6.6.148-rc1 review
Greg Kroah-Hartman
maintainercover 6.6.148-rc1 review
This is the start of the stable review cycle for the 6.6.148 release. There are 484 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 01 Aug 2026 14:13:41 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.148-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.148-rc1
Nikunj A Dadhania <[email protected]>
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
David Howells <[email protected]>
rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link
Robert Mader <[email protected]>
udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
Julien Massot <[email protected]>
ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY()
Chen-Yu Tsai <[email protected]>
ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link
SJ Park <[email protected]>
mm/damon/core: disallow overlapping input ranges for damon_set_regions()
SJ Park <[email protected]>
mm/damon/core: validate ranges in damon_set_regions()
Qian Zuo <[email protected]>
coredump: fix pidfs file refcount leak in umh_coredump_setup
Venkatesh Srinivas <[email protected]>
KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
David Matlack <[email protected]>
KVM: Introduce vcpu->wants_to_run
Reinette Chatre <[email protected]>
fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
Haoxiang Li <[email protected]>
net: ipa: fix SMEM state handle leaks in SMP2P init
Théo Lebrun <[email protected]>
net: macb: drop in-flight Tx SKBs on close
Bryam Vargas <[email protected]>
ata: libata-core: Reject an invalid concurrent positioning ranges count
Dawei Feng <[email protected]>
octeontx2-pf: fix SQB pointer leak on init failure
Wentao Liang <[email protected]>
ipmi: fix refcount leak in i_ipmi_request()
Breno Leitao <[email protected]>
bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
Breno Leitao <[email protected]>
bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
Rasmus Villemoes <[email protected]>
bootconfig: do not put quotes on cmdline items unless necessary
Junrui Luo <[email protected]>
octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
Sergio Paracuellos <[email protected]>
gpio: mt7621: avoid corruption of shared interrupt trigger state
Maoyi Xie <[email protected]>
net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
Runyu Xiao <[email protected]>
gpio: tegra: do not call pinctrl for GPIO direction
Bartosz Golaszewski <[email protected]>
pinctrl: remove pinctrl_gpio_direction_output()
Dexuan Cui <[email protected]>
net: mana: Validate the packet length reported by the NIC
Thomas Gleixner <[email protected]>
locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
Guangshuo Li <[email protected]>
mmc: vub300: fix use-after-free on probe failure
Johan Hovold <[email protected]>
mmc: vub300: rename probe error labels
Johan Hovold <[email protected]>
mmc: vub300: fix use-after-free on disconnect
Maoyi Xie <[email protected]>
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
Michael Bommarito <[email protected]>
tracing/user_events: Fix use-after-free in user_event_mm_dup()
Marco Crivellari <[email protected]>
workqueue: Add system_percpu_wq and system_dfl_wq
Tejun Heo <[email protected]>
workqueue: Factor out init_cpu_worker_pool()
Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix firmware leak in async update
Dmitry Torokhov <[email protected]>
firmware_loader: introduce __free() cleanup hanler
Mikulas Patocka <[email protected]>
dm-verity: make error counter atomic
Mikulas Patocka <[email protected]>
dm-verity: avoid double increment of &use_bh_wq_enabled
Souvik Banerjee <[email protected]>
ovl: use linked upper dentry in copy-up tmpfile
Benjamin Coddington <[email protected]>
NFS: Charge unstable writes by request size, not folio size
Christoph Hellwig <[email protected]>
nfs: remove dead code for the old swap over NFS implementation
Vincent Jardin <[email protected]>
i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
Stefan Eichenberger <[email protected]>
i2c: imx: separate atomic, dma and non-dma use case
Haoxiang Li <[email protected]>
platform/x86: dell-laptop: fix missing cleanups in init error path
Lyndon Sanche <[email protected]>
platform/x86: dell-smbios: Move request functions for reuse
Michael Bommarito <[email protected]>
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
Mika Westerberg <[email protected]>
thunderbolt: Remove XDomain from the bus without holding tb->lock
Mika Westerberg <[email protected]>
thunderbolt: Remove service debugfs entries during unregister
Mika Westerberg <[email protected]>
thunderbolt: Keep XDomain reference during the lifetime of a service
Alan Borzeszkowski <[email protected]>
thunderbolt: Update property.c function documentation
Christophe JAILLET <[email protected]>
thunderbolt: Remove usage of the deprecated ida_simple_xx() API
Gil Fine <[email protected]>
thunderbolt: Handle lane bonding of Gen 4 XDomain links properly
Koichiro Den <[email protected]>
dmaengine: dw-edma-pcie: Reject devices without driver data
Krzysztof Kozlowski <[email protected]>
dmaengine: dw-edma: Fix confusing cleanup.h syntax
Abinash Singh <[email protected]>
dma: dw-edma: Fix build warning in dw_edma_pcie_probe()
Yiyang Chen <[email protected]>
taskstats: retain dead thread stats in TGID queries
Oleg Nesterov <[email protected]>
taskstats: fill_stats_for_tgid: use for_each_thread()
Miquel Raynal <[email protected]>
mtd: rawnand: Pause continuous reads at block boundaries
Miquel Raynal <[email protected]>
mtd: rawnand: Ensure all continuous terms are always in sync
Miquel Raynal <[email protected]>
mtd: rawnand: Add a helper for calculating a page index
Florian Fuchs <[email protected]>
mtd: maps: vmu-flash: fix fault in unaligned fixup
Muchun Song <[email protected]>
mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages
Chuck Lever <[email protected]>
SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
Chuck Lever <[email protected]>
SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists
Jeff Layton <[email protected]>
sunrpc: allocate a separate bvec array for socket sends
Mike Snitzer <[email protected]>
NFSD: pass nfsd_file to nfsd_iter_read()
Theodor Arsenij Larionov-Trichkine <[email protected]>
netfilter: nft_fib: reject fib expression on the netdev egress hook
Florian Westphal <[email protected]>
netfilter: nf_tables: remove register tracking infrastructure
Yue Haibing <[email protected]>
netfilter: nf_tables: Remove unused nft_reduce_is_readonly()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
Florian Westphal <[email protected]>
netfilter: nf_conntrack_sip: remove net variable shadowing
Tristan Madani <[email protected]>
selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
Casey Schaufler <[email protected]>
lsm: infrastructure management of the sock security
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: don't leak bad clone into future transaction
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: move cloning of match info to insert/removal path
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: merge deactivate helper into caller
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: prepare walk function for on-demand clone
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: make pipapo_clone helper return NULL
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: move prove_locking helper around
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: use GFP_KERNEL for insertions
Cássio Gabriel <[email protected]>
ASoC: mediatek: mt8183: Check runtime resume during probe
Cássio Gabriel <[email protected]>
ASoC: mediatek: mt8192: Check runtime resume during probe
Tang Bin <[email protected]>
ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable
AngeloGioacchino Del Regno <[email protected]>
ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb
AngeloGioacchino Del Regno <[email protected]>
ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe()
AngeloGioacchino Del Regno <[email protected]>
ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable()
AngeloGioacchino Del Regno <[email protected]>
ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link
Abdun Nihaal <[email protected]>
fbdev: efifb: fix memory leak in efifb_probe()
Thomas Zimmermann <[email protected]>
fbdev/efifb: Replace references to global screen_info by local pointer
Runyu Xiao <[email protected]>
octeontx2-vf: clear stale mailbox IRQ state before request_irq()
Runyu Xiao <[email protected]>
octeontx2-pf: clear stale mailbox IRQ state before request_irq()
Subbaraya Sundeep <[email protected]>
octeontx2: Annotate mmio regions as __iomem
Jason Wang <[email protected]>
VDUSE: avoid leaking information to userspace
Eugenio Pérez <[email protected]>
vduse: take out allocations from vduse_dev_alloc_coherent
Eugenio Pérez <[email protected]>
vduse: remove unused vaddr parameter of vduse_domain_free_coherent
Sheng Zhao <[email protected]>
vduse: Use fixed 4KB bounce pages for non-4KB page size
David Howells <[email protected]>
rxrpc: Fix socket notification race
David Howells <[email protected]>
rxrpc: Fix notification vs call-release vs recvmsg
David Howells <[email protected]>
rxrpc: Use irq-disabling spinlocks between app and I/O thread
David Howells <[email protected]>
rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack
Li Xiasong <[email protected]>
tipc: restrict socket queue dumps in enqueue tracepoints
Jiacheng Yu <[email protected]>
fbcon: Use correct type for vc_resize() return value
Thomas Zimmermann <[email protected]>
fbcon: Rename struct fbcon_ops to struct fbcon_par
Li Daming <[email protected]>
rxrpc: serialize kernel accept preallocation with socket teardown
David Howells <[email protected]>
rxrpc: Pull out certain app callback funcs into an ops table
David Howells <[email protected]>
afs: Turn the afs_addr_list address array into an array of structs
Kees Cook <[email protected]>
afs: Annotate struct afs_addr_list with __counted_by
Tapio Reijonen <[email protected]>
serial: max310x: implement gpio_chip::get_direction()
Hugo Villeneuve <[email protected]>
serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch)
Xu Rao <[email protected]>
ALSA: hda: Fix cached processing coefficient verbs
Zhang Heng <[email protected]>
ALSA: hda: conexant: Remove mic bias threshold override
Mingyu Wang <[email protected]>
i2c: i801: fix hardware state machine corruption in error path
Ricardo Robaina <[email protected]>
audit: fix recursive locking deadlock in audit_dupe_exe()
Ricardo Robaina <[email protected]>
audit: use 'unsigned int' instead of 'unsigned'
Jeff Layton <[email protected]>
audit: widen ino fields to u64
NeilBrown <[email protected]>
VFS/audit: introduce kern_path_parent() for audit
Haoxiang Li <[email protected]>
i2c: davinci: Unregister cpufreq notifier on probe failure
Sebastian Alba Vives <[email protected]>
fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
Mikhail Gavrilov <[email protected]>
dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
Jason Gunthorpe <[email protected]>
udmabuf: Do not create malformed scatterlists
Weinan Liu <[email protected]>
iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
Matt Bobrowski <[email protected]>
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
Wentao Guan <[email protected]>
bpf: drop bpf_lsm_getselfattr from hook list
Coia Prant <[email protected]>
net: pcs: xpcs: fix SGMII state reading
Yitang Yang <[email protected]>
io_uring/rw: fix missing ERESTARTSYS conversion in read paths
Harry Wentland <[email protected]>
drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources
Namjae Jeon <[email protected]>
exfat: validate cluster allocation bits of the allocation bitmap
Eric Biggers <[email protected]>
fscrypt: Avoid dynamic allocation in fscrypt_get_devices()
Kyle Zeng <[email protected]>
openvswitch: fix GSO userspace truncation underflow
Namjae Jeon <[email protected]>
ksmbd: validate ACE size against SID sub-authorities
Namjae Jeon <[email protected]>
ksmbd: bound DACL dedup walk to copied ACEs
Wentao Guan <[email protected]>
ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
Haofeng Li <[email protected]>
ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
Youssef Samir <[email protected]>
net: qrtr: ns: Raise node count limit to 512
Weiming Shi <[email protected]>
ipv6: ndisc: fix NULL deref in accept_untracked_na()
Jacob Keller <[email protected]>
i40e: remove read access to debugfs files
Asad Kamal <[email protected]>
drm/amdgpu: fix aperture mapping leak
Ce Sun <[email protected]>
drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
Boyuan Zhang <[email protected]>
drm/amdgpu: fix division by zero with invalid uvd dimensions
Luca Coelho <[email protected]>
drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()
Boyuan Zhang <[email protected]>
drm/amdgpu/vcn4: avoid rereading IB param length
Boyuan Zhang <[email protected]>
drm/amdgpu/vce: fix integer overflow in image size
Alex Deucher <[email protected]>
drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
Alex Deucher <[email protected]>
drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
Alex Deucher <[email protected]>
drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
Alex Deucher <[email protected]>
drm/amdgpu/gfx8: drop unecessary BUG_ON()
Alex Deucher <[email protected]>
drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
Alex Deucher <[email protected]>
drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
Yang Wang <[email protected]>
drm/amd/pm: make pp_features read-only when scpm is enabled
James Raphael Tiovalen <[email protected]>
vxlan: mdb: Fix source list corruption on a failed replace
Daehyeon Ko <[email protected]>
tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
Asim Viladi Oglu Manizada <[email protected]>
pppoe: reload header pointer after dev_hard_header()
Doruk Tan Ozturk <[email protected]>
mctp: serial: handle zero-length frames to prevent rx buffer overflow
Doruk Tan Ozturk <[email protected]>
mac802154: llsec: reject frames shorter than the authentication tag
Ibrahim Hashimov <[email protected]>
mac802154: hold an interface reference across the scan worker
Michael Bommarito <[email protected]>
ila: reload IPv6 header after pskb_may_pull in checksum adjust
Sergey Temerkhanov <[email protected]>
ice: use READ_ONCE() to access cached PHC time
James Montgomery <[email protected]>
ksmbd: defer destroy_previous_session() until after NTLM authentication
Raphael Zimmer <[email protected]>
rbd: Reset positive result codes to zero in object map update path
Masami Hiramatsu (Google) <[email protected]>
selftests/ftrace: Reset triggers at top level before instance loop
Jann Horn <[email protected]>
proc: Fix broken error paths for namespace links
Fan Wu <[email protected]>
net: hip04: fix RX buffer leak on build_skb failure
David Lee <[email protected]>
net/x25: fix use-after-free in x25_kill_by_neigh()
Bryam Vargas <[email protected]>
net/iucv: fix use-after-free of a severed iucv_path
Hidayath Khan <[email protected]>
net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
Doruk Tan Ozturk <[email protected]>
geneve: require CAP_NET_ADMIN in the device netns for changelink
Sungmin Kang <[email protected]>
net: slip: serialize receive against buffer reallocation
Doruk Tan Ozturk <[email protected]>
vxlan: require CAP_NET_ADMIN in the device netns for changelink
Breno Leitao <[email protected]>
phonet: pep: fix use-after-free in pep_get_sb()
Lu Baolu <[email protected]>
iommu/vt-d: Disallow SVA if page walk is not coherent
Tengda Wu <[email protected]>
ftrace: Add global mutex to serialize trace_parser access
Eric Biggers <[email protected]>
fscrypt: Add missing superblock check in find_or_insert_direct_key()
Amir Goldstein <[email protected]>
fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
Christian Brauner <[email protected]>
binfmt_elf_fdpic: only honour the first PT_INTERP
Douya Le <[email protected]>
libceph: remove debugfs files before client teardown
Douya Le <[email protected]>
libceph: reject zero bucket types in crush_decode
Raphael Zimmer <[email protected]>
libceph: Reject monmaps advertising zero monitors
Shuangpeng Bai <[email protected]>
libceph: refresh auth->authorizer_buf{,_len} after authorizer updateZhao Zhang <[email protected]>
libceph: guard missing CRUSH type name lookup
Raphael Zimmer <[email protected]>
libceph: Fix multiplication overflow in decode_new_up_state_weight()
Douya Le <[email protected]>
libceph: bound get_version reply decode to front len
Bryam Vargas <[email protected]>
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
Max Kellermann <[email protected]>
ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT*
Jun Yang <[email protected]>
sctp: don't free the ASCONF's own transport in DEL-IP processing
Michael Bommarito <[email protected]>
mptcp: only set DATA_FIN when a mapping is present
Chenguang Zhao <[email protected]>
mptcp: decrement subflows counter on failed passive join
Will Deacon <[email protected]>
Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"
Will Deacon <[email protected]>
arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()
Masami Hiramatsu (Google) <[email protected]>
tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
deepakraog <[email protected]>
tracing: Fix resource leak on mmiotrace trace_pipe close
Steven Rostedt <[email protected]>
tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
Guangshuo Li <[email protected]>
intel_th: fix MSC output device reference leak
Alexander Usyskin <[email protected]>
mei: bus: access mei_device under device_lock on cleanup
Jiangshan Yi <[email protected]>
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
Hugo Villeneuve <[email protected]>
serial: sc16is7xx: implement gpio get_direction() callback
Ian Abbott <[email protected]>
comedi: comedi_parport: deal with premature interrupt
Nathan Chancellor <[email protected]>
x86/boot/compressed: Disable jump tables
Xu Rao <[email protected]>
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
Haoran Jiang <[email protected]>
LoongArch: Fix oops during single-step debugging
Zixing Liu <[email protected]>
platform/loongarch: laptop: Explicitly reset bl_powered state when suspend
Christian Brauner <[email protected]>
binfmt_misc: set have_execfd only once the interpreter is opened
Christian Brauner <[email protected]>
exec: fix unsigned loop counter wrap in transfer_args_to_stack()
Chengfeng Ye <[email protected]>
Bluetooth: RFCOMM: Fix session UAF in set_termios
Chengfeng Ye <[email protected]>
Bluetooth: hci_sync: Protect UUID list traversal
MinJea Kim <[email protected]>
staging: rtl8723bs: fix inverted HT40 secondary channel offset
Moksh Panicker <[email protected]>
staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
Fan Wu <[email protected]>
wifi: brcmfmac: make release_scratchbuffers idempotent
Devin Wittmayer <[email protected]>
wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
Devin Wittmayer <[email protected]>
wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
Huihui Huang <[email protected]>
wifi: wilc1000: validate assoc response length before subtracting header
Doruk Tan Ozturk <[email protected]>
wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB access from firmware ADDBA window size
Norbert Szetei <[email protected]>
ALSA: seq: close a re-opened queue timer in the destructor
Johan Hovold <[email protected]>
media: vpif_capture: fix OF node reference imbalance
Hans Verkuil <[email protected]>
media: vivid: check for vb2_is_busy() when toggling caps
Hans Verkuil <[email protected]>
media: vivid: add vivid_update_reduced_fps()
Guangshuo Li <[email protected]>
media: vimc: fix reference leak on failed device registration
Guangshuo Li <[email protected]>
media: vidtv: fix reference leak on failed device registration
Zile Xiong <[email protected]>
media: vb2: use ssize_t for vb2_read/vb2_write
Pengpeng Hou <[email protected]>
media: v4l2-ctrls: validate HEVC active reference counts
Sergey Shtylyov <[email protected]>
media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()
Myeonghun Pak <[email protected]>
media: ti: vpe: unwind v4l2 device registration on probe error
Hungyu Lin <[email protected]>
media: tegra-video: vi: fix invalid u32 return value in format lookup
Valery Borovsky <[email protected]>
media: sun4i-csi: Return queued buffers on start_streaming() failure
Myeonghun Pak <[email protected]>
media: stm32: dcmi: unregister notifier on probe failure
Ma Ke <[email protected]>
media: saa7134: Fix a possible memory leak in saa7134_video_init1
Valery Borovsky <[email protected]>
media: rtl2832_sdr: Return queued buffers on start_streaming() failure
Deepanshu Kartikey <[email protected]>
media: rtl2832: fix use-after-free in rtl2832_remove()
Myeonghun Pak <[email protected]>
media: radio-si476x: Unregister v4l2_device on probe failure
Valery Borovsky <[email protected]>
media: pwc: Return queued buffers on start_streaming() failure
Valery Borovsky <[email protected]>
media: pwc: Drain fill_buf on start_streaming() failure
Krzysztof Kozlowski <[email protected]>
media: pci: dm1105: Free allocated workqueue
Guoniu Zhou <[email protected]>
media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding
Guoniu Zhou <[email protected]>
media: nxp: imx8-isi: Fix potential out-of-bounds issues
Xiaolei Wang <[email protected]>
media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path
Xiaolei Wang <[email protected]>
media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure
Xiaolei Wang <[email protected]>
media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe
Valery Borovsky <[email protected]>
media: msi2500: Return queued buffers on start_streaming() failure
Anand Moon <[email protected]>
media: meson: vdec: Fix memory leak in error path of vdec_open
Guangshuo Li <[email protected]>
media: marvell-cam: fix missing pci_disable_device() on remove
Wang Jun <[email protected]>
media: cx23885: add ioremap return check and cleanup
Johan Hovold <[email protected]>
media: cx231xx: fix devres lifetime
Pengpeng Hou <[email protected]>
media: cedrus: skip invalid H.264 reference list entries
Samuel Holland <[email protected]>
media: cedrus: Fix missing cleanup in error path
Myeonghun Pak <[email protected]>
media: cedrus: clean up media device on probe failure
Myeonghun Pak <[email protected]>
media: cec: seco: unregister adapter on IR probe failure
David Carlier <[email protected]>
media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
Valery Borovsky <[email protected]>
media: airspy: Return queued buffers on start_streaming() failure
Linmao Li <[email protected]>
drm/vc4: Prevent shader BO mappings from becoming writable
Ian Forbes <[email protected]>
drm/vmwgfx: Validate vmw_surface_metadata::array_size
Zhu Lingshan <[email protected]>
drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
WenTao Liang <[email protected]>
drm/amd/display: set new_stream to NULL after release
Timur Kristóf <[email protected]>
drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
Mario Limonciello <[email protected]>
drm/amdgpu: Fix VFCT bus number matching with soft filter
Joonas Lahtinen <[email protected]>
drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
Joonas Lahtinen <[email protected]>
drm/i915/gem: Do not leak siblings[] on proto context error
Joonas Lahtinen <[email protected]>
drm/i915: Return NULL on error in active_instance
Alex Deucher <[email protected]>
drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
Alex Deucher <[email protected]>
drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
Alex Deucher <[email protected]>
drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()
Bryam Vargas <[email protected]>
drm/virtio: bound EDID block reads to the response buffer
WenTao Liang <[email protected]>
drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference
Thomas Zimmermann <[email protected]>
drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips
David Francis <[email protected]>
drm/amdkfd: Check bounds in allocate_event_notification_slot
Pavel Ondračka <[email protected]>
drm/radeon: fix r100_copy_blit for large BOs
Wentao Liang <[email protected]>
drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()
Joonas Lahtinen <[email protected]>
drm/i915/gem: Add missing nospec on parallel submit slot
Junrui Luo <[email protected]>
drm/nouveau: fix reversed error cleanup order in ucopy functions
Mario Limonciello <[email protected]>
drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1
Timur Kristóf <[email protected]>
drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
Timur Kristóf <[email protected]>
drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older
Timur Kristóf <[email protected]>
drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2)
Ashutosh Desai <[email protected]>
drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
Ashutosh Desai <[email protected]>
drm/dp/mst: fix buffer overflows in sideband chunk accumulation
Ashutosh Desai <[email protected]>
drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
Vitor Soares <[email protected]>
drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
Sergey Shtylyov <[email protected]>
drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
Chengfeng Ye <[email protected]>
bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
Marcin Szycik <[email protected]>
ice: fix LAG recipe to profile association
Li RongQing <[email protected]>
net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
Alexei Lazar <[email protected]>
net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation
Alexei Lazar <[email protected]>
net/mlx5e: Report zero bandwidth for non-ETS traffic classes
Yael Chemla <[email protected]>
net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule
Aldo Ariel Panzardo <[email protected]>
net: qrtr: restrict socket creation to the initial network namespace
Chenguang Zhao <[email protected]>
hinic: remove unused ethtool RSS user configuration buffers
Eric Dumazet <[email protected]>
ppp: annotate data races in ppp_generic
Qingfang Deng <[email protected]>
ppp: enable TX scatter-gather
Qingfang Deng <[email protected]>
ppp: convert to percpu netstats
Qingfang Deng <[email protected]>
ppp: use IFF_NO_QUEUE in virtual interfaces
Eric Dumazet <[email protected]>
ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup
Suman Ghosh <[email protected]>
octeontx2-vf: set TC flower flag on MCAM entry allocation
vadik likholetov <[email protected]>
net: stmmac: enable the MAC on link up for all supported speeds
Nazim Amirul <[email protected]>
net: stmmac: reset residual action in L3L4 filters on delete
Nazim Amirul <[email protected]>
net: stmmac: fix l3l4 filter rejecting unsupported offload requests
Cen Zhang (Microsoft) <[email protected]>
tipc: fix u16 MTU truncation in media and bearer MTU validation
Zhang Yi <[email protected]>
iomap: correct the range of a partial dirty clear
Harshaka Narayana <[email protected]>
vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
Qing Luo <[email protected]>
sctp: auth: verify auth requirement when auth_chunk is NULL
Michael Walle <[email protected]>
net: dpaa: fix mode setting
Eric Dumazet <[email protected]>
net: hsr: fix memory leak on slave unregistration by removing synced VLANs
Nikolay Aleksandrov <[email protected]>
net: bridge: vlan: fix vlan range dumps starting with pvid
Michael Bommarito <[email protected]>
amt: make the head writable before rewriting the L2 header
Michael Bommarito <[email protected]>
amt: re-read skb header pointers after every pull
Shelley Yang <[email protected]>
wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()
Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()
Lorenzo Bianconi <[email protected]>
wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()
Ruoyu Wang <[email protected]>
wifi: mt76: mt7915: guard HE capability lookups
Helen Koike <[email protected]>
tipc: fix infinite loop in __tipc_nl_compat_dumpit
Xiang Mei (Microsoft) <[email protected]>
nexthop: initialize extack in nh_res_bucket_migrate()
Xiang Mei (Microsoft) <[email protected]>
gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
Matthieu Baerts (NGI0) <[email protected]>
selftests: openvswitch: add config file
Matthieu Baerts (NGI0) <[email protected]>
selftests: af_unix: add USER_NS config
Kuniyuki Iwashima <[email protected]>
selftest: af_unix: Add Kconfig file.
Rishikesh Jethwani <[email protected]>
tls: device: push pending open record on splice EOF
Cen Zhang (Microsoft) <[email protected]>
sctp: validate stream count in sctp_process_strreset_inreq()
Nikhil P. Rao <[email protected]>
pds_core: check for workqueue allocation failure
Nikhil P. Rao <[email protected]>
pds_core: fix auxiliary device add/del races
Nikhil P. Rao <[email protected]>
pds_core: order completion reads after the ownership check
Nikhil P. Rao <[email protected]>
pds_core: yield the CPU while waiting for the adminq to drain
HanQuan <[email protected]>
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
Prashanth Kumar KR <[email protected]>
amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
Nikhil P. Rao <[email protected]>
pds_core: reject component parameter in legacy firmware update
Andrew Pope <[email protected]>
wifi: mac80211: recalculate TIM when a station enters power save
Li RongQing <[email protected]>
iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
Pengpeng Hou <[email protected]>
iommu/amd: Bound the early ACPI HID map
HE WEI (ギカク) <[email protected]>
wifi: mwifiex: bound uAP association event IEs to the event buffer
Ruoyu Wang <[email protected]>
wan: wanxl: Only reset hardware after BAR mapping
Ruoyu Wang <[email protected]>
nfp: Check resource mutex allocation
Xiang Mei <[email protected]>
wifi: mac80211: tear down new links on vif update error path
Guanghui Feng <[email protected]>
iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()
Guangshuo Li <[email protected]>
dpaa2-eth: put MAC endpoint device on disconnect
Guangshuo Li <[email protected]>
dpaa2-switch: put MAC endpoint device on disconnect
Aldo Ariel Panzardo <[email protected]>
rds: drop incoming messages that cross network namespace boundaries
Zhaolong Zhang <[email protected]>
bonding: fix devconf_all NULL dereference when IPv6 is disabled
David Lee <[email protected]>
net/packet: avoid fanout hook re-registration after unregister
Pengpeng Hou <[email protected]>
Bluetooth: btusb: validate Realtek vendor event length
Pengpeng Hou <[email protected]>
hwmon: occ: validate poll response sensor blocks
Yichong Chen <[email protected]>
smb: client: validate DFS referral PathConsumed
Eugene Shalygin <[email protected]>
hwmon: (asus-ec-sensors) add missed handle for ENOMEM
Eugene Shalygin <[email protected]>
hwmon: (asus-ec-sensors) fix EC read intervals
Eugene Shalygin <[email protected]>
hwmon: (asus-ec-sensors) fix looping over banks while reading from EC
Diego Fernando Mancera Gomez <[email protected]>
usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
Shahar Tzarfati <[email protected]>
wifi: iwlwifi: mvm: fix read in wake packet notification handler
Pagadala Yesu Anjaneyulu <[email protected]>
wifi: iwlwifi: mvm: validate SAR GEO response payload size
Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Use complete_all() to signal init_completion
Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Fix potential probe() deadlock
Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Don't use devres to unregister component
Shengjiu Wang <[email protected]>
ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
Pengpeng Hou <[email protected]>
ASoC: tas2781: bound firmware description string parsing
Guanghui Yang <[email protected]>
btrfs: free mapping node on duplicate reloc root insert
You-Kai Zheng <[email protected]>
btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8
Tristan Madani <[email protected]>
wifi: carl9170: fix buffer overflow in rx_stream failover path
Tristan Madani <[email protected]>
wifi: carl9170: fix OOB read from off-by-two in TX status handler
Tristan Madani <[email protected]>
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
Ruoyu Wang <[email protected]>
firewire: net: Fix fragmented datagram reassembly
Manivannan Sadhasivam <[email protected]>
wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
Manivannan Sadhasivam <[email protected]>
wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
Dmitry Morgun <[email protected]>
wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
Tzung-Bi Shih <[email protected]>
watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
Guenter Roeck <[email protected]>
hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
Guenter Roeck <[email protected]>
hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
Edward Adam Davis <[email protected]>
hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
Gaole Zhang <[email protected]>
wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
Cheng Yongkang <[email protected]>
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
Xincheng Zhang <[email protected]>
usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
Xie Bo <[email protected]>
RISC-V: KVM: Serialize virtual interrupt pending state updates
Sasha Levin <[email protected]>
Revert "drm/amd/display: Add missing kdoc for ALLM parameters"
Doruk Tan Ozturk <[email protected]>
crypto: rsa-pkcs1pad: Don't WARN on an empty digest
Chukun Pan <[email protected]>
USB: serial: option: add TDTECH MT5710-CN
Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix data loss on receive throttling
Sunho Park <[email protected]>
USB: serial: io_edgeport: cap received transmit credits
Tim Pambor <[email protected]>
USB: serial: ftdi_sio: add support for E+H FXA291
Muhammad Bilal <[email protected]>
usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
Fan Wu <[email protected]>
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
Sonali Pradhan <[email protected]>
usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
Johan Hovold <[email protected]>
USB: gadget: fsl-udc: fix device name leak on probe failure
Johan Hovold <[email protected]>
USB: gadget: snps-udc: fix device name leak on probe failure
Melbin K Mathew <[email protected]>
usb: gadget: printer: fix infinite loop in printer_read()
Fan Wu <[email protected]>
usb: gadget: f_midi: cancel pending IN work before freeing the midi object
Jinchao Wang <[email protected]>
usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
Xu Yang <[email protected]>
usb: chipidea: fix usage_count leak when autosuspend_delay is negative
Huang Wei <[email protected]>
USB: storage: add NO_ATA_1X quirk for Longmai USB Key
Huihui Huang <[email protected]>
wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
Weiming Shi <[email protected]>
mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
Xin Long <[email protected]>
sctp: fix auth_hmacs array size in struct sctp_cookie
Jamal Hadi Salim <[email protected]>
net/sched: act_tunnel_key: Defer dst_release to RCU callback
Emre Cecanpunar <[email protected]>
drm/i915/selftests: Fix GT PM sort comparators
Xiang Mei (Microsoft) <[email protected]>
ksmbd: validate compound request size before reading StructureSize2
Qihang <[email protected]>
ksmbd: pin conn during async oplock break notification
Shuhao Fu <[email protected]>
can: j1939: fix lockless local-destination check
Michal Luczaj <[email protected]>
bpf, sockmap: Reject unhashed UDP sockets on sockmap update
Shrikanth Hegde <[email protected]>
powerpc/vtime: Initialize starttime at boot for native accounting
Frederic Weisbecker <[email protected]>
powerpc/time: Prepare to stop elapsing in dynticks-idle
Alexander Gordeev <[email protected]>
sched/vtime: Get rid of generic vtime_task_switch() implementation
Pengpeng Hou <[email protected]>
drm/i915/gt: use correct selftest config symbol
Huiwen He <[email protected]>
smb/client: handle overlapping allocated ranges in fallocate
Ruoyu Wang <[email protected]>
Bluetooth: hci_qca: Clear memdump state on invalid dump size
Pauli Virtanen <[email protected]>
Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
Pauli Virtanen <[email protected]>
Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
Xiang Mei <[email protected]>
Bluetooth: qca: fix NVM tag length underflow in TLV parser
Takashi Iwai <[email protected]>
ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
Rosen Penev <[email protected]>
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
Rosen Penev <[email protected]>
ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
Rosen Penev <[email protected]>
ata: sata_dwc_460ex: use platform_get_irq()
Rosen Penev <[email protected]>
ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered
Bryam Vargas <[email protected]>
net/iucv: take a reference on the socket found in afiucv_hs_rcv()
Weiming Shi <[email protected]>
