci_saved_state *pci_saved_state;struct pci_saved_state *pm_save;
Greg Kroah-Hartman
maintainerPATCH 89/349 vfio/pci: Release the VGA arbiter client on register_device() failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
commit daedde7f024ecf88bc8e832ed40cf2c795f0796a upstream.
The re-order in the Fixes commit below displaced vfio_pci_vga_init() as the last failure point of what is now vfio_pci_core_register_device() without introducing an unwind for the VGA arbiter registration.
In current kernels this is mostly benign because vfio_pci_set_decode() only uses pci_dev state, but the original failure path could leave a callback with a freed vdev cookie. The stale registration also becomes unsafe again once the callback follows drvdata to the vfio device.
Add the required VGA unwind callout.
--- drivers/vfio/pci/vfio_pci_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/vfio/pci/vfio_pci_core.c +1 -0
@@ -2243,6 +2243,7 @@ out_power:pm_runtime_get_noresume (dev);pm_runtime_forbid (dev); +vfio_pci_vga_uninit (vdev); out_vf:vfio_pci_vf_uninit (vdev);return ret;
Greg Kroah-Hartman
maintainerPATCH 90/349 vfio/pci: Fix racy bitfields and tighten struct layout
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
commit e73638e55f861758d49f14d7bb5dba3035981cd7 upstream.
Bitfield operations are not atomic, they use a read-modify-write pattern, therefore we should be careful not to pack bitfields that can be concurrently updated into the same storage unit.
This split takes a binary approach: flags that are only modified pre/post open/close remain bitfields, flags modified from user action, including actions that reach across to another device (ex. reset) use dedicated storage units.
Note that the virq_disabled and bardirty flags are relocated to fill an existing hole in the structure.
Bitfield justifications:
has_dyn_msix: written only in vfio_pci_core_enable()
pci_2_3: written only in vfio_pci_core_enable()
reset_works: written only in vfio_pci_core_enable()
extended_caps: written only in vfio_cap_len() under vfio_config_init()
has_vga: written only in vfio_pci_core_enable()
nointx: written only in vfio_pci_core_enable()
needs_pm_restore: written only in vfio_pci_probe_power_state()
disable_idle_d3: written only at .init in vfio_pci_core_init_dev()
Dedicated storage units:
virq_disabled: written by guest INTx command writes in
vfio_basic_config_write() while the device is open
bardirty: written by guest BAR writes in vfio_basic_config_write()
while the device is open
pm_intx_masked: written in the runtime-PM suspend path.
pm_runtime_engaged: written by low-power feature entry/exit paths
needs_reset: set in vfio_pci_core_disable() and cleared for devices in
the set by vfio_pci_dev_set_try_reset()
sriov_active: written by vfio_pci_core_sriov_configure() via sysfs
sriov_numvfs while bound.
--- include/linux/vfio_pci_core.h | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
include/linux/vfio_pci_core.h +8 -5
@@ -60,6 +60,9 @@ struct vfio_pci_core_device {struct pci_dev *pdev;void __iomem *barmap[PCI_STD_NUM_BARS ];bool bar_mmap_supported[PCI_STD_NUM_BARS ]; +/* Flags modified at runtime - dedicated storage unit */ +bool virq_disabled; +bool bardirty;u8 *pci_config_map;u8 *vconfig;struct perm_bits *msi_perm;
@@ -74,19 +77,19 @@ struct vfio_pci_core_device {u16 msix_size;u32 msix_offset;u32 rbar[7 ]; +/* Flags only modified on setup/release - bitfield ok */ bool has_dyn_msix:1; bool pci_2_3:1; - bool virq_disabled:1; bool reset_works:1; bool extended_caps:1; - bool bardirty:1; bool has_vga:1; - bool needs_reset:1; bool nointx:1; bool needs_pm_restore:1; - bool pm_intx_masked:1; - bool pm_runtime_engaged:1; bool disable_idle_d3:1; +/* Flags modified at runtime - dedicated storage unit */ +bool needs_reset; +bool pm_intx_masked; +bool pm_runtime_engaged;bool sriov_active;struct pci_saved_state *pci_saved_state;struct pci_saved_state *pm_save;
Greg Kroah-Hartman
maintainerPATCH 91/349 vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <[email protected]>
commit a26b499b757cfc8bbff1088bb1b844639e250893 upstream.
vfio_mig_get_next_state() walks vfio_from_fsm_table[] one step at a time, looping to skip optional states the device does not support until *next_fsm is supported. A blocked transition is encoded as VFIO_DEVICE_STATE_ERROR, which the trailing return reports as -EINVAL.
The skip loop does not account for the ERROR sentinel. state_flags_table[ERROR] is ~0U and vfio_from_fsm_table[ERROR][*] is ERROR, so once *next_fsm becomes ERROR the loop condition stays true and *next_fsm never changes. The blocked arcs STOP_COPY -> PRE_COPY and STOP_COPY -> PRE_COPY_P2P map to ERROR yet pass the support check on a precopy-capable device, causing the loop to spin forever while holding the driver state mutex. This can result in a soft lockup, and a panic with softlockup_panic set.
Terminate the skip loop on the ERROR sentinel so a blocked transition falls through to the existing return and reports -EINVAL.
--- drivers/vfio/vfio_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/vfio/vfio_main.c +2 -1
@@ -845,7 +845,8 @@ int vfio_mig_get_next_state(struct vfio_* logical state, as per the above comment. */ *next_fsm = vfio_from_fsm_table[cur_fsm][new_fsm]; -while ((state_flags_table[*next_fsm] & device->migration_flags) != +while (*next_fsm !=VFIO_DEVICE_STATE_ERROR && + (state_flags_table[*next_fsm] & device->migration_flags) != state_flags_table[*next_fsm]) *next_fsm = vfio_from_fsm_table[*next_fsm][new_fsm];
Greg Kroah-Hartman
maintainerPATCH 92/349 vfio: Remove device debugfs before releasing devres
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
commit dc7fe87de492ea7f33a72b78d26650b75bf37f4f upstream.
VFIO device debugfs files created with debugfs_create_devm_seqfile() store a devres allocated debugfs_devm_entry as inode private data. vfio_unregister_group_dev() currently calls vfio_device_del() before vfio_device_debugfs_exit(), but device_del() releases devres. This can leave debugfs entries visible with stale inode private data while unregister waits for userspace references to drain.
Remove the per-device debugfs tree before vfio_device_del(). The debugfs view is diagnostic only, so losing it at the start of unregister is preferable to preserving entries whose backing storage may already have been released.
Complete the teardown by clearing the per-device debugfs root after removal. This matches the global debugfs root cleanup and prevents future users from mistaking a removed dentry for a live debugfs tree during the remainder of unregister.
--- drivers/vfio/debugfs.c | 1 + drivers/vfio/vfio_main.c | 8 +++++++- 2 files changed, 8 insertions(+), 1 deletion(-)
drivers/vfio/debugfs.c +1 -0
@@ -78,6 +78,7 @@ void vfio_device_debugfs_init(struct vfivoid vfio_device_debugfs_exit (struct vfio_device *vdev) {debugfs_remove_recursive (vdev->debug_root); + vdev->debug_root =NULL ; }void vfio_debugfs_create_root (void )
drivers/vfio/vfio_main.c +7 -1
@@ -395,6 +395,13 @@ void vfio_unregister_group_dev(struct vfvfio_device_group_unregister (device);/* +* Remove debugfs before device_del(), which releases devres. Some +* debugfs entries are created with debugfs_create_devm_seqfile() and +* therefore rely on devres-managed inode private data. +*/ +vfio_device_debugfs_exit (device); + +/* * Balances vfio_device_add() in register path, also prevents * new device opened by userspace in the cdev path. */
@@ -423,7 +430,6 @@ void vfio_unregister_group_dev(struct vf } } -vfio_device_debugfs_exit (device);/* Balances vfio_device_set_group in register path */ vfio_device_remove_group (device); }
Greg Kroah-Hartman
maintainerPATCH 93/349 Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zenm Chen <[email protected]>
commit 88b4d528eda4ac71c2952b3458f2abbc80a91cd2 upstream.
Add USB ID 2c4e:0128 for Mercusys MA60XNB, an RTL8851BU-based Wi-Fi + Bluetooth adapter.
The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below:
T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c4e ProdID=0128 Rev= 0.00 S: Manufacturer=Realtek S: Product=802.11ax WLAN Adapter S: SerialNumber=00e04c000001 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 8 Cls=ff(vend.) Sub=ff Prot=ff Driver=rtw89_8851bu E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/btusb.c +2 -0
@@ -521,6 +521,8 @@ static const struct usb_device_id quirks BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x7392, 0xe611), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x2c4e, 0x0128), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, /* Realtek 8852AE Bluetooth devices */ { USB_DEVICE(0x0bda, 0x2852), .driver_info = BTUSB_REALTEK |
Greg Kroah-Hartman
maintainerPATCH 94/349 Bluetooth: btusb: fix use-after-free on registration failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit eedc6867ebad73edbfaf9a0a65fbef7115cc4753 upstream.
Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected.
This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.
--- drivers/bluetooth/btusb.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/bluetooth/btusb.c +10 -1
@@ -4196,7 +4196,7 @@ static int btusb_probe(struct usb_interf err =hci_register_dev (hdev);if (err <0 ) - goto out_free_dev; + goto err_release_siblings;usb_set_intfdata (intf, data);
@@ -4205,6 +4205,15 @@ static int btusb_probe(struct usb_interfreturn 0 ; +err_release_siblings: +if (data->diag) { +usb_set_intfdata (data->diag,NULL ); +usb_driver_release_interface (&btusb_driver, data->diag); + } +if (data->isoc) { +usb_set_intfdata (data->isoc,NULL ); +usb_driver_release_interface (&btusb_driver, data->isoc); + } out_free_dev:if (data->reset_gpio)gpiod_put (data->reset_gpio);
Greg Kroah-Hartman
maintainerPATCH 95/349 Bluetooth: btusb: fix use-after-free on marvell probe failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit c5b600a3c05b1a7a110d558df935a8fc8a471c79 upstream.
Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion callback.
This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.
--- drivers/bluetooth/btusb.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/bluetooth/btusb.c +5 -3
@@ -4008,7 +4008,7 @@ static int btusb_probe(struct usb_interfif (id->driver_info &BTUSB_INTEL_COMBINED ) { err =btintel_configure_setup (hdev, btusb_driver.name);if (err) - goto out_free_dev; + goto err_kill_tx_urbs;/* Transport specific configuration */ hdev->send = btusb_send_frame_intel;
@@ -4170,7 +4170,7 @@ static int btusb_probe(struct usb_interf err =usb_set_interface (data->udev,0 ,0 );if (err <0 ) {BT_ERR ("failed to set interface 0, alt 0 %d" , err); - goto out_free_dev; + goto err_kill_tx_urbs; } }
@@ -4178,7 +4178,7 @@ static int btusb_probe(struct usb_interf err =usb_driver_claim_interface (&btusb_driver, data->isoc, data);if (err <0 ) - goto out_free_dev; + goto err_kill_tx_urbs; }if (IS_ENABLED (CONFIG_BT_HCIBTUSB_BCM ) && data->diag) {
@@ -4214,6 +4214,8 @@ err_release_siblings:usb_set_intfdata (data->isoc,NULL );usb_driver_release_interface (&btusb_driver, data->isoc); } +err_kill_tx_urbs: +usb_kill_anchored_urbs (&data->tx_anchor); out_free_dev:if (data->reset_gpio)gpiod_put (data->reset_gpio);
Greg Kroah-Hartman
maintainerPATCH 96/349 Bluetooth: btusb: fix wakeup source leak on probe failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 3d93e1bb0fb881fe3ef961d1120556658e9cac4d upstream.
Make sure to disable wakeup on probe failure to avoid leaking the wakeup source.
--- drivers/bluetooth/btusb.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/bluetooth/btusb.c +15 -3
@@ -2925,6 +2925,11 @@ static int marvell_config_oob_wake(strucreturn 0 ; } +#else +static inline int marvell_config_oob_wake (struct hci_dev *hdev) +{ +return 0 ; +}#endif static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
@@ -3739,6 +3744,11 @@ static int btusb_config_oob_wake(structbt_dev_info (hdev,"OOB Wake-on-BT configured at IRQ %u" , irq); return 0; } +#else +static inline int btusb_config_oob_wake (struct hci_dev *hdev) +{ +return 0 ; +}#endif static void btusb_check_needs_reset_resume (struct usb_interface *intf)
@@ -3962,7 +3972,6 @@ static int btusb_probe(struct usb_interf hdev->notify = btusb_notify; hdev->wakeup = btusb_wakeup; -#ifdef CONFIG_PM err =btusb_config_oob_wake (hdev);if (err) goto out_free_dev;
@@ -3971,9 +3980,9 @@ static int btusb_probe(struct usb_interfif (id->driver_info &BTUSB_MARVELL && data->oob_wake_irq) { err =marvell_config_oob_wake (hdev);if (err) - goto out_free_dev; + goto err_disable_wakeup; } -#endif +if (id->driver_info &BTUSB_CW6622 )set_bit (HCI_QUIRK_BROKEN_STORED_LINK_KEY , &hdev->quirks);
@@ -4216,6 +4225,9 @@ err_release_siblings: } err_kill_tx_urbs:usb_kill_anchored_urbs (&data->tx_anchor); +err_disable_wakeup: +if (data->oob_wake_irq) +device_init_wakeup (&data->udev->dev, false); out_free_dev:if (data->reset_gpio)gpiod_put (data->reset_gpio);
Greg Kroah-Hartman
maintainerPATCH 97/349 binder: fix UAF in binder_thread_release()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 114a116aaa5f0295376cdf12da743c5bce3b20ce upstream.
When a thread exits, binder_thread_release() walks its transaction stack to clear the t->from and t->to_proc that correspond with the exiting thread. However, a process dying in parallel might attempt to kfree some of these transactions. And if one of them has no associated t->to_proc, the t->to_proc->inner_lock will not be acquired.
This means that transaction accesses in binder_thread_release() after t->to_proc has been cleared might race with binder_free_transaction() and cause a use-after-free error as reported by KASAN:
==================================================================
BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798 Write of size 8 at addr ffff000016627500 by task X/715 CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: binder_thread_release+0x5d0/0x798 binder_ioctl+0x12c0/0x299c [...] Allocated by task 717 on cpu 18 at 67.267803s: __kasan_kmalloc+0xa0/0xbc __kmalloc_cache_noprof+0x174/0x444 binder_transaction+0x554/0x8150 binder_thread_write+0xa30/0x4354 binder_ioctl+0x20f0/0x299c [...] Freed by task 202 on cpu 18 at 90.416221s: __kasan_slab_free+0x58/0x80 kfree+0x1a0/0x4a4 binder_free_transaction+0x150/0x294 binder_send_failed_reply+0x398/0x6d8 binder_release_work+0x3e4/0x4ec binder_deferred_func+0xbd8/0x104c [...] ==================================================================
In order to avoid this, make sure that binder_free_transaction() reads the t->to_proc under the transaction lock. This will serialize the transaction release with the accesses in binder_thread_release(). Plus, it matches the documented locking rules for @to_proc.