ipv4: fib: free fib_alias with kfree_rcu() on insert error path
Norbert Szetei <[email protected]>
ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
Pushpendra Singh <[email protected]>
firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
Uday Khare <[email protected]>
ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
Charles Keepax <[email protected]>
ASoC: cs42l43: Correct report for forced microphone jack
Vijendar Mukunda <[email protected]>
ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()
Christian Hewitt <[email protected]>
ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
HE WEI (ギカク) <[email protected]>
wifi: cfg80211: bound element ID read when checking non-inheritance
Runyu Xiao <[email protected]>
wifi: brcmfmac: initialize SDIO data work before cleanup
Cen Zhang <[email protected]>
wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
Zhao Li <[email protected]>
wifi: cfg80211: reject unsupported PMSR FTM location requests
Zhao Li <[email protected]>
wifi: cfg80211: validate PMSR FTM preamble range
Zhao Li <[email protected]>
wifi: cfg80211: validate PMSR measurement type data
Zhao Li <[email protected]>
wifi: nl80211: validate nested MBSSID IE blobs
Zhao Li <[email protected]>
wifi: nl80211: free RNR data on MBSSID mismatch
Xiang Mei <[email protected]>
wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
Dawei Feng <[email protected]>
wifi: libertas: fix memory leak in helper_firmware_cb()
Bryam Vargas <[email protected]>
wifi: mac80211_hwsim: clamp virtio RX length before skb_put
Abdun Nihaal <[email protected]>
wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
Cen Zhang <[email protected]>
wifi: cfg80211: cancel sched scan results work on unregister
Xiang Mei (Microsoft) <[email protected]>
xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
Xiang Mei (Microsoft) <[email protected]>
xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
Aleksandrova Alyona <[email protected]>
RDMA/irdma: Prevent overflows in memory contiguity checks
Malaya Kumar Rout <[email protected]>
selftests/alsa: Fix memory leak in find_controls error path
Xue Lei <[email protected]>
mtd: fix double free and WARN_ON in add_mtd_device() error paths
Ruoyu Wang <[email protected]>
RDMA/siw: publish QP after initialization
Guoqing Jiang <[email protected]>
RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp
Danila Chernetsov <[email protected]>
RDMA/hns: Fix potential integer overflow in mhop hem cleanup
Ruoyu Wang <[email protected]>
RDMA/erdma: initialize ret for empty receive WR lists
Jacob Moroni <[email protected]>
RDMA/irdma: Prevent rereg_mr for non-mem regions
Jacob Moroni <[email protected]>
RDMA/umem: Add helpers for umem dmabuf revoke lock
Jacob Moroni <[email protected]>
RDMA/umem: Add pinned revocable dmabuf import interface
Jacob Moroni <[email protected]>
RDMA/umem: Move umem dmabuf revoke logic into helper function
Jacob Moroni <[email protected]>
RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper
Yishai Hadas <[email protected]>
RDMA/umem: Introduce an option to revoke DMABUF umem
Yishai Hadas <[email protected]>
RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device
Or Gerlitz <[email protected]>
RDMA/cma: Fix hardware address comparison length in netevent callback
Unnathi Chalicheemala <[email protected]>
firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
Filipe Manana <[email protected]>
btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
Xiang Mei <[email protected]>
btrfs: reject free space cache with more entries than pages
Pengpeng Hou <[email protected]>
mtd: nand: mtk-ecc: stop on ECC idle timeouts
Pengpeng Hou <[email protected]>
mtd: mtdswap: remove debugfs stats file on teardown
Michael Bommarito <[email protected]>
IB/mad: Drop unmatched RMPP responses before reassembly
Sumit Gupta <[email protected]>
arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix logic error in packet reset
Seungjin Bae <[email protected]>
Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
Chuck Lever <[email protected]>
xprtrdma: Clear receive-side ownership pointers on release
Mikko Perttunen <[email protected]>
gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
Jhonraushan <[email protected]>
accel/ivpu: Reject firmware log with size smaller than header
Claudiu Beznea <[email protected]>
dmaengine: sh: rz-dmac: Move interrupt request after everything is set up
Oliver Hartkopp <[email protected]>
can: isotp: serialize TX state transitions under so->rx_lock
Oliver Hartkopp <[email protected]>
can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
Oliver Hartkopp <[email protected]>
can: bcm: track a single source interface for ANYDEV timeout/throttle ops
Oliver Hartkopp <[email protected]>
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
Oliver Hartkopp <[email protected]>
can: bcm: fix stale rx/tx ops after device removal
Oliver Hartkopp <[email protected]>
can: bcm: add missing device refcount for CAN filter removal
Oliver Hartkopp <[email protected]>
can: bcm: validate frame length in bcm_rx_setup() for RTR replies
Oliver Hartkopp <[email protected]>
can: bcm: extend bcm_tx_lock usage for data and timer updates
Oliver Hartkopp <[email protected]>
can: bcm: fix CAN frame rx/tx statistics
Oliver Hartkopp <[email protected]>
can: bcm: add locking when updating filter and timer values
Phil Rosenthal <[email protected]>
KVM: x86/mmu: Fix use-after-free on vendor module reload
Hyunwoo Kim <[email protected]>
KVM: nVMX: Hide shadow VMCS right after VMCLEAR
Sean Christopherson <[email protected]>
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
Heiko Carstens <[email protected]>
seqlock: Allow UBSAN_ALIGNMENT to fail optimizing
Peter Zijlstra <[email protected]>
seqlock: Allow KASAN to fail optimizing
Peter Zijlstra <[email protected]>
seqlock: Cure some more scoped_seqlock() optimization fails
Daniel Gibson <[email protected]>
platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
Daniel Gibson <[email protected]>
platform/x86/amd/pmc: Don't log during intermediate wakeups
Ryosuke Yasuoka <[email protected]>
drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker
Daniel Borkmann <[email protected]>
selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs
Daniel Borkmann <[email protected]>
bpf: Fix ld_{abs,ind} failure path analysis in subprogs
Guixiong Wei <[email protected]>
platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug
-------------
Diffstat:
Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra234.dtsi | 24 +- arch/arm64/kvm/arm.c | 2 +- arch/loongarch/kernel/kgdb.c | 3 +- arch/mips/kvm/mips.c | 2 +- arch/powerpc/include/asm/cputime.h | 13 - arch/powerpc/kernel/time.c | 65 +++ arch/powerpc/kvm/powerpc.c | 2 +- arch/riscv/include/asm/kvm_host.h | 10 +- arch/riscv/kvm/aia.c | 35 +- arch/riscv/kvm/vcpu.c | 66 ++- arch/riscv/kvm/vcpu_onereg.c | 8 +- arch/s390/kvm/kvm-s390.c | 2 +- arch/x86/boot/compressed/Makefile | 1 + arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +- arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/mmu/mmu.c | 11 +- arch/x86/kvm/mmu/paging_tmpl.h | 10 +- arch/x86/kvm/svm/svm.c | 7 +- arch/x86/kvm/vmx/nested.c | 11 +- arch/x86/kvm/x86.c | 4 +- crypto/rsa-pkcs1pad.c | 2 +- drivers/accel/ivpu/ivpu_fw_log.c | 4 + drivers/ata/libata-core.c | 18 + drivers/ata/libata-scsi.c | 2 - drivers/ata/libata.h | 9 + drivers/ata/sata_dwc_460ex.c | 38 +- drivers/block/rbd.c | 7 +- drivers/bluetooth/btqca.c | 2 +- drivers/bluetooth/btusb.c | 4 +- drivers/bluetooth/hci_qca.c | 4 + drivers/cdrom/cdrom.c | 1 + drivers/char/ipmi/ipmi_msghandler.c | 8 + drivers/comedi/drivers/comedi_parport.c | 13 +- drivers/dma-buf/udmabuf.c | 21 +- drivers/dma/dw-edma/dw-edma-pcie.c | 63 +-- drivers/dma/sh/rz-dmac.c | 96 ++-- drivers/firewire/net.c | 37 +- drivers/firmware/arm_ffa/driver.c | 2 +- drivers/firmware/arm_scmi/notify.c | 6 +- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-mt7621.c | 2 + drivers/gpio/gpio-mvebu.c | 4 +- drivers/gpio/gpio-pxa.c | 4 +- drivers/gpio/gpio-tegra.c | 18 +- drivers/gpio/gpio-vf610.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 45 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 - drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 54 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 58 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 17 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 3 - drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 11 +- drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 4 +- drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 15 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 3 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 11 +- .../amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 9 +- .../gpu/drm/amd/display/dc/link/link_detection.c | 5 +- .../amd/display/modules/info_packet/info_packet.c | 2 - drivers/gpu/drm/amd/pm/amdgpu_pm.c | 5 + drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 7 +- drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 11 +- drivers/gpu/drm/display/drm_dp_mst_topology.c | 36 +- drivers/gpu/drm/i915/gem/i915_gem_context.c | 25 +- drivers/gpu/drm/i915/gt/intel_engine_user.c | 2 +- drivers/gpu/drm/i915/gt/selftest_gt_pm.c | 8 +- drivers/gpu/drm/i915/i915_active.c | 7 +- drivers/gpu/drm/nouveau/nouveau_exec.c | 4 +- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 1 + drivers/gpu/drm/radeon/r100.c | 13 +- drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 + drivers/gpu/drm/vc4/vc4_bo.c | 10 +- drivers/gpu/drm/virtio/virtgpu_kms.c | 5 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +- drivers/gpu/host1x/bus.c | 4 +- drivers/hwmon/asus-ec-sensors.c | 18 +- drivers/hwmon/corsair-cpro.c | 1 + drivers/hwmon/corsair-psu.c | 1 + drivers/hwmon/nzxt-smart2.c | 2 +- drivers/hwmon/occ/common.c | 38 +- drivers/hwtracing/intel_th/core.c | 10 - drivers/hwtracing/intel_th/msu.c | 2 + drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-i801.c | 2 +- drivers/i2c/busses/i2c-imx.c | 126 +++-- drivers/infiniband/core/cma.c | 2 +- drivers/infiniband/core/mad.c | 30 ++ drivers/infiniband/core/umem_dmabuf.c | 176 ++++++- drivers/infiniband/hw/erdma/erdma_qp.c | 2 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 2 +- drivers/infiniband/hw/irdma/verbs.c | 7 +- drivers/infiniband/sw/siw/siw_verbs.c | 62 ++- drivers/input/misc/ims-pcu.c | 37 +- drivers/iommu/amd/init.c | 6 + drivers/iommu/amd/iommu.c | 25 +- drivers/iommu/intel/perf.c | 2 +- drivers/iommu/intel/svm.c | 2 +- drivers/md/dm-verity-target.c | 14 +- drivers/md/dm-verity.h | 2 +- drivers/media/cec/platform/seco/seco-cec.c | 6 +- drivers/media/common/videobuf2/videobuf2-core.c | 12 +- drivers/media/dvb-frontends/rtl2832.c | 4 +- drivers/media/dvb-frontends/rtl2832_sdr.c | 19 +- drivers/media/pci/cx23885/cx23885-core.c | 14 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/saa7134/saa7134-video.c | 25 +- drivers/media/platform/aspeed/aspeed-video.c | 1 + drivers/media/platform/marvell/cafe-driver.c | 1 + .../media/platform/nxp/imx8-isi/imx8-isi-core.c | 2 + .../media/platform/nxp/imx8-isi/imx8-isi-core.h | 16 + .../platform/nxp/imx8-isi/imx8-isi-crossbar.c | 1 + drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c | 9 +- drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c | 11 +- .../media/platform/nxp/imx8-isi/imx8-isi-pipe.c | 20 +- drivers/media/platform/st/stm32/stm32-dcmi.c | 1 + drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c | 6 +- drivers/media/platform/ti/davinci/vpif_capture.c | 2 +- drivers/media/platform/ti/vpe/vpe.c | 3 +- drivers/media/radio/radio-si476x.c | 1 + drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vimc/vimc-core.c | 1 + drivers/media/test-drivers/vivid/vivid-ctrls.c | 15 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 38 +- drivers/media/test-drivers/vivid/vivid-vid-cap.h | 1 + drivers/media/test-drivers/vivid/vivid-vid-out.c | 6 + drivers/media/usb/airspy/airspy.c | 8 +- drivers/media/usb/cx231xx/cx231xx-cards.c | 16 +- drivers/media/usb/msi2500/msi2500.c | 32 +- drivers/media/usb/pwc/pwc-if.c | 13 +- drivers/media/v4l2-core/v4l2-ctrls-core.c | 13 + drivers/media/v4l2-core/v4l2-ctrls-request.c | 14 +- drivers/misc/mei/bus.c | 16 +- drivers/mmc/host/vub300.c | 36 +- drivers/mtd/maps/vmu-flash.c | 8 +- drivers/mtd/mtdcore.c | 23 +- drivers/mtd/mtdswap.c | 5 +- drivers/mtd/nand/ecc-mtk.c | 16 +- drivers/mtd/nand/raw/nand_base.c | 43 +- drivers/net/amt.c | 87 +++- drivers/net/bonding/bond_main.c | 3 +- drivers/net/ethernet/amd/pds_core/adminq.c | 12 +- drivers/net/ethernet/amd/pds_core/auxbus.c | 17 +- drivers/net/ethernet/amd/pds_core/core.c | 1 + drivers/net/ethernet/amd/pds_core/devlink.c | 6 + drivers/net/ethernet/amd/pds_core/main.c | 9 +- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 11 +- drivers/net/ethernet/cadence/macb_main.c | 22 +- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 1 + .../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 1 + drivers/net/ethernet/freescale/fman/fman_dtsec.c | 17 +- drivers/net/ethernet/hisilicon/hip04_eth.c | 11 +- drivers/net/ethernet/huawei/hinic/hinic_dev.h | 2 - drivers/net/ethernet/huawei/hinic/hinic_ethtool.c | 21 - drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 121 +---- drivers/net/ethernet/intel/ice/ice_lag.c | 2 +- drivers/net/ethernet/intel/ice/ice_ptp.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 14 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 9 + .../ethernet/marvell/octeontx2/nic/otx2_flows.c | 1 + .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 28 +- .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 13 +- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 15 + .../ethernet/mellanox/mlx5/core/esw/acl/helper.c | 2 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 13 + .../ethernet/netronome/nfp/nfpcore/nfp_resource.c | 3 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 92 ++-- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 35 ++ drivers/net/geneve.c | 3 + drivers/net/gtp.c | 5 +- drivers/net/ipa/ipa_smp2p.c | 30 +- drivers/net/mctp/mctp-serial.c | 2 +- drivers/net/pcs/pcs-xpcs.c | 34 +- drivers/net/ppp/ppp_generic.c | 154 +++--- drivers/net/ppp/pppoe.c | 2 + drivers/net/ppp/pptp.c | 1 + drivers/net/slip/slip.c | 4 + drivers/net/vmxnet3/vmxnet3_drv.c | 22 +- drivers/net/vxlan/vxlan_core.c | 3 + drivers/net/vxlan/vxlan_mdb.c | 30 +- drivers/net/wan/wanxl.c | 3 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 3 + drivers/net/wireless/ath/ath11k/pci.c | 4 + drivers/net/wireless/ath/ath11k/qmi.c | 11 +- drivers/net/wireless/ath/ath12k/pci.c | 4 + drivers/net/wireless/ath/ath6kl/txrx.c | 10 +- drivers/net/wireless/ath/ath6kl/wmi.c | 20 + drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +- drivers/net/wireless/ath/carl9170/rx.c | 7 +- drivers/net/wireless/ath/carl9170/tx.c | 2 +- drivers/net/wireless/atmel/at76c50x-usb.c | 7 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 3 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 10 + drivers/net/wireless/intersil/p54/txrx.c | 8 + drivers/net/wireless/marvell/libertas/firmware.c | 1 + drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- drivers/net/wireless/marvell/mwifiex/tdls.c | 2 +- drivers/net/wireless/marvell/mwifiex/uap_event.c | 24 +- drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 6 + .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 + drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 18 +- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 10 +- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 19 +- drivers/net/wireless/microchip/wilc1000/hif.c | 5 + drivers/net/wireless/virtual/mac80211_hwsim.c | 1 + drivers/pinctrl/cirrus/pinctrl-cs42l43.c | 4 +- drivers/pinctrl/cirrus/pinctrl-lochnagar.c | 2 +- drivers/pinctrl/core.c | 14 +- drivers/pinctrl/intel/pinctrl-cherryview.c | 4 +- drivers/pinctrl/intel/pinctrl-intel.c | 4 +- drivers/pinctrl/intel/pinctrl-lynxpoint.c | 4 +- drivers/pinctrl/mediatek/pinctrl-moore.c | 4 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 4 +- drivers/pinctrl/mediatek/pinctrl-paris.c | 4 +- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 4 +- drivers/pinctrl/pinctrl-as3722.c | 4 +- drivers/pinctrl/pinctrl-axp209.c | 2 +- drivers/pinctrl/pinctrl-cy8c95x0.c | 4 +- drivers/pinctrl/pinctrl-ingenic.c | 11 +- drivers/pinctrl/pinctrl-ocelot.c | 4 +- drivers/pinctrl/pinctrl-rk805.c | 4 +- drivers/pinctrl/pinctrl-st.c | 4 +- drivers/pinctrl/renesas/gpio.c | 4 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 4 +- drivers/pinctrl/vt8500/pinctrl-wmt.c | 4 +- drivers/platform/loongarch/loongson-laptop.c | 1 + drivers/platform/x86/amd/pmc/pmc.c | 39 +- drivers/platform/x86/amd/pmc/pmc.h | 1 + drivers/platform/x86/dell/dell-laptop.c | 28 +- drivers/platform/x86/dell/dell-smbios-base.c | 25 + drivers/platform/x86/dell/dell-smbios.h | 5 + .../uncore-frequency/uncore-frequency-common.c | 7 +- drivers/staging/media/meson/vdec/vdec.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 6 +- drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 3 + drivers/staging/media/tegra-video/vi.c | 4 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 9 +- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 2 +- drivers/thunderbolt/debugfs.c | 2 + drivers/thunderbolt/domain.c | 36 +- drivers/thunderbolt/icm.c | 5 + drivers/thunderbolt/nhi.c | 6 +- drivers/thunderbolt/nvm.c | 4 +- drivers/thunderbolt/property.c | 38 +- drivers/thunderbolt/switch.c | 20 +- drivers/thunderbolt/tb.c | 61 ++- drivers/thunderbolt/tb.h | 2 + drivers/thunderbolt/xdomain.c | 149 ++++-- drivers/tty/serial/8250/8250_mid.c | 14 +- drivers/tty/serial/max310x.c | 20 +- drivers/tty/serial/sc16is7xx.c | 12 + drivers/usb/atm/ueagle-atm.c | 17 + drivers/usb/chipidea/core.c | 1 + drivers/usb/gadget/function/f_midi.c | 1 + drivers/usb/gadget/function/f_ncm.c | 17 +- drivers/usb/gadget/function/f_printer.c | 23 +- drivers/usb/gadget/function/uvc_v4l2.c | 2 + drivers/usb/gadget/udc/bdc/bdc_core.c | 20 + drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 +- drivers/usb/gadget/udc/dummy_hcd.c | 40 +- drivers/usb/gadget/udc/fsl_udc_core.c | 1 - drivers/usb/gadget/udc/snps_udc_core.c | 1 - drivers/usb/host/xhci-pci.c | 1 + drivers/usb/host/xhci.c | 15 +- drivers/usb/host/xhci.h | 1 + drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 5 + drivers/usb/serial/io_edgeport.c | 3 +- drivers/usb/serial/keyspan_pda.c | 44 +- drivers/usb/serial/option.c | 1 + drivers/usb/storage/unusual_devs.h | 7 + drivers/vdpa/vdpa_user/iova_domain.c | 161 ++++--- drivers/vdpa/vdpa_user/iova_domain.h | 13 +- drivers/vdpa/vdpa_user/vduse_dev.c | 16 +- drivers/video/fbdev/core/bitblit.c | 122 ++--- drivers/video/fbdev/core/fbcon.c | 420 ++++++++-------- drivers/video/fbdev/core/fbcon.h | 6 +- drivers/video/fbdev/core/fbcon_ccw.c | 148 +++--- drivers/video/fbdev/core/fbcon_cw.c | 148 +++--- drivers/video/fbdev/core/fbcon_rotate.c | 44 +- drivers/video/fbdev/core/fbcon_rotate.h | 6 +- drivers/video/fbdev/core/fbcon_ud.c | 164 +++---- drivers/video/fbdev/core/softcursor.c | 18 +- drivers/video/fbdev/core/tileblit.c | 28 +- drivers/video/fbdev/efifb.c | 125 ++--- drivers/watchdog/watchdog_pretimeout.c | 2 + fs/afs/addr_list.c | 10 +- fs/afs/fs_probe.c | 6 +- fs/afs/internal.h | 6 +- fs/afs/proc.c | 4 +- fs/afs/rotate.c | 2 +- fs/afs/rxrpc.c | 15 +- fs/afs/server.c | 4 +- fs/afs/vl_alias.c | 4 +- fs/afs/vl_probe.c | 6 +- fs/afs/vl_rotate.c | 2 +- fs/binfmt_elf_fdpic.c | 4 + fs/binfmt_misc.c | 5 +- fs/btrfs/free-space-cache.c | 3 + fs/btrfs/relocation.c | 2 + fs/ceph/caps.c | 1 + fs/ceph/ioctl.c | 6 + fs/coredump.c | 1 + fs/crypto/inline_crypt.c | 57 +-- fs/crypto/keysetup_v1.c | 8 +- fs/exec.c | 2 +- fs/exfat/balloc.c | 54 ++- fs/f2fs/super.c | 25 +- fs/iomap/buffered-io.c | 12 +- fs/namei.c | 43 ++ fs/nfs/internal.h | 16 +- fs/nfs/pnfs_nfs.c | 2 +- fs/nfs/write.c | 14 +- fs/nfsd/nfs4xdr.c | 8 +- fs/nfsd/vfs.c | 7 +- fs/nfsd/vfs.h | 2 +- fs/overlayfs/copy_up.c | 12 +- fs/posix_acl.c | 7 + fs/proc/namespaces.c | 4 +- fs/smb/client/misc.c | 34 +- fs/smb/client/smb2ops.c | 25 +- fs/smb/server/oplock.c | 6 +- fs/smb/server/smb2misc.c | 5 + fs/smb/server/smb2pdu.c | 9 +- fs/smb/server/smbacl.c | 42 +- include/linux/audit.h | 6 +- include/linux/audit_arch.h | 12 +- include/linux/bootconfig.h | 3 + include/linux/bpf_lsm.h | 4 + include/linux/firmware.h | 3 + include/linux/fscrypt.h | 18 +- include/linux/kvm_host.h | 1 + include/linux/lsm_hooks.h | 1 + include/linux/namei.h | 1 + include/linux/pinctrl/consumer.h | 13 +- include/linux/ppp_channel.h | 3 +- include/linux/seqlock.h | 10 +- include/linux/sunrpc/svcsock.h | 3 + include/linux/sunrpc/xdr.h | 19 +- include/linux/vtime.h | 6 + include/linux/workqueue.h | 8 +- include/media/videobuf2-core.h | 8 +- include/net/af_rxrpc.h | 25 +- include/net/bluetooth/rfcomm.h | 3 + include/net/netfilter/nf_tables.h | 37 -- include/net/netfilter/nft_fib.h | 2 - include/net/netfilter/nft_meta.h | 3 - include/net/sctp/structs.h | 3 +- include/rdma/ib_umem.h | 41 ++ include/trace/events/rxrpc.h | 3 +- include/uapi/linux/btrfs.h | 2 +- init/main.c | 39 -- io_uring/rw.c | 28 +- kernel/audit.c | 2 +- kernel/audit.h | 32 +- kernel/audit_fsnotify.c | 39 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 42 +- kernel/auditfilter.c | 17 +- kernel/auditsc.c | 6 +- kernel/bpf/bpf_inode_storage.c | 9 + kernel/bpf/bpf_lsm.c | 1 - kernel/bpf/verifier.c | 17 + kernel/locking/spinlock_rt.c | 27 +- kernel/sched/cputime.c | 13 - kernel/taskstats.c | 67 +-- kernel/trace/ftrace.c | 13 + kernel/trace/trace_eprobe.c | 3 +- kernel/trace/trace_events_user.c | 43 +- kernel/trace/trace_mmiotrace.c | 4 +- kernel/trace/trace_probe.c | 13 +- kernel/workqueue.c | 46 +- lib/bootconfig.c | 65 +++ lib/compat_audit.c | 12 +- mm/damon/core.c | 13 + mm/mm_init.c | 34 +- net/bluetooth/hci_sync.c | 13 +- net/bluetooth/mgmt.c | 42 +- net/bluetooth/rfcomm/core.c | 17 + net/bluetooth/rfcomm/tty.c | 7 +- net/bridge/br_netlink_tunnel.c | 3 +- net/bridge/br_private.h | 6 +- net/bridge/br_vlan.c | 10 +- net/bridge/br_vlan_options.c | 3 +- net/bridge/netfilter/nft_meta_bridge.c | 20 - net/bridge/netfilter/nft_reject_bridge.c | 1 - net/can/bcm.c | 528 +++++++++++++++------ net/can/isotp.c | 278 ++++++++--- net/can/j1939/transport.c | 18 +- net/ceph/auth_x.c | 9 +- net/ceph/ceph_common.c | 4 +- net/ceph/mon_client.c | 4 +- net/ceph/osdmap.c | 12 +- net/core/sock_map.c | 2 + net/hsr/hsr_slave.c | 2 + net/ipv4/fib_trie.c | 2 +- net/ipv4/icmp.c | 18 +- net/ipv4/netfilter/nft_dup_ipv4.c | 1 - net/ipv4/netfilter/nft_fib_ipv4.c | 2 - net/ipv4/netfilter/nft_reject_ipv4.c | 1 - net/ipv4/nexthop.c | 2 +- net/ipv4/tcp_bpf.c | 2 +- net/ipv6/ila/ila_common.c | 12 + net/ipv6/ip6_tunnel.c | 3 + net/ipv6/ndisc.c | 8 +- net/ipv6/netfilter/nft_dup_ipv6.c | 1 - net/ipv6/netfilter/nft_fib_ipv6.c | 2 - net/ipv6/netfilter/nft_reject_ipv6.c | 1 - net/ipv6/raw.c | 2 +- net/ipv6/xfrm6_policy.c | 1 + net/iucv/af_iucv.c | 21 +- net/l2tp/l2tp_ppp.c | 1 + net/mac80211/iface.c | 8 +- net/mac80211/link.c | 4 + net/mac80211/rx.c | 2 + net/mac802154/llsec.c | 5 + net/mac802154/scan.c | 11 + net/mpls/af_mpls.c | 3 + net/mptcp/options.c | 12 +- net/mptcp/protocol.c | 1 + net/netfilter/nf_conntrack_sip.c | 10 +- net/netfilter/nf_tables_api.c | 67 --- net/netfilter/nft_bitwise.c | 104 ---- net/netfilter/nft_byteorder.c | 11 - net/netfilter/nft_cmp.c | 3 - net/netfilter/nft_compat.c | 10 - net/netfilter/nft_connlimit.c | 1 - net/netfilter/nft_counter.c | 1 - net/netfilter/nft_ct.c | 46 -- net/netfilter/nft_dup_netdev.c | 1 - net/netfilter/nft_dynset.c | 1 - net/netfilter/nft_exthdr.c | 34 -- net/netfilter/nft_fib.c | 51 +- net/netfilter/nft_fib_inet.c | 1 - net/netfilter/nft_fib_netdev.c | 30 +- net/netfilter/nft_flow_offload.c | 1 - net/netfilter/nft_fwd_netdev.c | 2 - net/netfilter/nft_hash.c | 36 -- net/netfilter/nft_immediate.c | 12 - net/netfilter/nft_last.c | 1 - net/netfilter/nft_limit.c | 2 - net/netfilter/nft_log.c | 1 - net/netfilter/nft_lookup.c | 12 - net/netfilter/nft_masq.c | 3 - net/netfilter/nft_meta.c | 45 -- net/netfilter/nft_nat.c | 2 - net/netfilter/nft_numgen.c | 22 - net/netfilter/nft_objref.c | 2 - net/netfilter/nft_osf.c | 25 - net/netfilter/nft_payload.c | 47 -- net/netfilter/nft_queue.c | 2 - net/netfilter/nft_quota.c | 1 - net/netfilter/nft_range.c | 1 - net/netfilter/nft_redir.c | 3 - net/netfilter/nft_reject_inet.c | 1 - net/netfilter/nft_reject_netdev.c | 1 - net/netfilter/nft_rt.c | 1 - net/netfilter/nft_set_pipapo.c | 259 ++++++---- net/netfilter/nft_set_pipapo.h | 8 + net/netfilter/nft_socket.c | 26 - net/netfilter/nft_synproxy.c | 1 - net/netfilter/nft_tproxy.c | 1 - net/netfilter/nft_tunnel.c | 26 - net/netfilter/nft_xfrm.c | 27 -- net/openvswitch/actions.c | 15 +- net/openvswitch/datapath.c | 25 +- net/openvswitch/datapath.h | 2 +- net/openvswitch/vport.c | 2 +- net/packet/af_packet.c | 6 +- net/phonet/pep.c | 2 + net/qrtr/af_qrtr.c | 8 + net/qrtr/ns.c | 4 +- net/rds/recv.c | 15 + net/rxrpc/af_rxrpc.c | 24 +- net/rxrpc/ar-internal.h | 3 +- net/rxrpc/call_accept.c | 77 +-- net/rxrpc/call_object.c | 42 +- net/rxrpc/conn_client.c | 12 +- net/rxrpc/conn_event.c | 14 +- net/rxrpc/conn_object.c | 8 +- net/rxrpc/input.c | 5 +- net/rxrpc/io_thread.c | 8 +- net/rxrpc/peer_event.c | 8 +- net/rxrpc/peer_object.c | 1 + net/rxrpc/recvmsg.c | 26 +- net/rxrpc/rxperf.c | 10 +- net/rxrpc/security.c | 4 +- net/rxrpc/sendmsg.c | 8 +- net/rxrpc/txbuf.c | 4 +- net/sched/act_tunnel_key.c | 14 +- net/sctp/auth.c | 2 +- net/sctp/sm_make_chunk.c | 6 + net/sctp/sm_statefuns.c | 2 +- net/sctp/stream.c | 6 +- net/sunrpc/svcsock.c | 51 +- net/sunrpc/xdr.c | 210 +++++++- net/sunrpc/xprtrdma/rpc_rdma.c | 4 + net/sunrpc/xprtrdma/verbs.c | 12 +- net/tipc/netlink.c | 6 +- net/tipc/netlink_compat.c | 4 + net/tipc/socket.c | 7 +- net/tls/tls_device.c | 6 +- net/wireless/core.c | 1 + net/wireless/nl80211.c | 20 +- net/wireless/pmsr.c | 21 +- net/wireless/scan.c | 2 +- net/x25/af_x25.c | 8 +- net/xfrm/xfrm_policy.c | 4 +- security/apparmor/include/net.h | 6 +- security/apparmor/lsm.c | 38 +- security/apparmor/net.c | 2 +- security/bpf/hooks.c | 3 + security/security.c | 36 +- security/selinux/hooks.c | 99 ++-- security/selinux/include/objsec.h | 5 + security/selinux/netlabel.c | 23 +- security/smack/smack.h | 5 + security/smack/smack_lsm.c | 70 ++- security/smack/smack_netfilter.c | 4 +- sound/core/seq/seq_timer.c | 13 +- sound/hda/hdac_regmap.c | 4 +- sound/pci/hda/patch_conexant.c | 3 - sound/soc/amd/ps/pci-ps.c | 2 +- sound/soc/codecs/bt-sco.c | 10 +- sound/soc/codecs/cs35l56-i2c.c | 4 +- sound/soc/codecs/cs35l56-spi.c | 4 +- sound/soc/codecs/cs35l56.c | 25 +- sound/soc/codecs/cs42l43-jack.c | 3 +- sound/soc/codecs/tas2562.c | 5 +- sound/soc/codecs/tas2781-fmwlib.c | 63 ++- sound/soc/mediatek/mt6797/mt6797-afe-pcm.c | 14 +- sound/soc/mediatek/mt7986/mt7986-afe-pcm.c | 14 +- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 26 +- sound/soc/mediatek/mt8188/mt8188-afe-pcm.c | 21 +- sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 135 ++---- sound/soc/mediatek/mt8195/mt8195-afe-pcm.c | 54 +-- sound/soc/mediatek/mt8195/mt8195-mt6359.c | 38 +- sound/soc/meson/aiu-fifo-spdif.c | 5 + sound/usb/quirks.c | 2 + tools/testing/selftests/alsa/mixer-test.c | 1 + .../testing/selftests/bpf/progs/verifier_ld_ind.c | 142 ++++++ tools/testing/selftests/ftrace/ftracetest | 1 + tools/testing/selftests/net/af_unix/config | 4 + tools/testing/selftests/net/openvswitch/config | 16 + virt/kvm/kvm_main.c | 3 + 561 files changed, 6388 insertions(+), 4060 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/484 platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixiong Wei <[email protected]>
commit 6b63520ed14b17bbe9c2103debbd2152dde1fba3 upstream.
When the last CPU of a legacy uncore die goes offline, uncore_freq_remove_die_entry() clears control_cpu. During CPU hotplug re-add, uncore_freq_add_entry() still populates sysfs attributes before assigning the new control CPU. As a result, the current frequency read returns -ENXIO and current_freq_khz is omitted from the recreated sysfs group.
Assign control_cpu before the initial read paths and before create_attr_group() so sysfs recreation uses the new online CPU. If sysfs creation fails, restore control_cpu to -1 to keep the error path state consistent.
--- .../x86/intel/uncore-frequency/uncore-frequency-common.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.c +6 -1
@@ -238,14 +238,19 @@ int uncore_freq_add_entry(struct uncore_data *data, int cpu)sprintf (data->name,"package_%02d_die_%02d" , data->package_id, data->die_id); } +/* +* Set the control CPU before any read path so entry recreation after CPU +* hotplug can populate read-only attributes from the new online CPU. +*/ + data->control_cpu = cpu;uncore_read (data, &data->initial_min_freq_khz, &data->initial_max_freq_khz); ret =create_attr_group (data, data->name);if (ret) { + data->control_cpu =-1 ;if (data->domain_id !=UNCORE_DOMAIN_ID_INVALID )ida_free (&intel_uncore_ida, data->instance_id); }else { - data->control_cpu = cpu; data->valid = true; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 2/484 bpf: Fix ld_{abs,ind} failure path analysis in subprogs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
commit ee861486e377edc55361c08dcbceab3f6b6577bd upstream.
Usage of ld_{abs,ind} instructions got extended into subprogs some time ago via commit 09b28d76eac4 ("bpf: Add abnormal return checks."). These are only allowed in subprograms when the latter are BTF annotated and have scalar return types.
The code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 + exit) from legacy cBPF times. While the enforcement is on scalar return types, the verifier must also simulate the path of abnormal exit if the packet data load via ld_{abs,ind} failed.
This is currently not the case. Fix it by having the verifier simulate both success and failure paths, and extend it in similar ways as we do for tail calls. The success path (r0=unknown, continue to next insn) is pushed onto stack for later validation and the r0=0 and return to the caller is done on the fall-through side.
[ Dropped visit_abnormal_return_insn changes: depends on 7.0 symbols from
e40f5a6bf88a ("bpf: correct stack liveness for tail calls");
Hunk1: adapted IS_ERR/PTR_ERR to !branch/-EFAULT to match push_stack() NULL-on-failure convention. ]
--- kernel/bpf/verifier.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
kernel/bpf/verifier.c +17 -0
@@ -15120,6 +15120,23 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)mark_reg_unknown (env, regs,BPF_REG_0 );/* ld_abs load up to 32-bit skb data. */ regs[BPF_REG_0 ].subreg_def = env->insn_idx +1 ; +/* +* See bpf_gen_ld_abs() which emits a hidden BPF_EXIT with r0=0 +* which must be explored by the verifier when in a subprog. +*/ +if (env->cur_state->curframe) { +struct bpf_verifier_state *branch; + +mark_reg_scratched (env,BPF_REG_0 ); + branch =push_stack (env, env->insn_idx +1 , env->insn_idx, false); +if (!branch) +return -EFAULT ; +mark_reg_known_zero (env, regs,BPF_REG_0 ); + err =prepare_func_exit (env, &env->insn_idx); +if (err) +return err; + env->insn_idx--; + }return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 3/484 selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
commit e0fcb42bc6f41bab2895757d6610616b3820eff7 upstream.
Extend the verifier_ld_ind BPF selftests with subprogs containing ld_{abs,ind} and craft the test in a way where the invalid register read is rejected in the fixed case. Also add a success case each, and add additional coverage related to the BTF return type enforcement.
# LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_ld_ind [...]
#611/1 verifier_ld_ind/ld_ind: check calling conv, r1:OK #611/2 verifier_ld_ind/ld_ind: check calling conv, r1 @unpriv:OK #611/3 verifier_ld_ind/ld_ind: check calling conv, r2:OK #611/4 verifier_ld_ind/ld_ind: check calling conv, r2 @unpriv:OK #611/5 verifier_ld_ind/ld_ind: check calling conv, r3:OK #611/6 verifier_ld_ind/ld_ind: check calling conv, r3 @unpriv:OK #611/7 verifier_ld_ind/ld_ind: check calling conv, r4:OK #611/8 verifier_ld_ind/ld_ind: check calling conv, r4 @unpriv:OK #611/9 verifier_ld_ind/ld_ind: check calling conv, r5:OK #611/10 verifier_ld_ind/ld_ind: check calling conv, r5 @unpriv:OK #611/11 verifier_ld_ind/ld_ind: check calling conv, r7:OK #611/12 verifier_ld_ind/ld_ind: check calling conv, r7 @unpriv:OK #611/13 verifier_ld_ind/ld_abs: subprog early exit on ld_abs failure:OK #611/14 verifier_ld_ind/ld_ind: subprog early exit on ld_ind failure:OK #611/15 verifier_ld_ind/ld_abs: subprog with both paths safe:OK #611/16 verifier_ld_ind/ld_ind: subprog with both paths safe:OK #611/17 verifier_ld_ind/ld_abs: reject void return subprog:OK #611/18 verifier_ld_ind/ld_ind: reject void return subprog:OK #611 verifier_ld_ind:OK
Summary: 1/18 PASSED, 0 SKIPPED, 0 FAILED
--- .../selftests/bpf/progs/verifier_ld_ind.c | 142 ++++++++++++++++++ 1 file changed, 142 insertions(+)
tools/testing/selftests/bpf/progs/verifier_ld_ind.c +142 -0
@@ -107,4 +107,146 @@ __naked void ind_check_calling_conv_r7(void) : __clobber_all); } +/* +* ld_{abs,ind} subprog that always sets r0=1 on the success path. +* bpf_gen_ld_abs() emits a hidden exit with r0=0 when the load helper +* fails. The verifier must model this failure return so that callers +* account for r0=0 as a possible return value. +*/ +__naked __noinline __used +static int ldabs_subprog(void) +{ + asmvolatile ( +"r6 = r1;" +".8byte %[ld_abs];" +"r0 = 1;" +"exit;" + : + : __imm_insn(ld_abs, BPF_LD_ABS(BPF_W, 0)) + : __clobber_all); +} + +__naked __noinline __used +static int ldind_subprog(void) +{ + asmvolatile ( +"r6 = r1;" +"r7 = 0;" +".8byte %[ld_ind];" +"r0 = 1;" +"exit;" + : + : __imm_insn(ld_ind, BPF_LD_IND(BPF_W, BPF_REG_7, 0)) + : __clobber_all); +} + +SEC("socket") +__description("ld_abs: subprog early exit on ld_abs failure") +__failure __msg("R9 !read_ok") +__naked void ld_abs_subprog_early_exit(void) +{ + asmvolatile ( +"call ldabs_subprog;" +"if r0 != 0 goto l_exit_%=;" +"r0 = r9;" +"l_exit_%=:" +"r0 = 0;" +"exit;" + ::: __clobber_all); +} + +SEC("socket") +__description("ld_ind: subprog early exit on ld_ind failure") +__failure __msg("R9 !read_ok") +__naked void ld_ind_subprog_early_exit(void) +{ + asmvolatile ( +"call ldind_subprog;" +"if r0 != 0 goto l_exit_%=;" +"r0 = r9;" +"l_exit_%=:" +"r0 = 0;" +"exit;" + ::: __clobber_all); +} + +SEC("socket") +__description("ld_abs: subprog with both paths safe") +__success +__naked void ld_abs_subprog_both_paths_safe (void ) +{ + asmvolatile ( +"call ldabs_subprog;" +"r0 = 0;" +"exit;" + ::: __clobber_all); +} + +SEC("socket") +__description("ld_ind: subprog with both paths safe") +__success +__naked void ld_ind_subprog_both_paths_safe (void ) +{ + asmvolatile ( +"call ldind_subprog;" +"r0 = 0;" +"exit;" + ::: __clobber_all); +} + +/* +* ld_{abs,ind} in subprogs require scalar (int) return type in BTF. +* A test with void return must be rejected. +*/ +__naked __noinline __used +static void ldabs_void_subprog(void) +{ + asmvolatile ( +"r6 = r1;" +".8byte %[ld_abs];" +"r0 = 1;" +"exit;" + : + : __imm_insn(ld_abs, BPF_LD_ABS(BPF_W, 0)) + : __clobber_all); +} + +SEC("socket") +__description("ld_abs: reject void return subprog") +__failure __msg("LD_ABS is only allowed in functions that return 'int'") +__naked void ld_abs_void_subprog_reject(void) +{ + asmvolatile ( +"call ldabs_void_subprog;" +"r0 = 0;" +"exit;" + ::: __clobber_all); +} + +__naked __noinline __used +static void ldind_void_subprog(void) +{ + asmvolatile ( +"r6 = r1;" +"r7 = 0;" +".8byte %[ld_ind];" +"r0 = 1;" +"exit;" + : + : __imm_insn(ld_ind, BPF_LD_IND(BPF_W, BPF_REG_7, 0)) + : __clobber_all); +} + +SEC("socket") +__description("ld_ind: reject void return subprog") +__failure __msg("LD_ABS is only allowed in functions that return 'int'") +__naked void ld_ind_void_subprog_reject(void) +{ + asmvolatile ( +"call ldind_void_subprog;" +"r0 = 0;" +"exit;" + ::: __clobber_all); +} + char _license[] SEC("license") = "GPL";
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 4/484 drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryosuke Yasuoka <[email protected]>
[ Upstream commit d1b894c5bbb3fee0012bd14356286dc2384e8213 ]
A probe-time deadlock can occur between the dequeue worker and drm_client_register(). During probe, drm_client_register() holds clientlist_mutex and calls the fbdev hotplug callback, which triggers an atomic commit that ends up sleeping in virtio_gpu_queue_ctrl_sgs() waiting for virtqueue space. The dequeue worker that would free that space calls virtio_gpu_cmd_get_display_info_cb(), which invokes drm_kms_helper_hotplug_event() -> drm_client_dev_hotplug(), attempting to acquire the same clientlist_mutex. Since wake_up() is only called after the resp_cb loop, the probe thread is never woken and both threads deadlock.
Fix this by removing the hotplug notification from virtio_gpu_cmd_get_display_info_cb(). The display data (outputs[i].info) is still updated synchronously in the callback.
For the init path, drm_client_register() already fires an initial hotplug when the client is registered, which picks up the connector state updated by display_info_cb.
For the runtime config_changed path, add a wait_event_timeout() in config_changed_work_func() so that display_info_cb updates the connector data before the hotplug notification is sent. Also replace drm_helper_hpd_irq_event() with drm_kms_helper_hotplug_event() since virtio-gpu never calls drm_kms_helper_poll_init() and thus drm_helper_hpd_irq_event() always returns false without doing anything.
--- drivers/gpu/drm/virtio/virtgpu_kms.c | 5 ++++- drivers/gpu/drm/virtio/virtgpu_vq.c | 3 --- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/virtio/virtgpu_kms.c +4 -1
@@ -48,7 +48,10 @@ static void virtio_gpu_config_changed_work_func(struct work_struct *work)virtio_gpu_cmd_get_edids (vgdev);virtio_gpu_cmd_get_display_info (vgdev);virtio_gpu_notify (vgdev); -drm_helper_hpd_irq_event (vgdev->ddev); +wait_event_timeout (vgdev->resp_wq, + !vgdev->display_info_pending, +5 *HZ ); +drm_kms_helper_hotplug_event (vgdev->ddev); } events_clear |=VIRTIO_GPU_EVENT_DISPLAY ; }
drivers/gpu/drm/virtio/virtgpu_vq.c +0 -3
@@ -669,9 +669,6 @@ static void virtio_gpu_cmd_get_display_info_cb(struct virtio_gpu_device *vgdev, vgdev->display_info_pending = false;spin_unlock (&vgdev->display_info_lock);wake_up (&vgdev->resp_wq); - -if (!drm_helper_hpd_irq_event (vgdev->ddev)) -drm_kms_helper_hotplug_event (vgdev->ddev); } static void virtio_gpu_cmd_get_capset_info_cb(struct virtio_gpu_device *vgdev,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 5/484 platform/x86/amd/pmc: Dont log during intermediate wakeups
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Gibson <[email protected]>
commit 037f0b03c663a247366673a807834389107995b7 upstream.
The ECs in the IdeaPads that need the delay_suspend quirk send lots of messages when charging, which not only causes intermediate wakeups when suspended, but also prevents the device from reaching the deepest suspend state.
Because of this amd_pmc_intermediate_wakeup_need_delay() returns false during intermediate wakeups and amd_pmc_want_suspend_delay() is called. So far it always logged its "Delaying suspend by 2.5s ..." messages then, which spams dmesg. This commit makes sure that those messages are only logged once per suspend.
--- drivers/platform/x86/amd/pmc/pmc.c | 39 ++++++++++++++++++++++++------ drivers/platform/x86/amd/pmc/pmc.h | 1 + 2 files changed, 32 insertions(+), 8 deletions(-)
drivers/platform/x86/amd/pmc/pmc.c +31 -8
@@ -811,6 +811,20 @@ static bool amd_pmc_intermediate_wakeup_need_delay(struct amd_pmc_dev *pdev)static bool amd_pmc_want_suspend_delay (struct amd_pmc_dev *pdev) { +/* +* intermediate_wakeup implies that the machine didn't get to deepest sleep +* state before - otherwise this function isn't called in amd_pmc_s2idle_check() +* because amd_pmc_intermediate_wakeup_need_delay() returns true first. +* On some IdeaPads that happens when charging, because the EC seems +* to send lots of messages then that wake the machine. +* +* But even in that case, the sleep here is necessary (on those IdeaPads), +* otherwise they wake up completely (resume) after a few seconds. +* So this variable is only used to avoid spamming dmesg on each +* intermediate wakeup. +*/ +bool intermediate_wakeup = !pdev->is_first_check_after_suspend; +/* * Some Lenovo Laptops (like different IdeaPad 3 Slims) need some * me-time before sleeping or they get uncooperative after waking
@@ -829,17 +843,20 @@ static bool amd_pmc_want_suspend_delay(struct amd_pmc_dev *pdev)* disabled with disable_workarounds or delay_suspend=0 */ if (delay_suspend ==1 || (delay_suspend ==-1 && !disable_workarounds)) { -dev_info (pdev->dev,"Delaying suspend by 2.5s to avoid platform bug\n" ); +if (!intermediate_wakeup) +dev_info (pdev->dev,"Delaying suspend by 2.5s to avoid platform bug\n" );return true; } -dev_info (pdev->dev,"Not delaying suspend because of module parameter, even though your device is assumed to need it!\n" ); +if (!intermediate_wakeup) +dev_info (pdev->dev,"Not delaying suspend because of module parameter, even though your device is assumed to need it!\n" ); }else if (delay_suspend ==1 ) { -dev_info (pdev->dev,"Delaying suspend by 2.5s because delay_suspend=1. If this solves problems on your machine, please report this whole line to: [email protected] so it can be automatically detected as affected in the future. System Vendor: \"%s\" Product Name: \"%s\" Product Family: \"%s\" Board Vendor: \"%s\" Board Name: \"%s\"\n" , -dmi_get_system_info (DMI_SYS_VENDOR ), -dmi_get_system_info (DMI_PRODUCT_NAME ), -dmi_get_system_info (DMI_PRODUCT_FAMILY ), -dmi_get_system_info (DMI_BOARD_VENDOR ), -dmi_get_system_info (DMI_BOARD_NAME )); +if (!intermediate_wakeup) +dev_info (pdev->dev,"Delaying suspend by 2.5s because delay_suspend=1. If this solves problems on your machine, please report this whole line to: [email protected] so it can be automatically detected as affected in the future. System Vendor: \"%s\" Product Name: \"%s\" Product Family: \"%s\" Board Vendor: \"%s\" Board Name: \"%s\"\n" , +dmi_get_system_info (DMI_SYS_VENDOR ), +dmi_get_system_info (DMI_PRODUCT_NAME ), +dmi_get_system_info (DMI_PRODUCT_FAMILY ), +dmi_get_system_info (DMI_BOARD_VENDOR ), +dmi_get_system_info (DMI_BOARD_NAME ));return true; }return false;
@@ -852,6 +869,9 @@ static void amd_pmc_s2idle_prepare(void)u8 msg;u32 arg =1 ; +/* Reset this variable because this is a fresh suspend */ + pdev->is_first_check_after_suspend = true; +/* Reset and Start SMU logging - to monitor the s0i3 stats */ amd_pmc_setup_smu_logging (pdev);
@@ -891,6 +911,9 @@ static void amd_pmc_s2idle_check(void) rc =amd_pmc_write_stb (pdev,AMD_PMC_STB_S2IDLE_CHECK );if (rc)dev_err (pdev->dev,"error writing to STB: %d\n" , rc); + +/* remember that first check after suspend is done (until next prepare) */ + pdev->is_first_check_after_suspend = false; }static int amd_pmc_dump_data (struct amd_pmc_dev *pdev)
drivers/platform/x86/amd/pmc/pmc.h +1 -0
@@ -37,6 +37,7 @@ struct amd_pmc_dev {struct dentry *dbgfs_dir;struct quirk_entry *quirks;bool disable_8042_wakeup; +bool is_first_check_after_suspend; };void amd_pmc_process_restore_quirks (struct amd_pmc_dev *dev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 6/484 platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Gibson <[email protected]>
commit a0738abd042f7406edd2175a819cf2e66388ed97 upstream.
dmi_get_system_info(...) can return NULL. Using that as %s arguments of dev_info() would log "(null)" (as part of a message like '... System Vendor: "(null)", Product Name: "(null)" ...'), which may be confusing for users.
Use Elvis operator to print "(Unknown)" instead.
--- drivers/platform/x86/amd/pmc/pmc.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/platform/x86/amd/pmc/pmc.c +5 -5
@@ -852,11 +852,11 @@ static bool amd_pmc_want_suspend_delay(struct amd_pmc_dev *pdev) }else if (delay_suspend ==1 ) {if (!intermediate_wakeup)dev_info (pdev->dev,"Delaying suspend by 2.5s because delay_suspend=1. If this solves problems on your machine, please report this whole line to: [email protected] so it can be automatically detected as affected in the future. System Vendor: \"%s\" Product Name: \"%s\" Product Family: \"%s\" Board Vendor: \"%s\" Board Name: \"%s\"\n" , -dmi_get_system_info (DMI_SYS_VENDOR ), -dmi_get_system_info (DMI_PRODUCT_NAME ), -dmi_get_system_info (DMI_PRODUCT_FAMILY ), -dmi_get_system_info (DMI_BOARD_VENDOR ), -dmi_get_system_info (DMI_BOARD_NAME )); +dmi_get_system_info (DMI_SYS_VENDOR ) ?:"(Unknown)" , +dmi_get_system_info (DMI_PRODUCT_NAME ) ?:"(Unknown)" , +dmi_get_system_info (DMI_PRODUCT_FAMILY ) ?:"(Unknown)" , +dmi_get_system_info (DMI_BOARD_VENDOR ) ?:"(Unknown)" , +dmi_get_system_info (DMI_BOARD_NAME ) ?:"(Unknown)" );return true; }return false;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 7/484 seqlock: Cure some more scoped_seqlock() optimization fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit 90dfeef1cd38dff19f8b3a752d13bfd79f0f7694 upstream.
Arnd reported an x86 randconfig using gcc-15 tripped over __scoped_seqlock_bug(). Turns out GCC chose not to inline the scoped_seqlock helper functions and as such was not able to optimize properly.
[ mingo: Clang fails the build too in some circumstances. ]
--- include/linux/seqlock.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/seqlock.h +2 -2
@@ -1281,7 +1281,7 @@ struct ss_tmp {spinlock_t *lock_irqsave; }; -static inline void __scoped_seqlock_cleanup (struct ss_tmp *sst) +static __always_inline void __scoped_seqlock_cleanup(struct ss_tmp *sst) {if (sst->lock)spin_unlock (sst->lock);
@@ -1306,7 +1306,7 @@ static inline void __scoped_seqlock_bug(extern void __scoped_seqlock_bug (void );#endif -static inline void +static __always_inline void__scoped_seqlock_next (struct ss_tmp *sst,seqlock_t *lock,enum ss_state target) {switch (sst->state) {
Greg Kroah-Hartman
maintainerPATCH 8/484 seqlock: Allow KASAN to fail optimizing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit b94d45b6bbb42571ec225d3be0e7457c8765a5b4 upstream.
Some KASAN builds are failing to properly optimize this code -- luckily we don't care about core quality for KASAN builds, so just exclude it.
--- include/linux/seqlock.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
include/linux/seqlock.h +4 -1
@@ -1291,11 +1291,14 @@ static __always_inline void __scoped_seqextern void __scoped_seqlock_invalid_target (void ); -#if defined(CONFIG_CC_IS_GCC ) &&CONFIG_GCC_VERSION <90000 +#if (defined(CONFIG_CC_IS_GCC ) &&CONFIG_GCC_VERSION <90000 ) || defined(CONFIG_KASAN )/* * For some reason some GCC-8 architectures (nios2, alpha) have trouble * determining that the ss_done state is impossible in __scoped_seqlock_next() * below. +* +* Similarly KASAN is known to confuse compilers enough to break this. But we +* don't care about code quality for KASAN builds anyway. */ static inline void __scoped_seqlock_bug (void ) { }#else
Greg Kroah-Hartman
maintainerPATCH 9/484 seqlock: Allow UBSAN_ALIGNMENT to fail optimizing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
commit 88331c4ec23a28c1006ec532fa64763d4c695e90 upstream.
With gcc-15 and gcc-16 with UBSAN_ALIGNMENT enabled the compiler fails to inline and optimize __scoped_seqlock_bug() away on s390:
s390x-16.1.0-ld: kernel/sched/build_policy.o: in function `__scoped_seqlock_next':
/.../seqlock.h:1286:(.text+0x22030): undefined reference to `__scoped_seqlock_bug'
Fix this by adding UBSAN_ALIGNMENT to the list of config options where a not inlined empty __scoped_seqlock_bug() is allowed.
--- include/linux/seqlock.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
include/linux/seqlock.h +4 -3
@@ -1291,14 +1291,15 @@ static __always_inline void __scoped_seqextern void __scoped_seqlock_invalid_target (void ); -#if (defined(CONFIG_CC_IS_GCC ) &&CONFIG_GCC_VERSION <90000 ) || defined(CONFIG_KASAN ) +#if (defined(CONFIG_CC_IS_GCC ) &&CONFIG_GCC_VERSION <90000 ) || \ + defined(CONFIG_KASAN ) || defined(CONFIG_UBSAN_ALIGNMENT )/* * For some reason some GCC-8 architectures (nios2, alpha) have trouble * determining that the ss_done state is impossible in __scoped_seqlock_next() * below. * -* Similarly KASAN is known to confuse compilers enough to break this. But we -* don't care about code quality for KASAN builds anyway. +* Similarly KASAN and UBSAN_ALIGNMENT are known to confuse compilers enough +* to break this. But we don't care about code quality for such builds anyway. */ static inline void __scoped_seqlock_bug (void ) { }#else
Greg Kroah-Hartman
maintainerPATCH 10/484 KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 2abd5287f08319fa35764566b15c6e22cb1068db upstream.
Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages.
Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages.
Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately.
--- arch/x86/kvm/mmu/mmu.c | 9 +++++---- arch/x86/kvm/mmu/paging_tmpl.h | 10 ++++++---- 2 files changed, 11 insertions(+), 8 deletions(-)
arch/x86/kvm/mmu/mmu.c +5 -4
@@ -4384,16 +4384,17 @@ static int direct_page_fault(struct kvm_ orig_pfn = fault->pfn; - r =RET_PF_RETRY ;write_lock (&vcpu->kvm->mmu_lock); -if (is_page_fault_stale (vcpu, fault)) - goto out_unlock; - r =make_mmu_pages_available (vcpu);if (r) goto out_unlock; +if (is_page_fault_stale (vcpu, fault)) { + r =RET_PF_RETRY ; + goto out_unlock; + } + r =direct_map (vcpu, fault); out_unlock:
arch/x86/kvm/mmu/paging_tmpl.h +6 -4
@@ -838,15 +838,17 @@ static int FNAME(page_fault)(struct kvm_ orig_pfn = fault->pfn; - r =RET_PF_RETRY ;write_lock (&vcpu->kvm->mmu_lock); -if (is_page_fault_stale (vcpu, fault)) - goto out_unlock; - r =make_mmu_pages_available (vcpu);if (r) goto out_unlock; + +if (is_page_fault_stale (vcpu, fault)) { + r =RET_PF_RETRY ; + goto out_unlock; + } + r =FNAME (fetch)(vcpu, fault, &walker); out_unlock:
Greg Kroah-Hartman
maintainerPATCH 11/484 KVM: nVMX: Hide shadow VMCS right after VMCLEAR
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
commit 622ebfac01ba4f9c0060cebd41257fe46fc4a0b3 upstream.
free_nested() frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loaded_vmcs_clear(), the vCPU might migrate before the pointer is cleared and __loaded_vmcs_clear() may then execute VMCLEAR.
The VMCS needs to stay attached until its explicit VMCLEAR completes, but then it can be hidden and the page safely freed.
--- arch/x86/kvm/vmx/nested.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
arch/x86/kvm/vmx/nested.c +9 -2
@@ -295,6 +295,7 @@ static void vmx_switch_vmcs(struct kvm_vstatic void free_nested (struct kvm_vcpu *vcpu) {struct vcpu_vmx *vmx =to_vmx (vcpu); +struct vmcs *shadow_vmcs;if (WARN_ON_ONCE (vmx->loaded_vmcs != &vmx->vmcs01))vmx_switch_vmcs (vcpu, &vmx->vmcs01);
@@ -312,9 +313,15 @@ static void free_nested(struct kvm_vcpu vmx->nested.current_vmptr =INVALID_GPA ;if (enable_shadow_vmcs) {vmx_disable_shadow_vmcs (vmx); -vmcs_clear (vmx->vmcs01.shadow_vmcs); -free_vmcs (vmx->vmcs01.shadow_vmcs); + +/* +* Keep the pointer visible until after VMCLEAR, so migration +* can clear an active shadow VMCS on the old CPU. +*/ + shadow_vmcs = vmx->vmcs01.shadow_vmcs; +vmcs_clear (shadow_vmcs); vmx->vmcs01.shadow_vmcs =NULL ; +free_vmcs (shadow_vmcs); }kfree (vmx->nested.cached_vmcs12); vmx->nested.cached_vmcs12 =NULL ;
Greg Kroah-Hartman
maintainerPATCH 12/484 KVM: x86/mmu: Fix use-after-free on vendor module reload
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Rosenthal <[email protected]>
commit 52f2f7c30126037975389aa04d24c506a5177c35 upstream.
mmu_destroy_caches() destroys pte_list_desc_cache and mmu_page_header_cache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor module is unloaded while kvm.ko remains loaded.
If creation of pte_list_desc_cache fails during a subsequent vendor module load, its assignment sets pte_list_desc_cache to NULL and the error path calls mmu_destroy_caches(). mmu_page_header_cache still points to the cache destroyed during the preceding vendor module unload. Passing that stale pointer to kmem_cache_destroy() causes a slab use-after-free.
Reproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y, CONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A one-shot test hook forces pte_list_desc_cache to NULL on the second invocation of kvm_mmu_vendor_module_init():
1. Load kvm.ko and kvm-intel.ko, creating both caches.
2. Unload only kvm_intel, leaving kvm.ko loaded.
3. Reload kvm_intel and force initialization through the -ENOMEM path.
KASAN reports:
BUG: KASAN: slab-use-after-free in kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... kmem_cache_destroy+0x21/0x1d0 kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... Allocated by task 16817: __kmem_cache_create_args+0x12c/0x3b0 __kmem_cache_create.constprop.0+0xb6/0xf0 [kvm] kvm_mmu_vendor_module_init+0x13b/0x170 [kvm] ... Freed by task 16820: kmem_cache_destroy+0x117/0x1d0 kvm_mmu_vendor_module_exit+0x21/0x30 [kvm]
Clear both pointers immediately after destroying their caches so that the stored state reflects the caches' lifetime and repeated cleanup is safe.
With the fix applied, the same injected vendor module reload fails with -ENOMEM as expected and produces no KASAN report.
Message-ID: <[email protected]>
--- arch/x86/kvm/mmu/mmu.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/kvm/mmu/mmu.c +2 -0
@@ -6804,7 +6804,9 @@ static struct shrinker mmu_shrinker = {static void mmu_destroy_caches (void ) {kmem_cache_destroy (pte_list_desc_cache); + pte_list_desc_cache =NULL ;kmem_cache_destroy (mmu_page_header_cache); + mmu_page_header_cache =NULL ; }static int get_nx_huge_pages (char *buffer,const struct kernel_param *kp)
Greg Kroah-Hartman
maintainerPATCH 13/484 can: bcm: add locking when updating filter and timer values
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit 749179c2e25b95d22499ed29096b3e02d6dfd2b4 upstream.
KCSAN detected a simultaneous access to timer values that can be overwritten in bcm_rx_setup() when updating timer and filter content while bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler() run concurrently on incoming CAN traffic.
Protect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter (nframes/flags/frames/last_frames) updates in bcm_rx_setup() with a new per-op bcm_rx_update_lock, taken with the matching scope in the RX handlers. memcpy_from_msg() is staged into a temporary buffer before the lock is taken, since it can sleep and must not run under a spinlock.
hrtimer_cancel() is always called without bcm_rx_update_lock held, since bcm_rx_timeout_handler()/bcm_rx_thr_handler() take the same lock and a running callback would otherwise deadlock against the canceller.
Also close a related race: bcm_rx_setup() cleared the RTR flag in the stored reply frame's can_id as a separate, unprotected step after the frame content was already installed, so a concurrent bcm_rx_handler() could transmit a stale reply with CAN_RTR_FLAG still set. Fold that normalization into the initial frame preparation instead (on the staged buffer for updates, directly on op->frames pre-registration for new ops), so the installed frame is always atomically self-consistent.
bcm_rx_handler()'s RX_RTR_FRAME check now takes a lock-protected snapshot of op->flags before deciding whether to call bcm_can_tx(), but does not hold the lock across that call.
Also take a lock-protected snapshot of the currframe in bcm_can_tx() to avoid partly overwrites by content updates in bcm_tx_setup(). Finally check if a TX_RESET_MULTI_IDX/SETTIMER might have reset op->currframe between the two locked sections in bcm_can_tx().
Omit calling hrtimer_forward() with zero interval in bcm_rx_thr_handler(). kt_ival2 may have been concurrently cleared by bcm_rx_setup() before it cancels this timer, so check kt_ival2 inside the bcm_rx_update_lock.
--- net/can/bcm.c | 176 ++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 133 insertions(+), 43 deletions(-)
net/can/bcm.c +133 -43
@@ -126,6 +126,7 @@ struct bcm_op {struct sock *sk;struct net_device *rx_reg_dev;spinlock_t bcm_tx_lock;/* protect currframe/count in runtime updates */ +spinlock_t bcm_rx_update_lock;/* protect filter/timer data updates */ };struct bcm_sock {
@@ -280,21 +281,27 @@ static int bcm_proc_show(struct seq_file *m, void *v)* bcm_can_tx - send the (next) CAN frame to the appropriate CAN interface * of the given bcm tx op */ -static void bcm_can_tx (struct bcm_op *op) +static void bcm_can_tx (struct bcm_op *op,struct canfd_frame *cf) {struct sk_buff *skb;struct net_device *dev; -struct canfd_frame *cf; +struct canfd_frame cframe; +bool cyclic = !cf; +unsigned int idx =0 ;int err;/* no target device? => exit */ if (!op->ifindex)return ; -/* read currframe under lock protection */ -spin_lock_bh (&op->bcm_tx_lock); - cf = op->frames + op->cfsiz * op->currframe; -spin_unlock_bh (&op->bcm_tx_lock); +if (cyclic) { +/* read currframe under lock protection */ +spin_lock_bh (&op->bcm_tx_lock); + idx = op->currframe; +memcpy (&cframe, op->frames + op->cfsiz * idx, op->cfsiz); + cf = &cframe; +spin_unlock_bh (&op->bcm_tx_lock); + } dev =dev_get_by_index (sock_net (op->sk), op->ifindex);if (!dev) {
@@ -323,14 +330,20 @@ static void bcm_can_tx(struct bcm_op *op)if (!err) op->frames_abs++; - op->currframe++; +/* only advance the cyclic sequence if nothing reset currframe while +* we were sending - a concurrent TX_RESET_MULTI_IDX means this +* frame's bookkeeping belongs to a sequence that no longer exists +*/ +if (!cyclic || op->currframe == idx) { + op->currframe++; -/* reached last frame? */ -if (op->currframe >= op->nframes) - op->currframe =0 ; +/* reached last frame? */ +if (op->currframe >= op->nframes) + op->currframe =0 ; -if (op->count >0 ) - op->count--; +if (op->count >0 ) + op->count--; + }spin_unlock_bh (&op->bcm_tx_lock); out:
@@ -429,7 +442,7 @@ static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)struct bcm_msg_head msg_head;if (op->kt_ival1 && (op->count >0 )) { -bcm_can_tx (op); +bcm_can_tx (op,NULL );if (!op->count && (op->flags &TX_COUNTEVT )) {/* create notification to user */
@@ -446,7 +459,7 @@ static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer) } }else if (op->kt_ival2) { -bcm_can_tx (op); +bcm_can_tx (op,NULL ); } return bcm_tx_set_expiry(op, &op->timer) ?
@@ -585,6 +598,8 @@ static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer) struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);struct bcm_msg_head msg_head; +spin_lock_bh (&op->bcm_rx_update_lock); +/* if user wants to be informed, when cyclic CAN-Messages come back */ if ((op->flags &RX_ANNOUNCE_RESUME ) && op->last_frames) {/* clear received CAN frames to indicate 'nothing received' */
@@ -601,6 +616,8 @@ static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer) msg_head.can_id = op->can_id; msg_head.nframes =0 ; +spin_unlock_bh (&op->bcm_rx_update_lock); +bcm_send_to_user (op, &msg_head,NULL ,0 );return HRTIMER_NORESTART ;
@@ -649,15 +666,26 @@ static int bcm_rx_thr_flush(struct bcm_op *op)static enum hrtimer_restart bcm_rx_thr_handler (struct hrtimer *hrtimer) { struct bcm_op *op = container_of(hrtimer, struct bcm_op, thrtimer); +enum hrtimer_restart ret; -if (bcm_rx_thr_flush (op)) { +spin_lock_bh (&op->bcm_rx_update_lock); + +/* kt_ival2 may have been concurrently cleared by bcm_rx_setup() +* before it cancels this timer - never forward with a zero +* interval in that case. +*/ +if (bcm_rx_thr_flush (op) && op->kt_ival2) {hrtimer_forward_now (hrtimer, op->kt_ival2); -return HRTIMER_RESTART ; + ret =HRTIMER_RESTART ; }else {/* rearm throttle handling */ op->kt_lastmsg =0 ; -return HRTIMER_NORESTART ; + ret =HRTIMER_NORESTART ; } + +spin_unlock_bh (&op->bcm_rx_update_lock); + +return ret; }/*
@@ -667,7 +695,9 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data) {struct bcm_op *op = (struct bcm_op *)data;const struct canfd_frame *rxframe = (struct canfd_frame *)skb->data; +struct canfd_frame rtrframe;unsigned int i; +bool rtr_frame;if (op->can_id != rxframe->can_id)return ;
@@ -691,12 +721,23 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)/* update statistics */ op->frames_abs++; -if (op->flags &RX_RTR_FRAME ) { +/* snapshot the flag under lock: op->flags/op->frames may be updated +* concurrently by bcm_rx_setup(). +*/ +spin_lock_bh (&op->bcm_rx_update_lock); + rtr_frame = op->flags &RX_RTR_FRAME ; +if (rtr_frame) +memcpy (&rtrframe, op->frames, op->cfsiz); +spin_unlock_bh (&op->bcm_rx_update_lock); + +if (rtr_frame) {/* send reply for RTR-request (placed in op->frames[0]) */ -bcm_can_tx (op); +bcm_can_tx (op, &rtrframe);return ; } +spin_lock_bh (&op->bcm_rx_update_lock); +if (op->flags &RX_FILTER_ID ) {/* the easiest case */ bcm_rx_update_and_send (op, op->last_frames, rxframe);
@@ -730,6 +771,8 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data) rx_starttimer:bcm_rx_starttimer (op); + +spin_unlock_bh (&op->bcm_rx_update_lock); }/*
@@ -1073,7 +1116,7 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,list_add_rcu (&op->list, &bo->tx_ops);if (op->flags &TX_ANNOUNCE ) -bcm_can_tx (op); +bcm_can_tx (op,NULL );if (op->flags &STARTTIMER )bcm_tx_start_timer (op);
@@ -1087,6 +1130,24 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,return err; } +static void bcm_rx_setup_rtr_check (struct bcm_msg_head *msg_head, +struct bcm_op *op,void *new_frames) +{ +/* funny feature in RX(!)_SETUP only for RTR-mode: +* copy can_id into frame BUT without RTR-flag to +* prevent a full-load-loopback-test ... ;-] +* normalize this on the staged buffer, before it is +* ever installed into op->frames. +*/ +if (msg_head->flags &RX_RTR_FRAME ) { +struct canfd_frame *frame0 = new_frames; + +if ((msg_head->flags &TX_CP_CAN_ID ) || + frame0->can_id == op->can_id) + frame0->can_id = op->can_id & ~CAN_RTR_FLAG ; + } +} +/* * bcm_rx_setup - create or update a bcm rx op (for bcm_sendmsg) */
@@ -1121,6 +1182,8 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,/* check the given can_id */ op =bcm_find_op (&bo->rx_ops, msg_head, ifindex);if (op) { +void *new_frames =NULL ; +/* update existing BCM operation */ /*
@@ -1132,19 +1195,48 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,return -E2BIG ;if (msg_head->nframes) { -/* update CAN frames content */ - err =memcpy_from_msg (op->frames, msg, +/* get new CAN frames content before locking */ + new_frames =kmalloc (msg_head->nframes * op->cfsiz, +GFP_KERNEL ); +if (!new_frames) +return -ENOMEM ; + + err =memcpy_from_msg (new_frames, msg, msg_head->nframes * op->cfsiz); -if (err <0 ) +if (err <0 ) { +kfree (new_frames);return err; + } -/* clear last_frames to indicate 'nothing received' */ -memset (op->last_frames,0 , msg_head->nframes * op->cfsiz); +bcm_rx_setup_rtr_check (msg_head, op, new_frames); } +spin_lock_bh (&op->bcm_rx_update_lock); op->nframes = msg_head->nframes; op->flags = msg_head->flags; +if (msg_head->nframes) { +/* update CAN frames content */ +memcpy (op->frames, new_frames, + msg_head->nframes * op->cfsiz); + +/* clear last_frames to indicate 'nothing received' */ +memset (op->last_frames,0 , + msg_head->nframes * op->cfsiz); + } + +if (msg_head->flags &SETTIMER ) { + op->ival1 = msg_head->ival1; + op->ival2 = msg_head->ival2; + op->kt_ival1 =bcm_timeval_to_ktime (msg_head->ival1); + op->kt_ival2 =bcm_timeval_to_ktime (msg_head->ival2); + op->kt_lastmsg =0 ; + } +spin_unlock_bh (&op->bcm_rx_update_lock); + +/* free temporary frames / kfree(NULL) is safe */ +kfree (new_frames); +/* Only an update -> do not call can_rx_register() */ do_rx_register =0 ;
@@ -1155,6 +1247,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,return -ENOMEM ;spin_lock_init (&op->bcm_tx_lock); +spin_lock_init (&op->bcm_rx_update_lock); op->can_id = msg_head->can_id; op->nframes = msg_head->nframes; op->cfsiz =CFSIZ (msg_head->flags);
@@ -1196,6 +1289,8 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,kfree (op);return err; } + +bcm_rx_setup_rtr_check (msg_head, op, op->frames); }/* bcm_can_tx / bcm_tx_timeout_handler needs this */
@@ -1223,29 +1318,22 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,/* check flags */ if (op->flags &RX_RTR_FRAME ) { -struct canfd_frame *frame0 = op->frames; -/* no timers in RTR-mode */ hrtimer_cancel (&op->thrtimer);hrtimer_cancel (&op->timer); - -/* -* funny feature in RX(!)_SETUP only for RTR-mode: -* copy can_id into frame BUT without RTR-flag to -* prevent a full-load-loopback-test ... ;-] -*/ -if ((op->flags &TX_CP_CAN_ID ) || - (frame0->can_id == op->can_id)) - frame0->can_id = op->can_id & ~CAN_RTR_FLAG ; - }else {if (op->flags &SETTIMER ) { -/* set timer value */ - op->ival1 = msg_head->ival1; - op->ival2 = msg_head->ival2; - op->kt_ival1 =bcm_timeval_to_ktime (msg_head->ival1); - op->kt_ival2 =bcm_timeval_to_ktime (msg_head->ival2); +/* set timers (locked) for newly created op */ +if (do_rx_register) { +spin_lock_bh (&op->bcm_rx_update_lock); + op->ival1 = msg_head->ival1; + op->ival2 = msg_head->ival2; + op->kt_ival1 =bcm_timeval_to_ktime (msg_head->ival1); + op->kt_ival2 =bcm_timeval_to_ktime (msg_head->ival2); + op->kt_lastmsg =0 ; +spin_unlock_bh (&op->bcm_rx_update_lock); + }/* disable an active timer due to zero value? */ if (!op->kt_ival1)
@@ -1255,9 +1343,11 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,* In any case cancel the throttle timer, flush * potentially blocked msgs and reset throttle handling */ - op->kt_lastmsg =0 ;hrtimer_cancel (&op->thrtimer); + +spin_lock_bh (&op->bcm_rx_update_lock);bcm_rx_thr_flush (op); +spin_unlock_bh (&op->bcm_rx_update_lock); }if ((op->flags &STARTTIMER ) && op->kt_ival1)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 14/484 can: bcm: fix CAN frame rx/tx statistics
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit e6c24ba95fc3f1b5e1dcd28b1c6e59ef61a9daa5 upstream.
KCSAN detected a data race within the bcm_rx_handler() when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs.
Use atomic operations with (signed) long data types to access the statistics in the hot path to fix the KCSAN complaint.
Additionally simplify the update and check of statistics overflow by using the atomic operations in separate bcm_update_[rx|tx]_stats() functions. The rx variant runs under bcm_rx_update_lock to prevent races when resetting the two rx counters; the tx variant runs under bcm_tx_lock and only needs to guard its own counter's overflow.
As the rx path resets its values already at LONG_MAX / 100, there is no conflict between the two locking domains (bcm_rx_update_lock vs. bcm_tx_lock) even for ops that use both paths.
The rx statistics update and the frames_filtered update in bcm_rx_changed() were previously performed in two separate bcm_rx_update_lock sections. For an rx op subscribed on all interfaces (ifindex == 0), bcm_rx_handler() can run concurrently on different CPUs, so a counter reset by one CPU between these two sections could leave frames_filtered larger than frames_abs on another CPU, producing a bogus (even negative) reduction percentage in procfs. Update the statistics in the same critical section as bcm_rx_changed() to close this gap, which also removes the now unneeded extra lock/unlock pair around the traffic_flags calculation.
--- net/can/bcm.c | 67 ++++++++++++++++++++++++++++++++++----------------- 1 file changed, 45 insertions(+), 22 deletions(-)
net/can/bcm.c +45 -22
@@ -109,7 +109,7 @@ struct bcm_op {int ifindex;canid_t can_id;u32 flags; -unsigned long frames_abs, frames_filtered; +atomic_long_t frames_abs, frames_filtered;struct bcm_timeval ival1, ival2;struct hrtimer timer, thrtimer;ktime_t rx_stamp, kt_ival1, kt_ival2, kt_lastmsg;
@@ -216,10 +216,13 @@ static int bcm_proc_show(struct seq_file *m, void *v)list_for_each_entry_rcu (op, &bo->rx_ops, list) { -unsigned long reduction; +long reduction, frames_filtered, frames_abs; + + frames_filtered =atomic_long_read (&op->frames_filtered); + frames_abs =atomic_long_read (&op->frames_abs);/* print only active entries & prevent division by zero */ -if (!op->frames_abs) +if (!frames_abs)continue ; seq_printf(m, "rx_op: %03X %-5s ", op->can_id,
@@ -241,9 +244,9 @@ static int bcm_proc_show(struct seq_file *m, void *v) (long long)ktime_to_us(op->kt_ival2));seq_printf (m,"# recv %ld (%ld) => reduction: " , - op->frames_filtered, op->frames_abs); + frames_filtered, frames_abs); - reduction =100 - (op->frames_filtered *100 ) / op->frames_abs; + reduction =100 - (frames_filtered *100 ) / frames_abs;seq_printf (m,"%s%ld%%\n" , (reduction ==100 ) ?"near " :"" , reduction);
@@ -267,7 +270,8 @@ static int bcm_proc_show(struct seq_file *m, void *v)seq_printf (m,"t2=%lld " , (long long )ktime_to_us (op->kt_ival2)); -seq_printf (m,"# sent %ld\n" , op->frames_abs); +seq_printf (m,"# sent %ld\n" , +atomic_long_read (&op->frames_abs)); }seq_putc (m,'\n' );
@@ -277,6 +281,24 @@ static int bcm_proc_show(struct seq_file *m, void *v) }#endif /* CONFIG_PROC_FS */ +static void bcm_update_rx_stats (struct bcm_op *op) +{ +/* prevent overflow of the reduction% calculation in bcm_proc_show() */ +if (atomic_long_inc_return (&op->frames_abs) >LONG_MAX /100 ) { +atomic_long_set (&op->frames_filtered,0 ); +atomic_long_set (&op->frames_abs,0 ); + } +} + +static void bcm_update_tx_stats (struct bcm_op *op) +{ +/* tx_op has no reduction% calculation - use the full range and +* just keep the displayed counter non-negative on overflow +*/ +if (atomic_long_inc_return (&op->frames_abs) ==LONG_MAX ) +atomic_long_set (&op->frames_abs,0 ); +} +/* * bcm_can_tx - send the (next) CAN frame to the appropriate CAN interface * of the given bcm tx op
@@ -328,7 +350,7 @@ static void bcm_can_tx(struct bcm_op *op, struct canfd_frame *cf)spin_lock_bh (&op->bcm_tx_lock);if (!err) - op->frames_abs++; +bcm_update_tx_stats (op);/* only advance the cyclic sequence if nothing reset currframe while * we were sending - a concurrent TX_RESET_MULTI_IDX means this
@@ -473,12 +495,9 @@ static void bcm_rx_changed(struct bcm_op *op, struct canfd_frame *data) {struct bcm_msg_head head; -/* update statistics */ - op->frames_filtered++; - -/* prevent statistics overflow */ -if (op->frames_filtered >ULONG_MAX /100 ) - op->frames_filtered = op->frames_abs =0 ; +/* update statistics (frames_filtered <= frames_abs) */ +if (atomic_long_read (&op->frames_abs)) +atomic_long_inc (&op->frames_filtered);/* this element is not throttled anymore */ data->flags &= (BCM_CAN_FLAGS_MASK |RX_RECV );
@@ -718,25 +737,29 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data) op->rx_stamp = skb->tstamp;/* save originator for recvfrom() */ op->rx_ifindex = skb->dev->ifindex; -/* update statistics */ - op->frames_abs++; -/* snapshot the flag under lock: op->flags/op->frames may be updated -* concurrently by bcm_rx_setup(). -*/ +/* op->flags/op->frames may be updated concurrently by bcm_rx_setup() */ spin_lock_bh (&op->bcm_rx_update_lock); + rtr_frame = op->flags &RX_RTR_FRAME ; -if (rtr_frame) +if (rtr_frame) { +bcm_update_rx_stats (op); +/* snapshot RTR content under lock */ memcpy (&rtrframe, op->frames, op->cfsiz); -spin_unlock_bh (&op->bcm_rx_update_lock); +spin_unlock_bh (&op->bcm_rx_update_lock); -if (rtr_frame) {/* send reply for RTR-request (placed in op->frames[0]) */ bcm_can_tx (op, &rtrframe);return ; } -spin_lock_bh (&op->bcm_rx_update_lock); +/* update statistics in the same critical section as bcm_rx_changed() +* below: frames_filtered must never be checked/incremented against a +* frames_abs snapshot from a concurrent bcm_rx_handler() call on +* another CPU for the same (wildcard) op, or frames_filtered can end +* up larger than frames_abs. +*/ +bcm_update_rx_stats (op);if (op->flags &RX_FILTER_ID ) {/* the easiest case */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 15/484 can: bcm: extend bcm_tx_lock usage for data and timer updates
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit 12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc upstream.