--- drivers/android/binder.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/android/binder.c +5 -1
@@ -1654,7 +1654,11 @@ static void binder_txn_latency_free(strustatic void binder_free_transaction (struct binder_transaction *t) { -struct binder_proc *target_proc = t->to_proc; +struct binder_proc *target_proc; + +spin_lock (&t->lock); + target_proc = t->to_proc; +spin_unlock (&t->lock);if (target_proc) {binder_inner_proc_lock (target_proc);
Greg Kroah-Hartman
maintainerPATCH 98/349 binder: fix UAF in binder_free_transaction()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit f223d27a546c1e1f48d38fd67760e78f068fe8c4 upstream.
In binder_free_transaction(), the t->to_proc is read under the t->lock. However, once the t->lock is dropped, the to_proc can die in parallel. This leads to a use-after-free error when we attempt to acquire its inner lock right afterwards:
==================================================================
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0 Write of size 4 at addr ffff00001125da70 by task B/672 CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x1a0 binder_free_transaction+0x8c/0x320 binder_send_failed_reply+0x21c/0x2f8 binder_thread_release+0x488/0x7e0 binder_ioctl+0x12c0/0x29a0 [...] Allocated by task 675: __kmalloc_cache_noprof+0x174/0x444 binder_open+0x118/0xb70 do_dentry_open+0x374/0x1040 vfs_open+0x58/0x3bc [...] Freed by task 212: __kasan_slab_free+0x58/0x80 kfree+0x1a0/0x4a4 binder_proc_dec_tmpref+0x32c/0x5e0 binder_deferred_func+0xc48/0x104c process_one_work+0x53c/0xbc0 [...] ==================================================================
To prevent this, pin the target thread (t->to_thread) to guarantee the target process remains alive. Undelivered transactions without a target thread are already safe, as the target process can only be the current context in those paths.
--- drivers/android/binder.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/android/binder.c +13 -0
@@ -1654,10 +1654,19 @@ static void binder_txn_latency_free(strustatic void binder_free_transaction (struct binder_transaction *t) { +struct binder_thread *target_thread;struct binder_proc *target_proc;spin_lock (&t->lock); target_proc = t->to_proc; + target_thread = t->to_thread; +/* +* Pin target_thread to keep target_proc alive. Undelivered +* transactions with !target_thread are safe, as target_proc +* can only be the current context there. +*/ +if (target_thread) +atomic_inc (&target_thread->tmp_ref);spin_unlock (&t->lock);if (target_proc) {
@@ -1672,6 +1681,10 @@ static void binder_free_transaction(stru t->buffer->transaction =NULL ;binder_inner_proc_unlock (target_proc); } + +if (target_thread) +binder_thread_dec_tmpref (target_thread); +if (trace_binder_txn_latency_free_enabled ())binder_txn_latency_free (t);/*
Greg Kroah-Hartman
maintainerPATCH 99/349 usb: xhci: Fix sleep in atomic context in xhci_free_streams()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: 胡连勤 <[email protected]>
commit 42c37c4b75d38b51d84f31a8e29427f5e06a7c2a upstream.
When a USB device with active stream endpoints is disconnected, xhci_free_streams() is called from the hub_event workqueue to free the stream resources. It calls xhci_free_stream_info() while holding xhci->lock with irqs disabled.
xhci_free_stream_info() invokes xhci_free_stream_ctx(), which calls dma_free_coherent() for large stream context arrays.
dma_free_coherent() can sleep (e.g. via vunmap), triggering a BUG when called from atomic context.
Call trace: dma_free_attrs+0x174/0x220 xhci_free_stream_info+0xd0/0x11c xhci_free_streams+0x278/0x37c usb_free_streams+0x98/0xc0 usb_unbind_interface+0x1b8/0x2f8 device_release_driver_internal+0x1d4/0x2cc device_release_driver+0x18/0x28 bus_remove_device+0x160/0x1a4 device_del+0x1ec/0x350 usb_disable_device+0x98/0x214 usb_disconnect+0xf0/0x35c hub_event+0xab4/0x19ec process_one_work+0x278/0x63c
Fix this by saving the stream_info pointers and clearing the ep references under the lock, then calling xhci_free_stream_info() outside the lock where sleeping is allowed.
--- drivers/usb/host/xhci.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/usb/host/xhci.c +10 -1
@@ -3576,6 +3576,7 @@ static int xhci_free_streams(struct usb_struct xhci_virt_device *vdev;struct xhci_command *command;struct xhci_input_control_ctx *ctrl_ctx; +struct xhci_stream_info *stream_info[EP_CTX_PER_DEV ];unsigned int ep_index;unsigned long flags;u32 changed_ep_bitmask;
@@ -3636,10 +3637,15 @@ static int xhci_free_streams(struct usb_if (ret <0 )return ret; +/* +* dma_free_coherent() called by xhci_free_stream_info() may sleep, +* so save stream_info pointers and clear references under lock, +* then free the memory outside lock. +*/ spin_lock_irqsave (&xhci->lock, flags);for (i =0 ; i < num_eps; i++) { ep_index =xhci_get_endpoint_index (&eps[i]->desc); -xhci_free_stream_info (xhci, vdev->eps[ep_index].stream_info); + stream_info[i] = vdev->eps[ep_index].stream_info; vdev->eps[ep_index].stream_info =NULL ;/* FIXME Unset maxPstreams in endpoint context and * update deq ptr to point to normal string ring.
@@ -3649,6 +3655,9 @@ static int xhci_free_streams(struct usb_ }spin_unlock_irqrestore (&xhci->lock, flags); +for (i =0 ; i < num_eps; i++) +xhci_free_stream_info (xhci, stream_info[i]); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 100/349 usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <[email protected]>
commit e8da46d99d3710106e7c44db14566bf9b57386b5 upstream.
rt1711h_probe() registers the TCPCI port before requesting the interrupt and enabling alert interrupts. If either of those later steps fails, the probe function returns without unregistering the TCPCI port. The explicit unregister currently only happens from the remove callback.
Register a devres action immediately after tcpci_register_port() succeeds, so tcpci_unregister_port() runs on later probe failures and on driver detach. Drop the remove callback to avoid unregistering the same port twice.
This issue was identified during our ongoing static-analysis research while reviewing kernel code.
--- drivers/usb/typec/tcpm/tcpci_rt1711h.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/usb/typec/tcpm/tcpci_rt1711h.c +8 -5
@@ -330,6 +330,8 @@ static int rt1711h_check_revision(structreturn ret; } +static void rt1711h_unregister_tcpci_port (void *tcpci); +static int rt1711h_probe (struct i2c_client *client) {int ret;
@@ -381,6 +383,10 @@ static int rt1711h_probe(struct i2c_clieif (IS_ERR_OR_NULL (chip->tcpci))return PTR_ERR (chip->tcpci); + ret =devm_add_action_or_reset (chip->dev, rt1711h_unregister_tcpci_port, chip->tcpci); +if (ret) +return ret; + ret = devm_request_threaded_irq(chip->dev, client->irq, NULL, rt1711h_irq, IRQF_ONESHOT | IRQF_TRIGGER_LOW,
@@ -398,11 +404,9 @@ static int rt1711h_probe(struct i2c_cliereturn 0 ; } -static void rt1711h_remove (struct i2c_client *client) +static void rt1711h_unregister_tcpci_port (void *tcpci) { -struct rt1711h_chip *chip =i2c_get_clientdata (client); - -tcpci_unregister_port (chip->tcpci); +tcpci_unregister_port (tcpci); }static const struct rt1711h_chip_info rt1711h = {
@@ -435,7 +439,6 @@ static struct i2c_driver rt1711h_i2c_dri .of_match_table = rt1711h_of_match, }, .probe = rt1711h_probe, - .remove = rt1711h_remove, .id_table = rt1711h_id, };module_i2c_driver (rt1711h_i2c_driver);
Greg Kroah-Hartman
maintainerPATCH 101/349 PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyao Li <[email protected]>
commit e373c789bac0ad73b472d8b44714df3bd18a4edf upstream.
Older steppings of the Loongson-3C6000 series incorrectly report the supported link speeds on their PCIe bridges (device IDs 0x3c19, 0x3c29) as only 2.5 GT/s, despite the upstream bus supporting speeds from 2.5 GT/s up to 16 GT/s.
As a result, since commit 774c71c52aa4 ("PCI/bwctrl: Enable only if more than one speed is supported"), bwctrl will be disabled if there's only one 2.5 GT/s value in vector 'supported_speeds'.
Manually override the 'supported_speeds' field for affected PCIe bridges with those found on the upstream bus to correctly reflect the supported link speeds. Updating the speeds to reflect what the hardware actually supports avoids quirks in drivers consuming the speed information.
This commit was originally found from AOSC OS[1].
--- drivers/pci/controller/pci-loongson.c | 36 ++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+)
drivers/pci/controller/pci-loongson.c +36 -0
@@ -176,6 +176,42 @@ static void loongson_pci_msi_quirk(struc }DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_LOONGSON ,DEV_LS7A_PCIE_PORT5 , loongson_pci_msi_quirk); +/* +* Older steppings of the Loongson-3C6000 series incorrectly report the +* supported link speeds on their PCIe bridges (device IDs 0x3c19, +* 0x3c29) as only 2.5 GT/s, despite the upstream bus supporting speeds +* from 2.5 GT/s up to 16 GT/s. +*/ +static void loongson_pci_bridge_speed_quirk (struct pci_dev *pdev) +{ +u8 old_supported_speeds = pdev->supported_speeds; + +switch (pdev->bus->max_bus_speed) { +case PCIE_SPEED_16_0GT : + pdev->supported_speeds |=PCI_EXP_LNKCAP2_SLS_16_0GB ; + fallthrough; +case PCIE_SPEED_8_0GT : + pdev->supported_speeds |=PCI_EXP_LNKCAP2_SLS_8_0GB ; + fallthrough; +case PCIE_SPEED_5_0GT : + pdev->supported_speeds |=PCI_EXP_LNKCAP2_SLS_5_0GB ; + fallthrough; +case PCIE_SPEED_2_5GT : + pdev->supported_speeds |=PCI_EXP_LNKCAP2_SLS_2_5GB ; +break ; +default : +pci_warn (pdev,"unexpected max bus speed" ); + +return ; + } + +if (pdev->supported_speeds != old_supported_speeds) +pci_info (pdev,"fixed up supported link speeds: 0x%x => 0x%x" , + old_supported_speeds, pdev->supported_speeds); +} +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_LOONGSON ,0x3c19 , loongson_pci_bridge_speed_quirk); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_LOONGSON ,0x3c29 , loongson_pci_bridge_speed_quirk); +static struct loongson_pci *pci_bus_to_loongson_pci (struct pci_bus *bus) {struct pci_config_window *cfg;
Greg Kroah-Hartman
maintainerPATCH 102/349 PCI: altera: Do not dispose parent IRQ mapping
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Vaidya <[email protected]>
commit 5ef4bac02189bee0b7c170e352d7a38e13fe9678 upstream.
altera_pcie_irq_teardown() calls irq_dispose_mapping() on pcie->irq. However, pcie->irq is the parent IRQ returned by platform_get_irq(), not the mapping created by Altera INTx irq_domain.
The Altera driver only sets the chained handler on the parent IRQ. It should detach that handler during teardown, but it should not dispose the parent IRQ mapping, which belongs to the parent interrupt controller's irq_domain.
Drop irq_dispose_mapping(pcie->irq) from the teardown path.
Note that during irqchip remove(), the child IRQs should've disposed. But since the chained handler itself is removed, there is no way the stale child IRQs (if exists) could fire. So it is safe here.
--- drivers/pci/controller/pcie-altera.c | 1 - 1 file changed, 1 deletion(-)
drivers/pci/controller/pcie-altera.c +0 -1
@@ -683,7 +683,6 @@ static void altera_pcie_irq_teardown(str {irq_set_chained_handler_and_data (pcie->irq,NULL ,NULL );irq_domain_remove (pcie->irq_domain); -irq_dispose_mapping (pcie->irq); }static int altera_pcie_parse_dt (struct altera_pcie *pcie)
Greg Kroah-Hartman
maintainerPATCH 103/349 PCI: host-common: Request bus reassignment when not probe-only
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ratheesh Kannoth <[email protected]>
commit fda8749ba73638f5bbca3ffb39bc6861eb3b23fa upstream.
pci_host_common_init() is used by several generic ECAM host drivers. After PCI core changes around pci_flags and preserve_config, these hosts no longer opted into full bus number reassignment the way they did before, which broke enumeration of devices on a Marvell CN106XX board.
When PCI_PROBE_ONLY is not set, add PCI_REASSIGN_ALL_BUS so pci_scan_bridge_extend() takes the reassignment path: bus numbers can be assigned from firmware EA data (e.g. pci_ea_fixed_busnrs()). Skip the flag in probe-only mode so existing assignments are not overridden.
--- drivers/pci/controller/pci-host-common.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/pci/controller/pci-host-common.c +4 -0
@@ -73,6 +73,10 @@ int pci_host_common_probe(struct platforif (IS_ERR (cfg))return PTR_ERR (cfg); +/* Do not reassign bus numbers if probe only */ +if (!pci_has_flag (PCI_PROBE_ONLY )) +pci_add_flags (PCI_REASSIGN_ALL_BUS ); + bridge->sysdata = cfg; bridge->ops = (struct pci_ops *)&ops->pci_ops; bridge->msi_domain = true;
Greg Kroah-Hartman
maintainerPATCH 104/349 PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Zhu <[email protected]>
commit aad953fb4eed0df5486cd54ccad80ac197678e01 upstream.
The IMX6SX_GPR12_PCIE_TEST_POWERDOWN bit does not control the PCIe reference clock on i.MX6SX. Instead, it is part of i.MX6SX PCIe core reset sequence.
Move the IMX6SX_GPR12_PCIE_TEST_POWERDOWN assertion/deassertion into the core reset functions to properly reflect its purpose. Remove the .enable_ref_clk() callback for i.MX6SX since it was incorrectly manipulating this bit.