Stage new CAN frame content for an existing tx op into a kmalloc()'d buffer and validate it there, mirroring the approach already used in bcm_rx_setup(). Only copy the validated data into op->frames while holding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler() can no longer observe a partially updated or unvalidated frame.
Add a missing error path for memcpy_from_msg() when copying CAN frame data from userspace.
Also move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup() under op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same lock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the torn 64-bit ktime_t read on 32-bit platforms.
--- net/can/bcm.c | 104 ++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 75 insertions(+), 29 deletions(-)
net/can/bcm.c +75 -29
@@ -125,7 +125,7 @@ struct bcm_op {struct canfd_frame last_sframe;struct sock *sk;struct net_device *rx_reg_dev; -spinlock_t bcm_tx_lock;/* protect currframe/count in runtime updates */ +spinlock_t bcm_tx_lock;/* protect tx data and timer updates */ spinlock_t bcm_rx_update_lock;/* protect filter/timer data updates */ };
@@ -440,12 +440,18 @@ static bool bcm_tx_set_expiry(struct bcm_op *op, struct hrtimer *hrt) {ktime_t ival; +spin_lock_bh (&op->bcm_tx_lock); +if (op->kt_ival1 && op->count) ival = op->kt_ival1; -else if (op->kt_ival2) +else if (op->kt_ival2) { ival = op->kt_ival2; -else + }else { +spin_unlock_bh (&op->bcm_tx_lock);return false; + } + +spin_unlock_bh (&op->bcm_tx_lock);hrtimer_set_expires (hrt,ktime_add (ktime_get (), ival));return true;
@@ -462,25 +468,47 @@ static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer) { struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);struct bcm_msg_head msg_head; +bool tx_ival1, tx_ival2; + +/* snapshot kt_ival1/kt_ival2/count under lock to avoid torn +* ktime_t reads racing with concurrent bcm_tx_setup() updates +*/ +spin_lock_bh (&op->bcm_tx_lock); + tx_ival1 = op->kt_ival1 && (op->count >0 ); + tx_ival2 = !!op->kt_ival2; +spin_unlock_bh (&op->bcm_tx_lock); + +if (tx_ival1) { +u32 flags, count; +struct bcm_timeval ival1, ival2; -if (op->kt_ival1 && (op->count >0 )) {bcm_can_tx (op,NULL ); -if (!op->count && (op->flags &TX_COUNTEVT )) { +/* snapshot variables under lock to avoid torn reads racing +* with concurrent bcm_tx_setup() updates +*/ +spin_lock_bh (&op->bcm_tx_lock); + flags = op->flags; + count = op->count; + ival1 = op->ival1; + ival2 = op->ival2; +spin_unlock_bh (&op->bcm_tx_lock); + +if (!count && (flags &TX_COUNTEVT )) {/* create notification to user */ memset (&msg_head,0 ,sizeof (msg_head)); msg_head.opcode =TX_EXPIRED ; - msg_head.flags = op->flags; - msg_head.count = op->count; - msg_head.ival1 = op->ival1; - msg_head.ival2 = op->ival2; + msg_head.flags = flags; + msg_head.count = count; + msg_head.ival1 = ival1; + msg_head.ival2 = ival2; msg_head.can_id = op->can_id; msg_head.nframes =0 ;bcm_send_to_user (op, &msg_head,NULL ,0 ); } - }else if (op->kt_ival2) { + }else if (tx_ival2) {bcm_can_tx (op,NULL ); }
@@ -988,6 +1016,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,/* check the given can_id */ op =bcm_find_op (&bo->tx_ops, msg_head, ifindex);if (op) { +void *new_frames; +/* update existing BCM operation */ /*
@@ -998,11 +1028,23 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,if (msg_head->nframes > op->nframes)return -E2BIG ; -/* update CAN frames content */ +/* get new CAN frames content into a staging buffer before +* locking: validate and normalize the frames there so that +* bcm_can_tx() / bcm_tx_timeout_handler() never observe a +* partially updated or unvalidated frame in op->frames +*/ + new_frames =kmalloc (msg_head->nframes * op->cfsiz,GFP_KERNEL ); +if (!new_frames) +return -ENOMEM ; +for (i =0 ; i < msg_head->nframes; i++) { - cf = op->frames + op->cfsiz * i; + cf = new_frames + op->cfsiz * i; err =memcpy_from_msg ((u8 *)cf, msg, op->cfsiz); +if (err <0 ) { +kfree (new_frames); +return err; + }if (op->flags &CAN_FD_FRAME ) {if (cf->len >64 )
@@ -1012,36 +1054,38 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, err = -EINVAL ; } -if (err <0 ) +if (err <0 ) { +kfree (new_frames);return err; + }if (msg_head->flags &TX_CP_CAN_ID ) {/* copy can_id into frame */ cf->can_id = msg_head->can_id; } } + +spin_lock_bh (&op->bcm_tx_lock); + +/* update CAN frames content */ +memcpy (op->frames, new_frames, msg_head->nframes * op->cfsiz); + op->flags = msg_head->flags; -/* only lock for unlikely count/nframes/currframe changes */ if (op->nframes != msg_head->nframes || - op->flags &TX_RESET_MULTI_IDX || - op->flags &SETTIMER ) { - -spin_lock_bh (&op->bcm_tx_lock); + op->flags &TX_RESET_MULTI_IDX ) { +/* potentially update changed nframes */ + op->nframes = msg_head->nframes; +/* restart multiple frame transmission */ + op->currframe =0 ; + } -if (op->nframes != msg_head->nframes || - op->flags &TX_RESET_MULTI_IDX ) { -/* potentially update changed nframes */ - op->nframes = msg_head->nframes; -/* restart multiple frame transmission */ - op->currframe =0 ; - } +if (op->flags &SETTIMER ) + op->count = msg_head->count; -if (op->flags &SETTIMER ) - op->count = msg_head->count; +spin_unlock_bh (&op->bcm_tx_lock); -spin_unlock_bh (&op->bcm_tx_lock); - } +kfree (new_frames); }else {/* insert new BCM operation for the given can_id */
@@ -1118,10 +1162,12 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,if (op->flags &SETTIMER ) {/* set timer values */ +spin_lock_bh (&op->bcm_tx_lock); op->ival1 = msg_head->ival1; op->ival2 = msg_head->ival2; op->kt_ival1 =bcm_timeval_to_ktime (msg_head->ival1); op->kt_ival2 =bcm_timeval_to_ktime (msg_head->ival2); +spin_unlock_bh (&op->bcm_tx_lock);/* disable an active timer due to zero values? */ if (!op->kt_ival1 && !op->kt_ival2)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 16/484 can: bcm: validate frame length in bcm_rx_setup() for RTR replies
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit 62ec41f364648be79d54d94d0d240ee326948afd upstream.
bcm_tx_setup() validates cf->len against the CAN/CAN FD DLC limits before installing frames for TX_SETUP, but bcm_rx_setup() never did the same for the RTR-reply frame configured via RX_SETUP with RX_RTR_FRAME.
--- net/can/bcm.c | 59 +++++++++++++++++++++++++++++++++++---------------- 1 file changed, 41 insertions(+), 18 deletions(-)
net/can/bcm.c +41 -18
@@ -1199,22 +1199,37 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,return err; } -static void bcm_rx_setup_rtr_check (struct bcm_msg_head *msg_head, -struct bcm_op *op,void *new_frames) +static int bcm_rx_setup_rtr_check (struct bcm_msg_head *msg_head, +struct bcm_op *op,void *new_frames) { +struct canfd_frame *frame0 = new_frames; + +if (!(msg_head->flags &RX_RTR_FRAME )) +return 0 ; + +/* this frame is sent out as-is by bcm_can_tx() whenever a matching +* remote request is received, so validate its length the same way +* bcm_tx_setup() validates TX_SETUP frames before installing it +*/ +if (msg_head->flags &CAN_FD_FRAME ) { +if (frame0->len >64 ) +return -EINVAL ; + }else { +if (frame0->len >8 ) +return -EINVAL ; + } +/* funny feature in RX(!)_SETUP only for RTR-mode: * copy can_id into frame BUT without RTR-flag to * prevent a full-load-loopback-test ... ;-] * normalize this on the staged buffer, before it is * ever installed into op->frames. */ -if (msg_head->flags &RX_RTR_FRAME ) { -struct canfd_frame *frame0 = new_frames; +if ((msg_head->flags &TX_CP_CAN_ID ) || + frame0->can_id == op->can_id) + frame0->can_id = op->can_id & ~CAN_RTR_FLAG ; -if ((msg_head->flags &TX_CP_CAN_ID ) || - frame0->can_id == op->can_id) - frame0->can_id = op->can_id & ~CAN_RTR_FLAG ; - } +return 0 ; }/*
@@ -1277,7 +1292,11 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,return err; } -bcm_rx_setup_rtr_check (msg_head, op, new_frames); + err =bcm_rx_setup_rtr_check (msg_head, op, new_frames); +if (err <0 ) { +kfree (new_frames); +return err; + } }spin_lock_bh (&op->bcm_rx_update_lock);
@@ -1350,16 +1369,12 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,if (msg_head->nframes) { err =memcpy_from_msg (op->frames, msg, msg_head->nframes * op->cfsiz); -if (err <0 ) { -if (op->frames != &op->sframe) -kfree (op->frames); -if (op->last_frames != &op->last_sframe) -kfree (op->last_frames); -kfree (op); -return err; - } +if (err <0 ) + goto free_op; -bcm_rx_setup_rtr_check (msg_head, op, op->frames); + err =bcm_rx_setup_rtr_check (msg_head, op, op->frames); +if (err <0 ) + goto free_op; }/* bcm_can_tx / bcm_tx_timeout_handler needs this */
@@ -1461,6 +1476,14 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, }return msg_head->nframes * op->cfsiz +MHSIZ ; + +free_op: +if (op->frames != &op->sframe) +kfree (op->frames); +if (op->last_frames != &op->last_sframe) +kfree (op->last_frames); +kfree (op); +return err; }/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 17/484 can: bcm: add missing device refcount for CAN filter removal
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit d59948293ea34b6337ce2b5febab8510de70048c upstream.
sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6 ("can: raw: add missing refcount for memory leak fix") introduced a netdevice_tracker which solves the issue for bcm.c too.
bcm_release(), bcm_delete_rx_op() and bcm_notifier() relied on dev_get_by_index(ifindex) to re-find the device for an rx_op before unregistering its filter. If a concurrent NETDEV_UNREGISTER has already unlisted the device from the ifindex table, that lookup fails and can_rx_unregister() is silently skipped, leaving a stale CAN filter pointing at the soon-to-be-freed bcm_op/socket.
Hold a netdev_hold()/netdev_put() tracked reference on op->rx_reg_dev from the moment the rx filter is registered in bcm_rx_setup() until it is unregistered in bcm_rx_unreg(), and use that reference directly in bcm_release() and bcm_delete_rx_op() instead of re-looking the device up by ifindex.
--- net/can/bcm.c | 44 ++++++++++++++++++++++++-------------------- 1 file changed, 24 insertions(+), 20 deletions(-)
net/can/bcm.c +24 -20
@@ -889,6 +889,7 @@ static void bcm_rx_unreg(struct net_device *dev, struct bcm_op *op)/* mark as removed subscription */ op->rx_reg_dev =NULL ; +dev_put (dev); }else printk (KERN_ERR "can-bcm: bcm_rx_unreg: registered device " "mismatch %p %p\n" , op->rx_reg_dev, dev);
@@ -919,17 +920,14 @@ static int bcm_delete_rx_op(struct list_head *ops, struct bcm_msg_head *mh,* Only remove subscriptions that had not * been removed due to NETDEV_UNREGISTER * in bcm_notifier() +* +* op->rx_reg_dev is a tracked reference taken +* when the subscription was registered, so it +* stays valid here even if a concurrent +* NETDEV_UNREGISTER already unlisted the dev. */ -if (op->rx_reg_dev) { -struct net_device *dev; - - dev =dev_get_by_index (sock_net (op->sk), - op->ifindex); -if (dev) { -bcm_rx_unreg (dev, op); -dev_put (dev); - } - } +if (op->rx_reg_dev) +bcm_rx_unreg (op->rx_reg_dev, op); }else can_rx_unregister(sock_net(op->sk), NULL, op->can_id,
@@ -1452,7 +1450,15 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, bcm_rx_handler, op, "bcm", sk); - op->rx_reg_dev = dev; +/* keep a reference so that a later +* unregister can safely reach the device even +* if a concurrent NETDEV_UNREGISTER has +* already unlisted it by ifindex +*/ +if (!err) { + op->rx_reg_dev = dev; +dev_hold (dev); + }dev_put (dev); }else {/* the requested device is gone - do not
@@ -1825,16 +1831,14 @@ static int bcm_release(struct socket *sock)* Only remove subscriptions that had not * been removed due to NETDEV_UNREGISTER * in bcm_notifier() +* +* op->rx_reg_dev is a tracked reference taken +* when the subscription was registered, so it +* stays valid here even if a concurrent +* NETDEV_UNREGISTER already unlisted the device. */ -if (op->rx_reg_dev) { -struct net_device *dev; - - dev =dev_get_by_index (net, op->ifindex); -if (dev) { -bcm_rx_unreg (dev, op); -dev_put (dev); - } - } +if (op->rx_reg_dev) +bcm_rx_unreg (op->rx_reg_dev, op); }else can_rx_unregister(net, NULL, op->can_id, REGMASK(op->can_id),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 18/484 can: bcm: fix stale rx/tx ops after device removal
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit 3b762c0d950383ab7a002686c9136b9aa55d2d70 upstream.
RX: an RX_SETUP update(!) for an existing op skipped can_rx_register() unconditionally, even when a concurrent NETDEV_UNREGISTER had already torn down its registration (op->rx_reg_dev == NULL). This silently did not re-enable frame delivery for that updated filter. bcm_rx_setup() now re-registers in that case, while leaving rx_ops with ifindex = 0 (all CAN devices) which never carry a tracked rx_reg_dev registered as-is.
TX: bcm_notify() only handled bo->rx_ops on NETDEV_UNREGISTER, leaving tx_ops with an active cyclic transmission re-arming its hrtimer indefinitely to execute bcm_tx_timeout_handler(). Cancelling the hrtimer prevents the runaway timer and any injection into a later reused ifindex, since nothing else calls bcm_can_tx() for the op until an explicit TX_SETUP update re-arms it.
Unlike bcm_rx_unreg(), which clears the tracked rx_reg_dev for rx_ops, the ifindex is intentionally left unchanged for tx_ops. bcm_tx_setup() always rejects ifindex 0, so clearing it would strand the op: neither a later TX_SETUP (bcm_find_op()) nor TX_DELETE (bcm_delete_tx_op()) could ever find it again, since both require an exact ifindex match.
--- net/can/bcm.c | 54 +++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 44 insertions(+), 10 deletions(-)
net/can/bcm.c +44 -10
@@ -1239,6 +1239,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,struct bcm_sock *bo =bcm_sk (sk);struct bcm_op *op;int do_rx_register; +int new_op =0 ;int err =0 ;if ((msg_head->flags &RX_FILTER_ID ) || (!(msg_head->nframes))) {
@@ -1323,8 +1324,15 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,/* free temporary frames / kfree(NULL) is safe */ kfree (new_frames); -/* Only an update -> do not call can_rx_register() */ - do_rx_register =0 ; +/* Don't register a new CAN filter for the rx_op update unless +* a concurrent NETDEV_UNREGISTER notifier already tore down +* the previous registration. In this case the receiver needs +* to be re-registered here so that this update doesn't +* silently stop delivering frames for the given ifindex. +* Ops with ifindex = 0 (all CAN interfaces) never carry a +* tracked rx_reg_dev and stay registered as-is. +*/ + do_rx_register = (ifindex && !op->rx_reg_dev) ?1 :0 ; }else {/* insert new BCM operation for the given can_id */
@@ -1394,6 +1402,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,/* call can_rx_register() */ do_rx_register =1 ; + new_op =1 ; }/* if ((op = bcm_find_op(&bo->rx_ops, msg_head->can_id, ifindex))) */
@@ -1407,7 +1416,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,if (op->flags &SETTIMER ) {/* set timers (locked) for newly created op */ -if (do_rx_register) { +if (new_op) {spin_lock_bh (&op->bcm_rx_update_lock); op->ival1 = msg_head->ival1; op->ival2 = msg_head->ival2;
@@ -1437,7 +1446,10 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, HRTIMER_MODE_REL_SOFT); } -/* now we can register for can_ids, if we added a new bcm_op */ +/* now we can register for can_ids, if we added a new bcm_op +* or need to re-register after a NETDEV_UNREGISTER tore down +* the previous registration of an existing op +*/ if (do_rx_register) {if (ifindex) {struct net_device *dev;
@@ -1467,18 +1479,32 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, err = -ENODEV ; } - }else + }else { err =can_rx_register (sock_net (sk),NULL , op->can_id,REGMASK (op->can_id), bcm_rx_handler, op,"bcm" , sk); + } +if (err) { -/* this bcm rx op is broken -> remove it */ -bcm_remove_op (op); +/* newly created bcm rx op is broken -> remove it */ +if (new_op) { +bcm_remove_op (op); +return err; + } + +/* an existing op just stays unregistered. +* Cancel op->timer and (defensively) op->thrtimer. +* Other settings can't be reached until the next +* successful RX_SETUP. +*/ +hrtimer_cancel (&op->timer); +hrtimer_cancel (&op->thrtimer);return err; } -/* add this bcm_op to the list of the rx_ops */ -list_add_rcu (&op->list, &bo->rx_ops); +/* add a new bcm_op to the list of the rx_ops */ +if (new_op) +list_add_rcu (&op->list, &bo->rx_ops); }return msg_head->nframes * op->cfsiz +MHSIZ ;
@@ -1694,11 +1720,19 @@ static void bcm_notify(struct bcm_sock *bo, unsigned long msg,case NETDEV_UNREGISTER :lock_sock (sk); -/* remove device specific receive entries */ +/* rx_ops: remove device specific receive entries */ list_for_each_entry (op, &bo->rx_ops, list)if (op->rx_reg_dev == dev)bcm_rx_unreg (dev, op); +/* tx_ops: stop device specific cyclic transmissions on the +* vanishing ifindex. Cancelling the timer is enough to stop +* cyclic bcm_can_tx() calls as there is no re-arming. +*/ +list_for_each_entry (op, &bo->tx_ops, list) +if (op->ifindex == dev->ifindex) +hrtimer_cancel (&op->timer); +/* remove device reference, if this is our bound device */ if (bo->bound && bo->ifindex == dev->ifindex) {#if IS_ENABLED (CONFIG_PROC_FS )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 19/484 can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit 58fd6cbc8541216af1d7ed272ea7ac2b66d50fd8 upstream.
For an rx op subscribed on all interfaces (ifindex == 0), the same op is registered once in the shared per-netns wildcard filter list, so bcm_rx_handler() can run concurrently on different CPUs for frames arriving on different net devices.
op->rx_stamp and op->rx_ifindex were written before bcm_rx_update_lock was taken, allowing concurrent writers to race each other - including a torn store of the 64-bit rx_stamp on 32-bit platforms.
Beyond a torn store bcm_send_to_user() must report the timestamp/ifindex of the very same frame whose content it is delivering. So the assignment is placed in the same unbroken bcm_rx_update_lock section as the content comparison.
As a side effect, the RTR-request frame feature (which never reach bcm_send_to_user()) no longer updates rx_stamp/rx_ifindex, since only the notification path needs them.
--- net/can/bcm.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
net/can/bcm.c +8 -5
@@ -761,11 +761,6 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)/* disable timeout */ hrtimer_cancel (&op->timer); -/* save rx timestamp */ - op->rx_stamp = skb->tstamp; -/* save originator for recvfrom() */ - op->rx_ifindex = skb->dev->ifindex; -/* op->flags/op->frames may be updated concurrently by bcm_rx_setup() */ spin_lock_bh (&op->bcm_rx_update_lock);
@@ -789,6 +784,14 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)*/ bcm_update_rx_stats (op); +/* save rx timestamp and originator for recvfrom() under lock. +* For an op subscribed on all interfaces (ifindex == 0) +* bcm_rx_handler() can run concurrently on different CPUs so +* the CAN content and the meta data must be bundled correctly. +*/ + op->rx_stamp = skb->tstamp; + op->rx_ifindex = skb->dev->ifindex; +if (op->flags &RX_FILTER_ID ) {/* the easiest case */ bcm_rx_update_and_send (op, op->last_frames, rxframe);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 20/484 can: bcm: track a single source interface for ANYDEV timeout/throttle ops
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit 2f5976f54a04e9f18b25283036ac3136be453b17 upstream.
An ANYDEV rx op (ifindex == 0) with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces: bcm_rx_handler() can run concurrently for the same op on different CPUs, racing hrtimer_cancel()/ bcm_rx_starttimer() against bcm_rx_timeout_handler() and causing spurious RX_TIMEOUT notifications and last_frames corruption. The same concurrency lets throttled multiplex frames from different interfaces clobber the single rx_ifindex/rx_stamp fields shared by the op.
Add op->if_detected to track the first interface that delivers a matching frame while a timeout/throttle timer is configured, and reject frames from any other interface for that op. The claim is decided in bcm_rx_handler() before hrtimer_cancel() touches op->timer, so a rejected frame can never disturb the claimed interface's watchdog. RTR-mode ops are excluded via RX_RTR_FRAME, independent of kt_ival1/kt_ival2, since those may briefly hold a stale value from an earlier non-RTR configuration.
The claim is released in bcm_notify() on NETDEV_UNREGISTER and in bcm_rx_setup() when SETTIMER reconfigures the timer values.
A (re-)claim is only possible on CAN devices in NETREG_REGISTERED dev->reg_state to cover the release in bcm_notify() where reg_state becomes NETREG_UNREGISTERING until synchronize_net().
--- net/can/bcm.c | 49 ++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 44 insertions(+), 5 deletions(-)
net/can/bcm.c +44 -5
@@ -114,6 +114,7 @@ struct bcm_op {struct hrtimer timer, thrtimer;ktime_t rx_stamp, kt_ival1, kt_ival2, kt_lastmsg;int rx_ifindex; +int if_detected;/* first received ifindex in ANYDEV rx_op mode */ int cfsiz;u32 count;u32 nframes;
@@ -758,6 +759,33 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)return ; } +/* An ANYDEV op with an active RX timeout and/or throttle timer +* tracks a single source interface: claim the first interface that +* delivers a matching frame and reject frames from any other one, +* before hrtimer_cancel() below can touch op->timer - this avoids +* racing bcm_rx_timeout_handler() across concurrent interfaces. +* RX_RTR_FRAME ops are excluded, as kt_ival1/kt_ival2 may briefly +* hold a stale value from an earlier non-RTR configuration. +*/ +if (!op->ifindex) { +spin_lock_bh (&op->bcm_rx_update_lock); + +if (!(op->flags &RX_RTR_FRAME ) && + (op->kt_ival1 || op->kt_ival2)) { +/* don't claim to vanishing interface */ +if (!op->if_detected && + skb->dev->reg_state ==NETREG_REGISTERED ) + op->if_detected = skb->dev->ifindex; + +if (op->if_detected != skb->dev->ifindex) { +spin_unlock_bh (&op->bcm_rx_update_lock); +return ; + } + } + +spin_unlock_bh (&op->bcm_rx_update_lock); + } +/* disable timeout */ hrtimer_cancel (&op->timer);
@@ -784,10 +812,9 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)*/ bcm_update_rx_stats (op); -/* save rx timestamp and originator for recvfrom() under lock. -* For an op subscribed on all interfaces (ifindex == 0) -* bcm_rx_handler() can run concurrently on different CPUs so -* the CAN content and the meta data must be bundled correctly. +/* save rx timestamp and originator for recvfrom() under lock: an +* ANYDEV op without an active timer can still run concurrently on +* different CPUs, so content and meta data must be bundled here. */ op->rx_stamp = skb->tstamp; op->rx_ifindex = skb->dev->ifindex;
@@ -1321,6 +1348,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, op->kt_ival1 =bcm_timeval_to_ktime (msg_head->ival1); op->kt_ival2 =bcm_timeval_to_ktime (msg_head->ival2); op->kt_lastmsg =0 ; + op->if_detected =0 ;/* reclaim ifindex in ANYDEV mode */ }spin_unlock_bh (&op->bcm_rx_update_lock);
@@ -1724,10 +1752,21 @@ static void bcm_notify(struct bcm_sock *bo, unsigned long msg,lock_sock (sk);/* rx_ops: remove device specific receive entries */ -list_for_each_entry (op, &bo->rx_ops, list) +list_for_each_entry (op, &bo->rx_ops, list) {if (op->rx_reg_dev == dev)bcm_rx_unreg (dev, op); +/* release an ANYDEV op's claim (see bcm_rx_handler()) +* on this now confirmed-gone interface. +*/ +if (!op->ifindex) { +spin_lock_bh (&op->bcm_rx_update_lock); +if (op->if_detected == dev->ifindex) + op->if_detected =0 ; +spin_unlock_bh (&op->bcm_rx_update_lock); + } + } +/* tx_ops: stop device specific cyclic transmissions on the * vanishing ifindex. Cancelling the timer is enough to stop * cyclic bcm_can_tx() calls as there is no re-arming.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 21/484 can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit 20bab8b88baac140ca3701116e1d486c7f51e311 upstream.
isotp_release() looked up the bound network device via dev_get_by_index() using the stored ifindex. During device unregistration the device is unlisted from the ifindex hash before the NETDEV_UNREGISTER notifier chain runs, so a concurrent isotp_release() could find no device, skip can_rx_unregister() entirely, and still proceed to free the socket. Since isotp_release() had already removed itself from the isotp notifier list at that point, isotp_notify() would never get a chance to clean up either, leaving a stale CAN filter that keeps pointing at the freed socket.
Fix this the same way raw.c already does: hold a tracked reference to the bound net_device in the socket (so->dev/so->dev_tracker) from bind() onward instead of re-resolving it from the ifindex, and serialize bind()/release() with rtnl_lock() so that so->dev is always consistent with what the NETDEV_UNREGISTER notifier sees. so->dev stays valid regardless of ifindex-hash unlisting, and is only ever cleared by whichever of isotp_release()/isotp_notify() gets there first, so the filter is always removed exactly once.
isotp_bind() now rejects a (re)bind with -EAGAIN while so->[tx|rx].state isn't ISOTP_IDLE yet, so a timer left running by a prior NETDEV_UNREGISTER can't act on a newly bound so->ifindex. Both checks share the same lock_sock() section, so there is no window in which a concurrent isotp_notify() clearing so->bound could be missed.
--- net/can/isotp.c | 88 +++++++++++++++++++++++++++++++++---------------- 1 file changed, 59 insertions(+), 29 deletions(-)
net/can/isotp.c +59 -29
@@ -150,6 +150,7 @@ struct isotp_sock {struct sock sk;int bound;int ifindex; +struct net_device *dev;canid_t txid;canid_t rxid;ktime_t tx_gap;
@@ -962,6 +963,14 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) goto err_event_drop; } +/* so->bound is only checked once above - a wakeup may have +* unbound/rebound the socket meanwhile, so re-validate it +*/ +if (!so->bound) { + err = -EADDRNOTAVAIL ; + goto err_out_drop; + } +/* PDU size > default => try max_pdu_size */ if (size > so->tx.buflen && so->tx.buflen < max_pdu_size) {u8 *newbuf =kmalloc (max_pdu_size,GFP_KERNEL );
@@ -1197,28 +1206,30 @@ static int isotp_release(struct socket *sock)list_del (&so->notifier);spin_unlock (&isotp_notifier_lock); +rtnl_lock ();lock_sock (sk); -/* remove current filters & unregister */ -if (so->bound) { -if (so->ifindex) { -struct net_device *dev; - - dev =dev_get_by_index (net, so->ifindex); -if (dev) { -if (isotp_register_rxid (so)) -can_rx_unregister (net, dev, so->rxid, -SINGLE_MASK (so->rxid), - isotp_rcv, sk); - -can_rx_unregister (net, dev, so->txid, -SINGLE_MASK (so->txid), - isotp_rcv_echo, sk); -dev_put (dev); - } - } +/* remove current filters & unregister +* tracked reference so->dev is taken at bind() time with rtnl_lock +*/ +if (so->bound && so->dev) { +if (isotp_register_rxid (so)) +can_rx_unregister (net, so->dev, so->rxid, +SINGLE_MASK (so->rxid), + isotp_rcv, sk); + +can_rx_unregister (net, so->dev, so->txid, +SINGLE_MASK (so->txid), + isotp_rcv_echo, sk); +dev_put (so->dev); } + so->ifindex =0 ; + so->bound =0 ; + so->dev =NULL ; + +rtnl_unlock (); +/* Always wait for a grace period before touching the timers below. * A concurrent NETDEV_UNREGISTER may have already unregistered our * filters and cleared so->bound in isotp_notify() without waiting
@@ -1231,9 +1242,6 @@ static int isotp_release(struct socket *sock)hrtimer_cancel (&so->txtimer);hrtimer_cancel (&so->rxtimer); - so->ifindex =0 ; - so->bound =0 ; -sock_orphan (sk); sock->sk =NULL ;
@@ -1287,6 +1295,7 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)if (!addr->can_ifindex)return -ENODEV ; +rtnl_lock ();lock_sock (sk);if (so->bound) {
@@ -1294,6 +1303,17 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len) goto out; } +/* A transmission or reception that outlived a previous binding +* (unbound by NETDEV_UNREGISTER) may still be draining; the FC/echo +* and RX watchdog timers bound how long this takes. Checked together +* with so->bound in the same lock_sock() section above, so there is +* no window in which a concurrent isotp_notify() could be missed. +*/ +if (so->tx.state !=ISOTP_IDLE || so->rx.state !=ISOTP_IDLE ) { + err = -EAGAIN ; + goto out; + } +/* ensure different CAN IDs when the rx_id is to be registered */ if (isotp_register_rxid (so) && rx_id == tx_id) { err = -EADDRNOTAVAIL ;
@@ -1306,14 +1326,12 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len) goto out; }if (dev->type !=ARPHRD_CAN ) { -dev_put (dev); err = -ENODEV ; - goto out; + goto out_put_dev; } -if (dev->mtu < so->ll.mtu) { -dev_put (dev); +if (READ_ONCE (dev->mtu) < so->ll.mtu) { err = -EINVAL ; - goto out; + goto out_put_dev; }if (!(dev->flags &IFF_UP )) notify_enetdown =1 ;
@@ -1331,16 +1349,25 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)can_rx_register (net, dev, tx_id,SINGLE_MASK (tx_id), isotp_rcv_echo, sk,"isotpe" , sk); -dev_put (dev); -/* switch to new settings */ so->ifindex = ifindex; so->rxid = rx_id; so->txid = tx_id; so->bound =1 ; +/* bind() ok -> hold a reference for so->dev so that isotp_release() +* can safely reach the device later, even if a concurrent +* NETDEV_UNREGISTER has already unlisted it by ifindex. +*/ + so->dev = dev; +dev_hold (so->dev); + +out_put_dev: +/* remove potential reference from dev_get_by_index() */ +dev_put (dev); out:release_sock (sk); +rtnl_unlock ();if (notify_enetdown) { sk->sk_err =ENETDOWN ;
@@ -1543,7 +1570,7 @@ static void isotp_notify(struct isotp_sock *so, unsigned long msg,if (!net_eq (dev_net (dev),sock_net (sk)))return ; -if (so->ifindex != dev->ifindex) +if (so->dev != dev)return ;switch (msg) {
@@ -1559,10 +1586,12 @@ static void isotp_notify(struct isotp_sock *so, unsigned long msg,can_rx_unregister (dev_net (dev), dev, so->txid,SINGLE_MASK (so->txid), isotp_rcv_echo, sk); +dev_put (so->dev); } so->ifindex =0 ; so->bound =0 ; + so->dev =NULL ;release_sock (sk); sk->sk_err =ENODEV ;
@@ -1622,6 +1651,7 @@ static int isotp_init(struct sock *sk) so->ifindex =0 ; so->bound =0 ; + so->dev =NULL ; so->opt.flags =CAN_ISOTP_DEFAULT_FLAGS ; so->opt.ext_address =CAN_ISOTP_DEFAULT_EXT_ADDRESS ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 22/484 can: isotp: serialize TX state transitions under so->rx_lock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit cf070fe33bfbd1a4c21236078fadb35dd223a157 upstream.
The TX state machine (so->tx.state) is driven from three contexts:sendmsg() claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two hrtimers timing out a stalled transfer. Mixing a lock-free cmpxchg() claim in sendmsg() with hrtimer_cancel() calls made under so->rx_lock elsewhere left windows where a frame or timer callback could act on a state that had already moved on, corrupting an unrelated transfer.
so->rx_lock now covers the full lifecycle of a TX claim: sendmsg() takes it to check so->tx.state is ISOTP_IDLE, switch it to ISOTP_SENDING, bump so->tx_gen and drain the previous transfer's timers - all as one critical section. isotp_rcv_fc()/isotp_rcv_cf() already run under this lock via isotp_rcv(), and isotp_rcv_echo() now takes it itself, so none of them can ever observe a transfer mid-claim. This also means a transfer can no longer be handed to sendmsg()'s cleanup paths (signal or send error) while another thread is concurrently claiming or finishing it, so those paths can cancel timers and reset the state unconditionally.
isotp_release() claims the socket the same way, so a racing sendmsg() sees a consistent ISOTP_SHUTDOWN and skips arming its timer or sending.
Only the hrtimer callbacks stay outside so->rx_lock, since they run under so->rx_lock's cancellation elsewhere and taking it themselves would deadlock. so->tx_gen lets them recognize whether the transfer they timed out is still the one currently active, so they don't report an error against a transfer that has since completed or been superseded.
--- net/can/isotp.c | 192 ++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 154 insertions(+), 38 deletions(-)
net/can/isotp.c +154 -38
@@ -155,7 +155,7 @@ struct isotp_sock {canid_t rxid;ktime_t tx_gap;ktime_t lastrxcf_tstamp; -struct hrtimer rxtimer, txtimer, txfrtimer; +struct hrtimer rxtimer, txtimer, txfrtimer, echotimer;struct can_isotp_options opt;struct can_isotp_fc_options rxfc, txfc;struct can_isotp_ll_options ll;
@@ -163,6 +163,7 @@ struct isotp_sock {u32 force_tx_stmin;u32 force_rx_stmin;u32 cfecho;/* consecutive frame echo tag */ +u32 tx_gen;/* generation, bumped per new tx transfer */ struct tpcon rx, tx;struct list_head notifier;wait_queue_head_t wait;
@@ -369,6 +370,15 @@ static int isotp_rcv_fc(struct isotp_sock *so, struct canfd_frame *cf, int ae)hrtimer_cancel (&so->txtimer); +/* isotp_tx_timeout() may have given up on this job while +* hrtimer_cancel() above waited for it to finish; so->rx_lock +* (held by our caller isotp_rcv()) rules out a concurrent claim, +* so a plain recheck is enough here. +*/ +if (so->tx.state !=ISOTP_WAIT_FC && + so->tx.state !=ISOTP_WAIT_FIRST_FC ) +return 1 ; +if ((cf->len < ae +FC_CONTENT_SZ ) || ((so->opt.flags &ISOTP_CHECK_PADDING ) &&check_pad (so, cf, ae +FC_CONTENT_SZ , so->opt.rxpad_content))) {
@@ -414,7 +424,7 @@ static int isotp_rcv_fc(struct isotp_sock *so, struct canfd_frame *cf, int ae) so->tx.bs =0 ; so->tx.state =ISOTP_SENDING ;/* send CF frame and enable echo timeout handling */ -hrtimer_start (&so->txtimer,ktime_set (ISOTP_ECHO_TIMEOUT ,0 ), +hrtimer_start (&so->echotimer,ktime_set (ISOTP_ECHO_TIMEOUT ,0 ),HRTIMER_MODE_REL_SOFT );isotp_send_cframe (so);break ;
@@ -567,6 +577,14 @@ static int isotp_rcv_cf(struct sock *sk, struct canfd_frame *cf, int ae,hrtimer_cancel (&so->rxtimer); +/* isotp_rx_timer_handler() may have raced us for so->rx.state +* while hrtimer_cancel() above waited for it to finish, already +* reporting ETIMEDOUT and resetting the reception; don't process +* this CF into a reassembly that has already been given up on. +*/ +if (so->rx.state !=ISOTP_WAIT_DATA ) +return 1 ; +/* CFs are never longer than the FF */ if (cf->len > so->rx.ll_dl)return 1 ;
@@ -856,20 +874,36 @@ static void isotp_rcv_echo(struct sk_buff *skb, void *data)struct canfd_frame *cf = (struct canfd_frame *)skb->data;/* only handle my own local echo CF/SF skb's (no FF!) */ -if (skb->sk != sk || so->cfecho != *(u32 *)cf->data) +if (skb->sk != sk)return ; +/* unlike isotp_rcv_fc()/isotp_rcv_cf(), not already under so->rx_lock +* (no isotp_rcv() caller here), so take it ourselves +*/ +spin_lock (&so->rx_lock); + +/* so->cfecho may since belong to a new transfer; recheck under lock */ +if (so->cfecho != *(u32 *)cf->data) + goto out_unlock; +/* cancel local echo timeout */ -hrtimer_cancel (&so->txtimer); +hrtimer_cancel (&so->echotimer);/* local echo skb with consecutive frame has been consumed */ so->cfecho =0 ; +/* claiming a transfer also takes so->rx_lock, so a plain recheck +* is enough: so->tx.state can't have flipped to ISOTP_SENDING for +* a new claim while we're still in here +*/ +if (so->tx.state !=ISOTP_SENDING ) + goto out_unlock; +if (so->tx.idx >= so->tx.len) {/* we are done */ so->tx.state =ISOTP_IDLE ;wake_up_interruptible (&so->wait); -return ; + goto out_unlock; }if (so->txfc.bs && so->tx.bs >= so->txfc.bs) {
@@ -877,53 +911,83 @@ static void isotp_rcv_echo(struct sk_buff *skb, void *data) so->tx.state =ISOTP_WAIT_FC ;hrtimer_start (&so->txtimer,ktime_set (ISOTP_FC_TIMEOUT ,0 ),HRTIMER_MODE_REL_SOFT ); -return ; + goto out_unlock; }/* no gap between data frames needed => use burst mode */ if (!so->tx_gap) {/* enable echo timeout handling */ -hrtimer_start (&so->txtimer,ktime_set (ISOTP_ECHO_TIMEOUT ,0 ), +hrtimer_start (&so->echotimer,ktime_set (ISOTP_ECHO_TIMEOUT ,0 ),HRTIMER_MODE_REL_SOFT );isotp_send_cframe (so); -return ; + goto out_unlock; }/* start timer to send next consecutive frame with correct delay */ hrtimer_start (&so->txfrtimer, so->tx_gap,HRTIMER_MODE_REL_SOFT ); + +out_unlock: +spin_unlock (&so->rx_lock); } -static enum hrtimer_restart isotp_tx_timer_handler (struct hrtimer *hrtimer) +/* shared by so->txtimer's and so->echotimer's callbacks. Both timers get +* cancelled under so->rx_lock elsewhere, so this must stay lock-free to +* avoid deadlocking with that; uses so->tx_gen instead to avoid tainting +* a new transfer with an error from the one that just timed out. +*/ +static enum hrtimer_restart isotp_tx_timeout (struct isotp_sock *so) { - struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, - txtimer);struct sock *sk = &so->sk; +u32 gen =READ_ONCE (so->tx_gen); +u32 old_state =READ_ONCE (so->tx.state);/* don't handle timeouts in IDLE or SHUTDOWN state */ -if (so->tx.state ==ISOTP_IDLE || so->tx.state ==ISOTP_SHUTDOWN ) +if (old_state ==ISOTP_IDLE || old_state ==ISOTP_SHUTDOWN ) +return HRTIMER_NORESTART ; + +/* only claim the timeout if the state is still unchanged */ +if (cmpxchg (&so->tx.state, old_state,ISOTP_IDLE ) != old_state)return HRTIMER_NORESTART ;/* we did not get any flow control or echo frame in time */ -/* report 'communication error on send' */ - sk->sk_err =ECOMM ; -if (!sock_flag (sk,SOCK_DEAD )) -sk_error_report (sk); +if (READ_ONCE (so->tx_gen) == gen) { +/* report 'communication error on send' */ + sk->sk_err =ECOMM ; +if (!sock_flag (sk,SOCK_DEAD )) +sk_error_report (sk); + } -/* reset tx state */ - so->tx.state =ISOTP_IDLE ;wake_up_interruptible (&so->wait);return HRTIMER_NORESTART ; } +/* so->txtimer: fires when a Flow Control frame does not arrive in time */ +static enum hrtimer_restart isotp_tx_timer_handler (struct hrtimer *hrtimer) +{ + struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, + txtimer); + +return isotp_tx_timeout (so); +} + +/* so->echotimer: fires when a sent CF/SF's local echo does not arrive */ +static enum hrtimer_restart isotp_echo_timer_handler (struct hrtimer *hrtimer) +{ + struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, + echotimer); + +return isotp_tx_timeout (so); +} +static enum hrtimer_restart isotp_txfr_timer_handler (struct hrtimer *hrtimer) { struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, txfrtimer);/* start echo timeout handling and cover below protocol error */ -hrtimer_start (&so->txtimer,ktime_set (ISOTP_ECHO_TIMEOUT ,0 ), +hrtimer_start (&so->echotimer,ktime_set (ISOTP_ECHO_TIMEOUT ,0 ),HRTIMER_MODE_REL_SOFT );/* cfecho should be consumed by isotp_rcv_echo() here */
@@ -943,13 +1007,24 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)int ae = (so->opt.flags &CAN_ISOTP_EXTEND_ADDR ) ?1 :0 ;int wait_tx_done = (so->opt.flags &CAN_ISOTP_WAIT_TX_DONE ) ?1 :0 ;s64 hrtimer_sec =ISOTP_ECHO_TIMEOUT ; +struct hrtimer *tx_hrt = &so->echotimer; +u32 new_state =ISOTP_SENDING ;int off;int err;if (!so->bound || so->tx.state ==ISOTP_SHUTDOWN )return -EADDRNOTAVAIL ; -while (cmpxchg (&so->tx.state,ISOTP_IDLE ,ISOTP_SENDING ) !=ISOTP_IDLE ) { +/* claim the socket under so->rx_lock: this serializes the claim +* with the RX path and with sendmsg()'s own error paths below, so +* none of them can ever see a transfer mid-claim +*/ +for (;;) { +spin_lock_bh (&so->rx_lock); +if (READ_ONCE (so->tx.state) ==ISOTP_IDLE ) +break ; +spin_unlock_bh (&so->rx_lock); +/* we do not support multiple buffers - for now */ if (msg->msg_flags &MSG_DONTWAIT )return -EAGAIN ;
@@ -958,11 +1033,23 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)return -EADDRNOTAVAIL ;/* wait for complete transmission of current pdu */ - err =wait_event_interruptible (so->wait, so->tx.state ==ISOTP_IDLE ); + err =wait_event_interruptible (so->wait, + so->tx.state ==ISOTP_IDLE );if (err) - goto err_event_drop; +return err; } +/* new transfer: bump so->tx_gen and drain the old one's timers, +* still under the so->rx_lock we just claimed the socket with +*/ +WRITE_ONCE (so->tx.state,ISOTP_SENDING ); +WRITE_ONCE (so->tx_gen,READ_ONCE (so->tx_gen) +1 ); +hrtimer_cancel (&so->txtimer); +hrtimer_cancel (&so->echotimer); +hrtimer_cancel (&so->txfrtimer); + so->cfecho =0 ; +spin_unlock_bh (&so->rx_lock); +/* so->bound is only checked once above - a wakeup may have * unbound/rebound the socket meanwhile, so re-validate it */
@@ -1073,18 +1160,33 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) so->cfecho = *(u32 *)cf->data; }else {/* standard flow control check */ - so->tx.state =ISOTP_WAIT_FIRST_FC ; + new_state =ISOTP_WAIT_FIRST_FC ;/* start timeout for FC */ hrtimer_sec =ISOTP_FC_TIMEOUT ; + tx_hrt = &so->txtimer;/* no CF echo tag for isotp_rcv_echo() (FF-mode) */ so->cfecho =0 ; } } -hrtimer_start (&so->txtimer,ktime_set (hrtimer_sec,0 ), +spin_lock_bh (&so->rx_lock); +if (so->tx.state ==ISOTP_SHUTDOWN ) { +/* isotp_release() has since taken over and already drained +* our timers - don't send into a socket that's going away +*/ +spin_unlock_bh (&so->rx_lock); +kfree_skb (skb); +dev_put (dev); +wake_up_interruptible (&so->wait); +return -EADDRNOTAVAIL ; + } +/* WAIT_FIRST_FC for standard FF, else stays ISOTP_SENDING */ + so->tx.state = new_state; +hrtimer_start (tx_hrt,ktime_set (hrtimer_sec,0 ),HRTIMER_MODE_REL_SOFT ); +spin_unlock_bh (&so->rx_lock);/* send the first or only CAN frame */ cf->flags = so->ll.tx_flags;
@@ -1097,13 +1199,10 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)pr_notice_once ("can-isotp: %s: can_send_ret %pe\n" , __func__,ERR_PTR (err)); +spin_lock_bh (&so->rx_lock);/* no transmission -> no timeout monitoring */ -hrtimer_cancel (&so->txtimer); - -/* reset consecutive frame echo tag */ - so->cfecho =0 ; - - goto err_out_drop; +hrtimer_cancel (tx_hrt); + goto err_out_drop_locked; }if (wait_tx_done) {
@@ -1119,14 +1218,21 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)return size; +err_out_drop: +/* claimed but nothing sent yet - no timer to cancel */ +spin_lock_bh (&so->rx_lock); + goto err_out_drop_locked; err_event_drop: -/* got signal: force tx state machine to be idle */ - so->tx.state =ISOTP_IDLE ; +/* interrupted waiting on our own transfer - drain its timers */ +spin_lock_bh (&so->rx_lock);hrtimer_cancel (&so->txfrtimer);hrtimer_cancel (&so->txtimer); -err_out_drop: -/* drop this PDU and unlock a potential wait queue */ +hrtimer_cancel (&so->echotimer); +err_out_drop_locked: +/* release the claim; so->rx_lock still held from above */ + so->cfecho =0 ; so->tx.state =ISOTP_IDLE ; +spin_unlock_bh (&so->rx_lock);wake_up_interruptible (&so->wait);return err;
@@ -1188,13 +1294,20 @@ static int isotp_release(struct socket *sock) so =isotp_sk (sk); net =sock_net (sk); -/* wait for complete transmission of current pdu */ -while (wait_event_interruptible (so->wait, so->tx.state ==ISOTP_IDLE ) ==0 && -cmpxchg (&so->tx.state,ISOTP_IDLE ,ISOTP_SHUTDOWN ) !=ISOTP_IDLE ) +/* best-effort: wait for a running pdu to finish, but don't block on +* it forever - give up after the first signal +*/ +while (so->tx.state !=ISOTP_IDLE && +wait_event_interruptible (so->wait, so->tx.state ==ISOTP_IDLE ) ==0 ) ; -/* force state machines to be idle also when a signal occurred */ +/* claim the socket under so->rx_lock like sendmsg() does, so its +* claim can't race the forced ISOTP_SHUTDOWN below; force it +* unconditionally, even when a signal cut the wait above short +*/ +spin_lock_bh (&so->rx_lock); so->tx.state =ISOTP_SHUTDOWN ; +spin_unlock_bh (&so->rx_lock); so->rx.state =ISOTP_IDLE ;spin_lock (&isotp_notifier_lock);
@@ -1240,6 +1353,7 @@ static int isotp_release(struct socket *sock)hrtimer_cancel (&so->txfrtimer);hrtimer_cancel (&so->txtimer); +hrtimer_cancel (&so->echotimer);hrtimer_cancel (&so->rxtimer);sock_orphan (sk);
@@ -1682,6 +1796,8 @@ static int isotp_init(struct sock *sk) so->rxtimer.function = isotp_rx_timer_handler;hrtimer_init (&so->txtimer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL_SOFT ); so->txtimer.function = isotp_tx_timer_handler; +hrtimer_init (&so->echotimer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL_SOFT ); + so->echotimer.function = isotp_echo_timer_handler;hrtimer_init (&so->txfrtimer,CLOCK_MONOTONIC ,HRTIMER_MODE_REL_SOFT ); so->txfrtimer.function = isotp_txfr_timer_handler;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 23/484 dmaengine: sh: rz-dmac: Move interrupt request after everything is set up
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit 731712403ddb39d1a76a11abf339a0615bc85de7 upstream.
Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel->ch_base, which is initialized only after requesting the IRQ, this may lead to invalid memory access. Likewise, the IRQ thread may access uninitialized data (the ld_free, ld_queue, and ld_active lists), which may also lead to issues.
Request the interrupts only after everything is set up. To keep the error path simpler, use dmam_alloc_coherent() instead of dma_alloc_coherent().
[tm: Kept the channel->irq field in rz_dmac_chan_probe() instead of
upstream's local irq variable, as commit 04e227718ab8 ("dmaengine: sh: rz-dmac: Make channel irq local") is not present in this tree. Likewise kept platform_get_irq_byname() instead of platform_get_irq_byname_optional() for the error IRQ in rz_dmac_probe(), as commit 6b3a6b6dc074 ("dmaengine: sh: rz_dmac: make error interrupt optional") is not present in this tree either; its early return on failure becomes a goto err jump to match the new call order.]
--- drivers/dma/sh/rz-dmac.c | 96 ++++++++++++++++------------------------ 1 file changed, 38 insertions(+), 58 deletions(-)
drivers/dma/sh/rz-dmac.c +38 -58
@@ -777,27 +777,6 @@ static int rz_dmac_chan_probe(struct rz_dmac *dmac, channel->index = index; channel->mid_rid = -EINVAL ; -/* Request the channel interrupt. */ -sprintf (pdev_irqname,"ch%u" , index); - channel->irq =platform_get_irq_byname (pdev, pdev_irqname); -if (channel->irq <0 ) -return channel->irq; - - irqname =devm_kasprintf (dmac->dev,GFP_KERNEL ,"%s:%u" , -dev_name (dmac->dev), index); -if (!irqname) -return -ENOMEM ; - - ret =devm_request_threaded_irq (dmac->dev, channel->irq, - rz_dmac_irq_handler, - rz_dmac_irq_handler_thread,0 , - irqname, channel); -if (ret) { -dev_err (dmac->dev,"failed to request IRQ %u (%d)\n" , - channel->irq, ret); -return ret; - } -/* Set io base address for each channel */ if (index <8 ) { channel->ch_base = dmac->base + CHANNEL_0_7_OFFSET +
@@ -810,9 +789,9 @@ static int rz_dmac_chan_probe(struct rz_dmac *dmac, }/* Allocate descriptors */ - lmdesc =dma_alloc_coherent (&pdev->dev, -sizeof (struct rz_lmdesc ) *DMAC_NR_LMDESC , - &channel->lmdesc.base_dma,GFP_KERNEL ); + lmdesc =dmam_alloc_coherent (&pdev->dev, +sizeof (struct rz_lmdesc ) *DMAC_NR_LMDESC , + &channel->lmdesc.base_dma,GFP_KERNEL );if (!lmdesc) {dev_err (&pdev->dev,"Can't allocate memory (lmdesc)\n" );return -ENOMEM ;
@@ -828,7 +807,26 @@ static int rz_dmac_chan_probe(struct rz_dmac *dmac,INIT_LIST_HEAD (&channel->ld_free);INIT_LIST_HEAD (&channel->ld_active); -return 0 ; +/* Request the channel interrupt. */ +sprintf (pdev_irqname,"ch%u" , index); + channel->irq =platform_get_irq_byname (pdev, pdev_irqname); +if (channel->irq <0 ) +return channel->irq; + + irqname =devm_kasprintf (dmac->dev,GFP_KERNEL ,"%s:%u" , +dev_name (dmac->dev), index); +if (!irqname) +return -ENOMEM ; + + ret =devm_request_threaded_irq (dmac->dev, channel->irq, + rz_dmac_irq_handler, + rz_dmac_irq_handler_thread,0 , + irqname, channel); +if (ret) +dev_err (dmac->dev,"failed to request IRQ %u (%d)\n" , + channel->irq, ret); + +return ret; }static int rz_dmac_parse_of (struct device *dev,struct rz_dmac *dmac)
@@ -855,7 +853,6 @@ static int rz_dmac_probe(struct platform_device *pdev)const char *irqname ="error" ;struct dma_device *engine;struct rz_dmac *dmac; -int channel_num;unsigned int i;int ret;int irq;
@@ -885,19 +882,6 @@ static int rz_dmac_probe(struct platform_device *pdev)if (IS_ERR (dmac->ext_base))return PTR_ERR (dmac->ext_base); -/* Register interrupt handler for error */ - irq =platform_get_irq_byname (pdev, irqname); -if (irq <0 ) -return irq; - - ret =devm_request_irq (&pdev->dev, irq, rz_dmac_irq_handler,0 , - irqname,NULL ); -if (ret) { -dev_err (&pdev->dev,"failed to request IRQ %u (%d)\n" , - irq, ret); -return ret; - } -/* Initialize the channels. */ INIT_LIST_HEAD (&dmac->engine.channels);
@@ -923,6 +907,21 @@ static int rz_dmac_probe(struct platform_device *pdev) goto err; } +/* Register interrupt handler for error */ + irq =platform_get_irq_byname (pdev, irqname); +if (irq <0 ) { + ret = irq; + goto err; + } + + ret =devm_request_irq (&pdev->dev, irq, rz_dmac_irq_handler,0 , + irqname,NULL ); +if (ret) { +dev_err (&pdev->dev,"failed to request IRQ %u (%d)\n" , + irq, ret); + goto err; + } +/* Register the DMAC as a DMA provider for DT. */ ret =of_dma_controller_register (pdev->dev.of_node, rz_dmac_of_xlate,NULL );
@@ -961,16 +960,6 @@ static int rz_dmac_probe(struct platform_device *pdev) dma_register_err:of_dma_controller_free (pdev->dev.of_node); err: - channel_num = i ? i -1 :0 ; -for (i =0 ; i < channel_num; i++) { -struct rz_dmac_chan *channel = &dmac->channels[i]; - -dma_free_coherent (&pdev->dev, -sizeof (struct rz_lmdesc ) *DMAC_NR_LMDESC , - channel->lmdesc.base, - channel->lmdesc.base_dma); - } -reset_control_assert (dmac->rstc); err_pm_runtime_put:pm_runtime_put (&pdev->dev);
@@ -983,18 +972,9 @@ static int rz_dmac_probe(struct platform_device *pdev)static int rz_dmac_remove (struct platform_device *pdev) {struct rz_dmac *dmac =platform_get_drvdata (pdev); -unsigned int i;dma_async_device_unregister (&dmac->engine);of_dma_controller_free (pdev->dev.of_node); -for (i =0 ; i < dmac->n_channels; i++) { -struct rz_dmac_chan *channel = &dmac->channels[i]; - -dma_free_coherent (&pdev->dev, -sizeof (struct rz_lmdesc ) *DMAC_NR_LMDESC , - channel->lmdesc.base, - channel->lmdesc.base_dma); - }reset_control_assert (dmac->rstc);pm_runtime_put (&pdev->dev);pm_runtime_disable (&pdev->dev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 24/484 accel/ivpu: Reject firmware log with size smaller than header
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jhonraushan <[email protected]>
commit ddb44baed257560f192b145ed36cf8c0a412de47 upstream.
fw_log_from_bo() validates the tracing buffer header_size and that the log fits within the BO, but never checks that log->size is at least log->header_size. fw_log_print_buffer() then computes:
u32 data_size = log->size - log->header_size;
which underflows to a near-U32_MAX value when firmware reports a log whose size is smaller than its header. That huge data_size defeats the log_start/log_end bounds clamps added by commit dd1311bcf0e6 ("accel/ivpu:
Add bounds checks for firmware log indices"), so fw_log_print_lines() reads far past the small real data region of the BO. A size of 0 also makes fw_log_from_bo() advance the offset by 0, causing the callers to loop forever on the same header.
Reject logs whose size is smaller than the header (which also rejects size == 0).
--- drivers/accel/ivpu/ivpu_fw_log.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/accel/ivpu/ivpu_fw_log.c +4 -0
@@ -43,6 +43,10 @@ static int fw_log_ptr(struct ivpu_device *vdev, struct ivpu_bo *bo, u32 *offset,ivpu_dbg (vdev,FW_BOOT ,"Invalid header size 0x%x\n" , log->header_size);return -EINVAL ; } +if (log->size < log->header_size) { +ivpu_dbg (vdev,FW_BOOT ,"Invalid log size 0x%x\n" , log->size); +return -EINVAL ; + }if ((char *)log + log->size > (char *)bo->kvaddr + bo->base.size) {ivpu_dbg (vdev,FW_BOOT ,"Invalid log size 0x%x\n" , log->size);return -EINVAL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 25/484 gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <[email protected]>
[ Upstream commit 266cddf7bd0f6c79b6c0633aef742a22bf70265b ]
__host1x_bo_unpin() drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cache local variable instead.
--- drivers/gpu/host1x/bus.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/host1x/bus.c +2 -2
@@ -1006,10 +1006,10 @@ void host1x_bo_clear_cached_mappings(struct host1x_bo *bo)if (WARN_ON (!cache))continue ; -mutex_lock (&mapping->cache->lock); +mutex_lock (&cache->lock);WARN_ON (kref_read (&mapping->ref) !=1 );__host1x_bo_unpin (&mapping->ref); -mutex_unlock (&mapping->cache->lock); +mutex_unlock (&cache->lock); } }EXPORT_SYMBOL (host1x_bo_clear_cached_mappings);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 26/484 xprtrdma: Clear receive-side ownership pointers on release
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 2ae8e7afbc63bf84243367f89eb43571f0345a74 ]
Three small ownership-state cleanups land the transport in a state that lets future reviewers reason about each pointer locally rather than tracing the whole reply path:
rpcrdma_rep_put() clears rep->rr_rqst before the rep enters rb_free_reps so that no rep on the free list still carries a stale rqst pointer. rpcrdma_reply_handler() and rpcrdma_unpin_rqst() are the only sites that set rr_rqst; rpcrdma_reply_handler() hands the rep through rpcrdma_rep_put(), and rpcrdma_unpin_rqst() NULLs rr_rqst directly because its error path abandons the rep for teardown cleanup rather than returning it to rb_free_reps.
rpcrdma_reply_put() NULLs req->rl_reply before calling rpcrdma_rep_put(). The previous order placed the rep on rb_free_reps while req->rl_reply still pointed at it; the window was harmless because xprt_rdma_free_slot() holds the req exclusively across the pair, but closing it makes the invariant 'rep on rb_free_reps implies no req references it' strictly checkable.
rpcrdma_sendctx_unmap() and rpcrdma_sendctx_cancel() clear req->rl_sendctx after dropping the sendctx pointer in the sendctx ring. Without this, req->rl_sendctx survives across Send completion and points at a sendctx that may already have been reassigned by rpcrdma_sendctx_get_locked() to a different req. No caller dereferences the stale pointer today -- rpcrdma_prepare_send_sges() overwrites it before the next Send -- but a NULL is a more honest representation of 'the Send is no longer outstanding' and lets the assertion patch that follows trip on any future regression.
--- net/sunrpc/xprtrdma/rpc_rdma.c | 4 ++++ net/sunrpc/xprtrdma/verbs.c | 12 ++++++++++-- 2 files changed, 14 insertions(+), 2 deletions(-)
net/sunrpc/xprtrdma/rpc_rdma.c +4 -0
@@ -542,6 +542,7 @@ void rpcrdma_sendctx_unmap(struct rpcrdma_sendctx *sc)rpcrdma_sendctx_dma_unmap (sc); sc->sc_req =NULL ; + req->rl_sendctx =NULL ;rpcrdma_req_put (req); }
@@ -550,8 +551,11 @@ void rpcrdma_sendctx_unmap(struct rpcrdma_sendctx *sc)*/ static void rpcrdma_sendctx_cancel (struct rpcrdma_sendctx *sc) { +struct rpcrdma_req *req = sc->sc_req; +rpcrdma_sendctx_dma_unmap (sc); sc->sc_req =NULL ; + req->rl_sendctx =NULL ; }/* Prepare an SGE for the RPC-over-RDMA transport header.
net/sunrpc/xprtrdma/verbs.c +10 -2
@@ -1067,9 +1067,15 @@ static struct rpcrdma_rep *rpcrdma_rep_get_locked(struct rpcrdma_buffer *buf)* @buf: buffer pool * @rep: rep to release * +* The rep's transient association with an rpc_rqst, established +* by rpcrdma_reply_handler() and torn down here, must not survive +* onto rb_free_reps: rpcrdma_post_recvs() pulls reps from the free +* list to re-post them, and a non-NULL rr_rqst on a free-listed rep +* would imply the rep is still referenced by a req. */ void rpcrdma_rep_put (struct rpcrdma_buffer *buf,struct rpcrdma_rep *rep) { + rep->rr_rqst =NULL ;llist_add (&rep->rr_node, &buf->rb_free_reps); }
@@ -1252,9 +1258,11 @@ rpcrdma_mr_get(struct rpcrdma_xprt *r_xprt)*/ void rpcrdma_reply_put (struct rpcrdma_buffer *buffers,struct rpcrdma_req *req) { -if (req->rl_reply) { -rpcrdma_rep_put (buffers, req->rl_reply); +struct rpcrdma_rep *rep = req->rl_reply; + +if (rep) { req->rl_reply =NULL ; +rpcrdma_rep_put (buffers, rep); }/* I2: rl_reply NULL after the put closes the * 'rep on rb_free_reps still referenced by req' window.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 27/484 Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <[email protected]>
[ Upstream commit 875115b82c295277b81b6dfee7debc725f44e854 ]
The ims_pcu_process_data() processes incoming URB data byte by byte. However, it fails to check if the read_pos index exceeds IMS_PCU_BUF_SIZE.
If a malicious USB device sends a packet larger than IMS_PCU_BUF_SIZE, read_pos will increment indefinitely. Moreover, since read_pos is located immediately after read_buf, the attacker can overwrite read_pos itself to arbitrarily control the index.
This manipulated read_pos is subsequently used in ims_pcu_handle_response() to copy data into cmd_buf, leading to a heap buffer overflow.
Specifically, an attacker can overwrite the cmd_done.wait.head located at offset 136 relative to cmd_buf in the ims_pcu_handle_response(). Consequently, when the driver calls complete(&pcu->cmd_done), it triggers a control flow hijack by using the manipulated pointer.
Fix this by adding a bounds check for read_pos before writing to read_buf. If the packet is too long, discard it, log a warning, and reset the parser state.
--- drivers/input/misc/ims-pcu.c | 32 ++++++++++++++++++++++++++------ 1 file changed, 26 insertions(+), 6 deletions(-)
drivers/input/misc/ims-pcu.c +26 -6
@@ -448,6 +448,14 @@ static void ims_pcu_handle_response(struct ims_pcu *pcu) } } +static void ims_pcu_reset_packet (struct ims_pcu *pcu) +{ + pcu->have_stx = true; + pcu->have_dle = false; + pcu->read_pos =0 ; + pcu->check_sum =0 ; +} +static void ims_pcu_process_data (struct ims_pcu *pcu,struct urb *urb) {int i;
@@ -460,6 +468,14 @@ static void ims_pcu_process_data(struct ims_pcu *pcu, struct urb *urb)continue ;if (pcu->have_dle) { +if (pcu->read_pos >=IMS_PCU_BUF_SIZE ) { +dev_warn (pcu->dev, +"Packet too long (%d bytes), discarding\n" , + pcu->read_pos); +ims_pcu_reset_packet (pcu); +continue ; + } + pcu->have_dle = false; pcu->read_buf[pcu->read_pos++] = data; pcu->check_sum += data;
@@ -472,10 +488,8 @@ static void ims_pcu_process_data(struct ims_pcu *pcu, struct urb *urb)dev_warn (pcu->dev,"Unexpected STX at byte %d, discarding old data\n" , pcu->read_pos); +ims_pcu_reset_packet (pcu); pcu->have_stx = true; - pcu->have_dle = false; - pcu->read_pos =0 ; - pcu->check_sum =0 ;break ;case IMS_PCU_PROTOCOL_DLE :
@@ -495,12 +509,18 @@ static void ims_pcu_process_data(struct ims_pcu *pcu, struct urb *urb)ims_pcu_handle_response (pcu); } - pcu->have_stx = false; - pcu->have_dle = false; - pcu->read_pos =0 ; +ims_pcu_reset_packet (pcu);break ;default : +if (pcu->read_pos >=IMS_PCU_BUF_SIZE ) { +dev_warn (pcu->dev, +"Packet too long (%d bytes), discarding\n" , + pcu->read_pos); +ims_pcu_reset_packet (pcu); +continue ; + } + pcu->read_buf[pcu->read_pos++] = data; pcu->check_sum += data;break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 28/484 Input: ims-pcu - fix logic error in packet reset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit 2c9b85a14abb4811e8d4773ccd13559e59792efb ]
ims_pcu_reset_packet() incorrectly sets have_stx to true, which implies that the start-of-packet delimiter has already been received. This causes the protocol parser to skip waiting for the next STX byte and potentially process garbage data.
Correctly set have_stx to false when resetting the packet state.
--- drivers/input/misc/ims-pcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/misc/ims-pcu.c +1 -1
@@ -450,7 +450,7 @@ static void ims_pcu_handle_response(struct ims_pcu *pcu)static void ims_pcu_reset_packet (struct ims_pcu *pcu) { - pcu->have_stx = true; + pcu->have_stx = false; pcu->have_dle = false; pcu->read_pos =0 ; pcu->check_sum =0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 29/484 arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Gupta <[email protected]>
[ Upstream commit 0dfa1e960f86e032007882b032c5cc7d14ebe73e ]
The Tegra234 SoC uses Cortex-A78AE cores, not Cortex-A78. Update the compatible string for all CPU nodes to match the actual hardware.
Tegra234 hardware reports:
# head /proc/cpuinfo | egrep 'implementer|part' CPU implementer : 0x41 CPU part : 0xd42
Which maps to (from arch/arm64/include/asm/cputype.h):
#define ARM_CPU_IMP_ARM 0x41
#define ARM_CPU_PART_CORTEX_A78AE 0xD42
--- arch/arm64/boot/dts/nvidia/tegra234.dtsi | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
arch/arm64/boot/dts/nvidia/tegra234.dtsi +12 -12
@@ -3109,7 +3109,7 @@ cpus { #size-cells = <0>; cpu0_0: cpu@0 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x00000>;
@@ -3128,7 +3128,7 @@ cpu0_0: cpu@0 { }; cpu0_1: cpu@100 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x00100>;
@@ -3147,7 +3147,7 @@ cpu0_1: cpu@100 { }; cpu0_2: cpu@200 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x00200>;
@@ -3166,7 +3166,7 @@ cpu0_2: cpu@200 { }; cpu0_3: cpu@300 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x00300>;
@@ -3185,7 +3185,7 @@ cpu0_3: cpu@300 { }; cpu1_0: cpu@10000 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x10000>;
@@ -3204,7 +3204,7 @@ cpu1_0: cpu@10000 { }; cpu1_1: cpu@10100 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x10100>;
@@ -3223,7 +3223,7 @@ cpu1_1: cpu@10100 { }; cpu1_2: cpu@10200 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x10200>;
@@ -3242,7 +3242,7 @@ cpu1_2: cpu@10200 { }; cpu1_3: cpu@10300 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x10300>;
@@ -3261,7 +3261,7 @@ cpu1_3: cpu@10300 { }; cpu2_0: cpu@20000 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x20000>;
@@ -3280,7 +3280,7 @@ cpu2_0: cpu@20000 { }; cpu2_1: cpu@20100 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x20100>;
@@ -3299,7 +3299,7 @@ cpu2_1: cpu@20100 { }; cpu2_2: cpu@20200 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x20200>;
@@ -3318,7 +3318,7 @@ cpu2_2: cpu@20200 { }; cpu2_3: cpu@20300 { - compatible = "arm,cortex-a78"; + compatible = "arm,cortex-a78ae"; device_type = "cpu"; reg = <0x20300>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 30/484 IB/mad: Drop unmatched RMPP responses before reassembly
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
[ Upstream commit d2e52d610b9b09694261632340b801a421e0b0c5 ]
Kernel-handled RMPP receive processing starts reassembly for active DATA responses before the response is matched to an outstanding send. The normal match happens later, after ib_process_rmpp_recv_wc() has either assembled a complete message or consumed the segment.
That ordering lets an unsolicited response that routes to a kernel RMPP agent by the high TID bits allocate or extend RMPP receive state before the full TID and source address are checked against a real request. A reordered burst can therefore reach the receive-side insertion path even though the response would not match any send.
For kernel-handled RMPP DATA responses, require the existing ib_find_send_mad() match before entering RMPP reassembly. The matcher already checks the full TID, management class and source address/GID against the agent wait, backlog and in-flight send lists. If there is no match, drop the response without creating RMPP state.
This leaves the RMPP window behavior unchanged and only rejects responses that have no corresponding request.
--- drivers/infiniband/core/mad.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
drivers/infiniband/core/mad.c +30 -0
@@ -1778,6 +1778,24 @@ void ib_mark_mad_done(struct ib_mad_send_wr_private *mad_send_wr) &mad_send_wr->mad_agent_priv->done_list); } +static bool is_kernel_rmpp_data_response (struct ib_mad_agent_private *agent, +struct ib_mad_recv_wc *mad_recv_wc) +{ +const struct ib_mad_hdr *mad_hdr = &mad_recv_wc->recv_buf.mad->mad_hdr; +struct ib_rmpp_mad *rmpp_mad; + +if (!ib_mad_kernel_rmpp_agent (&agent->agent) || + !ib_response_mad (mad_hdr) || + !ib_is_mad_class_rmpp (mad_hdr->mgmt_class)) +return false; + + rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad; + +return (ib_get_rmpp_flags (&rmpp_mad->rmpp_hdr) & +IB_MGMT_RMPP_FLAG_ACTIVE ) && + rmpp_mad->rmpp_hdr.rmpp_type ==IB_MGMT_RMPP_TYPE_DATA ; +} +static void ib_mad_complete_recv (struct ib_mad_agent_private *mad_agent_priv,struct ib_mad_recv_wc *mad_recv_wc) {
@@ -1796,6 +1814,18 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv, }list_add (&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list); +if (is_kernel_rmpp_data_response (mad_agent_priv, mad_recv_wc)) { +spin_lock_irqsave (&mad_agent_priv->lock, flags); + mad_send_wr =ib_find_send_mad (mad_agent_priv, mad_recv_wc); +spin_unlock_irqrestore (&mad_agent_priv->lock, flags); + +if (!mad_send_wr) { +ib_free_recv_mad (mad_recv_wc); +deref_mad_agent (mad_agent_priv); +return ; + } + } +if (ib_mad_kernel_rmpp_agent (&mad_agent_priv->agent)) { mad_recv_wc =ib_process_rmpp_recv_wc (mad_agent_priv, mad_recv_wc);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 31/484 mtd: mtdswap: remove debugfs stats file on teardown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 66fb31358108d10245b9e4ef0eef3e7d9747055e ]
mtdswap_add_debugfs() creates an mtdswap_stats debugfs file under the per-MTD debugfs directory, but mtdswap_remove_dev() never removes it before freeing the mtdswap_dev.
Store the returned dentry and remove it during device teardown before the driver-private state is freed.
--- drivers/mtd/mtdswap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/mtd/mtdswap.c +4 -1
@@ -125,6 +125,7 @@ struct mtdswap_dev {char *page_buf;char *oob_buf; +struct dentry *debugfs_stats; };struct mtdswap_oobdata {
@@ -1262,7 +1263,8 @@ static int mtdswap_add_debugfs(struct mtdswap_dev *d)if (IS_ERR_OR_NULL (root))return -1 ; -debugfs_create_file ("mtdswap_stats" ,S_IRUSR , root, d, &mtdswap_fops); + d->debugfs_stats =debugfs_create_file ("mtdswap_stats" ,0400 , root, + d, &mtdswap_fops);return 0 ; }
@@ -1463,6 +1465,7 @@ static void mtdswap_remove_dev(struct mtd_blktrans_dev *dev) {struct mtdswap_dev *d =MTDSWAP_MBD_TO_MTDSWAP (dev); +debugfs_remove (d->debugfs_stats);del_mtd_blktrans_dev (dev);mtdswap_cleanup (d);kfree (d);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 32/484 mtd: nand: mtk-ecc: stop on ECC idle timeouts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 16f7ec8d5dc100eafd2c8e06cd30340a30b104a1 ]
mtk_ecc_wait_idle() logs when the encoder or decoder does not become idle, but returns void. Callers can therefore configure a non-idle ECC engine or read parity bytes after an unconfirmed encoder idle state.
Return the idle poll result and propagate it from the enable and encode paths that require the engine to be idle before continuing.
--- drivers/mtd/nand/ecc-mtk.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/mtd/nand/ecc-mtk.c +12 -4
@@ -123,8 +123,8 @@ static int mt7622_ecc_regs[] = { [ECC_DECIRQ_STA] = 0x144, }; -static inline void mtk_ecc_wait_idle (struct mtk_ecc *ecc, -enum mtk_ecc_operation op) +static inline int mtk_ecc_wait_idle (struct mtk_ecc *ecc, +enum mtk_ecc_operation op) {struct device *dev = ecc->dev;u32 val;
@@ -136,6 +136,8 @@ static inline void mtk_ecc_wait_idle(struct mtk_ecc *ecc,if (ret)dev_warn (dev,"%s NOT idle\n" , op ==ECC_ENCODE ?"encoder" :"decoder" ); + +return ret; }static irqreturn_t mtk_ecc_irq (int irq,void *id)
@@ -312,7 +314,11 @@ int mtk_ecc_enable(struct mtk_ecc *ecc, struct mtk_ecc_config *config)return ret; } -mtk_ecc_wait_idle (ecc, op); + ret =mtk_ecc_wait_idle (ecc, op); +if (ret) { +mutex_unlock (&ecc->lock); +return ret; + } ret =mtk_ecc_config (ecc, config);if (ret) {
@@ -412,7 +418,9 @@ int mtk_ecc_encode(struct mtk_ecc *ecc, struct mtk_ecc_config *config,if (ret) goto timeout; -mtk_ecc_wait_idle (ecc,ECC_ENCODE ); + ret =mtk_ecc_wait_idle (ecc,ECC_ENCODE ); +if (ret) + goto timeout;/* Program ECC bytes to OOB: per sector oob = FDM + ECC + SPARE */ len = (config->strength * ecc->caps->parity_bits +7 ) >>3 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 33/484 btrfs: reject free space cache with more entries than pages
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit a2d8d5647ed854e38f941741aea45b9eb15a6350 ]
When loading a v1 free space cache, __load_free_space_cache() takes num_entries and num_bitmaps straight from the on-disk btrfs_free_space_header. That header is stored in the tree_root under a key with type 0, which the tree-checker has no case for, so neither count is validated before the load trusts it.