--- drivers/pci/controller/dwc/pci-imx6.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-)
drivers/pci/controller/dwc/pci-imx6.c +3 -9
@@ -612,14 +612,6 @@ static int imx_pcie_attach_pd(struct devreturn 0 ; } -static int imx6sx_pcie_enable_ref_clk (struct imx_pcie *imx_pcie,bool enable) -{ -regmap_update_bits (imx_pcie->iomuxc_gpr,IOMUXC_GPR12 , -IMX6SX_GPR12_PCIE_TEST_POWERDOWN , - enable ?0 :IMX6SX_GPR12_PCIE_TEST_POWERDOWN ); -return 0 ; -} -static int imx6q_pcie_enable_ref_clk (struct imx_pcie *imx_pcie,bool enable) {if (enable) {
@@ -702,6 +694,9 @@ static int imx6sx_pcie_core_reset(structif (assert)regmap_set_bits (imx_pcie->iomuxc_gpr,IOMUXC_GPR12 ,IMX6SX_GPR12_PCIE_TEST_POWERDOWN ); +else +regmap_clear_bits (imx_pcie->iomuxc_gpr,IOMUXC_GPR12 , +IMX6SX_GPR12_PCIE_TEST_POWERDOWN );/* Force PCIe PHY reset */ regmap_update_bits(imx_pcie->iomuxc_gpr, IOMUXC_GPR5, IMX6SX_GPR5_PCIE_BTNRST_RESET,
@@ -1578,7 +1573,6 @@ static const struct imx_pcie_drvdata drv .mode_off[0] = IOMUXC_GPR12, .mode_mask[0] = IMX6Q_GPR12_DEVICE_TYPE, .init_phy = imx6sx_pcie_init_phy, - .enable_ref_clk = imx6sx_pcie_enable_ref_clk, .core_reset = imx6sx_pcie_core_reset, }, [IMX6QP] = {
Greg Kroah-Hartman
maintainerPATCH 105/349 mm/damon/ops-common: handle extreme intervals in damon_hot_score()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
commit 35d4a3cf70a855b50e53189ac2f8463e20a02046 upstream.
Fix three issues in damon_hot_score() that comes from wrong handling of extreme (zero or too high) monitoring intervals user setup.
When the user sets sampling interval zero, damon_max_nr_accesses(), which is called from damon_hot_score(), causes a divide-by-zero. Needless to say, it is a problem.
When the user sets the aggregation interval zero, the function returns zero. It is wrong, since the real maximum nr_acceses in the setup should be one. Worse yet, it can cause another divide-by-zero from its caller, damon_hot_score(), since it uses damon_max_nr_accesses() return value as a denominator.
When the user sets the aggregation interval very high, damon_hot_score() could return a value out of [0, DAMOS_MAX_SCORE] range. Since the return value is used as an index to the regions_score_histogram array, which is DAMOS_MAX_SCORE+1 size, it causes out of bounds array access.
The issues can be relatively easily reproduced like below. The sysfs write permission is required, though.
# ./damo start --damos_action lru_prio --damos_quota_space 100M \
--damos_quota_interval 1s
# cd /sys/kernel/mm/damon/admin/kdamonds/0
# echo 0 > contexts/0/monitoring_attrs/intervals/sample_us
# echo 0 > contexts/0/monitoring_attrs/intervals/aggr_us
# echo commit > state
# dmesg
[...]
[ 131.329762] Oops: divide error: 0000 [#1] SMP NOPTI
[...]
[ 131.336089] RIP: 0010:damon_hot_score+0x27/0xd0
[...]Fix the divide-by-zero intervals problems by explicitly handling the zero intervals in damon_max_nr_accesses(). Fix the out-of-bound array access by applying [0, DAMOS_MAX_SCORE] bounds before returning from damon_hot_score().
The issue was discovered [1] by Sashiko.
--- include/linux/damon.h | 8 ++++++-- mm/damon/ops-common.c | 1 + 2 files changed, 7 insertions(+), 2 deletions(-)
include/linux/damon.h +6 -2
@@ -770,9 +770,13 @@ static inline bool damon_target_has_pid(static inline unsigned int damon_max_nr_accesses (const struct damon_attrs *attrs) { -/* {aggr,sample}_interval are unsigned long, hence could overflow */ -return min (attrs->aggr_interval / attrs->sample_interval, +unsigned long sample_interval; +unsigned long max_nr_accesses; + + sample_interval = attrs->sample_interval ? :1 ; + max_nr_accesses =min (attrs->aggr_interval / sample_interval, (unsigned long )UINT_MAX ); +return max_nr_accesses ? :1 ; }
mm/damon/ops-common.c +1 -0
@@ -107,6 +107,7 @@ int damon_hot_score(struct damon_ctx *c,* Transform it to fit in [0, DAMOS_MAX_SCORE] */ hotness = hotness *DAMOS_MAX_SCORE /DAMON_MAX_SUBSCORE ; + hotness =max (min (hotness,DAMOS_MAX_SCORE ),0 );return hotness; }
Greg Kroah-Hartman
maintainerPATCH 106/349 netfilter: ipset: fix race between dump and ip_set_list resize
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
commit 7cd9103283b26b917360ec99d7d2f2d761bcf1ab upstream.
The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the array pointer. These run from netlink_recvmsg() without the nfnl mutex and without an RCU read-side critical section.
A concurrent ip_set_create() can grow the array: it publishes the new array, calls synchronize_net() and then kvfree()s the old one. Since the dump paths read the array outside any RCU reader, synchronize_net() does not wait for them and the old array can be freed while they still index into it, causing a use-after-free.
The dumped set itself stays pinned via set->ref_netlink, so only the array load needs protecting. Take rcu_read_lock() around it, matching ip_set_get_byname() and __ip_set_put_byindex().
BUG: KASAN: slab-use-after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) Read of size 8 at addr ffff88800b5c4018 by task exploit/150 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) netlink_dump (net/netlink/af_netlink.c:2325) netlink_recvmsg (net/netlink/af_netlink.c:1976) sock_recvmsg (net/socket.c:1159) __sys_recvfrom (net/socket.c:2315) ... Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI KASAN: maybe wild-memory-access in range [0x02d6...d0-0x02d6...d7] RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698) Kernel panic - not syncing: Fatal exception
--- net/netfilter/ipset/ip_set_core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/netfilter/ipset/ip_set_core.c +7 -1
@@ -1480,7 +1480,11 @@ ip_set_dump_done(struct netlink_callbackstruct ip_set_net *inst = (struct ip_set_net *)cb->args[IPSET_CB_NET ];ip_set_id_t index = (ip_set_id_t )cb->args[IPSET_CB_INDEX ]; -struct ip_set *set =ip_set_ref_netlink (inst, index); +struct ip_set *set; + +rcu_read_lock (); + set =ip_set_ref_netlink (inst, index); +rcu_read_unlock ();if (set->variant->uref) set->variant->uref (set, cb, false);
@@ -1685,7 +1689,9 @@ next_set: release_refcount:/* If there was an error or set is done, release set */ if (ret || !cb->args[IPSET_CB_ARG0 ]) { +rcu_read_lock (); set =ip_set_ref_netlink (inst, index); +rcu_read_unlock ();if (set->variant->uref) set->variant->uref (set, cb, false);pr_debug ("release set %s\n" , set->name);
Greg Kroah-Hartman
maintainerPATCH 107/349 virtio_pci: fix vq info pointer lookup via wrong index
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ammar Faizi <[email protected]>
commit f7d380fb525c13bdd114369a1979c80c346e6abc upstream.
Unbinding a virtio balloon device:
echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind
triggers a NULL pointer dereference. The dmesg says:
BUG: kernel NULL pointer dereference, address: 0000000000000008
[...]
RIP: 0010:__list_del_entry_valid_or_report+0x5/0xf0
Call Trace:
<TASK>
vp_del_vqs+0x121/0x230
remove_common+0x135/0x150
virtballoon_remove+0xee/0x100
virtio_dev_remove+0x3b/0x80
device_release_driver_internal+0x187/0x2c0
unbind_store+0xb9/0xe0
kernfs_fop_write_iter.llvm.11660790530567441834+0xf6/0x180
vfs_write+0x2a9/0x3b0
ksys_write+0x5c/0xd0
do_syscall_64+0x54/0x230
entry_SYSCALL_64_after_hwframe+0x29/0x31
[...]
</TASK>The virtio_balloon device registers 5 queues (inflate, deflate, stats, free_page, reporting) but only the first two are unconditional. The stats, free_page and reporting queues are each conditional on their respective feature bits. When any of these features are absent, the corresponding vqs_info entry has name == NULL, creating holes in the array.
The root cause is an indexing mismatch introduced when vq info storage was changed to be passed as an argument. vp_find_vqs_msix() and vp_find_vqs_intx() store the info pointer at vp_dev->vqs[i], where 'i' is the caller's sparse array index. However, the virtqueue itself gets vq->index assigned from queue_idx, a dense index that skips NULL entries. When holes exist, 'i' and queue_idx diverge. Later, vp_del_vqs() looks up info via vp_dev->vqs[vq->index] using the dense index into the sparsely-populated array, and hits NULL.
Fix this by storing info at vp_dev->vqs[queue_idx] instead of vp_dev->vqs[i], so the store index matches the lookup index (vq->index). Apply the fix to both the MSIX and INTX paths.
Message-Id: <[email protected]>
--- drivers/virtio/virtio_pci_common.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/virtio/virtio_pci_common.c +6 -4
@@ -426,10 +426,11 @@ static int vp_find_vqs_msix(struct virti vqs[i] =NULL ;continue ; } - vqs[i] =vp_find_one_vq_msix (vdev, queue_idx++, vqi->callback, + vqs[i] =vp_find_one_vq_msix (vdev, queue_idx, vqi->callback, vqi->name, vqi->ctx, false, &allocated_vectors, vector_policy, - &vp_dev->vqs[i]); + &vp_dev->vqs[queue_idx]); + queue_idx++;if (IS_ERR (vqs[i])) { err =PTR_ERR (vqs[i]); goto error_find;
@@ -488,9 +489,10 @@ static int vp_find_vqs_intx(struct virti vqs[i] =NULL ;continue ; } - vqs[i] =vp_setup_vq (vdev, queue_idx++, vqi->callback, + vqs[i] =vp_setup_vq (vdev, queue_idx, vqi->callback, vqi->name, vqi->ctx, -VIRTIO_MSI_NO_VECTOR , &vp_dev->vqs[i]); +VIRTIO_MSI_NO_VECTOR , &vp_dev->vqs[queue_idx]); + queue_idx++;if (IS_ERR (vqs[i])) { err =PTR_ERR (vqs[i]); goto out_del_vqs;
Greg Kroah-Hartman
maintainerPATCH 108/349 virtio-mmio: fix device release warning on module unload
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit c687bc35694698ec4c7f92bf929c3d659f0cecb8 upstream.
Driver core expects devices to be allocated dynamically and complains loudly when a device that lacks a release function is freed.
Use __root_device_register() to allocate and register the root device instead of open coding using a static device.
Note that root_device_register(), which also creates a link to the module, cannot be used as the device is registered when parsing the module parameters which happens before the module kobject has been set up.
Message-ID: <[email protected]>
--- drivers/virtio/virtio_mmio.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-)
drivers/virtio/virtio_mmio.c +13 -13
@@ -708,9 +708,7 @@ static void virtio_mmio_remove(struct pl#if defined(CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES ) -static struct device vm_cmdline_parent = { - .init_name ="virtio-mmio-cmdline" , -}; +static struct device *vm_cmdline_parent;static int vm_cmdline_parent_registered;static int vm_cmdline_id;
@@ -718,7 +716,6 @@ static int vm_cmdline_id;static int vm_cmdline_set (const char *device,const struct kernel_param *kp) { -int err;struct resource resources[2 ] = {};char *str;long long base, size;
@@ -750,11 +747,10 @@ static int vm_cmdline_set(const char *de resources[1 ].start = resources[1 ].end = irq;if (!vm_cmdline_parent_registered) { - err =device_register (&vm_cmdline_parent); -if (err) { -put_device (&vm_cmdline_parent); + vm_cmdline_parent =__root_device_register ("virtio-mmio-cmdline" ,NULL ); +if (IS_ERR (vm_cmdline_parent)) {pr_err ("Failed to register parent device!\n" ); -return err; +return PTR_ERR (vm_cmdline_parent); } vm_cmdline_parent_registered =1 ; }
@@ -765,7 +761,7 @@ static int vm_cmdline_set(const char *de (unsigned long long )resources[0 ].end, (int)resources[1].start); - pdev =platform_device_register_resndata (&vm_cmdline_parent, + pdev =platform_device_register_resndata (vm_cmdline_parent,"virtio-mmio" , vm_cmdline_id++, resources,ARRAY_SIZE (resources),NULL ,0 );
@@ -789,8 +785,12 @@ static int vm_cmdline_get_device(structstatic int vm_cmdline_get (char *buffer,const struct kernel_param *kp) { buffer[0 ] ='\0' ; -device_for_each_child (&vm_cmdline_parent, buffer, - vm_cmdline_get_device); + +if (vm_cmdline_parent_registered) { +device_for_each_child (vm_cmdline_parent, buffer, + vm_cmdline_get_device); + } +return strlen (buffer) +1 ; }
@@ -812,9 +812,9 @@ static int vm_unregister_cmdline_device(static void vm_unregister_cmdline_devices (void ) {if (vm_cmdline_parent_registered) { -device_for_each_child (&vm_cmdline_parent,NULL , +device_for_each_child (vm_cmdline_parent,NULL , vm_unregister_cmdline_device); -device_unregister (&vm_cmdline_parent); +root_device_unregister (vm_cmdline_parent); vm_cmdline_parent_registered =0 ; } }
Greg Kroah-Hartman
maintainerPATCH 109/349 hwrng: virtio: clamp device-reported used.len at copy_data()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
commit e3046eeada299f917a8ad883af4434bfb86556b1 upstream.
random_recv_done() stores the device-reported used.len directly into vi->data_avail. copy_data() then indexes vi->data[] using vi->data_idx (advanced by previous copy_data() calls) and issues a memcpy() without re-validating either value against the posted buffer size sizeof(vi->data) (SMP_CACHE_BYTES bytes, typically 32 or 64).
A malicious or buggy virtio-rng backend can set used.len beyond sizeof(vi->data), steering the memcpy() past the end of the inline array into adjacent kmalloc-1k slab bytes. hwrng_fillfn() mixes those bytes into the guest RNG, and guest root can also observe them directly via /dev/hwrng.