The load loops num_entries times and maps the next page whenever the current one runs out, going through io_ctl_check_crc() -> io_ctl_map_page(), which does io_ctl->pages[io_ctl->index++]. But pages[] is allocated in io_ctl_init() from the cache inode's i_size, not from num_entries:
num_pages = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE); io_ctl->pages = kcalloc(num_pages, sizeof(struct page *), GFP_NOFS);
So if num_entries claims more records than the pages can hold, io_ctl->index runs off the end of pages[]. The write side never hits this because io_ctl_add_entry() and io_ctl_add_bitmap() both stop once io_ctl->index >= io_ctl->num_pages; the read side just never had the same check.
To trigger it, take a clean cache (num_entries = <N> here), set num_entries in the header to 0x10000, and fix up the leaf checksum so it still passes the tree-checker. The cache inode has i_size = 65536, so num_pages is 16 and pages[] is a 16-pointer (kmalloc-128) array. The load now tries to read 65536 entries, io_ctl->index walks up to 16, and pages[16] is read past the array:
BUG: KASAN: slab-out-of-bounds in io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565) Read of size 8 at addr ffff88800c833a80 by task kworker/u8:3/58 io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565) __load_free_space_cache (fs/btrfs/free-space-cache.c:655 fs/btrfs/free-space-cache.c:820) load_free_space_cache (fs/btrfs/free-space-cache.c:1017) caching_thread (fs/btrfs/block-group.c:880) btrfs_work_helper (fs/btrfs/async-thread.c:312) process_one_work worker_thread kthread ret_from_fork
free-space-cache.c:420 is io_ctl_map_page(), inlined into io_ctl_check_crc() at line 565, which is why that is the frame KASAN names. The out-of-bounds slot is then treated as a struct page and handed to crc32c(), so the bad read turns into a GP fault.
Add the missing check to io_ctl_check_crc(), which is where both the entry loop and the bitmap loop end up. When num_entries is too large the load now fails like any corrupt cache: __load_free_space_cache() drops it and rebuilds the free space from the extent tree, so a valid cache is never rejected.
--- fs/btrfs/free-space-cache.c | 3 +++ 1 file changed, 3 insertions(+)
fs/btrfs/free-space-cache.c +3 -0
@@ -559,6 +559,9 @@ static int io_ctl_check_crc(struct btrfs_io_ctl *io_ctl, int index)u32 crc = ~(u32 )0 ;unsigned offset =0 ; +if (index >= io_ctl->num_pages) +return -EIO ; +if (index ==0 ) offset =sizeof (u32) * io_ctl->num_pages;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 34/484 btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit ce6050bafb4e33377dc17fcc357736bfc351180c ]
If we have an unexpected reloc_root for our root, we jump to the out label but never drop the reference we obtained for root, resulting in a leak. Add a missing btrfs_put_root() call.
--- fs/btrfs/relocation.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/relocation.c +1 -0
@@ -1991,6 +1991,7 @@ void merge_reloc_roots(struct reloc_control *rc)* corruption, e.g. bad reloc tree key offset. */ ret = -EINVAL ; +btrfs_put_root (root); goto out; } ret =merge_reloc_root (rc, root);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 35/484 firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Unnathi Chalicheemala <[email protected]>
[ Upstream commit 8ae5f8e4836667fcaffdf2e3c6068b0a8b364dd8 ]
ffa_partition_info_get() passes uuid_str directly to uuid_parse() without a NULL check. When a caller passes NULL, uuid_parse() -> __uuid_parse() -> uuid_is_valid() dereferences the pointer, causing a kernel panic:
| Unable to handle kernel NULL pointer dereference at virtual address | 0000000000000040 | pc : uuid_parse+0x40/0xac | lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa]
Add a NULL guard before uuid_parse() so a NULL argument returns -ENODEV instead of crashing. Callers are expected to always supply a valid partition UUID, so NULL is not a supported input.
--- drivers/firmware/arm_ffa/driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/arm_ffa/driver.c +1 -1
@@ -582,7 +582,7 @@ static int ffa_partition_info_get(const char *uuid_str,uuid_t uuid;struct ffa_partition_info *pbuf; -if (uuid_parse (uuid_str, &uuid)) { +if (!uuid_str ||uuid_parse (uuid_str, &uuid)) {pr_err ("invalid uuid (%s)\n" , uuid_str);return -ENODEV ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 36/484 RDMA/cma: Fix hardware address comparison length in netevent callback
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Or Gerlitz <[email protected]>
[ Upstream commit 18313833e2c6de222a4f6c072da759d0d5888528 ]
The cited commit hardcoded the hardware address comparison len to ETH_ALEN.
This breaks IPoIB, which uses 20-byte addresses. By truncating the memcmp, the CMA may incorrectly assume the target address is unchanged and fails to abort the stalled connection.
Fix this by replacing ETH_ALEN with the dynamic neigh->dev->addr_len to correctly evaluate the full address regardless of the link layer.
--- drivers/infiniband/core/cma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/core/cma.c +1 -1
@@ -5215,7 +5215,7 @@ static int cma_netevent_callback(struct notifier_block *self,list_for_each_entry (current_id, &ips_node->id_list, id_list_entry) {if (!memcmp (current_id->id.route.addr.dev_addr.dst_dev_addr, - neigh->ha,ETH_ALEN )) + neigh->ha, neigh->dev->addr_len))continue ;cma_id_get (current_id);if (!queue_work (cma_wq, ¤t_id->id.net_work))
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 37/484 RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yishai Hadas <[email protected]>
[ Upstream commit 682358fd35dece838e6ae2d9d6a69fc0b9a9d411 ]
Add support for creating pinned DMABUF umem with a specified DMA device instead of the DMA device of the given IB device.
This API will be utilized in the upcoming patches of the series when multiple path DMAs are implemented.
Stable-dep-of: a846aecb931b ("RDMA/irdma: Prevent rereg_mr for non-mem regions")
--- drivers/infiniband/core/umem_dmabuf.c | 45 ++++++++++++++++++++------- include/rdma/ib_umem.h | 15 +++++++++ 2 files changed, 49 insertions(+), 11 deletions(-)
drivers/infiniband/core/umem_dmabuf.c +34 -11
@@ -110,10 +110,12 @@ void ib_umem_dmabuf_unmap_pages(struct ib_umem_dmabuf *umem_dmabuf) }EXPORT_SYMBOL (ib_umem_dmabuf_unmap_pages); -struct ib_umem_dmabuf *ib_umem_dmabuf_get (struct ib_device *device, -unsigned long offset,size_t size, -int fd,int access, -const struct dma_buf_attach_ops *ops) +static struct ib_umem_dmabuf * +ib_umem_dmabuf_get_with_dma_device (struct ib_device *device, +struct device *dma_device, +unsigned long offset,size_t size, +int fd,int access, +const struct dma_buf_attach_ops *ops) {struct dma_buf *dmabuf;struct ib_umem_dmabuf *umem_dmabuf;
@@ -152,7 +154,7 @@ struct ib_umem_dmabuf *ib_umem_dmabuf_get(struct ib_device *device, umem_dmabuf->attach =dma_buf_dynamic_attach ( dmabuf, - device->dma_device, + dma_device, ops, umem_dmabuf);if (IS_ERR (umem_dmabuf->attach)) {
@@ -168,6 +170,15 @@ struct ib_umem_dmabuf *ib_umem_dmabuf_get(struct ib_device *device,dma_buf_put (dmabuf);return ret; } + +struct ib_umem_dmabuf *ib_umem_dmabuf_get (struct ib_device *device, +unsigned long offset,size_t size, +int fd,int access, +const struct dma_buf_attach_ops *ops) +{ +return ib_umem_dmabuf_get_with_dma_device (device, device->dma_device, + offset, size, fd, access, ops); +}EXPORT_SYMBOL (ib_umem_dmabuf_get); static void
@@ -184,16 +195,18 @@ static struct dma_buf_attach_ops ib_umem_dmabuf_attach_pinned_ops = { .move_notify = ib_umem_dmabuf_unsupported_move_notify, }; -struct ib_umem_dmabuf *ib_umem_dmabuf_get_pinned (struct ib_device *device, -unsigned long offset, -size_t size,int fd, -int access) +struct ib_umem_dmabuf * +ib_umem_dmabuf_get_pinned_with_dma_device (struct ib_device *device, +struct device *dma_device, +unsigned long offset,size_t size, +int fd,int access) {struct ib_umem_dmabuf *umem_dmabuf;int err; - umem_dmabuf =ib_umem_dmabuf_get (device, offset, size, fd, access, - &ib_umem_dmabuf_attach_pinned_ops); + umem_dmabuf =ib_umem_dmabuf_get_with_dma_device (device, dma_device, offset, + size, fd, access, + &ib_umem_dmabuf_attach_pinned_ops);if (IS_ERR (umem_dmabuf))return umem_dmabuf;
@@ -215,6 +228,16 @@ struct ib_umem_dmabuf *ib_umem_dmabuf_get_pinned(struct ib_device *device,ib_umem_release (&umem_dmabuf->umem);return ERR_PTR (err); } +EXPORT_SYMBOL (ib_umem_dmabuf_get_pinned_with_dma_device); + +struct ib_umem_dmabuf *ib_umem_dmabuf_get_pinned (struct ib_device *device, +unsigned long offset, +size_t size,int fd, +int access) +{ +return ib_umem_dmabuf_get_pinned_with_dma_device (device, device->dma_device, + offset, size, fd, access); +}EXPORT_SYMBOL (ib_umem_dmabuf_get_pinned);void ib_umem_dmabuf_release (struct ib_umem_dmabuf *umem_dmabuf)
include/rdma/ib_umem.h +15 -0
@@ -122,6 +122,11 @@ struct ib_umem_dmabuf *ib_umem_dmabuf_get_pinned(struct ib_device *device,unsigned long offset, size_t size, int fd, int access); +struct ib_umem_dmabuf * +ib_umem_dmabuf_get_pinned_with_dma_device (struct ib_device *device, +struct device *dma_device, +unsigned long offset,size_t size, +int fd,int access);int ib_umem_dmabuf_map_pages (struct ib_umem_dmabuf *umem_dmabuf);void ib_umem_dmabuf_unmap_pages (struct ib_umem_dmabuf *umem_dmabuf);void ib_umem_dmabuf_release (struct ib_umem_dmabuf *umem_dmabuf);
@@ -170,6 +175,16 @@ ib_umem_dmabuf_get_pinned(struct ib_device *device, unsigned long offset, {return ERR_PTR (-EOPNOTSUPP ); } + +static inline struct ib_umem_dmabuf * +ib_umem_dmabuf_get_pinned_with_dma_device (struct ib_device *device, +struct device *dma_device, +unsigned long offset,size_t size, +int fd,int access) +{ +return ERR_PTR (-EOPNOTSUPP ); +} +static inline int ib_umem_dmabuf_map_pages (struct ib_umem_dmabuf *umem_dmabuf) {return -EOPNOTSUPP ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 38/484 RDMA/umem: Introduce an option to revoke DMABUF umem
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yishai Hadas <[email protected]>
[ Upstream commit 253c61dc256b3e6be65657f78b4a8452163ce00f ]
Introduce an option to revoke DMABUF umem.
This option will retain the umem allocation while revoking its DMA mapping. Furthermore, any subsequent attempts to map the pages should fail once the umem has been revoked.
This functionality will be utilized in the upcoming patches in the series, where we aim to delay umem deallocation until the mkey deregistration. However, we must unmap its pages immediately.
Stable-dep-of: a846aecb931b ("RDMA/irdma: Prevent rereg_mr for non-mem regions")
--- drivers/infiniband/core/umem_dmabuf.c | 21 +++++++++++++++++++-- include/rdma/ib_umem.h | 3 +++ 2 files changed, 22 insertions(+), 2 deletions(-)
drivers/infiniband/core/umem_dmabuf.c +19 -2
@@ -23,6 +23,9 @@ int ib_umem_dmabuf_map_pages(struct ib_umem_dmabuf *umem_dmabuf)dma_resv_assert_held (umem_dmabuf->attach->dmabuf->resv); +if (umem_dmabuf->revoked) +return -EINVAL ; +if (umem_dmabuf->sgt) goto wait_fence;
@@ -240,15 +243,29 @@ struct ib_umem_dmabuf *ib_umem_dmabuf_get_pinned(struct ib_device *device, }EXPORT_SYMBOL (ib_umem_dmabuf_get_pinned); -void ib_umem_dmabuf_release (struct ib_umem_dmabuf *umem_dmabuf) +void ib_umem_dmabuf_revoke (struct ib_umem_dmabuf *umem_dmabuf) {struct dma_buf *dmabuf = umem_dmabuf->attach->dmabuf;dma_resv_lock (dmabuf->resv,NULL ); +if (umem_dmabuf->revoked) + goto end;ib_umem_dmabuf_unmap_pages (umem_dmabuf); -if (umem_dmabuf->pinned) +if (umem_dmabuf->pinned) {dma_buf_unpin (umem_dmabuf->attach); + umem_dmabuf->pinned =0 ; + } + umem_dmabuf->revoked =1 ; +end:dma_resv_unlock (dmabuf->resv); +} +EXPORT_SYMBOL (ib_umem_dmabuf_revoke); + +void ib_umem_dmabuf_release (struct ib_umem_dmabuf *umem_dmabuf) +{ +struct dma_buf *dmabuf = umem_dmabuf->attach->dmabuf; + +ib_umem_dmabuf_revoke (umem_dmabuf);dma_buf_detach (dmabuf, umem_dmabuf->attach);dma_buf_put (dmabuf);
include/rdma/ib_umem.h +3 -0
@@ -38,6 +38,7 @@ struct ib_umem_dmabuf {unsigned long last_sg_trim;void *private; u8 pinned : 1; + u8 revoked : 1; };static inline struct ib_umem_dmabuf *to_ib_umem_dmabuf (struct ib_umem *umem)
@@ -130,6 +131,7 @@ ib_umem_dmabuf_get_pinned_with_dma_device(struct ib_device *device,int ib_umem_dmabuf_map_pages (struct ib_umem_dmabuf *umem_dmabuf);void ib_umem_dmabuf_unmap_pages (struct ib_umem_dmabuf *umem_dmabuf);void ib_umem_dmabuf_release (struct ib_umem_dmabuf *umem_dmabuf); +void ib_umem_dmabuf_revoke (struct ib_umem_dmabuf *umem_dmabuf);int ib_umem_check_rereg (struct ib_umem *umem,int flags,int new_access_flags);
@@ -191,6 +193,7 @@ static inline int ib_umem_dmabuf_map_pages(struct ib_umem_dmabuf *umem_dmabuf) }static inline void ib_umem_dmabuf_unmap_pages (struct ib_umem_dmabuf *umem_dmabuf) { }static inline void ib_umem_dmabuf_release (struct ib_umem_dmabuf *umem_dmabuf) { } +static inline void ib_umem_dmabuf_revoke (struct ib_umem_dmabuf *umem_dmabuf) {}static inline int ib_umem_check_rereg (struct ib_umem *umem,int flags,int new_access_flags)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 39/484 RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <[email protected]>
[ Upstream commit 553dfa8cbd0c6d36adae042d9738ddf8f8765ac7 ]
Move the inner logic of ib_umem_dmabuf_get_pinned_with_dma_device() to a new static function that returns with the lock held upon success.
The intent is to allow reuse for the future get_pinned_revocable_and_lock function.
Stable-dep-of: a846aecb931b ("RDMA/irdma: Prevent rereg_mr for non-mem regions")
--- drivers/infiniband/core/umem_dmabuf.c | 35 ++++++++++++++++++++------- 1 file changed, 26 insertions(+), 9 deletions(-)
drivers/infiniband/core/umem_dmabuf.c +26 -9
@@ -198,18 +198,19 @@ static struct dma_buf_attach_ops ib_umem_dmabuf_attach_pinned_ops = { .move_notify = ib_umem_dmabuf_unsupported_move_notify, }; -struct ib_umem_dmabuf * -ib_umem_dmabuf_get_pinned_with_dma_device (struct ib_device *device, -struct device *dma_device, -unsigned long offset,size_t size, -int fd,int access) +static struct ib_umem_dmabuf * +ib_umem_dmabuf_get_pinned_and_lock (struct ib_device *device, +struct device *dma_device, +unsigned long offset, +size_t size,int fd,int access, +const struct dma_buf_attach_ops *ops) {struct ib_umem_dmabuf *umem_dmabuf;int err; - umem_dmabuf =ib_umem_dmabuf_get_with_dma_device (device, dma_device, offset, - size, fd, access, - &ib_umem_dmabuf_attach_pinned_ops); + umem_dmabuf = +ib_umem_dmabuf_get_with_dma_device (device, dma_device, offset, + size, fd, access, ops);if (IS_ERR (umem_dmabuf))return umem_dmabuf;
@@ -222,7 +223,6 @@ ib_umem_dmabuf_get_pinned_with_dma_device(struct ib_device *device, err =ib_umem_dmabuf_map_pages (umem_dmabuf);if (err) goto err_release; -dma_resv_unlock (umem_dmabuf->attach->dmabuf->resv);return umem_dmabuf;
@@ -231,6 +231,23 @@ ib_umem_dmabuf_get_pinned_with_dma_device(struct ib_device *device,ib_umem_release (&umem_dmabuf->umem);return ERR_PTR (err); } + +struct ib_umem_dmabuf * +ib_umem_dmabuf_get_pinned_with_dma_device (struct ib_device *device, +struct device *dma_device, +unsigned long offset,size_t size, +int fd,int access) +{ +struct ib_umem_dmabuf *umem_dmabuf = +ib_umem_dmabuf_get_pinned_and_lock (device, dma_device, offset, + size, fd, access, + &ib_umem_dmabuf_attach_pinned_ops); +if (IS_ERR (umem_dmabuf)) +return umem_dmabuf; + +dma_resv_unlock (umem_dmabuf->attach->dmabuf->resv); +return umem_dmabuf; +}EXPORT_SYMBOL (ib_umem_dmabuf_get_pinned_with_dma_device); struct ib_umem_dmabuf *ib_umem_dmabuf_get_pinned(struct ib_device *device,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 40/484 RDMA/umem: Move umem dmabuf revoke logic into helper function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <[email protected]>
[ Upstream commit 797291a66ce346c96114b72222fc290d402da005 ]
This same logic will eventually be reused from within the invalidate_mappings callback which already has the dma_resv_lock held, so break it out into a separate function so it can be reused.
Stable-dep-of: a846aecb931b ("RDMA/irdma: Prevent rereg_mr for non-mem regions")
--- drivers/infiniband/core/umem_dmabuf.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-)
drivers/infiniband/core/umem_dmabuf.c +17 -9
@@ -198,6 +198,22 @@ static struct dma_buf_attach_ops ib_umem_dmabuf_attach_pinned_ops = { .move_notify = ib_umem_dmabuf_unsupported_move_notify, }; +static void ib_umem_dmabuf_revoke_locked (struct dma_buf_attachment *attach) +{ +struct ib_umem_dmabuf *umem_dmabuf = attach->importer_priv; + +dma_resv_assert_held (attach->dmabuf->resv); + +if (umem_dmabuf->revoked) +return ; +ib_umem_dmabuf_unmap_pages (umem_dmabuf); +if (umem_dmabuf->pinned) { +dma_buf_unpin (umem_dmabuf->attach); + umem_dmabuf->pinned =0 ; + } + umem_dmabuf->revoked =1 ; +} +static struct ib_umem_dmabuf * ib_umem_dmabuf_get_pinned_and_lock(struct ib_device *device, struct device *dma_device,
@@ -265,15 +281,7 @@ void ib_umem_dmabuf_revoke(struct ib_umem_dmabuf *umem_dmabuf)struct dma_buf *dmabuf = umem_dmabuf->attach->dmabuf;dma_resv_lock (dmabuf->resv,NULL ); -if (umem_dmabuf->revoked) - goto end; -ib_umem_dmabuf_unmap_pages (umem_dmabuf); -if (umem_dmabuf->pinned) { -dma_buf_unpin (umem_dmabuf->attach); - umem_dmabuf->pinned =0 ; - } - umem_dmabuf->revoked =1 ; -end: +ib_umem_dmabuf_revoke_locked (umem_dmabuf->attach);dma_resv_unlock (dmabuf->resv); }EXPORT_SYMBOL (ib_umem_dmabuf_revoke);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 41/484 RDMA/umem: Add pinned revocable dmabuf import interface
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <[email protected]>
[ Upstream commit ff85a2ebacbdaec9f28c4660c991295ace93cd1c ]
Added an interface for importing a pinned but revocable dmabuf. This interface can be used by drivers that are capable of revocation so that they can import dmabufs from exporters that may require it, such as VFIO.
This interface implements a two step process, where drivers will first call ib_umem_dmabuf_get_pinned_revocable_and_lock() which will pin and map the dmabuf (and provide a functional move_notify/invalidate_mappings callback), but will return with the lock still held so that the driver can then populate the callback via ib_umem_dmabuf_set_revoke_locked() without races from concurrent revocations. This scheme also allows for easier integration with drivers that may not have actually allocated their internal MR objects at the time of the get_pinned_revocable* call.
Stable-dep-of: a846aecb931b ("RDMA/irdma: Prevent rereg_mr for non-mem regions")
--- drivers/infiniband/core/umem_dmabuf.c | 61 +++++++++++++++++++++++++++ include/rdma/ib_umem.h | 19 +++++++++ 2 files changed, 80 insertions(+)
drivers/infiniband/core/umem_dmabuf.c +61 -0
@@ -206,6 +206,10 @@ static void ib_umem_dmabuf_revoke_locked(struct dma_buf_attachment *attach)if (umem_dmabuf->revoked)return ; + +if (umem_dmabuf->pinned_revoke) + umem_dmabuf->pinned_revoke (umem_dmabuf->private); +ib_umem_dmabuf_unmap_pages (umem_dmabuf);if (umem_dmabuf->pinned) {dma_buf_unpin (umem_dmabuf->attach);
@@ -214,6 +218,11 @@ static void ib_umem_dmabuf_revoke_locked(struct dma_buf_attachment *attach) umem_dmabuf->revoked =1 ; } +static struct dma_buf_attach_ops ib_umem_dmabuf_attach_pinned_revocable_ops = { + .allow_peer2peer = true, + .move_notify = ib_umem_dmabuf_revoke_locked, +}; +static struct ib_umem_dmabuf * ib_umem_dmabuf_get_pinned_and_lock(struct ib_device *device, struct device *dma_device,
@@ -266,6 +275,58 @@ ib_umem_dmabuf_get_pinned_with_dma_device(struct ib_device *device, }EXPORT_SYMBOL (ib_umem_dmabuf_get_pinned_with_dma_device); +/** +* ib_umem_dmabuf_get_pinned_revocable_and_lock - Map & pin a revocable dmabuf +* @device: IB device. +* @offset: Start offset. +* @size: Length. +* @fd: dmabuf fd. +* @access: Access flags. +* +* Obtains a umem from a dmabuf for drivers/devices that can support revocation. +* +* Returns with dma_resv_lock held upon success. The driver must set the revoke +* callback prior to unlock by calling ib_umem_dmabuf_set_revoke_locked(). +* +* When a revocation occurs, the revoke callback will be called. The driver must +* ensure that the region is no longer accessed when the callback returns. Any +* subsequent access attempts should also probably cause an AE for MRs. +* +* If the umem is used for an MR, the driver must ensure that the key remains in +* use such that it cannot be obtained by a new region until this region is +* fully deregistered (i.e., ibv_dereg_mr). If a driver needs to serialize with +* revoke calls, it can use dma_resv_lock. +* +* If successful, then the revoke callback may be called at any time and will +* also be called automatically upon ib_umem_release (serialized). The revoke +* callback will be called one time at most. +* +* Return: A pointer to ib_umem_dmabuf on success, or an ERR_PTR on failure. +*/ +struct ib_umem_dmabuf * +ib_umem_dmabuf_get_pinned_revocable_and_lock (struct ib_device *device, +unsigned long offset,size_t size, +int fd,int access) +{ +const struct dma_buf_attach_ops *ops = + &ib_umem_dmabuf_attach_pinned_revocable_ops; + +return ib_umem_dmabuf_get_pinned_and_lock (device, device->dma_device, + offset, size, fd, access, + ops); +} +EXPORT_SYMBOL (ib_umem_dmabuf_get_pinned_revocable_and_lock); + +void ib_umem_dmabuf_set_revoke_locked (struct ib_umem_dmabuf *umem_dmabuf, +void (*revoke)(void *priv),void *priv) +{ +dma_resv_assert_held (umem_dmabuf->attach->dmabuf->resv); + + umem_dmabuf->pinned_revoke = revoke; + umem_dmabuf->private = priv; +} +EXPORT_SYMBOL (ib_umem_dmabuf_set_revoke_locked); + struct ib_umem_dmabuf *ib_umem_dmabuf_get_pinned(struct ib_device *device, unsigned long offset, size_t size, int fd,
include/rdma/ib_umem.h +19 -0
@@ -36,6 +36,7 @@ struct ib_umem_dmabuf {struct scatterlist *last_sg;unsigned long first_sg_offset;unsigned long last_sg_trim; +void (*pinned_revoke)(void *priv);void *private; u8 pinned : 1; u8 revoked : 1;
@@ -124,6 +125,12 @@ struct ib_umem_dmabuf *ib_umem_dmabuf_get_pinned(struct ib_device *device, size_t size, int fd, int access);struct ib_umem_dmabuf * +ib_umem_dmabuf_get_pinned_revocable_and_lock (struct ib_device *device, +unsigned long offset,size_t size, +int fd,int access); +void ib_umem_dmabuf_set_revoke_locked (struct ib_umem_dmabuf *umem_dmabuf, +void (*revoke)(void *priv),void *priv); +struct ib_umem_dmabuf * ib_umem_dmabuf_get_pinned_with_dma_device(struct ib_device *device, struct device *dma_device, unsigned long offset, size_t size,
@@ -178,6 +185,18 @@ ib_umem_dmabuf_get_pinned(struct ib_device *device, unsigned long offset,return ERR_PTR (-EOPNOTSUPP ); } +static inline struct ib_umem_dmabuf * +ib_umem_dmabuf_get_pinned_revocable_and_lock (struct ib_device *device, +unsigned long offset,size_t size, +int fd,int access) +{ +return ERR_PTR (-EOPNOTSUPP ); +} + +static inline void +ib_umem_dmabuf_set_revoke_locked (struct ib_umem_dmabuf *umem_dmabuf, +void (*revoke)(void *priv),void *priv) {} +static inline struct ib_umem_dmabuf * ib_umem_dmabuf_get_pinned_with_dma_device(struct ib_device *device, struct device *dma_device,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 42/484 RDMA/umem: Add helpers for umem dmabuf revoke lock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <[email protected]>
[ Upstream commit 3a0b171302eea1732a168e26db3b8461f51cc1f9 ]
Added helpers to acquire and release the umem dmabuf revoke lock. The intent is to avoid the need for drivers to peek into the ib_umem_dmabuf internals to get the dma_resv_lock and bring us one step closer to abstracting ib_umem_dmabuf away from drivers in general.
Stable-dep-of: a846aecb931b ("RDMA/irdma: Prevent rereg_mr for non-mem regions")
--- drivers/infiniband/core/umem_dmabuf.c | 16 ++++++++++++++++ include/rdma/ib_umem.h | 4 ++++ 2 files changed, 20 insertions(+)
drivers/infiniband/core/umem_dmabuf.c +16 -0
@@ -337,6 +337,22 @@ struct ib_umem_dmabuf *ib_umem_dmabuf_get_pinned(struct ib_device *device, }EXPORT_SYMBOL (ib_umem_dmabuf_get_pinned); +void ib_umem_dmabuf_revoke_lock (struct ib_umem_dmabuf *umem_dmabuf) +{ +struct dma_buf *dmabuf = umem_dmabuf->attach->dmabuf; + +dma_resv_lock (dmabuf->resv,NULL ); +} +EXPORT_SYMBOL (ib_umem_dmabuf_revoke_lock); + +void ib_umem_dmabuf_revoke_unlock (struct ib_umem_dmabuf *umem_dmabuf) +{ +struct dma_buf *dmabuf = umem_dmabuf->attach->dmabuf; + +dma_resv_unlock (dmabuf->resv); +} +EXPORT_SYMBOL (ib_umem_dmabuf_revoke_unlock); +void ib_umem_dmabuf_revoke (struct ib_umem_dmabuf *umem_dmabuf) {struct dma_buf *dmabuf = umem_dmabuf->attach->dmabuf;
include/rdma/ib_umem.h +4 -0
@@ -138,6 +138,8 @@ ib_umem_dmabuf_get_pinned_with_dma_device(struct ib_device *device,int ib_umem_dmabuf_map_pages (struct ib_umem_dmabuf *umem_dmabuf);void ib_umem_dmabuf_unmap_pages (struct ib_umem_dmabuf *umem_dmabuf);void ib_umem_dmabuf_release (struct ib_umem_dmabuf *umem_dmabuf); +void ib_umem_dmabuf_revoke_lock (struct ib_umem_dmabuf *umem_dmabuf); +void ib_umem_dmabuf_revoke_unlock (struct ib_umem_dmabuf *umem_dmabuf);void ib_umem_dmabuf_revoke (struct ib_umem_dmabuf *umem_dmabuf);int ib_umem_check_rereg (struct ib_umem *umem,int flags,int new_access_flags);
@@ -212,6 +214,8 @@ static inline int ib_umem_dmabuf_map_pages(struct ib_umem_dmabuf *umem_dmabuf) }static inline void ib_umem_dmabuf_unmap_pages (struct ib_umem_dmabuf *umem_dmabuf) { }static inline void ib_umem_dmabuf_release (struct ib_umem_dmabuf *umem_dmabuf) { } +static inline void ib_umem_dmabuf_revoke_lock (struct ib_umem_dmabuf *umem_dmabuf) {} +static inline void ib_umem_dmabuf_revoke_unlock (struct ib_umem_dmabuf *umem_dmabuf) {}static inline void ib_umem_dmabuf_revoke (struct ib_umem_dmabuf *umem_dmabuf) {} static inline int ib_umem_check_rereg(struct ib_umem *umem, int flags,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 43/484 RDMA/irdma: Prevent rereg_mr for non-mem regions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <[email protected]>
[ Upstream commit a846aecb931b4d65d5eafa92a0623545af46d4f2 ]
When a QP/CQ/SRQ is created, a two step process is used where the buffer is allocated in userspace and explicitly registered with the normal reg_mr mechanism prior to creating the actual QP/CQ/SRQ object.
These special registrations are indicated via an ABI field so the driver knows that they do not have a valid mkey and to skip the actual CQP command submission.
Since these are real MR objects from the core's perspective, it is possible for a user application to invoke rereg_mr on them and cause a real CQP op to be emitted with the zero-initialized mkey value of 0.
Fix this by preventing rereg_mr on these special regions.
--- drivers/infiniband/hw/irdma/verbs.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/infiniband/hw/irdma/verbs.c +3 -0
@@ -3251,6 +3251,9 @@ static struct ib_mr *irdma_rereg_user_mr(struct ib_mr *ib_mr, int flags,if (flags & ~(IB_MR_REREG_TRANS |IB_MR_REREG_PD |IB_MR_REREG_ACCESS ))return ERR_PTR (-EOPNOTSUPP ); +if (iwmr->type !=IRDMA_MEMREG_TYPE_MEM ) +return ERR_PTR (-EINVAL ); + ret =ib_umem_check_rereg (iwmr->region, flags, new_access);if (ret)return ERR_PTR (ret);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 44/484 RDMA/erdma: initialize ret for empty receive WR lists
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit 2815a277c53e9a84784d6410cd55a9da5b33068d ]
erdma_post_recv() returns ret after walking the receive work request list. If the caller passes an empty list, the loop is skipped and ret is not assigned.
Initialize ret to 0 so an empty receive work request list returns success instead of stack data.
--- drivers/infiniband/hw/erdma/erdma_qp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/erdma/erdma_qp.c +1 -1
@@ -573,7 +573,7 @@ int erdma_post_recv(struct ib_qp *ibqp, const struct ib_recv_wr *recv_wr,const struct ib_recv_wr *wr = recv_wr;struct erdma_qp *qp =to_eqp (ibqp);unsigned long flags; -int ret; +int ret =0 ;spin_lock_irqsave (&qp->lock, flags);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 45/484 RDMA/hns: Fix potential integer overflow in mhop hem cleanup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danila Chernetsov <[email protected]>
[ Upstream commit 9f0f2d2121f16d420199a82ac5bbc242269133b3 ]
In hns_roce_cleanup_mhop_hem_table(), the expression:
obj = i * buf_chunk_size / table->obj_size;
is evaluated using 32-bit unsigned arithmetic because 'buf_chunk_size' is u32 and the usual arithmetic conversions convert 'i' to unsigned int. The result is assigned to a u64 variable, but the multiplication may overflow before the assignment.
For sufficiently large HEM tables, this produces an incorrect object index passed to hns_roce_table_mhop_put().
Cast 'i' to u64 before the multiplication so that the intermediate calculation is performed with 64-bit arithmetic.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/infiniband/hw/hns/hns_roce_hem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/hns/hns_roce_hem.c +1 -1
@@ -907,7 +907,7 @@ static void hns_roce_cleanup_mhop_hem_table(struct hns_roce_dev *hr_dev, mhop.bt_chunk_size;for (i =0 ; i < table->num_hem; ++i) { - obj = i * buf_chunk_size / table->obj_size; + obj = (u64 )i * buf_chunk_size / table->obj_size;if (table->hem[i])hns_roce_table_mhop_put (hr_dev, table, obj,0 ); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 46/484 RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoqing Jiang <[email protected]>
[ Upstream commit 788bbf4c2fc6e0c35bae9ed5068f484272539d3e ]
We can just check max_send_wr here given both max_send_wr and max_recv_wr are defined as u32 type, and we also need to ensure num_sqe (derived from max_send_wr) shouldn't be zero.
Stable-dep-of: bb27fcc67c42 ("RDMA/siw: publish QP after initialization")
--- drivers/infiniband/sw/siw/siw_verbs.c | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-)
drivers/infiniband/sw/siw/siw_verbs.c +5 -13
@@ -336,11 +336,10 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs, goto err_atomic; }/* -* NOTE: we allow for zero element SQ and RQ WQE's SGL's -* but not for a QP unable to hold any WQE (SQ + RQ) +* NOTE: we don't allow for a QP unable to hold any SQ WQE */ -if (attrs->cap.max_send_wr + attrs->cap.max_recv_wr ==0 ) { -siw_dbg (base_dev,"QP must have send or receive queue\n" ); +if (attrs->cap.max_send_wr ==0 ) { +siw_dbg (base_dev,"QP must have send queue\n" ); rv = -EINVAL ; goto err_atomic; }
@@ -360,21 +359,14 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,if (rv) goto err_atomic; - num_sqe = attrs->cap.max_send_wr; - num_rqe = attrs->cap.max_recv_wr;/* All queue indices are derived from modulo operations * on a free running 'get' (consumer) and 'put' (producer) * unsigned counter. Having queue sizes at power of two * avoids handling counter wrap around. */ -if (num_sqe) - num_sqe =roundup_pow_of_two (num_sqe); -else { -/* Zero sized SQ is not supported */ - rv = -EINVAL ; - goto err_out_xa; - } + num_sqe =roundup_pow_of_two (attrs->cap.max_send_wr); + num_rqe = attrs->cap.max_recv_wr;if (num_rqe) num_rqe =roundup_pow_of_two (num_rqe);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 47/484 RDMA/siw: publish QP after initialization
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit bb27fcc67c429d97f785c92c35a6c5adebb05d7f ]
siw_create_qp() currently calls siw_qp_add() before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being constructed.
Move siw_qp_add() to the end of siw_create_qp(), after QP initialization and before adding the QP to the siw device list.