Concrete impact is inside the guest:
- Memory-safety / hardening: any virtio-rng backend that over-reports used.len causes the driver to read past vi->data into unrelated slab contents. hwrng_fillfn() is a kernel thread that runs as soon as the device is probed; no guest userspace interaction is required to first-trigger the OOB.
- Cross-boundary leak (confidential-compute threat model): a malicious hypervisor cooperating with a malicious or compromised guest root userspace can use /dev/hwrng as a leak channel for guest-kernel heap data. The host sets a large used.len, guest root reads /dev/hwrng, and the returned bytes contain guest kernel slab contents that were adjacent to vi->data. In practice, confidential-compute guests (SEV-SNP, TDX) usually disable virtio-rng entirely, so this path is narrow, but the fix is still worth carrying because the underlying memory-safety bug contaminates the guest RNG on any host.
KASAN confirms the OOB on a 7.1-rc4 guest whose virtio-rng backend has been patched to report used.len = 0x10000:
BUG: KASAN: slab-out-of-bounds in virtio_read+0x394/0x5d0 Read of size 64 at addr ffff88800ae0ba20 by task hwrng/52 Call Trace: __asan_memcpy+0x23/0x60 virtio_read+0x394/0x5d0 hwrng_fillfn+0xb2/0x470 kthread+0x2cc/0x3a0 Allocated by task 1: probe_common+0xa5/0x660 virtio_dev_probe+0x549/0xbc0 The buggy address belongs to the object at ffff88800ae0b800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 0 bytes to the right of allocated 544-byte region [ffff88800ae0b800, ffff88800ae0ba20)
Same class of bug as commit c04db81cd028 ("net/9p: Fix buffer overflow in USB transport layer"), which hardened usb9pfs_rx_complete() against unchecked device-reported length in the USB 9p transport.
With the clamp at point of use and array_index_nospec() in place, the same harness boots cleanly: copy_data() returns zero for the bogus report, the device-supplied bytes after data_idx are discarded, and the driver issues a fresh request.
Message-ID: <[email protected]>
--- drivers/char/hw_random/virtio-rng.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
drivers/char/hw_random/virtio-rng.c +21 -2
@@ -7,6 +7,7 @@#include <asm/barrier.h> #include <linux/err.h> #include <linux/hw_random.h> +#include <linux/nospec.h> #include <linux/scatterlist.h> #include <linux/spinlock.h> #include <linux/virtio.h>
@@ -66,8 +67,26 @@ static void request_entropy(struct virtrstatic unsigned int copy_data (struct virtrng_info *vi,void *buf,unsigned int size) { - size = min_t(unsigned int, size, vi->data_avail); -memcpy (buf, vi->data + vi->data_idx, size); +unsigned int idx, avail; + +/* +* vi->data_avail was set from the device-reported used.len and +* vi->data_idx was advanced by previous copy_data() calls. A +* malicious or buggy virtio-rng backend can drive either past +* sizeof(vi->data). Clamp at point of use and harden the index +* with array_index_nospec() so the memcpy() below cannot be +* steered into adjacent slab memory, including under +* speculation. +*/ + avail = min_t(unsigned int, vi->data_avail, sizeof(vi->data)); +if (vi->data_idx >= avail) { + vi->data_avail =0 ; +request_entropy (vi); +return 0 ; + } + size = min_t(unsigned int, size, avail - vi->data_idx); + idx =array_index_nospec (vi->data_idx,sizeof (vi->data)); +memcpy (buf, vi->data + idx, size); vi->data_idx += size; vi->data_avail -= size;if (vi->data_avail ==0 )
Greg Kroah-Hartman
maintainerPATCH 110/349 USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit abf76d3239dee97b66e7241ad04811f1ce562e28 upstream.
The chaoskey driver has a use-after-free bug in its release routine. If the user closes the device file after the USB device has been unplugged, a debugging log statement will try to access the usb_interface structure after it has been deallocated:
BUG: KASAN: slab-use-after-free in dev_driver_string (drivers/base/core.c:2406) Read of size 8 at addr ffff888168e8a0b8 by task chaoskey_raw_re/10106 Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) dev_driver_string (drivers/base/core.c:2406) __dynamic_dev_dbg (lib/dynamic_debug.c:906) chaoskey_release (drivers/usb/misc/chaoskey.c:323) __fput (fs/file_table.c:510) fput_close_sync (fs/file_table.c:615) __x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
The driver's last reference to the interface structure is dropped in the chaoskey_free() routine, so the code must not use the interface -- even in a debugging statement -- after that routine returns. (Exception: If we know that another reference is held by someone else, such as the device core while the disconnect routine runs, there's no problem. Thanks to Johan Hovold for pointing this out.)
Since the bad access is part of an unimportant debugging statement, we can fix the problem simply by removing the whole statement.
--- drivers/usb/misc/chaoskey.c | 1 - 1 file changed, 1 deletion(-)
drivers/usb/misc/chaoskey.c +0 -1
@@ -320,7 +320,6 @@ bail:mutex_unlock (&dev->lock); destruction:mutex_unlock (&chaoskey_list_lock); -usb_dbg (interface,"release success" );return rv; }
Greg Kroah-Hartman
maintainerPATCH 111/349 usb: dwc3: run gadget disconnect from sleepable suspend context
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <[email protected]>
commit 010382937fb69892b3469ac4d30af072262f59e8 upstream.
dwc3_gadget_suspend() takes dwc->lock with IRQs disabled and then calls dwc3_disconnect_gadget(). For async callbacks that helper only uses plain spin_unlock()/spin_lock(), so the gadget ->disconnect() callback still runs with IRQs disabled and any sleepable callback trips Lockdep.
This issue was found by our static analysis tool and then manually reviewed against the current tree.
The grounded PoC kept the dwc3_gadget_suspend() -> dwc3_disconnect_gadget() -> gadget_driver->disconnect() chain, and Lockdep reported:
BUG: sleeping function called from invalid context gadget_disconnect+0x21/0x39 [vuln_msv] dwc3_gadget_suspend.constprop.0+0x2b/0x42 [vuln_msv]
Keep the disconnect callback selection in one common helper, but add a sleepable suspend-side wrapper which snapshots the callback under dwc->lock and then runs it after spin_unlock_irqrestore(). The regular event path still uses the existing spin_unlock()/spin_lock() window.
--- drivers/usb/dwc3/gadget.c | 43 ++++++++++++++++++++++++++++++++++++------- 1 file changed, 36 insertions(+), 7 deletions(-)
drivers/usb/dwc3/gadget.c +36 -7
@@ -3902,15 +3902,48 @@ static void dwc3_endpoint_interrupt(stru } } +static bool dwc3_prepare_disconnect_gadget (struct dwc3 *dwc, +struct usb_gadget_driver **driver, +struct usb_gadget **gadget) +{ +if (!dwc->async_callbacks || !dwc->gadget_driver || + !dwc->gadget_driver->disconnect) +return false; + + *driver = dwc->gadget_driver; + *gadget = dwc->gadget; + +return true; +} +static void dwc3_disconnect_gadget (struct dwc3 *dwc) { -if (dwc->async_callbacks && dwc->gadget_driver->disconnect) { +struct usb_gadget_driver *driver; +struct usb_gadget *gadget; + +if (dwc3_prepare_disconnect_gadget (dwc, &driver, &gadget)) {spin_unlock (&dwc->lock); - dwc->gadget_driver->disconnect (dwc->gadget); + driver->disconnect (gadget);spin_lock (&dwc->lock); } } +static void dwc3_disconnect_gadget_sleepable (struct dwc3 *dwc) +{ +struct usb_gadget_driver *driver; +struct usb_gadget *gadget; +unsigned long flags; + +spin_lock_irqsave (&dwc->lock, flags); +if (!dwc3_prepare_disconnect_gadget (dwc, &driver, &gadget)) { +spin_unlock_irqrestore (&dwc->lock, flags); +return ; + } + +spin_unlock_irqrestore (&dwc->lock, flags); + driver->disconnect (gadget); +} +static void dwc3_suspend_gadget (struct dwc3 *dwc) {if (dwc->async_callbacks && dwc->gadget_driver->suspend) {
@@ -4804,7 +4837,6 @@ void dwc3_gadget_exit(struct dwc3 *dwc)int dwc3_gadget_suspend (struct dwc3 *dwc) { -unsigned long flags;int ret; ret =dwc3_gadget_soft_disconnect (dwc);
@@ -4818,10 +4850,7 @@ int dwc3_gadget_suspend(struct dwc3 *dwcreturn -EAGAIN ; } -spin_lock_irqsave (&dwc->lock, flags); -if (dwc->gadget_driver) -dwc3_disconnect_gadget (dwc); -spin_unlock_irqrestore (&dwc->lock, flags); +dwc3_disconnect_gadget_sleepable (dwc);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 112/349 6lowpan: fix NHC entry use-after-free on error path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <[email protected]>
commit 1720db928e5a58ca7d75ac1d514c3b73fd7061a7 upstream.
lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding lowpan_nhc_lock. If the descriptor has no uncompress callback, the error path drops the lock before printing nhc->name.
lowpan_nhc_del() removes descriptors under the same lock and then relies on synchronize_net() before the owning module can be unloaded. That only waits for net RX RCU readers. lowpan_header_decompress() is also exported and can be reached from callers that are not necessarily covered by the net core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive path.
This leaves a race where one task drops lowpan_nhc_lock in the error path, another task unregisters and frees the matching descriptor after synchronize_net() returns, and the first task then dereferences nhc->name for the warning.
With the post-unlock window widened, KASAN reports:
BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220 Read of size 8 lowpan_nhc_do_uncompression lowpan_header_decompress
Fix this by printing the warning before dropping lowpan_nhc_lock, so the descriptor name is read while unregister is still excluded. The malformed packet is still rejected with -ENOTSUPP.
--- net/6lowpan/nhc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/6lowpan/nhc.c +1 -1
@@ -117,9 +117,9 @@ int lowpan_nhc_do_uncompression(struct sreturn ret; } }else { -spin_unlock_bh (&lowpan_nhc_lock);netdev_warn (dev,"received nhc id for %s which is not implemented.\n" , nhc->name); +spin_unlock_bh (&lowpan_nhc_lock);return -ENOTSUPP ; } }else {
Greg Kroah-Hartman
maintainerPATCH 113/349 tipc: fix out-of-bounds read in broadcast Gap ACK blocks
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Page <[email protected]>
commit 2b66974a1b6134a4bbc3bfed181f7418f688eb54 upstream.
A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its data area. tipc_get_gap_ack_blks() only verifies that the record's len field is self-consistent with its ugack_cnt/bgack_cnt counts (sz == struct_size(p, gacks, ugack_cnt + bgack_cnt)); it does not check that the record actually fits in the message data area, msg_data_sz().
The unicast caller tipc_link_proto_rcv() bounds it ("if (glen > dlen) break;"), but the broadcast caller tipc_bcast_sync_rcv() discards the returned size, so tipc_link_advance_transmq() copies the record off the receive skb with an attacker-controlled count:
this_ga = kmemdup(ga, struct_size(ga, gacks, ga->bgack_cnt), GFP_ATOMIC);
A TIPC neighbour that negotiated TIPC_GAP_ACK_BLOCK triggers it with one ordinary broadcast STATE_MSG (msg_bc_ack_invalid() clear), sized so its data area is short, carrying a Gap ACK record with len = 0x400, bgack_cnt = 0xff and ugack_cnt = 0. len then equals struct_size(p, gacks, 255), so the consistency check passes and ga is non-NULL; kmemdup() reads struct_size(ga, gacks, 255) = 1024 bytes out of the much smaller skb:
BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x48/0x60 Read of size 1024 at addr ffff0000c7030d38 by task poc864/69 Call trace: kmemdup_noprof+0x48/0x60 tipc_link_advance_transmq+0x86c/0xb80 tipc_link_bc_ack_rcv+0x19c/0x1e0 tipc_bcast_sync_rcv+0x1c4/0x2c4 tipc_rcv+0x85c/0x1340 tipc_l2_rcv_msg+0xac/0x104 The buggy address belongs to the object at ffff0000c7030d00 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 56 bytes inside of allocated 704-byte region [ffff0000c7030d00, ffff0000c7030fc0)
The copied-out bytes are subsequently consumed as gap/ack values, but the read is already out of bounds at the kmemdup() regardless of how they are used.
The unicast STATE path drops such a message: "if (glen > dlen) break;" skips the rest of STATE_MSG handling and the skb is freed. Make the broadcast path drop it too. tipc_bcast_sync_rcv() now bounds the record against msg_data_sz() and, when it does not fit, reports it back through tipc_node_bc_sync_rcv() to tipc_rcv() so the skb is discarded rather than processed. ga is not cleared on this path: ga == NULL already means "legacy peer without Selective ACK", a distinct legitimate state.