--- drivers/infiniband/sw/siw/siw_verbs.c | 44 +++++++++++++++------------ 1 file changed, 24 insertions(+), 20 deletions(-)
drivers/infiniband/sw/siw/siw_verbs.c +24 -20
@@ -302,6 +302,7 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,struct siw_ucontext *uctx = rdma_udata_to_drv_context(udata, struct siw_ucontext, base_ucontext); +struct siw_uresp_create_qp uresp = {};unsigned long flags;int num_sqe, num_rqe, rv =0 ;size_t length;
@@ -355,11 +356,6 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,spin_lock_init (&qp->rq_lock);spin_lock_init (&qp->orq_lock); - rv =siw_qp_add (sdev, qp); -if (rv) - goto err_atomic; - -/* All queue indices are derived from modulo operations * on a free running 'get' (consumer) and 'put' (producer) * unsigned counter. Having queue sizes at power of two
@@ -377,14 +373,14 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,if (qp->sendq ==NULL ) { rv = -ENOMEM ; - goto err_out_xa; + goto err_out; }if (attrs->sq_sig_type !=IB_SIGNAL_REQ_WR ) {if (attrs->sq_sig_type ==IB_SIGNAL_ALL_WR ) qp->attrs.flags |=SIW_SIGNAL_ALL_WR ;else { rv = -EINVAL ; - goto err_out_xa; + goto err_out; } } qp->pd = pd;
@@ -410,7 +406,7 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,if (qp->recvq ==NULL ) { rv = -ENOMEM ; - goto err_out_xa; + goto err_out; } qp->attrs.rq_size = num_rqe; }
@@ -425,11 +421,8 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs, qp->attrs.state =SIW_QP_STATE_IDLE ;if (udata) { -struct siw_uresp_create_qp uresp = {}; - uresp.num_sqe = num_sqe; uresp.num_rqe = num_rqe; - uresp.qp_id =qp_id (qp);if (qp->sendq) { length = num_sqe *sizeof (struct siw_sqe );
@@ -438,7 +431,7 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs, length, &uresp.sq_key);if (!qp->sq_entry) { rv = -ENOMEM ; - goto err_out_xa; + goto err_out; } }
@@ -450,9 +443,23 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,if (!qp->rq_entry) { uresp.sq_key =SIW_INVAL_UOBJ_KEY ; rv = -ENOMEM ; - goto err_out_xa; + goto err_out; } } + } + qp->tx_cpu =siw_get_tx_cpu (sdev); +if (qp->tx_cpu <0 ) { + rv = -EINVAL ; + goto err_out; + } +init_completion (&qp->qp_free); + + rv =siw_qp_add (sdev, qp); +if (rv) + goto err_out_tx; + +if (udata) { + uresp.qp_id =qp_id (qp);if (udata->outlen <sizeof (uresp)) { rv = -EINVAL ;
@@ -462,22 +469,19 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,if (rv) goto err_out_xa; } - qp->tx_cpu =siw_get_tx_cpu (sdev); -if (qp->tx_cpu <0 ) { - rv = -EINVAL ; - goto err_out_xa; - } +INIT_LIST_HEAD (&qp->devq);spin_lock_irqsave (&sdev->lock, flags);list_add_tail (&qp->devq, &sdev->qp_list);spin_unlock_irqrestore (&sdev->lock, flags); -init_completion (&qp->qp_free); -return 0 ; err_out_xa:xa_erase (&sdev->qp_xa,qp_id (qp)); +err_out_tx: +siw_put_tx_cpu (qp->tx_cpu); +err_out:if (uctx) {rdma_user_mmap_entry_remove (qp->sq_entry);rdma_user_mmap_entry_remove (qp->rq_entry);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 48/484 mtd: fix double free and WARN_ON in add_mtd_device() error paths
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xue Lei <[email protected]>
[ Upstream commit 9d4af746af8ce27eefc2338b2feaa1e01f28b6c3 ]
When device_register() or mtd_nvmem_add() fails inside add_mtd_device() for a partition, the error handling triggers mtd_release() via put_device() or device_unregister(). mtd_release() calls release_mtd_partition() which frees the mtd_info structure. However, callers such as mtd_add_partition() and add_mtd_partitions() also call free_partition() in their error paths, resulting in a double free.
Additionally, release_mtd_partition() hits WARN_ON(!list_empty( &mtd->part.node)) because the partition node is still linked in the parent's partitions list when the release callback fires from the add_mtd_device() error path.
Fix this by overriding dev->type and dev->release before put_device() in the error paths, so that device_release() invokes a no-op function instead of mtd_release(). For the mtd_nvmem_add() failure case, device_unregister() is replaced with device_del() to separate the device removal from the final kobject reference drop, allowing the override to take effect before put_device() is called.
The callers' error paths (list_del + free_partition) remain the sole owners of mtd_info lifetime on add_mtd_device() failure, which is the expected contract.
The normal partition teardown path is not affected: del_mtd_device() goes through kref_put() -> mtd_device_release() -> device_unregister() with dev->type still set to &mtd_devtype, so mtd_release() -> release_mtd_partition() continues to work correctly for the regular removal case.
--- drivers/mtd/mtdcore.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-)
drivers/mtd/mtdcore.c +19 -4
@@ -103,6 +103,15 @@ static void mtd_release(struct device *dev)device_destroy (&mtd_class, index +1 ); } +/* +* No-op device release used in add_mtd_device() error paths. +* Prevents mtd_release() from being called via device_release(), +* which would free the mtd_info that the caller still manages. +*/ +static void mtd_dev_release_nop (struct device *dev) +{ +} +static void mtd_device_release (struct kref *kref) { struct mtd_info *mtd = container_of(kref, struct mtd_info, refcnt);
@@ -745,10 +754,8 @@ int add_mtd_device(struct mtd_info *mtd)mtd_check_of_node (mtd);of_node_get (mtd_get_of_node (mtd)); error =device_register (&mtd->dev); -if (error) { -put_device (&mtd->dev); +if (error) goto fail_added; - }/* Add the nvmem provider */ error =mtd_nvmem_add (mtd);
@@ -786,8 +793,16 @@ int add_mtd_device(struct mtd_info *mtd)return 0 ; fail_nvmem_add: -device_unregister (&mtd->dev); +device_del (&mtd->dev); fail_added: +/* +* Clear type and set nop release to prevent mtd_release() -> +* release_mtd_partition() -> free_partition() from freeing mtd. +* The caller handles cleanup on failure. +*/ + mtd->dev.type =NULL ; + mtd->dev.release = mtd_dev_release_nop; +put_device (&mtd->dev);of_node_put (mtd_get_of_node (mtd));idr_remove (&mtd_idr, i); fail_locked:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 49/484 selftests/alsa: Fix memory leak in find_controls error path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malaya Kumar Rout <[email protected]>
[ Upstream commit cb89f0c1aed02eb233c4271f76f830b37e222ff6 ]
In find_controls(), card_data is allocated with malloc() but when snd_ctl_open_lconf() fails, the code jumps to next_card without freeing the allocated memory. This results in a memory leak for each card where snd_ctl_open_lconf() fails.
Add free(card_data) before goto next_card to ensure proper cleanup of the allocated memory in the error path.
--- tools/testing/selftests/alsa/mixer-test.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/alsa/mixer-test.c +1 -0
@@ -82,6 +82,7 @@ static void find_controls(void)if (err <0 ) {ksft_print_msg ("Failed to get hctl for card %d: %s\n" , card,snd_strerror (err)); +free (card_data); goto next_card; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 50/484 RDMA/irdma: Prevent overflows in memory contiguity checks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandrova Alyona <[email protected]>
[ Upstream commit 3cda0dfe8c651dcbb9e38977905d3d3b1750c4ab ]
irdma_check_mem_contiguous() and irdma_check_mr_contiguous() verify that PBL entries describe physically contiguous memory ranges.
Both functions calculate byte offsets using 32-bit operands. For example, with 4 KiB pages, pg_size * pg_idx overflows 32-bit arithmetic when pg_idx reaches 1048576. In the level-2 check, PBLE_PER_PAGE is 512, so i * pg_size * PBLE_PER_PAGE overflows when i reaches 2048.
These values are reachable in the driver. For MRs, palloc->total_cnt comes from iwmr->page_cnt, which is calculated by ib_umem_num_dma_blocks(). The MR size is limited by IRDMA_MAX_MR_SIZE, so a 4 GiB MR with 4 KiB pages can reach page_cnt of 1048576. PBLE resources do not exclude this value either: for gen3, the limit is based on avail_sds * MAX_PBLE_PER_SD, and MAX_PBLE_PER_SD is 0x40000, so 4 SDs are enough for 1048576 PBLEs.
Cast one operand to u64 before the multiplications so that the offset calculations are performed in 64-bit arithmetic.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/infiniband/hw/irdma/verbs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/hw/irdma/verbs.c +2 -2
@@ -2366,7 +2366,7 @@ static bool irdma_check_mem_contiguous(u64 *arr, u32 npages, u32 pg_size)u32 pg_idx;for (pg_idx =0 ; pg_idx < npages; pg_idx++) { -if ((*arr + (pg_size * pg_idx)) != arr[pg_idx]) +if ((*arr + ((u64 )pg_size * pg_idx)) != arr[pg_idx])return false; }
@@ -2399,7 +2399,7 @@ static bool irdma_check_mr_contiguous(struct irdma_pble_alloc *palloc,for (i =0 ; i < lvl2->leaf_cnt; i++, leaf++) { arr = leaf->addr; -if ((*start_addr + (i * pg_size *PBLE_PER_PAGE )) != *arr) +if ((*start_addr + ((u64 )i * pg_size *PBLE_PER_PAGE )) != *arr)return false; ret =irdma_check_mem_contiguous (arr, leaf->cnt, pg_size);if (!ret)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 51/484 xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei (Microsoft) <[email protected]>
[ Upstream commit 136992de9bb91871084ae52d172610541c76e4d2 ]
On the error path where in6_dev_get(dev) returns NULL, xfrm6_fill_dst() releases the device reference with netdev_put() but leaves xdst->u.dst.dev set. dst_destroy() later calls netdev_put(dst->dev) again, so the same net_device reference is released twice, underflowing its refcount (ref_tracker WARNING + "unregister_netdevice: waiting for <dev> to become free").
Clear xdst->u.dst.dev after the netdev_put(), the same way the XFRM device-offload paths xfrm_dev_state_add() and xfrm_dev_policy_add() in net/xfrm/xfrm_device.c NULL ->dev when releasing the reference on error.
ref_tracker: reference already released.
ref_tracker: allocated in:
xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:86)
...
udpv6_sendmsg (net/ipv6/udp.c:1696)
...
ref_tracker: freed in:
xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:90)
...
WARNING: lib/ref_tracker.c:322 at ref_tracker_free+0x58b/0x780 dst_destroy (net/core/dst.c:115) rcu_core handle_softirqs ...
--- net/ipv6/xfrm6_policy.c | 1 + 1 file changed, 1 insertion(+)
net/ipv6/xfrm6_policy.c +1 -0
@@ -88,6 +88,7 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev, xdst->u.rt6.rt6i_idev =in6_dev_get (dev);if (!xdst->u.rt6.rt6i_idev) {netdev_put (dev, &xdst->u.dst.dev_tracker); + xdst->u.dst.dev =NULL ;return -ENODEV ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 52/484 xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei (Microsoft) <[email protected]>
[ Upstream commit f38f8cce2f7e79775b3db7e8a5eacda04ac908e4 ]
xfrm_hash_rebuild()'s first loop preallocates the bins/chains the reinsert loop needs, so the reinsert (after hlist_del_rcu()) cannot allocate or fail. But its guard is inverted: it skips policies with prefixlen < threshold and preallocates for the rest.
prefixlen < threshold is exactly when policy_hash_bysel() returns NULL and the reinsert takes the allocating xfrm_policy_inexact_insert() path. So the loop preallocates for the exact policies (which never allocate) and skips the inexact ones, whose bin/node is then allocated GFP_ATOMIC during reinsert. On failure the error path only WARN_ONCE()s and continues, leaving a poisoned bydst node; the next rebuild's hlist_del_rcu() dereferences LIST_POISON2 and takes a GPF. Reachable under memory pressure, deterministic via failslab.
Invert the guard so preallocation covers exactly the reinserted policies; the reinsert then allocates nothing and cannot fail.
Crash:
Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead...] ... Workqueue: events xfrm_hash_rebuild RIP: 0010:xfrm_hash_rebuild+0x5b3/0x1190 RAX: dead000000000122 (LIST_POISON2 + offset) ... Call Trace: hlist_del_rcu (include/linux/rculist.h:599) xfrm_hash_rebuild (net/xfrm/xfrm_policy.c:1365) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) ... Kernel panic - not syncing: Fatal exception in interrupt
--- net/xfrm/xfrm_policy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/xfrm/xfrm_policy.c +2 -2
@@ -1298,8 +1298,8 @@ static void xfrm_hash_rebuild(struct work_struct *work) } } -if (policy->selector.prefixlen_d < dbits || - policy->selector.prefixlen_s < sbits) +if (policy->selector.prefixlen_d >= dbits && + policy->selector.prefixlen_s >= sbits)continue ; bin =xfrm_policy_inexact_alloc_bin (policy, dir);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 53/484 wifi: cfg80211: cancel sched scan results work on unregister
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <[email protected]>
[ Upstream commit edf0730be33696a1bd142792830d392129e495cc ]
cfg80211_sched_scan_results() can queue rdev->sched_scan_res_wk from a driver result notification while a scheduled scan request is present. The work callback recovers the containing cfg80211_registered_device and then locks the wiphy and walks the scheduled-scan request list.
wiphy_unregister() already makes the wiphy unreachable and drains rdev work items before cfg80211_dev_free() can release the object, but it does not drain sched_scan_res_wk. A queued or running result work item can therefore cross the unregister/free boundary and access freed rdev state.
The buggy scenario involves two paths, with each column showing the order within that path:
scheduled-scan result path: unregister/free path:
1. cfg80211_sched_scan_results() 1. interface teardown stops and
queues rdev->sched_scan_res_wk. removes the scheduled scan request.
2. cfg80211_wq starts the work 2. wiphy_unregister() drains other
item and recovers rdev. rdev work items.
3. The worker locks rdev->wiphy 3. cfg80211_dev_free() destroys and
and walks rdev state. frees rdev.
Cancel sched_scan_res_wk in wiphy_unregister() alongside the other rdev work items. cancel_work_sync() removes a pending result notification and waits for an already running callback, so cfg80211_dev_free() cannot free rdev while this work item is still active.
Validation reproduced this kernel report:
BUG: KASAN: use-after-free in cfg80211_sched_scan_results_wk+0x4a6/0x530 Workqueue: cfg80211 cfg80211_sched_scan_results_wk [cfg80211] Read of size 8 Call trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 cfg80211_sched_scan_results_wk+0x4a6/0x530 srso_alias_return_thunk+0x5/0xfbef5 __virt_addr_valid+0x224/0x430 kasan_report+0xac/0xe0 lockdep_hardirqs_on_prepare+0xea/0x1a0 process_one_work+0x8d0/0x18f0 (kernel/workqueue.c:3212) lock_is_held_type+0x8f/0x100 worker_thread+0x5ad/0xfd0 __kthread_parkme+0xc6/0x200 kthread+0x31e/0x410 trace_hardirqs_on+0x1a/0x170 ret_from_fork+0x576/0x810 __switch_to+0x57e/0xe20 __switch_to_asm+0x33/0x70 ret_from_fork_asm+0x1a/0x30
--- net/wireless/core.c | 1 + 1 file changed, 1 insertion(+)
net/wireless/core.c +1 -0
@@ -1132,6 +1132,7 @@ void wiphy_unregister(struct wiphy *wiphy)/* this has nothing to do now but make sure it's gone */ cancel_work_sync (&rdev->wiphy_work); +cancel_work_sync (&rdev->sched_scan_res_wk);cancel_work_sync (&rdev->rfkill_block);cancel_work_sync (&rdev->conn_work);flush_work (&rdev->event_work);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 54/484 wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 0d388f62031dbabcba0f44bb91b59f10e88cac17 ]
The memory allocated in the ipw2100_alloc_device() function is not freed in some of the error paths in ipw2100_pci_init_one(). Fix that by converting the direct return into a goto to the error path return.
The error path when pci_enable_device() fails cannot jump to fail, since at this point priv is not set, so perform error handling inline.
--- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/wireless/intel/ipw2x00/ipw2100.c +4 -4
@@ -6172,6 +6172,8 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,if (err) { printk(KERN_WARNING DRV_NAME "Error calling pci_enable_device.\n"); +free_libipw (dev,0 ); +pci_iounmap (pci_dev, ioaddr);return err; }
@@ -6184,16 +6186,14 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,if (err) { printk(KERN_WARNING DRV_NAME "Error calling pci_set_dma_mask.\n"); -pci_disable_device (pci_dev); -return err; + goto fail; } err =pci_request_regions (pci_dev,DRV_NAME );if (err) { printk(KERN_WARNING DRV_NAME "Error calling pci_request_regions.\n"); -pci_disable_device (pci_dev); -return err; + goto fail; }/* We disable the RETRY_TIMEOUT register (0x41) to keep
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 55/484 wifi: mac80211_hwsim: clamp virtio RX length before skb_put
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
[ Upstream commit 10a2b430f8f06ae14b9590b6f6faa6b588ef0654 ]
hwsim_virtio_rx_work() passes the virtqueue used-ring length reported by the device straight to skb_put() on a fixed-size receive skb. A backend reporting a length larger than the skb tailroom drives skb_put() past the buffer end and hits skb_over_panic() -- a host-triggerable guest panic (denial of service).
Clamp the length to the skb's available room before skb_put(). A conforming device never reports more than the posted buffer size, so valid frames are unaffected; a truncated over-report then fails the length/header checks in hwsim_virtio_handle_cmd() and is dropped, so truncating rather than dropping here cannot be turned into a parsing problem.
--- drivers/net/wireless/virtual/mac80211_hwsim.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/virtual/mac80211_hwsim.c +1 -0
@@ -6383,6 +6383,7 @@ static void hwsim_virtio_rx_work(struct work_struct *work) skb->data = skb->head;skb_reset_tail_pointer (skb); + len =min (len,skb_end_offset (skb));skb_put (skb, len);hwsim_virtio_handle_cmd (skb);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 56/484 wifi: libertas: fix memory leak in helper_firmware_cb()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <[email protected]>
[ Upstream commit 63c2391deefb31e1b801b7f32bd502ca4808639b ]
helper_firmware_cb() neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path.
Fix this memory leak by calling release_firmware() immediately after lbs_fw_loaded() returns.
The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in the current wireless tree.
An x86_64 allyesconfig build showed no new warnings. As we do not have compatible Libertas USB hardware for exercising this firmware-download path, no runtime testing was able to be performed.
--- drivers/net/wireless/marvell/libertas/firmware.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/marvell/libertas/firmware.c +1 -0
@@ -78,6 +78,7 @@ static void helper_firmware_cb(const struct firmware *firmware, void *context) }else {/* No main firmware needed for this helper --> success! */ lbs_fw_loaded (priv,0 , firmware,NULL ); +release_firmware (firmware); } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 57/484 wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit ebd6d37fa94bee929e0b4c9ca19fdf9b1dcf6cea ]
p54_rx_eeprom_readback() copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit da1b9a55ff11 ("wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()") closed the destination overflow by copying a fixed priv->eeprom_slice_size (and rejecting a mismatched advertised len), but the source side is still unbounded: nothing verifies the frame is long enough to supply that many bytes.
A malicious USB device can send a short frame whose advertised len matches priv->eeprom_slice_size while the payload is truncated. The equality check passes and memcpy() reads past the end of the skb, leaking adjacent heap:
BUG: KASAN: slab-out-of-bounds in p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507) Read of size 1016 at addr ffff88800f077114 by task swapper/0/0 Call Trace: <IRQ> ... __asan_memcpy (mm/kasan/shadow.c:105) p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507) p54u_rx_cb (drivers/net/wireless/intersil/p54/p54usb.c:163) __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657) dummy_timer (drivers/usb/gadget/udc/dummy_hcd.c:2005) ... </IRQ> The buggy address belongs to the object at ffff88800f0770c0 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 84 bytes inside of allocated 704-byte region [ffff88800f0770c0, ffff88800f077380)
Check that the slice fits in the skb before copying.
--- drivers/net/wireless/intersil/p54/txrx.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/wireless/intersil/p54/txrx.c +8 -0
@@ -499,11 +499,19 @@ static void p54_rx_eeprom_readback(struct p54_common *priv,if (le16_to_cpu (eeprom->v2.len) != priv->eeprom_slice_size)return ; +if (eeprom->v2.data + priv->eeprom_slice_size > +skb_tail_pointer (skb)) +return ; +memcpy (priv->eeprom, eeprom->v2.data, priv->eeprom_slice_size); }else {if (le16_to_cpu (eeprom->v1.len) != priv->eeprom_slice_size)return ; +if (eeprom->v1.data + priv->eeprom_slice_size > +skb_tail_pointer (skb)) +return ; +memcpy (priv->eeprom, eeprom->v1.data, priv->eeprom_slice_size); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 58/484 wifi: nl80211: free RNR data on MBSSID mismatch
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <[email protected]>
[ Upstream commit 07a95ec2b54774201fdf4ef7ffb0ca2ab19ed29c ]
nl80211_parse_beacon() rejects EMA RNR data when there are fewer RNR entries than MBSSID entries.
The rejected RNR allocation has not been attached to the beacon data yet, so free it before returning the error.
--- net/wireless/nl80211.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/wireless/nl80211.c +3 -1
@@ -5651,8 +5651,10 @@ static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,if (IS_ERR (rnr))return PTR_ERR (rnr); -if (rnr && rnr->cnt < bcn->mbssid_ies->cnt) +if (rnr && rnr->cnt < bcn->mbssid_ies->cnt) { +kfree (rnr);return -EINVAL ; + } bcn->rnr_ies = rnr; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 59/484 wifi: nl80211: validate nested MBSSID IE blobs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <[email protected]>
[ Upstream commit 7f4b01812323443b55e4c65381c9dc851ff009e3 ]
Validate each nested NL80211_ATTR_MBSSID_ELEMS entry as a well-formed information-element stream before storing it for beacon construction.
RNR parsing already validates each nested blob with validate_ie_attr() before storing it. Apply the same syntactic IE validation to MBSSID entries before counting and copying their data and length pointers.
--- net/wireless/nl80211.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
net/wireless/nl80211.c +10 -2
@@ -5453,7 +5453,8 @@ static int nl80211_parse_mbssid_config(struct wiphy *wiphy, }static struct cfg80211_mbssid_elems * -nl80211_parse_mbssid_elems (struct wiphy *wiphy,struct nlattr *attrs) +nl80211_parse_mbssid_elems (struct wiphy *wiphy,struct nlattr *attrs, +struct netlink_ext_ack *extack) {struct nlattr *nl_elems;struct cfg80211_mbssid_elems *elems;
@@ -5464,6 +5465,12 @@ nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)return ERR_PTR (-EINVAL );nla_for_each_nested (nl_elems, attrs, rem_elems) { +int ret; + + ret =validate_ie_attr (nl_elems, extack); +if (ret) +return ERR_PTR (ret); +if (num_elems >=255 )return ERR_PTR (-EINVAL ); num_elems++;
@@ -5635,7 +5642,8 @@ static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,if (attrs[NL80211_ATTR_MBSSID_ELEMS ]) {struct cfg80211_mbssid_elems *mbssid =nl80211_parse_mbssid_elems (&rdev->wiphy, - attrs[NL80211_ATTR_MBSSID_ELEMS ]); + attrs[NL80211_ATTR_MBSSID_ELEMS ], + extack);if (IS_ERR (mbssid))return PTR_ERR (mbssid);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 60/484 wifi: cfg80211: validate PMSR measurement type data
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <[email protected]>
[ Upstream commit 41aa973eb05922848dded26875c55ef982ac1c49 ]
PMSR request parsing accepts missing or duplicated measurement type entries in NL80211_PMSR_REQ_ATTR_DATA.
Track whether one measurement type was already provided, reject a second one immediately, and return an error if the request data block contains no measurement type at all.
--- net/wireless/pmsr.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
net/wireless/pmsr.c +17 -2
@@ -188,6 +188,7 @@ static int pmsr_parse_peer(struct cfg80211_registered_device *rdev, {struct nlattr *tb[NL80211_PMSR_PEER_ATTR_MAX +1 ];struct nlattr *req[NL80211_PMSR_REQ_ATTR_MAX +1 ]; +bool have_measurement_type = false;struct nlattr *treq;int err, rem;
@@ -240,6 +241,14 @@ static int pmsr_parse_peer(struct cfg80211_registered_device *rdev, }nla_for_each_nested (treq, req[NL80211_PMSR_REQ_ATTR_DATA ], rem) { +if (have_measurement_type) { +NL_SET_ERR_MSG_ATTR (info->extack, treq, +"multiple measurement types in request data" ); +return -EINVAL ; + } + + have_measurement_type = true; +switch (nla_type (treq)) {case NL80211_PMSR_TYPE_FTM : err =pmsr_parse_ftm (rdev, treq, out, info);
@@ -249,10 +258,16 @@ static int pmsr_parse_peer(struct cfg80211_registered_device *rdev, "unsupported measurement type"); err = -EINVAL ; } +if (err) +return err; } -if (err) -return err; +if (!have_measurement_type) { +NL_SET_ERR_MSG_ATTR (info->extack, + req[NL80211_PMSR_REQ_ATTR_DATA ], +"missing measurement type in request data" ); +return -EINVAL ; + }return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 61/484 wifi: cfg80211: validate PMSR FTM preamble range
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <[email protected]>
[ Upstream commit 36230936468f0ba4930e94aef496fc229d4bb951 ]
PMSR FTM request parsing accepts preamble values outside the enumerated nl80211 preamble range.
Reject out-of-range values before using them in the parser capability bit test using the policy.
--- net/wireless/nl80211.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/wireless/nl80211.c +3 -1
@@ -309,7 +309,9 @@ nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {static const struct nla_policy nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX +1 ] = { [NL80211_PMSR_FTM_REQ_ATTR_ASAP ] = { .type =NLA_FLAG }, - [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE ] = { .type =NLA_U32 }, + [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE ] = +NLA_POLICY_RANGE (NLA_U32 ,NL80211_PREAMBLE_LEGACY , +NL80211_PREAMBLE_HE ), [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP ] =NLA_POLICY_MAX (NLA_U8 ,15 ), [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD ] = { .type =NLA_U16 },
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 62/484 wifi: cfg80211: reject unsupported PMSR FTM location requests
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Li <[email protected]>
[ Upstream commit 69ef6a7ec277f16d216be8da2b3cbe872786c999 ]
PMSR FTM location request flags are syntactically valid, but they must be rejected when the device capability does not advertise support for them.
Return an error immediately after rejecting unsupported LCI or civic location request bits so the request cannot reach the driver.
--- net/wireless/pmsr.c | 2 ++ 1 file changed, 2 insertions(+)
net/wireless/pmsr.c +2 -0
@@ -114,6 +114,7 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,NL_SET_ERR_MSG_ATTR (info->extack, tb[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI ],"FTM: LCI request not supported" ); +return -EOPNOTSUPP ; } out->ftm.request_civicloc =
@@ -122,6 +123,7 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,NL_SET_ERR_MSG_ATTR (info->extack, tb[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC ],"FTM: civic location request not supported" ); +return -EOPNOTSUPP ; } out->ftm.trigger_based =
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 63/484 wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <[email protected]>
[ Upstream commit f3858d5b1432098c1936e03d6e03dd0e33facf60 ]
ieee80211_do_stop() removes AP_VLAN packets from the parent AP ps->bc_buf while holding ps->bc_buf.lock with IRQs disabled. It then calls ieee80211_free_txskb() before dropping the lock.
ieee80211_free_txskb() is not just a passive SKB release. For SKBs with TX status state it can report a dropped frame through cfg80211/nl80211, and that path can reach netlink tap transmit. This is the same reason the pending queue cleanup in ieee80211_do_stop() already unlinks SKBs under the queue lock and frees them after IRQ state is restored.
The buggy scenario involves two paths, with each column showing the order within that path:
AP_VLAN management TX: AP_VLAN stop: 1. attach ACK-status state 1. clear the running state 2. queue a multicast SKB on 2. take ps->bc_buf.lock with IRQs
parent ps->bc_buf disabled
3. unlink the AP_VLAN SKB
4. call ieee80211_free_txskb()
Unlink matching AP_VLAN SKBs from ps->bc_buf under the existing lock, but move them to a local free queue. Drop the lock and restore IRQ state before calling ieee80211_free_txskb().
WARNING: kernel/softirq.c:430 at __local_bh_enable_ip
--- net/mac80211/iface.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/mac80211/iface.c +7 -1
@@ -591,6 +591,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_doWARN_ON (!list_empty (&sdata->u.ap.vlans)); }else if (sdata->vif.type ==NL80211_IFTYPE_AP_VLAN ) {/* remove all packets in parent bc_buf pointing to this dev */ +__skb_queue_head_init (&freeq); ps = &sdata->bss->ps;spin_lock_irqsave (&ps->bc_buf.lock, flags);
@@ -598,10 +599,15 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_doif (skb->dev == sdata->dev) {__skb_unlink (skb, &ps->bc_buf); local->total_ps_buffered--; -ieee80211_free_txskb (&local->hw, skb); +__skb_queue_tail (&freeq, skb); } }spin_unlock_irqrestore (&ps->bc_buf.lock, flags); + + skb_queue_walk_safe(&freeq, skb, tmp) { +__skb_unlink (skb, &freeq); +ieee80211_free_txskb (&local->hw, skb); + } }if (going_down)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 64/484 wifi: brcmfmac: initialize SDIO data work before cleanup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <[email protected]>
[ Upstream commit 2a665946e0407a05a3f81bd56a08553c446498e0 ]
brcmf_sdio_probe() stores the newly allocated bus in sdiodev->bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls brcmf_sdio_remove().
brcmf_sdio_remove() unconditionally cancels bus->datawork. Initialize the work item before the first failure path that can reach brcmf_sdio_remove(), so the cleanup path always observes a valid work object.
This issue was found by our static analysis tool and then confirmed by manual review of the probe error path and the remove-time work drain. The problem pattern is an early setup failure that reaches a cleanup helper which cancels an embedded work item before its initializer has run.
A QEMU PoC forced alloc_ordered_workqueue() to fail at the same point in brcmf_sdio_probe(), before INIT_WORK(&bus->datawork) is reached. The resulting fail path calls brcmf_sdio_remove(), and DEBUG_OBJECTS reports the invalid work drain with brcmf_sdio_probe() and brcmf_sdio_remove() in the stack.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +1 -1
@@ -4458,6 +4458,7 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev) bus->sdiodev = sdiodev; sdiodev->bus = bus;skb_queue_head_init (&bus->glom); +INIT_WORK (&bus->datawork, brcmf_sdio_dataworker); bus->txbound =BRCMF_TXBOUND ; bus->rxbound =BRCMF_RXBOUND ; bus->txminmax =BRCMF_TXMINMAX ;
@@ -4471,7 +4472,6 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev) goto fail; }brcmf_sdiod_freezer_count (sdiodev); -INIT_WORK (&bus->datawork, brcmf_sdio_dataworker); bus->brcmf_wq = wq;/* attempt to attach to the dongle */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 65/484 wifi: cfg80211: bound element ID read when checking non-inheritance
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: HE WEI (ギカク) <[email protected]>
[ Upstream commit cb8afea4655ff004fa7feee825d5c79783525383 ]
cfg80211_is_element_inherited() reads the first data octet of the candidate element (id = elem->data[0]) to look it up in an extension non-inheritance list. It does so after testing elem->id, but without verifying that the element actually has a data octet. A zero-length extension element (WLAN_EID_EXTENSION with length 0) therefore makes it read one octet past the end of the element.
_ieee802_11_parse_elems_full() runs this check for every element of a frame once a non-inheritance context exists -- e.g. while parsing a per-STA profile of a Multi-Link element in a (re)association response, or a non-transmitted BSS profile -- so a crafted frame from an AP can trigger a one-octet slab-out-of-bounds read during element parsing:
BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited Read of size 1 ... in net/wireless/scan.c
Return early (treat the element as inherited) when an extension element carries no data, mirroring the existing handling of empty ID lists.
The bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.
--- net/wireless/scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/scan.c +1 -1
@@ -243,7 +243,7 @@ bool cfg80211_is_element_inherited(const struct element *elem,return true;if (elem->id ==WLAN_EID_EXTENSION ) { -if (!ext_id_len) +if (!ext_id_len || !elem->datalen)return true; loop_len = ext_id_len; list = &non_inherit_elem->data[3 + id_len];
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 66/484 ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Hewitt <[email protected]>
[ Upstream commit 6b59c53c8adc2b522327407af5e1793a65b67e4b ]
The I2S FIFO soft-resets its fast domain on start (AIU_RST_SOFT bit 0 + AIU_I2S_SYNC read in aiu_fifo_i2s_trigger), mirroring the downstream vendor driver's audio_out_i2s_enable(). The S/PDIF FIFO has no equivalent:
it only toggles the IEC958 DCU, so a stale datapath FIFO can be replayed, producing the "machine gun noise" buffer underrun - on start when switching outputs, and on stop when playback ends. The latter is audible on devices with an always-on S/PDIF-fed DAC (e.g. the ES7144 on the WeTek Play2).
The vendor driver resets the IEC958 fast domain (AIU_RST_SOFT bit 2) on both enable and disable (audio_hw_958_enable), and when reconfiguring (audio_hw_958_reset clears AIU_958_DCU_FF_CTRL then resets). Do the same:
reset before enabling the DCU on start, and before disabling on stop.
--- sound/soc/meson/aiu-fifo-spdif.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/soc/meson/aiu-fifo-spdif.c +5 -0
@@ -24,6 +24,7 @@#define AIU_MEM_IEC958_CONTROL_MODE_16BIT BIT(7)#define AIU_MEM_IEC958_CONTROL_MODE_LINEAR BIT(8)#define AIU_MEM_IEC958_BUF_CNTL_INIT BIT(0) +#define AIU_RST_SOFT_958_FAST BIT(2)#define AIU_FIFO_SPDIF_BLOCK 8
@@ -68,11 +69,15 @@ static int fifo_spdif_trigger(struct snd_pcm_substream *substream, int cmd,case SNDRV_PCM_TRIGGER_START :case SNDRV_PCM_TRIGGER_RESUME :case SNDRV_PCM_TRIGGER_PAUSE_RELEASE : +snd_soc_component_write (component,AIU_RST_SOFT , +AIU_RST_SOFT_958_FAST );fifo_spdif_dcu_enable (component, true);break ;case SNDRV_PCM_TRIGGER_SUSPEND :case SNDRV_PCM_TRIGGER_PAUSE_PUSH :case SNDRV_PCM_TRIGGER_STOP : +snd_soc_component_write (component,AIU_RST_SOFT , +AIU_RST_SOFT_958_FAST );fifo_spdif_dcu_enable (component, false);break ;default :
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 67/484 ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vijendar Mukunda <[email protected]>
[ Upstream commit f7697ecf6eab9d4887dd731038b3dc405c7e755e ]
The driver handles ACP6.3/7.0/7.1/7.2 platforms but the region was claimed with the stale name "AMD ACP6.2 audio" left over from the original ACP6.2 driver. Correct it to "AMD ACP6.3 audio".
--- sound/soc/amd/ps/pci-ps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/amd/ps/pci-ps.c +1 -1
@@ -599,7 +599,7 @@ static int snd_acp63_probe(struct pci_dev *pci,return -ENODEV ; } - ret =pci_request_regions (pci,"AMD ACP6.2 audio" ); + ret =pci_request_regions (pci,"AMD ACP6.3 audio" );if (ret <0 ) {dev_err (&pci->dev,"pci_request_regions failed\n" ); goto disable_pci;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 68/484 ASoC: cs42l43: Correct report for forced microphone jack
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit f74e6e15485b68b92b2807071e822db6309b7e38 ]
Currently if the jack is forced to the microphone mode, it will report as line in. Correct the report to microphone.
--- sound/soc/codecs/cs42l43-jack.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/codecs/cs42l43-jack.c +2 -1
@@ -283,6 +283,7 @@ irqreturn_t cs42l43_bias_detect_clamp(int irq, void *data)#define CS42L43_JACK_ABSENT 0x0#define CS42L43_JACK_OPTICAL (SND_JACK_MECHANICAL | SND_JACK_AVOUT) +#define CS42L43_JACK_MICROPHONE (SND_JACK_MECHANICAL | SND_JACK_MICROPHONE)#define CS42L43_JACK_HEADPHONE (SND_JACK_MECHANICAL | SND_JACK_HEADPHONE)#define CS42L43_JACK_HEADSET (SND_JACK_MECHANICAL | SND_JACK_HEADSET)#define CS42L43_JACK_LINEOUT (SND_JACK_MECHANICAL | SND_JACK_LINEOUT)
@@ -867,7 +868,7 @@ static const struct cs42l43_jack_override_mode { .hsdet_mode = CS42L43_JACK_3_POLE_SWITCHES, .mic_ctrl = (0x3 <<CS42L43_JACK_STEREO_CONFIG_SHIFT ) | CS42L43_HS1_BIAS_EN_MASK | CS42L43_HS2_BIAS_EN_MASK, - .report = CS42L43_JACK_LINEIN, + .report = CS42L43_JACK_MICROPHONE, }, [CS42L43_JACK_RAW_OPTICAL] = { .hsdet_mode = CS42L43_JACK_3_POLE_SWITCHES,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 69/484 ASoC: tas2562: fix deprecated shut-down GPIO always cleared after lookup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uday Khare <[email protected]>
[ Upstream commit 3238c634725afbb2a137fdda762208510828f71d ]
In tas2562_parse_dt(), the fallback lookup for the deprecated "shut-down" GPIO property is broken due to a missing pair of braces.
The code intends to reset sdz_gpio to NULL only when the lookup returns an error that is not -EPROBE_DEFER (so the driver gracefully continues without a GPIO). However, without braces the statement:
tas2562->sdz_gpio = NULL;
falls outside the IS_ERR() check and is executed unconditionally for every path through the if block, including a successful GPIO lookup.
This means any device using the deprecated 'shut-down' DT property will always have sdz_gpio == NULL after probe, making the GPIO completely non-functional.
Fix this by adding the missing braces to scope the NULL assignment inside the IS_ERR() branch, matching the pattern already used for the primary 'shutdown' GPIO lookup above.