--- net/tipc/bcast.c | 22 ++++++++++++++-------- net/tipc/bcast.h | 2 +- net/tipc/node.c | 15 ++++++++++++--- 3 files changed, 27 insertions(+), 12 deletions(-)
net/tipc/bcast.c +14 -8
@@ -497,12 +497,13 @@ void tipc_bcast_ack_rcv(struct net *net,*/ int tipc_bcast_sync_rcv (struct net *net,struct tipc_link *l,struct tipc_msg *hdr, -struct sk_buff_head *retrq) +struct sk_buff_head *retrq,bool *valid) {struct sk_buff_head *inputq = &tipc_bc_base (net)->inputq;struct tipc_gap_ack_blks *ga;struct sk_buff_head xmitq;int rc =0 ; +u16 glen;__skb_queue_head_init (&xmitq);
@@ -510,13 +511,18 @@ int tipc_bcast_sync_rcv(struct net *net,if (msg_type (hdr) !=STATE_MSG ) {tipc_link_bc_init_rcv (l, hdr); }else if (!msg_bc_ack_invalid (hdr)) { -tipc_get_gap_ack_blks (&ga, l, hdr, false); -if (!sysctl_tipc_bc_retruni) - retrq = &xmitq; - rc =tipc_link_bc_ack_rcv (l,msg_bcast_ack (hdr), -msg_bc_gap (hdr), ga, &xmitq, - retrq); - rc |=tipc_link_bc_sync_rcv (l, hdr, &xmitq); + glen =tipc_get_gap_ack_blks (&ga, l, hdr, false); +if (glen >msg_data_sz (hdr)) { +/* Malformed Gap ACK blocks; caller drops the msg */ + *valid = false; + }else { +if (!sysctl_tipc_bc_retruni) + retrq = &xmitq; + rc =tipc_link_bc_ack_rcv (l,msg_bcast_ack (hdr), +msg_bc_gap (hdr), ga, &xmitq, + retrq); + rc |=tipc_link_bc_sync_rcv (l, hdr, &xmitq); + } }tipc_bcast_unlock (net);
net/tipc/bcast.h +1 -1
@@ -97,7 +97,7 @@ void tipc_bcast_ack_rcv(struct net *net, struct tipc_msg *hdr);int tipc_bcast_sync_rcv (struct net *net,struct tipc_link *l,struct tipc_msg *hdr, -struct sk_buff_head *retrq); +struct sk_buff_head *retrq,bool *valid);int tipc_nl_add_bc_link (struct net *net,struct tipc_nl_msg *msg,struct tipc_link *bcl);int tipc_nl_bc_link_set (struct net *net,struct nlattr *attrs[]);
net/tipc/node.c +12 -3
@@ -1831,12 +1831,15 @@ static void tipc_node_mcast_rcv(struct t }static void tipc_node_bc_sync_rcv (struct tipc_node *n,struct tipc_msg *hdr, -int bearer_id,struct sk_buff_head *xmitq) +int bearer_id,struct sk_buff_head *xmitq, +bool *valid) {struct tipc_link *ucl;int rc; - rc =tipc_bcast_sync_rcv (n->net, n->bc_entry.link, hdr, xmitq); + rc =tipc_bcast_sync_rcv (n->net, n->bc_entry.link, hdr, xmitq, valid); +if (!*valid) +return ;if (rc &TIPC_LINK_DOWN_EVT ) {tipc_node_reset_links (n);
@@ -2140,12 +2143,18 @@ rcv:/* Ensure broadcast reception is in synch with peer's send state */ if (unlikely (usr ==LINK_PROTOCOL )) { +bool valid = true; +if (unlikely (skb_linearize (skb))) {tipc_node_put (n); goto discard; } hdr =buf_msg (skb); -tipc_node_bc_sync_rcv (n, hdr, bearer_id, &xmitq); +tipc_node_bc_sync_rcv (n, hdr, bearer_id, &xmitq, &valid); +if (!valid) { +tipc_node_put (n); + goto discard; + } }else if (unlikely (tipc_link_acked (n->bc_entry.link) != bc_ack)) {tipc_bcast_ack_rcv (net, n->bc_entry.link, hdr); }
Greg Kroah-Hartman
maintainerPATCH 114/349 staging: vme_user: bound slave read/write to the kern_buf size
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Tautschnig <[email protected]>
commit 9f32f38265014fac7f5dc9490fb01a638ce6e121 upstream.
The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy 'count' bytes into/out of the fixed-size kern_buf (size_buf == PCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without bounding *ppos + count against size_buf.
vme_user_write()/vme_user_read() only clamp count to the VME window size (image_size = vme_get_size(resource)), which VME_SET_SLAVE sets from the user-supplied slave.size -- validated against the VME address space (up to VME_A32_MAX = 4 GiB), not against PCI_BUF_SIZE. When the window exceeds 128 KiB, a write()/read() copies past the kern_buf allocation.
Clamp count against size_buf in both helpers, with an early return when *ppos is already at/after the buffer end. *ppos is >= 0 here (the caller rejects negative offsets), so size_buf - *ppos cannot wrap. This mirrors the existing clamp in the MASTER-path helpers resource_to_user() / resource_from_user(), and matches the read()/write() convention of a short transfer at end-of-buffer.
Found by static analysis (CodeQL taint tracking + CBMC bounded model checking) and confirmed dynamically under KASAN with the vme_fake bridge:
BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x2d/0x80
Write of size 262144 at addr ffff888004100000 by task trigger/68
_copy_from_user+0x2d/0x80
vme_user_write+0x13e/0x240 [vme_user]
vfs_write+0x1b8/0x7a0
ksys_write+0xb8/0x150--- drivers/staging/vme_user/vme_user.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
drivers/staging/vme_user/vme_user.c +22 -0
@@ -156,6 +156,17 @@ static ssize_t buffer_to_user(unsigned i {void *image_ptr; +/* +* The slave window (image_size) can exceed the fixed kern_buf +* (size_buf == PCI_BUF_SIZE), so bound the copy to kern_buf. +* *ppos is >= 0 here (checked by the caller), so the +* subtraction below cannot wrap. +*/ +if (*ppos >= image[minor].size_buf) +return 0 ; +if (count > image[minor].size_buf - *ppos) + count = image[minor].size_buf - *ppos; + image_ptr = image[minor].kern_buf + *ppos;if (copy_to_user (buf, image_ptr, (unsigned long )count))return -EFAULT ;
@@ -168,6 +179,17 @@ static ssize_t buffer_from_user(unsigned {void *image_ptr; +/* +* The slave window (image_size) can exceed the fixed kern_buf +* (size_buf == PCI_BUF_SIZE), so bound the copy to kern_buf. +* *ppos is >= 0 here (checked by the caller), so the +* subtraction below cannot wrap. +*/ +if (*ppos >= image[minor].size_buf) +return 0 ; +if (count > image[minor].size_buf - *ppos) + count = image[minor].size_buf - *ppos; + image_ptr = image[minor].kern_buf + *ppos;if (copy_from_user (image_ptr, buf, (unsigned long )count))return -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 115/349 smb: client: restrict implied bcc[0] exemption to responses without data area
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shoichiro Miyamoto <[email protected]>
commit 53b7c271f06be4dd5cfc8c6ef552a8355c891a7f upstream.
smb2_check_message() has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received ("server can return one byte more due to implied bcc[0]"). This was introduced to accommodate servers that omit the trailing bcc[0] overlap byte when no data area is present.
However, the exemption is applied unconditionally, regardless of whether the command actually carries a data area (has_smb2_data_area[]). When a response with a data area is subject to the +1 exemption, the reported data can extend one byte beyond the bytes actually received, yet smb2_check_message() still accepts it. The subsequent decoder then reads past the end of the receive buffer. This is reachable during NEGOTIATE and SESSION_SETUP, before the session is established.
The resulting out-of-bounds reads are visible under KASAN when mounting against a non-conforming server; both the SPNEGO/negTokenInit and the NTLMSSP challenge decoders are affected:
BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x16a7/0x1b00 Read of size 1 at addr ffff8880084d67c0 by task mount.cifs/81 CPU: 1 UID: 0 PID: 81 Comm: mount.cifs Not tainted 7.1.0-rc6 #1 Call Trace: <TASK> dump_stack_lvl+0x4e/0x70 print_report+0x157/0x4c9 kasan_report+0xce/0x100 asn1_ber_decoder+0x16a7/0x1b00 decode_negTokenInit+0x19/0x30 SMB2_negotiate+0x31d9/0x4c90 cifs_negotiate_protocol+0x1f2/0x3f0 cifs_get_smb_ses+0x93f/0x17e0 cifs_mount_get_session+0x7f/0x3a0 cifs_mount+0xb4/0xcf0 cifs_smb3_do_mount+0x23a/0x1500 smb3_get_tree+0x3b0/0x630 vfs_get_tree+0x82/0x2d0 fc_mount+0x10/0x1b0 path_mount+0x50d/0x1de0 __x64_sys_mount+0x20b/0x270 do_syscall_64+0xee/0x590 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 85: kmem_cache_alloc_noprof+0x106/0x380 mempool_alloc_noprof+0x116/0x1e0 cifs_small_buf_get+0x31/0x80 allocate_buffers+0x10d/0x2b0 cifs_demultiplex_thread+0x1d5/0x1d50 kthread+0x2c6/0x390 ret_from_fork+0x36e/0x5a0 ret_from_fork_asm+0x1a/0x30 The buggy address is located 0 bytes to the right of allocated 448-byte region [ffff8880084d6600, ffff8880084d67c0) which belongs to the cache cifs_small_rq of size 448 BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x36/0x50 Read of size 329 at addr ffff88800726c678 by task mount.cifs/89 CPU: 0 UID: 0 PID: 89 Comm: mount.cifs Tainted: G B 7.1.0-rc6 #1 Call Trace: <TASK> dump_stack_lvl+0x4e/0x70 print_report+0x157/0x4c9 kasan_report+0xce/0x100 kasan_check_range+0x10f/0x1e0 __asan_memcpy+0x23/0x60 kmemdup_noprof+0x36/0x50 decode_ntlmssp_challenge+0x457/0x680 SMB2_sess_auth_rawntlmssp_negotiate+0x6f0/0xcb0 SMB2_sess_setup+0x219/0x4f0 cifs_setup_session+0x248/0xaf0 cifs_get_smb_ses+0xf79/0x17e0 cifs_mount_get_session+0x7f/0x3a0 cifs_mount+0xb4/0xcf0 cifs_smb3_do_mount+0x23a/0x1500 smb3_get_tree+0x3b0/0x630 vfs_get_tree+0x82/0x2d0 fc_mount+0x10/0x1b0 path_mount+0x50d/0x1de0 __x64_sys_mount+0x20b/0x270 do_syscall_64+0xee/0x590 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 93: kmem_cache_alloc_noprof+0x106/0x380 mempool_alloc_noprof+0x116/0x1e0 cifs_small_buf_get+0x31/0x80 allocate_buffers+0x10d/0x2b0 cifs_demultiplex_thread+0x1d5/0x1d50 kthread+0x2c6/0x390 ret_from_fork+0x36e/0x5a0 ret_from_fork_asm+0x1a/0x30 The buggy address is located 120 bytes inside of allocated 448-byte region [ffff88800726c600, ffff88800726c7c0) which belongs to the cache cifs_small_rq of size 448
Restrict the +1 exemption to responses that have no data area, so that it still covers the bcc[0] omission it was meant for. When a data area is present, the +1 discrepancy instead means the reported data length overruns the received buffer, so the response must be rejected.
--- fs/smb/client/smb2misc.c | 32 ++++++++++++++++++++++++++------ 1 file changed, 26 insertions(+), 6 deletions(-)
fs/smb/client/smb2misc.c +26 -6
@@ -18,6 +18,8 @@#include "nterr.h" #include "cached_dir.h" +static unsigned int __smb2_calc_size (void *buf,bool *have_data); +static int check_smb2_hdr (struct smb2_hdr *shdr,__u64 mid) {
@@ -143,6 +145,7 @@ smb2_check_message(char *buf, unsigned iint command;__u32 calc_len;/* calculated length */ __u64 mid; +bool have_data;/* If server is a channel, select the primary channel */ pserver =SERVER_IS_CHAN (server) ? server->primary_server : server;
@@ -226,7 +229,8 @@ smb2_check_message(char *buf, unsigned i } } - calc_len =smb2_calc_size (buf); + have_data = false; + calc_len =__smb2_calc_size (buf, &have_data);/* For SMB2_IOCTL, OutputOffset and OutputLength are optional, so might * be 0, and not a real miscalculation */
@@ -245,8 +249,13 @@ smb2_check_message(char *buf, unsigned i/* Windows 7 server returns 24 bytes more */ if (calc_len +24 == len && command ==SMB2_OPLOCK_BREAK_HE )return 0 ; -/* server can return one byte more due to implied bcc[0] */ -if (calc_len == len +1 ) +/* +* Server can return one byte more due to implied bcc[0]. +* Allow it only when there is no data area; if data_length > 0 +* the +1 gap indicates an overreported data length rather than +* the bcc[0] omission. +*/ +if (calc_len == len +1 && !have_data)return 0 ;/*
@@ -407,14 +416,17 @@ smb2_get_data_area_len(int *off, int *le/* * Calculate the size of the SMB message based on the fixed header * portion, the number of word parameters and the data portion of the message. +* If have_data is non-NULL, it is set to true when a non-empty data area was +* found (data_length > 0), allowing callers to distinguish the implied bcc[0] +* case (no data area) from an overreported data length. */ -unsigned int -smb2_calc_size (void *buf) +static unsigned int +__smb2_calc_size (void *buf,bool *have_data) {struct smb2_pdu *pdu = buf;struct smb2_hdr *shdr = &pdu->hdr;int offset;/* the offset from the beginning of SMB to data area */ -int data_length;/* the length of the variable length data area */ +int data_length =0 ;/* the length of the variable length data area */ /* Structure Size has already been checked to make sure it is 64 */ int len =le16_to_cpu (shdr->StructureSize);
@@ -447,9 +459,17 @@ smb2_calc_size(void *buf) } calc_size_exit:cifs_dbg (FYI ,"SMB2 len %d\n" , len); +if (have_data) + *have_data = (data_length >0 );return len; } +unsigned int +smb2_calc_size (void *buf) +{ +return __smb2_calc_size (buf,NULL ); +} +/* Note: caller must free return buffer */ __le16 *cifs_convert_path_to_utf16 (const char *from,struct cifs_sb_info *cifs_sb)
Greg Kroah-Hartman
maintainerPATCH 116/349 staging: vme_user: fix location monitor leak in fake bridge
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao-Qun Huang <[email protected]>
commit e8422d89e8af41d87f0e9db564be8e2634f4c602 upstream.
fake_init() allocates a location monitor resource and links it into fake_bridge->lm_resources. The init error path frees this list, but fake_exit() only frees the slave and master resource lists. Loading and unloading the module therefore triggers a kmemleak warning:
unreferenced object 0xffff8b8b82aebe40 (size 64):
comm "init", pid 1, jiffies 4294894572
backtrace (crc c1e013ef):
kmemleak_alloc+0x4e/0x90
__kmalloc_cache_noprof+0x338/0x430
0xffffffffc0602246
do_one_initcall+0x4f/0x320
do_init_module+0x68/0x270
load_module+0x2a3b/0x2d90Free the lm_resources list in fake_exit() as well, before fake_bridge is freed.
--- drivers/staging/vme_user/vme_fake.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/staging/vme_user/vme_fake.c +8 -0
@@ -1239,6 +1239,7 @@ static void __exit fake_exit(void) {struct list_head *pos =NULL ;struct list_head *tmplist; +struct vme_lm_resource *lm;struct vme_master_resource *master_image;struct vme_slave_resource *slave_image;int i;
@@ -1269,6 +1270,13 @@ static void __exit fake_exit(void)fake_crcsr_exit (fake_bridge);/* resources are stored in link list */ +list_for_each_safe (pos, tmplist, &fake_bridge->lm_resources) { + lm = list_entry(pos, struct vme_lm_resource, list); +list_del (pos); +kfree (lm); + } + +/* resources are stored in link list */ list_for_each_safe (pos, tmplist, &fake_bridge->slave_resources) { slave_image = list_entry(pos, struct vme_slave_resource, list);list_del (pos);
Greg Kroah-Hartman
maintainerPATCH 117/349 staging: vme_user: fix location monitor leak in tsi148 bridge
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao-Qun Huang <[email protected]>
commit 151edde741f8bc7f2931c5f44ab376d32b0c8beb upstream.
tsi148_probe() allocates a location monitor resource and links it into tsi148_bridge->lm_resources. The probe error path frees this list, but tsi148_remove() only frees the dma, slave and master resource lists, so the location monitor resource is leaked on device unbind or module unload.
Free the lm_resources list in tsi148_remove() as well, before tsi148_bridge is freed.
--- drivers/staging/vme_user/vme_tsi148.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/staging/vme_user/vme_tsi148.c +8 -0
@@ -2537,6 +2537,7 @@ static void tsi148_remove(struct pci_dev {struct list_head *pos =NULL ;struct list_head *tmplist; +struct vme_lm_resource *lm;struct vme_master_resource *master_image;struct vme_slave_resource *slave_image;struct vme_dma_resource *dma_ctrlr;
@@ -2594,6 +2595,13 @@ static void tsi148_remove(struct pci_devtsi148_crcsr_exit (tsi148_bridge, pdev);/* resources are stored in link list */ +list_for_each_safe (pos, tmplist, &tsi148_bridge->lm_resources) { + lm = list_entry(pos, struct vme_lm_resource, list); +list_del (pos); +kfree (lm); + } + +/* resources are stored in link list */ list_for_each_safe (pos, tmplist, &tsi148_bridge->dma_resources) { dma_ctrlr = list_entry(pos, struct vme_dma_resource, list);list_del (pos);
Greg Kroah-Hartman
maintainerPATCH 118/349 media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
commit c32fe4c4918c9aa49f61359e3b42619c4d8686de upstream.
If the driver's stripe information is invalid it can result in an integer underflow. Add a range check to avoid this kind of error.
This patch fixes the following smatch error:drivers/staging/media/ipu3/ipu3-css-params.c:1792 imgu_css_cfg_acc_stripe() warn: 'acc->stripe.bds_out_stripes[0]->width - 2 * f' 4294967168 can't fit into 65535 'acc->stripe.bds_out_stripes[1]->offset'
--- drivers/staging/media/ipu3/ipu3-css-params.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/staging/media/ipu3/ipu3-css-params.c +6 -2
@@ -1770,6 +1770,8 @@ static int imgu_css_cfg_acc_stripe(struc acc->stripe.bds_out_stripes[0 ].width =ALIGN (css_pipe->rect[IPU3_CSS_RECT_BDS ].width, f); }else { +u32 offset; +/* Image processing is divided into two stripes */ acc->stripe.bds_out_stripes[0 ].width = acc->stripe.bds_out_stripes[1].width =
@@ -1788,8 +1790,10 @@ static int imgu_css_cfg_acc_stripe(struc acc->stripe.bds_out_stripes[1 ].width += f; }/* Overlap between stripes is IPU3_UAPI_ISP_VEC_ELEMS * 4 */ - acc->stripe.bds_out_stripes[1 ].offset = - acc->stripe.bds_out_stripes[0 ].width -2 * f; + offset = acc->stripe.bds_out_stripes[0 ].width -2 * f; +if (offset >65535 ) +return -EINVAL ; + acc->stripe.bds_out_stripes[1 ].offset = offset; } acc->stripe.effective_stripes[0].height =
Greg Kroah-Hartman
maintainerPATCH 119/349 staging: media: atomisp: reduce load_primary_binaries() stack usage
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit f4d51e55dd47ef467fbe37d8575e20eee41b092d upstream.
The load_primary_binaries() function is overly complex and has som large variables on the stack, which can cause warnings depending on CONFIG_FRAME_WARN setting:
drivers/staging/media/atomisp/pci/sh_css.c: In function 'load_primary_binaries':drivers/staging/media/atomisp/pci/sh_css.c:5260:1: error: the frame size of 1560 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
Half of the stack usage is for the prim_descr[] array, but only one member of the array is used at any given time.
Reduce the stack usage by turning the array into a single structure.
--- drivers/staging/media/atomisp/pci/sh_css.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/staging/media/atomisp/pci/sh_css.c +3 -3
@@ -5057,7 +5057,6 @@ static int load_primary_binaries(struct ia_css_capture_settings *mycs;unsigned int i;bool need_extra_yuv_scaler = false; -struct ia_css_binary_descr prim_descr[MAX_NUM_PRIMARY_STAGES ];IA_CSS_ENTER_PRIVATE ("" );assert (pipe);
@@ -5227,15 +5226,16 @@ static int load_primary_binaries(/* Primary */ for (i =0 ; i < mycs->num_primary_stage; i++) { +struct ia_css_binary_descr prim_descr;struct ia_css_frame_info *local_vf_info =NULL ;if (pipe->enable_viewfinder[IA_CSS_PIPE_OUTPUT_STAGE_0 ] && (i == mycs->num_primary_stage -1 )) local_vf_info = &vf_info; -ia_css_pipe_get_primary_binarydesc (pipe, &prim_descr[i], +ia_css_pipe_get_primary_binarydesc (pipe, &prim_descr, &prim_in_info, &prim_out_info, local_vf_info, i); - err =ia_css_binary_find (&prim_descr[i], &mycs->primary_binary[i]); + err =ia_css_binary_find (&prim_descr, &mycs->primary_binary[i]);if (err) {IA_CSS_LEAVE_ERR_PRIVATE (err);return err;
Greg Kroah-Hartman
maintainerPATCH 120/349 staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <[email protected]>
commit 5a752a616e756844388a1a45404db9fc29fec655 upstream.
supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use:
memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2);
where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field.
rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently.
Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.
--- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +8 -0
@@ -1455,6 +1455,10 @@ static int rtw_cfg80211_set_wpa_ie(struc pwpa =rtw_get_wpa_ie (buf, &wpa_ielen, ielen);if (pwpa && wpa_ielen >0 ) { +if (wpa_ielen +2 >sizeof (padapter->securitypriv.supplicant_ie)) { + ret = -EINVAL ; + goto exit; + }if (rtw_parse_wpa_ie (pwpa, wpa_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK;
@@ -1464,6 +1468,10 @@ static int rtw_cfg80211_set_wpa_ie(struc pwpa2 =rtw_get_wpa2_ie (buf, &wpa2_ielen, ielen);if (pwpa2 && wpa2_ielen >0 ) { +if (wpa2_ielen +2 >sizeof (padapter->securitypriv.supplicant_ie)) { + ret = -EINVAL ; + goto exit; + }if (rtw_parse_wpa2_ie (pwpa2, wpa2_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK;
Greg Kroah-Hartman
maintainerPATCH 121/349 staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <[email protected]>
commit a1fc19d61f661d47204f095b593de507884849f7 upstream.
OnAuth() has two bugs in the shared-key authentication path.
When the Privacy bit is set, rtw_wep_decrypt() is called without verifying that the frame is long enough to contain a valid WEP IV and ICV. Inside rtw_wep_decrypt(), length is computed as:
length = len - WLAN_HDR_A3_LEN - iv_len
and then passed as (length - 4) to crc32_le(). If len is less than WLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), length - 4 is negative and, after the implicit cast to size_t, causes crc32_le() to read far beyond the frame buffer. Add a minimum length check before accessing the IV field and calling the decryption path.
When processing a seq=3 response, rtw_get_ie() stores the Challenge Text IE length in ie_len, but the subsequent memcmp() always reads 128 bytes regardless of ie_len. IEEE 802.11 mandates a challenge text of exactly 128 bytes; reject any IE whose length field differs, matching the check already applied to OnAuthClient().
--- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +7 -1
@@ -694,6 +694,9 @@ unsigned int OnAuth(struct adapter *padaif ((pmlmeinfo->state&0x03 ) !=WIFI_FW_AP_STATE )return _FAIL; +if (len <WLAN_HDR_A3_LEN ) +return _FAIL; + sa =GetAddr2Ptr (pframe); auth_mode = psecuritypriv->dot11AuthAlgrthm;
@@ -705,6 +708,9 @@ unsigned int OnAuth(struct adapter *pada prxattrib->hdrlen =WLAN_HDR_A3_LEN ; prxattrib->encrypt = _WEP40_; +if (len <WLAN_HDR_A3_LEN +8 ) +return _FAIL; + iv = pframe+prxattrib->hdrlen; prxattrib->key_index = ((iv[3 ]>>6 )&0x3 );
@@ -809,7 +815,7 @@ unsigned int OnAuth(struct adapter *pada p =rtw_get_ie (pframe +WLAN_HDR_A3_LEN +4 + _AUTH_IE_OFFSET_,WLAN_EID_CHALLENGE , (int *)&ie_len, len -WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ -4 ); -if (!p || ie_len <=0 ) { +if (!p || ie_len !=128 ) { status =WLAN_STATUS_CHALLENGE_FAIL ; goto auth_fail; }
Greg Kroah-Hartman
maintainerPATCH 122/349 staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <[email protected]>
commit f9654207e92283e0acac5d64fe5f8835383b5a23 upstream.
The IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each iteration but only guards on i < pkt_len. When a malicious AP sends an AssocResponse whose last IE has only one byte remaining in the frame (the element_id byte lands at pkt_len-1), the loop reads pIE->length from pframe[pkt_len], which is one byte past the allocated receive buffer.
Additionally, even when the header bytes are in bounds, pIE->length itself can extend the data window beyond pkt_len, silently passing a truncated IE to the handler functions.
Add two guards at the top of the loop body:
1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).
2. Break if the IE's declared data extends past pkt_len.
--- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +4 -0
@@ -1424,7 +1424,11 @@ unsigned int OnAssocRsp(struct adapter */* to handle HT, WMM, rate adaptive, update MAC reg */ /* for not to handle the synchronous IO in the tasklet */ for (i = (6 +WLAN_HDR_A3_LEN ); i < pkt_len;) { +if (i +sizeof (*pIE) > pkt_len) +break ; pIE = (struct ndis_80211_var_ie *)(pframe + i); +if (i +sizeof (*pIE) + pIE->length > pkt_len) +break ;switch (pIE->element_id) {case WLAN_EID_VENDOR_SPECIFIC :
Greg Kroah-Hartman
maintainerPATCH 123/349 staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <[email protected]>
commit ed51de4a86e173c3b0ef78e039c2e49e08b11f16 upstream.
The IE parsing loop in update_beacon_info() advances by (pIE->length + 2) each iteration but only guards on i < len. When a malicious AP sends a Beacon whose last IE has only one byte remaining in the frame (the element_id byte lands at len-1), the loop reads pIE->length from one byte past the allocated receive buffer.
Additionally, even when the header bytes are in bounds, pIE->length itself can extend the data window beyond len, passing a truncated IE to the handler functions.
Add two guards at the top of the loop body:
1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).
2. Break if the IE's declared data extends past len.
Also replace i += (pIE->length + 2) with i += sizeof(*pIE) + pIE->length for consistency with the sizeof(*pIE) guards added above.
--- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/staging/rtl8723bs/core/rtw_wlan_util.c +5 -1
@@ -1331,7 +1331,11 @@ void update_beacon_info(struct adapter * len = pkt_len - (_BEACON_IE_OFFSET_ +WLAN_HDR_A3_LEN );for (i =0 ; i < len;) { +if (i +sizeof (*pIE) > len) +break ; pIE = (struct ndis_80211_var_ie *)(pframe + (_BEACON_IE_OFFSET_ +WLAN_HDR_A3_LEN ) + i); +if (i +sizeof (*pIE) + pIE->length > len) +break ;switch (pIE->element_id) {case WLAN_EID_VENDOR_SPECIFIC :
@@ -1356,7 +1360,7 @@ void update_beacon_info(struct adapter *break ; } - i += (pIE->length +2 ); + i +=sizeof (*pIE) + pIE->length; } }
Greg Kroah-Hartman
maintainerPATCH 124/349 staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <[email protected]>
commit ef61d628dfad38fead1fd2e08979ae9126d011d5 upstream.
Two IE parsing loops are missing the header bounds checks before they dereference pIE->length:
- issue_assocreq() walks pmlmeinfo->network.ies to build the association request. If the stored IE data ends with only an element_id byte and no length byte, pIE->length is read one byte past the end of the buffer.
- join_cmd_hdl() walks pnetwork->ies during station join and has the same problem under the same conditions.
Both buffers are filled from AP beacon and probe-response frames, so a malicious AP that sends a truncated final IE can trigger the issue.
Apply the two-guard pattern established in update_beacon_info():
1. Break if fewer than sizeof(*pIE) bytes remain.
2. Break if the IE's declared data extends past the buffer end.
--- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +8 -0
@@ -2965,7 +2965,11 @@ void issue_assocreq(struct adapter *pada/* vendor specific IE, such as WPA, WMM, WPS */ for (i =sizeof (struct ndis_802_11_fix_ie ); i < pmlmeinfo->network.ie_length;) { +if (i +sizeof (*pIE) > pmlmeinfo->network.ie_length) +break ; pIE = (struct ndis_80211_var_ie *)(pmlmeinfo->network.ies + i); +if (i +sizeof (*pIE) + pIE->length > pmlmeinfo->network.ie_length) +break ;switch (pIE->element_id) {case WLAN_EID_VENDOR_SPECIFIC :
@@ -5370,7 +5374,11 @@ u8 join_cmd_hdl(struct adapter *padapter/* sizeof(struct ndis_802_11_fix_ie) */ for (i = _FIXED_IE_LENGTH_; i < pnetwork->ie_length;) { +if (i +sizeof (*pIE) > pnetwork->ie_length) +break ; pIE = (struct ndis_80211_var_ie *)(pnetwork->ies + i); +if (i +sizeof (*pIE) + pIE->length > pnetwork->ie_length) +break ;switch (pIE->element_id) {case WLAN_EID_VENDOR_SPECIFIC :/* Get WMM IE. */
Greg Kroah-Hartman
maintainerPATCH 125/349 staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <[email protected]>
commit 3bf39f711ff27c64be8680a8938bcc5001982e81 upstream.
The loop in is_ap_in_tkip() iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload:
- pIE->element_id and pIE->length are read without checking that i + sizeof(*pIE) <= ie_length, so a truncated IE at the end of the buffer causes an OOB read.
- For WLAN_EID_VENDOR_SPECIFIC the code compares pIE->data + 12, which requires pIE->length >= 16. For WLAN_EID_RSN it compares pIE->data + 8, requiring pIE->length >= 12. Neither requirement is checked.
Add the missing IE header and payload bounds checks and guard each data access with an explicit pIE->length minimum, matching the pattern established in update_beacon_info().
--- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/staging/rtl8723bs/core/rtw_wlan_util.c +11 -3
@@ -1376,15 +1376,23 @@ unsigned int is_ap_in_tkip(struct adaptefor (i =sizeof (struct ndis_802_11_fix_ie ); i < pmlmeinfo->network.ie_length;) { pIE = (struct ndis_80211_var_ie *)(pmlmeinfo->network.ies + i); +if (i +sizeof (*pIE) > pmlmeinfo->network.ie_length) +break ; +if (i +sizeof (*pIE) + pIE->length > pmlmeinfo->network.ie_length) +break ; +switch (pIE->element_id) {case WLAN_EID_VENDOR_SPECIFIC : -if ((!memcmp (pIE->data,RTW_WPA_OUI ,4 )) && (!memcmp ((pIE->data +12 ),WPA_TKIP_CIPHER ,4 ))) +if (pIE->length >=16 && + !memcmp (pIE->data,RTW_WPA_OUI ,4 ) && + !memcmp ((pIE->data +12 ),WPA_TKIP_CIPHER ,4 ))return true;break ;case WLAN_EID_RSN : -if (!memcmp ((pIE->data +8 ),RSN_TKIP_CIPHER ,4 )) +if (pIE->length >=12 && + !memcmp ((pIE->data +8 ),RSN_TKIP_CIPHER ,4 ))return true;break ;
@@ -1392,7 +1400,7 @@ unsigned int is_ap_in_tkip(struct adaptebreak ; } - i += (pIE->length +2 ); + i +=sizeof (*pIE) + pIE->length; }return false;
Greg Kroah-Hartman
maintainerPATCH 126/349 staging: rtl8723bs: fix OOB write in HT_caps_handler()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <[email protected]>
commit f8001e1a516ba3b495728c65b61f799cbfad6bd0 upstream.
HT_caps_handler() iterates pIE->length bytes and writes into HT_caps.u.HT_cap[], which is a fixed 26-byte array (sizeof struct HT_caps_element). Because pIE->length is a raw u8 from an over-the-air 802.11 AssocResponse frame and is never validated, a malicious AP can set it up to 255, causing up to 229 bytes of out-of-bounds writes into adjacent fields of struct mlme_ext_info.
Truncate the iteration count to the size of HT_caps.u.HT_cap using umin() so that data from a longer-than-expected IE is silently ignored rather than written out of bounds, preserving interoperability with APs that pad the element. An early return on oversized IEs was considered but rejected: it would bypass the pmlmeinfo->HT_caps_enable = 1 assignment that precedes the loop, silently disabling HT mode for APs that append extra bytes to the HT Capabilities IE.
--- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/staging/rtl8723bs/core/rtw_wlan_util.c +2 -1
@@ -978,7 +978,8 @@ void HT_caps_handler(struct adapter *pad pmlmeinfo->HT_caps_enable =1 ; -for (i =0 ; i < (pIE->length); i++) { +for (i =0 ; i <umin (pIE->length, +sizeof (pmlmeinfo->HT_caps.u.HT_cap)); i++) {if (i !=2 ) {/* Commented by Albert 2010/07/12 */ /* Got the endian issue here. */
Greg Kroah-Hartman
maintainerPATCH 127/349 crypto: amlogic - avoid double cleanup in meson_crypto_probe()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <[email protected]>
commit 6d827ade51a24e18d81afb9f32756d339520a14c upstream.
When meson_allocate_chanlist() fails after a partial allocation, it already unwinds the allocated chanlist state through its local error path. meson_crypto_probe() then jump to error_flow and calls meson_free_chanlist() again, causing the same per-flow resources to be torn down twice. In the reproduced failure path, the second teardown re-entered crypto_engine_exit() on an already destroyed worker and KASAN reported a slab-use-after-free in kthread_destroy_worker().
Prevent double-free by handling partial allocation failures locally within meson_allocate_chanlist() and skipping the outer cleanup path.
The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available.
The bug was reproduced in a QEMU x86_64 guest booted with KASAN on v7.1, using the reproducer under tools/testing/meson_crypto_probe. The reproducer forces the second dma_alloc_attrs() call in the gxl-crypto probe path to return NULL, making meson_allocate_chanlist() fail after partial initialization. On the unpatched kernel this reliably triggered a slab-use-after-free. With this fix applied, the same reproducer no longer emits any KASAN report and the probe fails cleanly with -ENOMEM.
==================================================================
BUG: KASAN: slab-use-after-free in kthread_destroy_worker+0xb2/0xd0
Read of size 8 at addr ff1100010c057a68 by task insmod/265
CPU: 1 UID: 0 PID: 265 Comm: insmod Tainted: G O 7.1.0-rc2-00376-g810af9adc907-dirty #10 PREEMPT(lazy)
Tainted: [O]=OOT_MODULE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x68/0xa0
print_report+0xcb/0x5e0
? __virt_addr_valid+0x21d/0x3f0
? kthread_destroy_worker+0xb2/0xd0
? kthread_destroy_worker+0xb2/0xd0
kasan_report+0xca/0x100
? kthread_destroy_worker+0xb2/0xd0
kthread_destroy_worker+0xb2/0xd0
meson_crypto_probe+0x4d0/0xc10 [amlogic_gxl_crypto]
platform_probe+0x99/0x140
really_probe+0x1c6/0x6a0
? __pfx___device_attach_driver+0x10/0x10
__driver_probe_device+0x248/0x310
? acpi_driver_match_device+0xb0/0x100
driver_probe_device+0x48/0x210
? __pfx___device_attach_driver+0x10/0x10
__device_attach_driver+0x160/0x320
bus_for_each_drv+0x104/0x190
? __pfx_bus_for_each_drv+0x10/0x10
? _raw_spin_unlock_irqrestore+0x2c/0x50
__device_attach+0x19d/0x3b0
? __pfx___device_attach+0x10/0x10
? do_raw_spin_unlock+0x53/0x220
device_initial_probe+0x78/0xa0
bus_probe_device+0x5b/0x130
device_add+0xcfd/0x1430
? __pfx_device_add+0x10/0x10
? insert_resource+0x34/0x50
? lock_release+0xc9/0x290
platform_device_add+0x24e/0x590
? __pfx_meson_crypto_probe_repro_init+0x10/0x10 [meson_crypto_probe_repro]
meson_crypto_probe_repro_init+0x330/0xff0 [meson_crypto_probe_repro]
do_one_initcall+0xc0/0x450
? __pfx_do_one_initcall+0x10/0x10
? _raw_spin_unlock_irqrestore+0x2c/0x50
? __create_object+0x59/0x80
? kasan_unpoison+0x27/0x60
do_init_module+0x27b/0x7d0
? __pfx_do_init_module+0x10/0x10
? kasan_quarantine_put+0x84/0x1d0
? kfree+0x32c/0x510
? load_module+0x561e/0x5ff0
load_module+0x54fe/0x5ff0
? __pfx_load_module+0x10/0x10
? security_file_permission+0x20/0x40
? kernel_read_file+0x23d/0x6e0
? mmap_region+0x235/0x4a0
? __pfx_kernel_read_file+0x10/0x10
? __file_has_perm+0x2c0/0x3e0
init_module_from_file+0x158/0x180
? __pfx_init_module_from_file+0x10/0x10
? __lock_acquire+0x45a/0x1ba0
? idempotent_init_module+0x315/0x610
? lock_release+0xc9/0x290
? lockdep_init_map_type+0x4b/0x220
? do_raw_spin_unlock+0x53/0x220
idempotent_init_module+0x330/0x610
? __pfx_idempotent_init_module+0x10/0x10
? __pfx_cred_has_capability.isra.0+0x10/0x10
? ksys_mmap_pgoff+0x385/0x520
__x64_sys_finit_module+0xbe/0x120
do_syscall_64+0x115/0x690
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7d6d31690d
Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d f3 b4 0f 00 f7 d8 >
RSP: 002b:00007fffc027ac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 000055f7b81967c0 RCX: 00007f7d6d31690d
RDX: 0000000000000000 RSI: 000055f79a0d6cd2 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 000055f79a0d6cd2
R13: 000055f7b8196790 R14: 000055f79a0d5888 R15: 000055f7b81968e0
</TASK>--- drivers/crypto/amlogic/amlogic-gxl-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/amlogic/amlogic-gxl-core.c +1 -1
@@ -293,8 +293,8 @@ static int meson_crypto_probe(struct plareturn 0 ; error_alg:meson_unregister_algs (mc); -error_flow:meson_free_chanlist (mc,MAXFLOW -1 ); +error_flow:clk_disable_unprepare (mc->busclk);return err; }
Greg Kroah-Hartman
maintainerPATCH 128/349 ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gil Portnoy <[email protected]>
commit 10f293a07f9e10e988b0ae44e2e99c631f5a68e0 upstream.
Commit f580d27e8928 ("ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL") made smb2_cancel() skip a work whose state is KSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But KSMBD_WORK has three states (ACTIVE, CANCELLED, CLOSED), and the same freeing producer path is reached for CLOSED too:
SMB2_CLOSE on the locking handle -> set_close_state_blocked_works() sets the deferred work's state to KSMBD_WORK_CLOSED and wakes the smb2_lock() worker. The worker takes the non-ACTIVE early-exit, locks_free_lock()s the file_lock and, because the state is not KSMBD_WORK_CANCELLED, takes the STATUS_RANGE_NOT_LOCKED branch with "goto out2" -- which, like the cancelled branch, skips release_async_work(). The work stays on conn->async_requests with a live cancel_fn = smb2_remove_blocked_lock pointing at the freed file_lock.
A subsequent SMB2_CANCEL for the same AsyncId then passes the KSMBD_WORK_CANCELLED-only guard (its state is KSMBD_WORK_CLOSED), so smb2_cancel() fires cancel_fn again over the freed file_lock -- the same use-after-free fixed, via SMB2_CLOSE instead of a first SMB2_CANCEL:
BUG: KASAN: slab-use-after-free in __locks_delete_block
__locks_delete_block
locks_delete_block
ksmbd_vfs_posix_lock_unblock
smb2_remove_blocked_lock
smb2_cancel <- 2nd SMB2_CANCEL fires cancel_fn
handle_ksmbd_work
Allocated by ...: locks_alloc_lock <- smb2_lock
Freed by ...: locks_free_lock <- smb2_lock (non-ACTIVE early-exit)
... cache file_lock_cache of size 192Reproduced on mainline 7.1-rc7 (which already contains f580d27e8928) with KASAN by an authenticated SMB client; the double-SMB2_CANCEL control is silent on that kernel, so the splat is attributable to the CLOSE trigger.
Only an ACTIVE deferred work may have its cancel_fn fired: both terminal states (CANCELLED and CLOSED) reach the smb2_lock() early-exit that frees the file_lock and skips release_async_work(). Guard on KSMBD_WORK_ACTIVE so any non-active work is skipped.
--- fs/smb/server/smb2pdu.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
fs/smb/server/smb2pdu.c +7 -7
@@ -7276,14 +7276,14 @@ int smb2_cancel(struct ksmbd_work *work)continue ;/* -* A cancelled deferred byte-range lock frees its -* file_lock and takes the smb2_lock() early-exit that -* skips release_async_work(), so the work stays on -* conn->async_requests with a live cancel_fn pointing -* at the freed file_lock. Re-firing it on a second -* SMB2_CANCEL is a use-after-free. +* Only an ACTIVE deferred work may have its cancel_fn +* fired. A CANCELLED or CLOSED work already took the +* smb2_lock() non-ACTIVE early-exit that frees the +* file_lock and skips release_async_work(), so it is +* still on conn->async_requests with a live cancel_fn +* pointing at the freed file_lock. */ -if (iter->state ==KSMBD_WORK_CANCELLED ) +if (iter->state !=KSMBD_WORK_ACTIVE )break ; ksmbd_debug(SMB,
Greg Kroah-Hartman
maintainerPATCH 129/349 net: af_key: initialize alg_key_len for IPComp states
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijing Yin <[email protected]>
commit d129c3177d7b1138fd5066fcc63a698b3ba415b0 upstream.
pfkey_msg2xfrm_state() handles the IPComp (SADB_X_SATYPE_IPCOMP) case by allocating x->calg and copying only the algorithm name:
x->calg = kmalloc_obj(*x->calg);
if (!x->calg) {
err = -ENOMEM;
goto out;
}
strcpy(x->calg->alg_name, a->name);
x->props.calgo = sa->sadb_sa_encrypt;Unlike the authentication (x->aalg) and encryption (x->ealg) branches of the same function, the compression branch never initializes calg->alg_key_len. IPComp carries no key and the allocation only reserves sizeof(struct xfrm_algo) (i.e. no room for a key), so the field is left containing uninitialized slab data.
calg->alg_key_len is later used as a length by xfrm_algo_clone() when an IPComp state is cloned during XFRM_MSG_MIGRATE:
xfrm_state_migrate() xfrm_state_clone_and_setup() x->calg = xfrm_algo_clone(orig->calg); kmemdup(orig, xfrm_alg_len(orig));
where xfrm_alg_len() returns sizeof(*alg) + (alg_key_len + 7) / 8. With a non-zero garbage alg_key_len, kmemdup() reads past the end of the 68-byte calg object. Adding an IPComp SA via PF_KEY and then migrating it triggers (net-next, KASAN, init_on_alloc=0):
BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x44/0x60 Read of size 4164 at addr ff11000025a74980 by task diag2/9287 CPU: 3 UID: 0 PID: 9287 Comm: diag2 7.1.0-rc6-g903db046d557 #1 Call Trace: <TASK> dump_stack_lvl+0x10e/0x1f0 print_report+0xf7/0x600 kasan_report+0xe4/0x120 kasan_check_range+0x105/0x1b0 __asan_memcpy+0x23/0x60 kmemdup_noprof+0x44/0x60 xfrm_state_migrate+0x70a/0x1da0 xfrm_migrate+0x753/0x18a0 xfrm_do_migrate+0xb47/0xf10 xfrm_user_rcv_msg+0x411/0xb50 netlink_rcv_skb+0x158/0x420 xfrm_netlink_rcv+0x71/0x90 netlink_unicast+0x584/0x850 netlink_sendmsg+0x8b0/0xdc0 ____sys_sendmsg+0x9f7/0xb90 ___sys_sendmsg+0x134/0x1d0 __sys_sendmsg+0x16d/0x220 do_syscall_64+0x116/0x7d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 9287: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 pfkey_add+0x2652/0x2ea0 pfkey_process+0x6d0/0x830 pfkey_sendmsg+0x42c/0x850 __sys_sendto+0x461/0x4b0 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0x116/0x7d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ff11000025a74980 which belongs to the cache kmalloc-96 of size 96 The buggy address is located 0 bytes inside of allocated 68-byte region [ff11000025a74980, ff11000025a749c4)
Depending on the uninitialized value the same field can instead request an oversized kmemdup() allocation and make the migration clone fail.
The XFRM netlink path is not affected: verify_one_alg() rejects an XFRMA_ALG_COMP attribute shorter than xfrm_alg_len(), so a calg added via XFRM_MSG_NEWSA is always self-consistent.
Initialize calg->alg_key_len to 0, matching the aalg/ealg branches.
--- net/key/af_key.c | 1 + 1 file changed, 1 insertion(+)
net/key/af_key.c +1 -0
@@ -1218,6 +1218,7 @@ static struct xfrm_state * pfkey_msg2xfr goto out; }strcpy (x->calg->alg_name, a->name); + x->calg->alg_key_len =0 ; x->props.calgo = sa->sadb_sa_encrypt; }else {int keysize =0 ;
Greg Kroah-Hartman
maintainerPATCH 130/349 audit: Fix data races of skb_queue_len() readers on audit_queue
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Wang <[email protected]>
commit c9a71daaecb2fb1d8c704545cc0b1c920b9bf5d7 upstream.
Multiple readers access audit_queue.qlen via skb_queue_len() without holding the queue lock or using READ_ONCE(), while kauditd writes to this field via the skb_dequeue() → __skb_unlink() path with WRITE_ONCE() protected by a spinlock. This constitutes data races.
All affected skb_queue_len(&audit_queue) call sites:
- kauditd_thread() wait_event_freezable() condition
- audit_receive_msg() AUDIT_GET handler (s.backlog assignment)
- audit_receive() backlog check
- audit_log_start() backlog check and pr_warn()
KCSAN reports the following conflicting access pattern (one example):
==================================================================
BUG: KCSAN: data-race in audit_log_start / skb_dequeue
write (marked) to 0xffffffff8512ee20 of 4 bytes by task 661 on cpu 57:
skb_dequeue+0x70/0xf0 kauditd_send_queue+0x71/0x220 kauditd_thread+0x1cb/0x430 kthread+0x1c2/0x210 ret_from_fork+0x162/0x1a0 ret_from_fork_asm+0x1a/0x30
read to 0xffffffff8512ee20 of 4 bytes by task 36586 on cpu 1:
audit_log_start+0x2a0/0x6b0 audit_core_dumps+0x64/0xa0 do_coredump+0x14b/0x1260 get_signal+0xeb2/0xf70 arch_do_signal_or_restart+0x41/0x170 exit_to_user_mode_loop+0xa2/0x1c0 do_syscall_64+0x1a3/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0xe0
value changed: 0x00000001 -> 0x00000000
==================================================================
Resolve the race by switching to lockless helper skb_queue_len_lockless(), which internally uses READ_ONCE() and properly pairs with the WRITE_ONCE() write accesses already present on the writer side.
--- kernel/audit.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
kernel/audit.c +5 -5
@@ -909,7 +909,7 @@ main_queue:* do the multicast send and rotate records from the * main queue to the retry/hold queues */ wait_event_freezable (kauditd_wait, - (skb_queue_len (&audit_queue) ?1 :0 )); + (skb_queue_len_lockless (&audit_queue) ?1 :0 )); }return 0 ;
@@ -1244,7 +1244,7 @@ static int audit_receive_msg(struct sk_b s.rate_limit = audit_rate_limit; s.backlog_limit = audit_backlog_limit; s.lost =atomic_read (&audit_lost); - s.backlog =skb_queue_len (&audit_queue); + s.backlog =skb_queue_len_lockless (&audit_queue); s.feature_bitmap =AUDIT_FEATURE_BITMAP_ALL ; s.backlog_wait_time = audit_backlog_wait_time; s.backlog_wait_time_actual =atomic_read (&audit_backlog_wait_time_actual);
@@ -1585,7 +1585,7 @@ static void audit_receive(struct sk_buff/* can't block with the ctrl lock, so penalize the sender now */ if (audit_backlog_limit && - (skb_queue_len (&audit_queue) > audit_backlog_limit)) { + (skb_queue_len_lockless (&audit_queue) > audit_backlog_limit)) {DECLARE_WAITQUEUE (wait, current);/* wake kauditd to try and flush the queue */
@@ -1885,7 +1885,7 @@ struct audit_buffer *audit_log_start(strlong stime = audit_backlog_wait_time;while (audit_backlog_limit && - (skb_queue_len (&audit_queue) > audit_backlog_limit)) { + (skb_queue_len_lockless (&audit_queue) > audit_backlog_limit)) {/* wake kauditd to try and flush the queue */ wake_up_interruptible (&kauditd_wait);
@@ -1905,7 +1905,7 @@ struct audit_buffer *audit_log_start(str }else {if (audit_rate_check () &&printk_ratelimit ())pr_warn ("audit_backlog=%d > audit_backlog_limit=%d\n" , -skb_queue_len (&audit_queue), +skb_queue_len_lockless (&audit_queue), audit_backlog_limit);audit_log_lost ("backlog limit exceeded" );return NULL ;
Greg Kroah-Hartman
maintainerPATCH 131/349 Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Page <[email protected]>
commit fa85d985f614bc3feb343000f14a1072e99b0df1 upstream.
add_device_complete() runs from the hci_cmd_sync_work kworker, which holds only hci_req_sync_lock and *not* hci_dev_lock. It calls hci_conn_params_lookup() and then dereferences the returned object (params->flags) without taking hci_dev_lock:
params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, le_addr_type(cp->addr.type)); ... device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, hdev->conn_flags, params ? params->flags : 0);
hci_conn_params_lookup() walks hdev->le_conn_params and is documented to require hdev->lock. A concurrent MGMT_OP_REMOVE_DEVICE (remove_device()), which does run under hci_dev_lock, can call hci_conn_params_free() to list_del() and kfree() the very object the lookup returned, so the subsequent params->flags read touches freed memory [0].
Hold hci_dev_lock() across the hci_conn_params_lookup() and the read of params->flags (and the matching event emission) so the lookup result cannot be freed by a concurrent remove_device() before it is used, honouring the locking contract of hci_conn_params_lookup().
[0]: (trailing page/memory-state dump trimmed)
BUG: KASAN: slab-use-after-free in add_device_complete+0x358/0x3d8 net/bluetooth/mgmt.c:7671 Read of size 1 at addr ffff000017ab26c1 by task kworker/u9:8/388 CPU: 1 UID: 0 PID: 388 Comm: kworker/u9:8 Not tainted 7.0.11 #20 PREEMPT Hardware name: linux,dummy-virt (DT) Workqueue: hci0 hci_cmd_sync_work Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xb4/0xd4 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x118/0x5d8 mm/kasan/report.c:482 kasan_report+0xb0/0xf4 mm/kasan/report.c:595 __asan_report_load1_noabort+0x20/0x2c mm/kasan/report_generic.c:378 add_device_complete+0x358/0x3d8 net/bluetooth/mgmt.c:7671 hci_cmd_sync_work+0x14c/0x240 net/bluetooth/hci_sync.c:334 process_one_work+0x628/0xd38 kernel/workqueue.c:3289 process_scheduled_works kernel/workqueue.c:3372 [inline] worker_thread+0x7a8/0xac0 kernel/workqueue.c:3453 kthread+0x39c/0x444 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Allocated by task 3401: kasan_save_stack+0x3c/0x64 mm/kasan/common.c:57 kasan_save_track+0x20/0x3c mm/kasan/common.c:78 kasan_save_alloc_info+0x40/0x54 mm/kasan/generic.c:570 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xd4/0xd8 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x1b0/0x458 mm/slub.c:5385 kmalloc_noprof include/linux/slab.h:950 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] hci_conn_params_add+0x10c/0x4b0 net/bluetooth/hci_core.c:2279 hci_conn_params_set net/bluetooth/mgmt.c:5162 [inline] add_device+0x5b4/0xa54 net/bluetooth/mgmt.c:7755 hci_mgmt_cmd net/bluetooth/hci_sock.c:1721 [inline] hci_sock_sendmsg+0x10b4/0x1dd0 net/bluetooth/hci_sock.c:1841 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0xe0/0x128 net/socket.c:742 sock_write_iter+0x250/0x390 net/socket.c:1195 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x66c/0xab0 fs/read_write.c:688 ksys_write+0x1fc/0x24c fs/read_write.c:740 __do_sys_write fs/read_write.c:751 [inline] __se_sys_write fs/read_write.c:748 [inline] __arm64_sys_write+0x70/0xa4 fs/read_write.c:748 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x84/0x2a8 arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0xe4/0x294 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x44/0x5c arch/arm64/kernel/syscall.c:151 el0_svc+0x38/0xac arch/arm64/kernel/entry-common.c:724 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:743 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 Freed by task 3740: kasan_save_stack+0x3c/0x64 mm/kasan/common.c:57 kasan_save_track+0x20/0x3c mm/kasan/common.c:78 kasan_save_free_info+0x4c/0x74 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x88/0xb8 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2685 [inline] slab_free mm/slub.c:6170 [inline] kfree+0x14c/0x458 mm/slub.c:6488 hci_conn_params_free+0x288/0x484 net/bluetooth/hci_core.c:2312 remove_device+0x4b0/0x968 net/bluetooth/mgmt.c:7919 hci_mgmt_cmd net/bluetooth/hci_sock.c:1721 [inline] hci_sock_sendmsg+0x10b4/0x1dd0 net/bluetooth/hci_sock.c:1841 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0xe0/0x128 net/socket.c:742 sock_write_iter+0x250/0x390 net/socket.c:1195 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x66c/0xab0 fs/read_write.c:688 ksys_write+0x1fc/0x24c fs/read_write.c:740 __do_sys_write fs/read_write.c:751 [inline] __se_sys_write fs/read_write.c:748 [inline] __arm64_sys_write+0x70/0xa4 fs/read_write.c:748 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x84/0x2a8 arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0xe4/0x294 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x44/0x5c arch/arm64/kernel/syscall.c:151 el0_svc+0x38/0xac arch/arm64/kernel/entry-common.c:724 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:743 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
--- net/bluetooth/mgmt.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/mgmt.c +3 -0
@@ -7740,6 +7740,8 @@ static void add_device_complete(struct hif (!err) {struct hci_conn_params *params; +hci_dev_lock (hdev); + params =hci_conn_params_lookup (hdev, &cp->addr.bdaddr,le_addr_type (cp->addr.type));
@@ -7748,6 +7750,7 @@ static void add_device_complete(struct hdevice_flags_changed (NULL , hdev, &cp->addr.bdaddr, cp->addr.type, hdev->conn_flags, params ? params->flags :0 ); +hci_dev_unlock (hdev); } mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE,
Greg Kroah-Hartman
maintainerPATCH 132/349 coresight: etb10: restore atomic_t for shared reading state
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <[email protected]>
commit fa09f08ede3db3050ae16ae1ed92c902d0cada23 upstream.
The etb10 miscdevice uses drvdata->reading as a shared exclusivity gate for userspace buffer access. etb_open() claims that gate with local_cmpxchg(), and etb_release() clears it with local_set().
That gate is shared per-device state rather than CPU-local state. A running system can reach it whenever /dev/<etb> is opened, closed, and reopened by different tasks while the device remains registered, so the same drvdata->reading variable may be claimed on one CPU and later cleared on another.
This code used to use atomic_t for the same gate, but commit 27b10da8fff2 ("coresight: etb10: moving to local atomic operations") changed it to local_t even though the access pattern remained cross-task and cross-CPU. Restore atomic_t together with atomic_cmpxchg() and atomic_set() so the exclusivity gate again uses a primitive intended for shared state.
The issue was found on Linux v6.18.21 by our static analysis tool while scanning surviving local_t-on-shared-state sites, and then manually reviewed against the live etb10 file-op path.
It was runtime-validated with a reproducible QEMU no-device KCSAN PoC that kept the same report-local contract:
1. use one shared struct etb_drvdata carrier and its
drvdata->reading gate;
2. call etb_open() and etb_release() sequentially on that gate to
confirm the original claim/clear path;
3. bind the open side to CPU0 and the release side to CPU1 for the
same gate to show cross-CPU ownership; 4. run bound workers that repeatedly race etb_open() and etb_release() on the same gate until KCSAN reports a target hit.
The harness recorded:
L1 passed open=1 release=1
reading_after_open=1 reading_after_release=0
L2 passed open_cpu=0 release_cpu=1
cross_cpu_release=1 reading_after=0 open_ret=0
Representative KCSAN excerpt from the no-device validation run:
BUG: KCSAN: data-race in etb_open.constprop.0.isra.0 [vuln_msv]
write to 0xffffffffc0003810 of 4 bytes by task 216 on cpu 1:
etb_open.constprop.0.isra.0+0x38/0x80 [vuln_msv] l3_worker_thread_fn+0x4f/0xf0 [vuln_msv] kthread+0x17e/0x1c0 ret_from_fork+0x22/0x30
read to 0xffffffffc0003810 of 4 bytes by task 215 on cpu 0:
etb_open.constprop.0.isra.0+0x18/0x80 [vuln_msv] l3_worker_thread_fn+0x4f/0xf0 [vuln_msv] kthread+0x17e/0x1c0 ret_from_fork+0x22/0x30
value changed: 0x00000000 -> 0x00000001
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 215 Comm: etb10_l3_a Tainted: G O 6.1.66 #2
This no-device harness is not a real ETB10 hardware end-to-end run, but it preserves the same shared drvdata->reading gate and the same etb_open()/etb_release() claim/clear contract. No real ETB10 hardware was available for runtime testing.
Build-tested with:
make olddefconfig
make -j"$(nproc)" drivers/hwtracing/coresight/coresight-etb10.o
--- drivers/hwtracing/coresight/coresight-etb10.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/hwtracing/coresight/coresight-etb10.c +3 -3
@@ -85,7 +85,7 @@ struct etb_drvdata {struct coresight_device *csdev;struct miscdevice miscdev;raw_spinlock_t spinlock; -local_t reading; +atomic_t reading;pid_t pid;u8 *buf;u32 buffer_depth;
@@ -603,7 +603,7 @@ static int etb_open(struct inode *inode,struct etb_drvdata *drvdata =container_of (file->private_data, struct etb_drvdata, miscdev); -if (local_cmpxchg (&drvdata->reading,0 ,1 )) +if (atomic_cmpxchg (&drvdata->reading,0 ,1 ))return -EBUSY ;dev_dbg (&drvdata->csdev->dev,"%s: successfully opened\n" , __func__);
@@ -641,7 +641,7 @@ static int etb_release(struct inode *ino {struct etb_drvdata *drvdata =container_of (file->private_data, struct etb_drvdata, miscdev); -local_set (&drvdata->reading,0 ); +atomic_set (&drvdata->reading,0 );dev_dbg (&drvdata->csdev->dev,"%s: released\n" , __func__);return 0 ;