--- sound/soc/codecs/tas2562.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/soc/codecs/tas2562.c +3 -2
@@ -684,11 +684,12 @@ static int tas2562_parse_dt(struct tas2562_data *tas2562)if (tas2562->sdz_gpio ==NULL ) { tas2562->sdz_gpio =devm_gpiod_get_optional (dev,"shut-down" ,GPIOD_OUT_HIGH ); -if (IS_ERR (tas2562->sdz_gpio)) +if (IS_ERR (tas2562->sdz_gpio)) {if (PTR_ERR (tas2562->sdz_gpio) == -EPROBE_DEFER )return -EPROBE_DEFER ; - tas2562->sdz_gpio =NULL ; + tas2562->sdz_gpio =NULL ; + } }if (tas2562->model_id ==TAS2110 )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 70/484 firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pushpendra Singh <[email protected]>
[ Upstream commit a4447c0693830d5ecadd6e755cb7fdc55d86aacc ]
The scmi_notify() function is called from interrupt context to queue received notification events onto a per-protocol kfifo. When the kfifo is full, it logs a warning via dev_warn() for every dropped event.
Under conditions where the platform sends a burst of SCMI notifications faster than the deferred worker can drain the queue, this results in a flood of dev_warn() calls from IRQ context. Each call acquires the console lock and may execute blocking console writes, causing the CPU to be held in interrupt context for an extended period and leading to observable system stalls.
Fix this by switching to dev_warn_ratelimited() to limit the frequency of log messages when the notification queue is full. This reduces console overhead in interrupt context and prevents CPU stalls caused by excessive logging, while still preserving diagnostic visibility.
--- drivers/firmware/arm_scmi/notify.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/firmware/arm_scmi/notify.c +3 -3
@@ -595,9 +595,9 @@ int scmi_notify(const struct scmi_handle *handle, u8 proto_id, u8 evt_id,return -EINVAL ; }if (kfifo_avail (&r_evt->proto->equeue.kfifo) <sizeof (eh) + len) { -dev_warn (handle->dev, -"queue full, dropping proto_id:%d evt_id:%d ts:%lld\n" , - proto_id, evt_id,ktime_to_ns (ts)); +dev_warn_ratelimited (handle->dev, +"queue full, dropping proto_id:%d evt_id:%d ts:%lld\n" , + proto_id, evt_id,ktime_to_ns (ts));return -ENOMEM ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 71/484 ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert Szetei <[email protected]>
[ Upstream commit ec4215683e47424c9c4762fd3c60f552a3119142 ]
pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:
l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv()
-> ppp_input(&po->chan)
It runs under rcu_read_lock() holding only an l2tp_session reference and takes NO reference on the internal PPP channel (struct channel, chan->ppp) that ppp_input() dereferences.
The pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel are RCU-safe. But the internal struct channel is a separate allocation that ppp_release_channel() frees with a plain kfree():
close(data socket) -> pppol2tp_release() -> pppox_unbind_sock()
-> ppp_unregister_channel() -> ppp_release_channel() -> kfree(pch)
For a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit (no PPPIOCCONNECT, pch->ppp == NULL) and not bridged, teardown skips both ppp_disconnect_channel()'s synchronize_net() and ppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace period. rcu_read_lock() in pppol2tp_recv() does not protect against a plain kfree(), so an in-flight ppp_input() on one CPU can dereference the channel just freed by close() on another CPU.
The bug is reachable by an unprivileged user.
Defer the channel free to an RCU callback via call_rcu() so the grace period fences any in-flight ppp_input(). The disconnect and unbridge teardown paths already fence with synchronize_net()/synchronize_rcu(); call_rcu() does the same here without stalling the close() path.
--- drivers/net/ppp/ppp_generic.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/net/ppp/ppp_generic.c +15 -3
@@ -192,6 +192,7 @@ struct channel {struct list_head clist;/* link in list of channels per unit */ rwlock_t upl;/* protects `ppp' and 'bridge' */ struct channel __rcu *bridge;/* "bridged" ppp channel */ +struct rcu_head rcu;/* for RCU-deferred free of the channel */ #ifdef CONFIG_PPP_MULTILINK u8 avail;/* flag used in multilink stuff */ u8 had_frag;/* >= 1 fragments have been sent */
@@ -3555,6 +3556,18 @@ ppp_disconnect_channel(struct channel *pch)return err; } +/* Purge after the grace period: a late ppp_input() may still queue an +* skb on pch->file.rq before the last RCU reader drains. +*/ +static void ppp_release_channel_free (struct rcu_head *rcu) +{ + struct channel *pch = container_of(rcu, struct channel, rcu); + +skb_queue_purge (&pch->file.xq); +skb_queue_purge (&pch->file.rq); +kfree (pch); +} +/* * Free up the resources used by a ppp channel. */
@@ -3570,9 +3583,7 @@ static void ppp_destroy_channel(struct channel *pch)pr_err ("ppp: destroying undead channel %p !\n" , pch);return ; } -skb_queue_purge (&pch->file.xq); -skb_queue_purge (&pch->file.rq); -kfree (pch); +call_rcu (&pch->rcu, ppp_release_channel_free); } static void __exit ppp_cleanup(void)
@@ -3585,6 +3596,7 @@ static void __exit ppp_cleanup(void)device_destroy (ppp_class,MKDEV (PPP_MAJOR ,0 ));class_destroy (ppp_class);unregister_pernet_device (&ppp_net_ops); +rcu_barrier ();/* wait for RCU callbacks before module unload */ }/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 72/484 ipv4: fib: free fib_alias with kfree_rcu() on insert error path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit f2f152e94a67bc746afaf05a1b2702c195553112 ]
fib_table_insert() publishes new_fa into the leaf's fa_list with fib_insert_alias() before calling the fib entry notifiers. When a notifier fails, the error path removes new_fa with fib_remove_alias() (hlist_del_rcu) and frees it right away with kmem_cache_free().
fib_table_lookup() walks that list under rcu_read_lock() only, so a concurrent lookup that already reached new_fa keeps reading it after the free:
BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601) Read of size 1 at addr ffff88810676d4eb by task exploit/297 Call Trace: fib_table_lookup (net/ipv4/fib_trie.c:1601) ip_route_output_key_hash_rcu (net/ipv4/route.c:2814) ip_route_output_key_hash (net/ipv4/route.c:2705) __ip4_datagram_connect (net/ipv4/datagram.c:49) udp_connect (net/ipv4/udp.c:2144) __sys_connect (net/socket.c:2167) __x64_sys_connect (net/socket.c:2173) do_syscall_64 entry_SYSCALL_64_after_hwframe which belongs to the cache ip_fib_alias of size 56
Triggering the error path needs CAP_NET_ADMIN and a registered fib notifier that can reject a route; a netdevsim device whose IPv4 FIB resource is exhausted is enough.
Free new_fa with alias_free_mem_rcu(), as fib_table_delete() already does for a fib_alias removed from the trie.
--- net/ipv4/fib_trie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/fib_trie.c +1 -1
@@ -1390,7 +1390,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb, out_remove_new_fa:fib_remove_alias (t, tp, l, new_fa); out_free_new_fa: -kmem_cache_free (fn_alias_kmem, new_fa); +alias_free_mem_rcu (new_fa); out:fib_release_info (fi); err:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 73/484 net/iucv: take a reference on the socket found in afiucv_hs_rcv()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
[ Upstream commit 4fa349156043dc119721d067329714179f501749 ]
afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*() handlers without holding a reference. AF_IUCV sockets are not RCU-protected and are freed synchronously by iucv_sock_kill() -> sock_put(), so a concurrent close can free the socket in the window between read_unlock() and the handler, which then dereferences freed memory (for example sk->sk_data_ready() in afiucv_hs_callback_syn()).
Take a reference with sock_hold() while the socket is still on the list and release it with sock_put() once the handler has run.
--- net/iucv/af_iucv.c | 4 ++++ 1 file changed, 4 insertions(+)
net/iucv/af_iucv.c +4 -0
@@ -2090,6 +2090,8 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev, } } } +if (sk) +sock_hold (sk);read_unlock (&iucv_sk_list.lock);if (!iucv) sk =NULL ;
@@ -2139,6 +2141,8 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev,kfree_skb (skb); } +if (sk) +sock_put (sk);return err; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 74/484 ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit 4bbc16a353a98023e5ddfca7c1fc0e49971cf4d0 ]
sata_dwc_enable_interrupts() is called before platform_get_irq() and ata_host_activate(), leaving the SATA controller's interrupt mask enabled without a registered handler. If a later step fails (irq request, phy init, etc.) or if the controller asserts an interrupt during probe, the irq line may fire with no handler, causing a spurious interrupt storm.
Move sata_dwc_enable_interrupts() after ata_host_activate() so that interrupts are only unmasked once the handler is registered and the core is fully initialized.
--- drivers/ata/sata_dwc_460ex.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/ata/sata_dwc_460ex.c +2 -3
@@ -1168,9 +1168,6 @@ static int sata_dwc_probe(struct platform_device *ofdev)/* Save dev for later use in dev_xxx() routines */ hsdev->dev = dev; -/* Enable SATA Interrupts */ -sata_dwc_enable_interrupts (hsdev); -/* Get SATA interrupt number */ irq =irq_of_parse_and_map (np,0 );if (!irq) {
@@ -1203,6 +1200,8 @@ static int sata_dwc_probe(struct platform_device *ofdev)if (err)dev_err (dev,"failed to activate host" ); +/* Enable SATA Interrupts */ +sata_dwc_enable_interrupts (hsdev);return 0 ; error_out:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 75/484 ata: sata_dwc_460ex: use platform_get_irq()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit a4af122106f73ea510bb35a9ea1dedd980fc0db7 ]
Replace irq_of_parse_and_map() with platform_get_irq() in both sata_dwc_dma_init_old() and sata_dwc_probe(). This is the preferred way to obtain IRQs for platform devices and provides better error reporting. Remove the now-unnecessary #include <linux/of_irq.h>.
irq_of_parse_and_map() requires irq_dispose_mapping(), which is missing.
Also fix unused variable when CONFIG_SATA_DWC_OLD_DMA is disabled.
--- drivers/ata/sata_dwc_460ex.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-)
drivers/ata/sata_dwc_460ex.c +7 -14
@@ -19,7 +19,6 @@#include <linux/device.h> #include <linux/dmaengine.h> #include <linux/of.h> -#include <linux/of_irq.h> #include <linux/platform_device.h> #include <linux/phy/phy.h> #include <linux/libata.h>
@@ -226,7 +225,6 @@ static int sata_dwc_dma_init_old(struct platform_device *pdev, struct sata_dwc_device *hsdev) {struct device *dev = &pdev->dev; -struct device_node *np = dev->of_node; hsdev->dma =devm_kzalloc (dev,sizeof (*hsdev->dma),GFP_KERNEL );if (!hsdev->dma)
@@ -236,11 +234,9 @@ static int sata_dwc_dma_init_old(struct platform_device *pdev, hsdev->dma->id = pdev->id;/* Get SATA DMA interrupt number */ - hsdev->dma->irq =irq_of_parse_and_map (np,1 ); -if (!hsdev->dma->irq) { -dev_err (dev,"no SATA DMA irq\n" ); -return -ENODEV ; - } + hsdev->dma->irq =platform_get_irq (pdev,1 ); +if (hsdev->dma->irq <0 ) +return hsdev->dma->irq;/* Get physical SATA DMA register base address */ hsdev->dma->regs =devm_platform_ioremap_resource (pdev,1 );
@@ -1125,7 +1121,6 @@ static const struct ata_port_info sata_dwc_port_info[] = {static int sata_dwc_probe (struct platform_device *ofdev) {struct device *dev = &ofdev->dev; -struct device_node *np = dev->of_node;struct sata_dwc_device *hsdev;u32 idr, versionr;char *ver = (char *)&versionr;
@@ -1169,14 +1164,12 @@ static int sata_dwc_probe(struct platform_device *ofdev) hsdev->dev = dev;/* Get SATA interrupt number */ - irq =irq_of_parse_and_map (np,0 ); -if (!irq) { -dev_err (dev,"no SATA DMA irq\n" ); -return -ENODEV ; - } + irq =platform_get_irq (ofdev,0 ); +if (irq <0 ) +return irq;#ifdef CONFIG_SATA_DWC_OLD_DMA -if (!of_property_present (np,"dmas" )) { +if (!of_property_present (dev->of_node,"dmas" )) { err =sata_dwc_dma_init_old (ofdev, hsdev);if (err)return err;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 76/484 ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit 66c4e310ad71f41e41736d33dd8a1fb5eaaec7f3 ]
clear_interrupt_bit() ignores the bit argument and performs a read-write-back of the entire INTPR register. If INTPR uses standard Write-1-to-Clear semantics, this clears every pending interrupt bit, not just the intended one. Coalesced interrupts (e.g. DMAT + NEWFP) would be cleared together, silently losing the second event.
Write only the specific bit to clear so that other pending interrupts are preserved.
--- drivers/ata/sata_dwc_460ex.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/ata/sata_dwc_460ex.c +1 -2
@@ -394,8 +394,7 @@ static void clear_serror(struct ata_port *ap)static void clear_interrupt_bit (struct sata_dwc_device *hsdev,u32 bit) { -sata_dwc_writel (&hsdev->sata_dwc_regs->intpr, -sata_dwc_readl (&hsdev->sata_dwc_regs->intpr)); +sata_dwc_writel (&hsdev->sata_dwc_regs->intpr, bit); }static u32 qcmd_tag_to_mask (u8 tag)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 77/484 ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit c2130f6553f4a5cbdc259de069600117a995f197 ]
The hand-rolled bit-scanning loop in the NCQ completion path has an infinite loop bug. When tag_mask has only high bits set (e.g. 0x80000000), the inner while loop left-shifts tag_mask until it overflows to 0. At that point !(0 & 1) is always true and 0 <<= 1 stays 0, causing an infinite loop in hardirq context with a spinlock held.
Replace the open-coded bit-scanning with __ffs() which correctly finds the least significant set bit and is bounded by the width of the argument.
--- drivers/ata/sata_dwc_460ex.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
drivers/ata/sata_dwc_460ex.c +2 -7
@@ -607,14 +607,9 @@ static irqreturn_t sata_dwc_isr(int irq, void *dev_instance) status = ap->ops->sff_check_status (ap);dev_dbg (ap->dev,"%s ATA status register=0x%x\n" , __func__, status); - tag =0 ;while (tag_mask) { -while (!(tag_mask &0x00000001 )) { - tag++; - tag_mask <<=1 ; - } - - tag_mask &= (~0x00000001 ); + tag =__ffs (tag_mask); + tag_mask &= ~(1U << tag); qc =ata_qc_from_tag (ap, tag);if (unlikely (!qc)) {dev_err (ap->dev,"failed to get qc" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 78/484 ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 93b47e66cc6d6c6382d44b44f5e7f6fc3a7b38c3 ]
Salvador reported that the recent fix for applying the DSD quirk to Musical Fidelity devices broke for his M6s DAC model (2772:0502).
Although this is basically a firmware bug, the model in question is fairly old, and no further firmware update can be expected, so it'd be better to address in the driver side.
As an ad hoc workaround, skip the DSD quirk for this device by adding an empty quirk entry of 2772:0502; this essentially skips the later DSD quirk entry by the match with the vendor 2772.
--- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/quirks.c +2 -0
@@ -2269,6 +2269,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { QUIRK_FLAG_DSD_RAW),DEVICE_FLG (0x2708 ,0x0002 ,/* Audient iD14 */ QUIRK_FLAG_IGNORE_CTL_ERROR ), +DEVICE_FLG (0x2772 ,0x0502 ,/* Musical Fidelity M6s DAC */ +0 ),/* for avoiding QUIRK_FLAG_DSD_RAW with vendor match */ DEVICE_FLG (0x2912 ,0x30c8 ,/* Audioengine D1 */ QUIRK_FLAG_GET_SAMPLE_RATE ), DEVICE_FLG(0x2a70, 0x1881, /* OnePlus Technology (Shenzhen) Co., Ltd. BE02T */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 79/484 Bluetooth: qca: fix NVM tag length underflow in TLV parser
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit c90164ca0f7036942ba088eb7ea8d3f6c2352020 ]
In the TLV_TYPE_NVM branch of qca_tlv_check_data() the tag loop bound is "while (idx < length - sizeof(struct tlv_type_nvm))". "length" is a signed int from the firmware TLV header and sizeof(struct tlv_type_nvm) is a size_t (12), so "length" is converted to size_t and any firmware-supplied "length" < 12 makes the subtraction wrap to a huge value. The loop body then reads a 12-byte struct tlv_type_nvm past the end of the short vmalloc'd firmware buffer (and the EDL_TAG_ID_* handlers can write past it).
Rewrite the bound as "idx + sizeof(struct tlv_type_nvm) <= length"; both operands are non-negative, so it no longer underflows and a "length" too small for one record correctly skips the loop.
BUG: KASAN: vmalloc-out-of-bounds in qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421) Read of size 2 at addr ffffc900000e5004 by task kworker/u9:0/52 Workqueue: hci0 hci_power_on Call Trace: ... kasan_report (mm/kasan/report.c:595) qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421 drivers/bluetooth/btqca.c:617) qca_uart_setup (drivers/bluetooth/btqca.c:948) qca_setup (drivers/bluetooth/hci_qca.c:2029) hci_uart_setup (drivers/bluetooth/hci_ldisc.c:438) hci_dev_open_sync (net/bluetooth/hci_sync.c:5227) hci_power_on (net/bluetooth/hci_core.c:920) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
--- drivers/bluetooth/btqca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/bluetooth/btqca.c +1 -1
@@ -430,7 +430,7 @@ static int qca_tlv_check_data(struct hci_dev *hdev, idx =0 ; data = tlv->data; -while (idx < length -sizeof (struct tlv_type_nvm )) { +while (idx +sizeof (struct tlv_type_nvm ) <= length) { tlv_nvm = (struct tlv_type_nvm *)(data + idx); tag_id =le16_to_cpu (tlv_nvm->tag_id);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 80/484 Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit 16cd66443957e4ad42155c6fec401012f600c6f8 ]
Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF.
Take hdev->lock for hci_conn lookup and hci_abort_conn(). Don't use RCU to ensure the conn is fully initialized at this point.
--- net/bluetooth/mgmt.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
net/bluetooth/mgmt.c +16 -0
@@ -3005,6 +3005,8 @@ static int unpair_device_sync(struct hci_dev *hdev, void *data)struct mgmt_cp_unpair_device *cp = cmd->param;struct hci_conn *conn; +hci_dev_lock (hdev); +if (cp->addr.type ==BDADDR_BREDR ) conn =hci_conn_hash_lookup_ba (hdev,ACL_LINK , &cp->addr.bdaddr);
@@ -3012,6 +3014,11 @@ static int unpair_device_sync(struct hci_dev *hdev, void *data) conn =hci_conn_hash_lookup_le (hdev, &cp->addr.bdaddr,le_addr_type (cp->addr.type)); +if (conn) +hci_conn_get (conn); + +hci_dev_unlock (hdev); +if (!conn)return 0 ;
@@ -3019,6 +3026,7 @@ static int unpair_device_sync(struct hci_dev *hdev, void *data)* will clean up the connection no matter the error. */ hci_abort_conn (conn,HCI_ERROR_REMOTE_USER_TERM ); +hci_conn_put (conn);return 0 ; }
@@ -3166,6 +3174,8 @@ static int disconnect_sync(struct hci_dev *hdev, void *data)struct mgmt_cp_disconnect *cp = cmd->param;struct hci_conn *conn; +hci_dev_lock (hdev); +if (cp->addr.type ==BDADDR_BREDR ) conn =hci_conn_hash_lookup_ba (hdev,ACL_LINK , &cp->addr.bdaddr);
@@ -3173,6 +3183,11 @@ static int disconnect_sync(struct hci_dev *hdev, void *data) conn =hci_conn_hash_lookup_le (hdev, &cp->addr.bdaddr,le_addr_type (cp->addr.type)); +if (conn) +hci_conn_get (conn); + +hci_dev_unlock (hdev); +if (!conn)return -ENOTCONN ;
@@ -3180,6 +3195,7 @@ static int disconnect_sync(struct hci_dev *hdev, void *data)* will clean up the connection no matter the error. */ hci_abort_conn (conn,HCI_ERROR_REMOTE_USER_TERM ); +hci_conn_put (conn);return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 81/484 Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit da55f570191d5d72f10c607a7043b947eb05ea46 ]
Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hci_conn in hci_sync callbacks also needs to hold refcount to avoid UAF.
Take appropriate locks for hci_conn lookups, and take refcount for hci_conn pointers stored in mgmt_pending_cmd so that the pointer stays valid.
When accessing conn->state, ensure hdev->lock is held to avoid data race.
--- net/bluetooth/mgmt.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-)
net/bluetooth/mgmt.c +22 -4
@@ -7417,6 +7417,9 @@ static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) rp.max_tx_power =HCI_TX_POWER_INVALID ; } +if (conn) +hci_conn_put (conn); +mgmt_cmd_complete (cmd->sk, cmd->hdev->id,MGMT_OP_GET_CONN_INFO , status, &rp,sizeof (rp));
@@ -7431,6 +7434,8 @@ static int get_conn_info_sync(struct hci_dev *hdev, void *data)int err;__le16 handle; +hci_dev_lock (hdev); +/* Make sure we are still connected */ if (cp->addr.type ==BDADDR_BREDR ) conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
@@ -7438,12 +7443,16 @@ static int get_conn_info_sync(struct hci_dev *hdev, void *data)else conn =hci_conn_hash_lookup_ba (hdev,LE_LINK , &cp->addr.bdaddr); -if (!conn || conn->state !=BT_CONNECTED ) +if (!conn || conn->state !=BT_CONNECTED ) { +hci_dev_unlock (hdev);return MGMT_STATUS_NOT_CONNECTED ; + } - cmd->user_data = conn; + cmd->user_data =hci_conn_get (conn); handle =cpu_to_le16 (conn->handle); +hci_dev_unlock (hdev); +/* Refresh RSSI each time */ err =hci_read_rssi_sync (hdev, handle);
@@ -7577,6 +7586,9 @@ static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) } complete: +if (conn) +hci_conn_put (conn); +mgmt_cmd_complete (cmd->sk, cmd->hdev->id, cmd->opcode, status, &rp,sizeof (rp));
@@ -7593,15 +7605,21 @@ static int get_clock_info_sync(struct hci_dev *hdev, void *data)memset (&hci_cp,0 ,sizeof (hci_cp));hci_read_clock_sync (hdev, &hci_cp); +hci_dev_lock (hdev); +/* Make sure connection still exists */ conn =hci_conn_hash_lookup_ba (hdev,ACL_LINK , &cp->addr.bdaddr); -if (!conn || conn->state !=BT_CONNECTED ) +if (!conn || conn->state !=BT_CONNECTED ) { +hci_dev_unlock (hdev);return MGMT_STATUS_NOT_CONNECTED ; + } - cmd->user_data = conn; + cmd->user_data =hci_conn_get (conn); hci_cp.handle =cpu_to_le16 (conn->handle); hci_cp.which =0x01 ;/* Piconet clock */ +hci_dev_unlock (hdev); +return hci_read_clock_sync (hdev, &hci_cp); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 82/484 Bluetooth: hci_qca: Clear memdump state on invalid dump size
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit bf587a10c33e5571a299742e45bc18960b9912e7 ]
qca_controller_memdump() allocates qca->qca_memdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active, and reads the advertised dump size.
If the controller reports a zero dump size, the error path frees the local qca_memdump object and returns without clearing qca->qca_memdump or undoing the collection state. A later memdump work item initializes its local pointer from qca->qca_memdump and skips allocation when that pointer is non-NULL, so it can operate on freed memory. The stale collection and IBS-disabled flags can also leave waiters or later transmit handling blocked behind an aborted dump.
Clear the saved pointer and memdump state before returning from the invalid-size path, matching the cleanup used when hci_devcd_init() fails.
A static analysis checker reported the stale memdump state, and manual source review confirmed the invalid-size failure path.
--- drivers/bluetooth/hci_qca.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/bluetooth/hci_qca.c +4 -0
@@ -1069,6 +1069,10 @@ static void qca_controller_memdump(struct work_struct *work)if (!(qca_memdump->ram_dump_size)) {bt_dev_err (hu->hdev,"Rx invalid memdump size" );kfree (qca_memdump); + qca->qca_memdump =NULL ; + qca->memdump_state =QCA_MEMDUMP_COLLECTED ; +clear_and_wake_up_bit (QCA_MEMDUMP_COLLECTION , &qca->flags); +clear_bit (QCA_IBS_DISABLED , &qca->flags);kfree_skb (skb);mutex_unlock (&qca->hci_memdump_lock);return ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 83/484 smb/client: handle overlapping allocated ranges in fallocate
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huiwen He <[email protected]>
[ Upstream commit b09ae45d85dc816987a71db9eebc54b0ae288e94 ]
smb3_simple_fallocate_range() can skip holes when an allocated range returned by the server starts before the current fallocate offset. The skipped hole is not zero-filled, but fallocate still returns success. A later write to that hole may therefore fail with ENOSPC.
The function queries allocated ranges so that it can preserve existing contents and write zeroes only into holes. However, the server may return a range that starts before the current fallocate offset.
For example, assume the fallocate request is [100, 400) and the only allocated range returned by the server is [0, 200):
Request: [100, 400)
Server range: [ 0, 200) allocated
Correct:
[100, 200) allocated data, skip
[200, 400) hole, zero-fill
Current:
[100, 300) skipped
[300, 400) zero-filled afterwardsThe current code adds the full server range length, 200, to the current offset 100 and moves to 300. As a result, the hole in [200, 300) is skipped without being zero-filled.
Fix this by advancing only over the part of the allocated range that overlaps the current fallocate offset. Ignore ranges that end before the current offset and reject ranges whose end offset overflows.
This also prevents a malformed range length from causing an out-of-bounds zero-buffer read.
--- fs/smb/client/smb2ops.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-)
fs/smb/client/smb2ops.c +18 -7
@@ -3417,6 +3417,7 @@ static int smb3_simple_fallocate_range(unsigned int xid,struct file_allocated_range_buffer in_data, *out_data =NULL , *tmp_data;u32 out_data_len;char *buf =NULL ; +u64 range_start, range_len, range_end;loff_t l;int rc;
@@ -3453,13 +3454,21 @@ static int smb3_simple_fallocate_range(unsigned int xid, goto out; } -if (off <le64_to_cpu (tmp_data->file_offset)) { + range_start =le64_to_cpu (tmp_data->file_offset); + range_len =le64_to_cpu (tmp_data->length); +if (check_add_overflow (range_start, range_len, &range_end) || + range_end >S64_MAX ) { + rc = -EINVAL ; + goto out; + } + +if (off < range_start) {/* * We are at a hole. Write until the end of the region * or until the next allocated data, * whichever comes next. */ - l =le64_to_cpu (tmp_data->file_offset) - off; + l = range_start - off;if (len < l) l = len; rc = smb3_simple_fallocate_write_range(xid, tcon,
@@ -3476,11 +3485,13 @@ static int smb3_simple_fallocate_range(unsigned int xid,* until the end of the data or the end of the region * we are supposed to fallocate, whichever comes first. */ - l =le64_to_cpu (tmp_data->length); -if (len < l) - l = len; - off += l; - len -= l; +if (off < range_end) { + l = range_end - off; +if (len < l) + l = len; + off += l; + len -= l; + } tmp_data = &tmp_data[1 ]; out_data_len -=sizeof (struct file_allocated_range_buffer );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 84/484 drm/i915/gt: use correct selftest config symbol
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit a82f1bb8191aec98a971a2196136016ef70c0880 ]
intel_engine_user.c checks CONFIG_DRM_I915_SELFTESTS before running the engine UABI isolation check. Kconfig defines DRM_I915_SELFTEST, without the trailing "S", and the rest of i915 uses CONFIG_DRM_I915_SELFTEST.
Because CONFIG_DRM_I915_SELFTESTS is not backed by any Kconfig symbol, the IS_ENABLED() test is always false. Use the existing selftest symbol so the debug/selftest guarded path can be reached when selftests are enabled.
This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the Kconfig definition and the inconsistent guard in intel_engine_user.c.
--- drivers/gpu/drm/i915/gt/intel_engine_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/gt/intel_engine_user.c +1 -1
@@ -260,7 +260,7 @@ void intel_engines_driver_register(struct drm_i915_private *i915) p = &prev->rb_right; } -if (IS_ENABLED (CONFIG_DRM_I915_SELFTESTS ) && +if (IS_ENABLED (CONFIG_DRM_I915_SELFTEST ) &&IS_ENABLED (CONFIG_DRM_I915_DEBUG_GEM )) {struct intel_engine_cs *engine;unsigned int isolation;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 85/484 sched/vtime: Get rid of generic vtime_task_switch() implementation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Gordeev <[email protected]>
[ Upstream commit 89d6910cc562ab34d1f1c08f3cf0a9700b8bf2c4 ]
The generic vtime_task_switch() implementation gets built only if __ARCH_HAS_VTIME_TASK_SWITCH is not defined, but requires an architecture to implement arch_vtime_task_switch() callback at the same time, which is confusing.
Further, arch_vtime_task_switch() is implemented for 32-bit PowerPC architecture only and vtime_task_switch() generic variant is rather superfluous.
Simplify the whole vtime_task_switch() wiring by moving the existing generic implementation to PowerPC.
Stable-dep-of: c1c1ffa490fc ("powerpc/vtime: Initialize starttime at boot for native accounting")
--- arch/powerpc/include/asm/cputime.h | 13 ------------- arch/powerpc/kernel/time.c | 22 ++++++++++++++++++++++ kernel/sched/cputime.c | 13 ------------- 3 files changed, 22 insertions(+), 26 deletions(-)
arch/powerpc/include/asm/cputime.h +0 -13
@@ -32,23 +32,10 @@#ifdef CONFIG_PPC64 #define get_accounting (tsk) (&get_paca()->accounting)#define raw_get_accounting (tsk) (&local_paca->accounting) -static inline void arch_vtime_task_switch (struct task_struct *tsk) { }#else #define get_accounting (tsk) (&task_thread_info(tsk)->accounting)#define raw_get_accounting (tsk) get_accounting(tsk) -/* -* Called from the context switch with interrupts disabled, to charge all -* accumulated times to the current process, and to prepare accounting on -* the next process. -*/ -static inline void arch_vtime_task_switch (struct task_struct *prev) -{ -struct cpu_accounting_data *acct =get_accounting (current); -struct cpu_accounting_data *acct0 =get_accounting (prev); - - acct->starttime = acct0->starttime; -}#endif /*
arch/powerpc/kernel/time.c +22 -0
@@ -354,6 +354,28 @@ void vtime_flush(struct task_struct *tsk) acct->hardirq_time =0 ; acct->softirq_time = 0; } + +/* +* Called from the context switch with interrupts disabled, to charge all +* accumulated times to the current process, and to prepare accounting on +* the next process. +*/ +void vtime_task_switch (struct task_struct *prev) +{ +if (is_idle_task (prev)) +vtime_account_idle (prev); +else +vtime_account_kernel (prev); + +vtime_flush (prev); + +if (!IS_ENABLED (CONFIG_PPC64 )) { +struct cpu_accounting_data *acct =get_accounting (current); +struct cpu_accounting_data *acct0 =get_accounting (prev); + + acct->starttime = acct0->starttime; + } +}#endif /* CONFIG_VIRT_CPU_ACCOUNTING_NATIVE */ void __no_kcsan __delay(unsigned long loops)
kernel/sched/cputime.c +0 -13
@@ -424,19 +424,6 @@ static inline void irqtime_account_process_tick(struct task_struct *p, int user_*/ #ifdef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE -# ifndef __ARCH_HAS_VTIME_TASK_SWITCH -void vtime_task_switch (struct task_struct *prev) -{ -if (is_idle_task (prev)) -vtime_account_idle (prev); -else -vtime_account_kernel (prev); - -vtime_flush (prev); -arch_vtime_task_switch (prev); -} -# endif -void vtime_account_irq (struct task_struct *tsk,unsigned int offset) {unsigned int pc =irq_count () - offset;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 86/484 powerpc/time: Prepare to stop elapsing in dynticks-idle
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <[email protected]>
[ Upstream commit c8ba971cf8567d49eb5f43ee90c4e50424331c18 ]
Currently the tick subsystem stores the idle cputime accounting in private fields, allowing cohabitation with architecture idle vtime accounting. The former is fetched on online CPUs, the latter on offline CPUs.
For consolidation purpose, architecture vtime accounting will continue to account the cputime but will make a break when the idle tick is stopped. The dyntick cputime accounting will then be relayed by the tick subsystem so that the idle cputime is still seen advancing coherently even when the tick isn't there to flush the idle vtime.
Prepare for that and introduce three new APIs which will be used in subsequent patches:
- vtime_dynticks_start() is deemed to be called when idle enters in dyntick mode. The idle cputime that elapsed so far is accumulated.
- vtime_dynticks_stop() is deemed to be called when idle exits from dyntick mode. The vtime entry clocks are fast-forward to current time so that idle accounting restarts elapsing from now.
- vtime_reset() is deemed to be called from dynticks idle IRQ entry to fast-forward the clock to current time so that the IRQ time is still accounted by vtime while nohz cputime is paused.
Also accumulated vtime won't be flushed from dyntick-idle ticks to avoid accounting twice the idle cputime, along with nohz accounting.
Stable-dep-of: c1c1ffa490fc ("powerpc/vtime: Initialize starttime at boot for native accounting")
--- arch/powerpc/kernel/time.c | 41 ++++++++++++++++++++++++++++++++++++++ include/linux/vtime.h | 6 ++++++ 2 files changed, 47 insertions(+)
arch/powerpc/kernel/time.c +41 -0
@@ -376,6 +376,47 @@ void vtime_task_switch(struct task_struct *prev) acct->starttime = acct0->starttime; } } + +#ifdef CONFIG_NO_HZ_COMMON +/** +* vtime_reset - Fast forward vtime entry clocks +* +* Called from dynticks idle IRQ entry to fast-forward the clocks to current time +* so that the IRQ time is still accounted by vtime while nohz cputime is paused. +*/ +void vtime_reset (void ) +{ +struct cpu_accounting_data *acct =get_accounting (current); + + acct->starttime =mftb (); +#ifdef CONFIG_ARCH_HAS_SCALED_CPUTIME + acct->startspurr =read_spurr (acct->starttime); +#endif +} + +/** +* vtime_dyntick_start - Inform vtime about entry to idle-dynticks +* +* Called when idle enters in dyntick mode. The idle cputime that elapsed so far +* is accumulated and the tick subsystem takes over the idle cputime accounting. +*/ +void vtime_dyntick_start (void ) +{ +vtime_account_idle (current); +} + +/** +* vtime_dyntick_stop - Inform vtime about exit from idle-dynticks +* +* Called when idle exits from dyntick mode. The vtime entry clocks are +* fast-forward to current time so that idle accounting restarts elapsing from +* now. +*/ +void vtime_dyntick_stop (void ) +{ +vtime_reset (); +} +#endif /* CONFIG_NO_HZ_COMMON */ #endif /* CONFIG_VIRT_CPU_ACCOUNTING_NATIVE */ void __no_kcsan __delay(unsigned long loops)
include/linux/vtime.h +6 -0
@@ -37,11 +37,17 @@ extern void vtime_account_irq(struct task_struct *tsk, unsigned int offset);extern void vtime_account_softirq (struct task_struct *tsk);extern void vtime_account_hardirq (struct task_struct *tsk);extern void vtime_flush (struct task_struct *tsk); +extern void vtime_reset (void ); +extern void vtime_dyntick_start (void ); +extern void vtime_dyntick_stop (void );#else /* !CONFIG_VIRT_CPU_ACCOUNTING_NATIVE */ static inline void vtime_account_irq (struct task_struct *tsk,unsigned int offset) { }static inline void vtime_account_softirq (struct task_struct *tsk) { }static inline void vtime_account_hardirq (struct task_struct *tsk) { }static inline void vtime_flush (struct task_struct *tsk) { } +static inline void vtime_reset (void ) { } +static inline void vtime_dyntick_start (void ) { } +static inline void vtime_dyntick_stop (void ) { }#endif /*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 87/484 powerpc/vtime: Initialize starttime at boot for native accounting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shrikanth Hegde <[email protected]>
[ Upstream commit c1c1ffa490fc33591e90852ed0d38804dd20bc36 ]
It was observed that /proc/stat had very large value for one ore more CPUs. It was more visible after recent code simplifications around cpustats.
System has 240 CPUs.
cat /proc/uptime;
194.18 46500.55
cat /proc/stat
cpu 5966 39 837032887 4650070 164 185 100 0 0 0
cpu0 108 0 837030890 19109 24 4 23 0 0 0
Since uptime is 194s, system time of each CPU can't be more than 19400. Sum of system time of all CPUs can't be more than 19400*240 4656000. In fact huge value is close to mftb(). Note mftb doesn't reset on powerVM when the LPAR restart. It only resets when whole system resets. The same issue exists for kexec too.
This happens since starttime is not setup at init time. Once it is set then subsequent vtime_delta will return the right delta.
Fix it by initializing the starttime during CPU initialization. This fixes the large times seen.
cat /proc/uptime; cat /proc/stat
15.78 3694.63
cpu 6035 35 1347 369479 23 144 49 0 0 0
cpu0 19 0 38 1508 0 1 14 0 0 0
Now, system time is reported as expected.
--- arch/powerpc/kernel/time.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/kernel/time.c +3 -1
@@ -377,7 +377,6 @@ void vtime_task_switch(struct task_struct *prev) } } -#ifdef CONFIG_NO_HZ_COMMON /** * vtime_reset - Fast forward vtime entry clocks *
@@ -394,6 +393,7 @@ void vtime_reset(void)#endif } +#ifdef CONFIG_NO_HZ_COMMON /** * vtime_dyntick_start - Inform vtime about entry to idle-dynticks *
@@ -927,6 +927,7 @@ static void __init set_decrementer_max(void)static void __init init_decrementer_clockevent (void ) {register_decrementer_clockevent (smp_processor_id ()); +vtime_reset (); }void secondary_cpu_time_init (void )
@@ -942,6 +943,7 @@ void secondary_cpu_time_init(void)/* FIME: Should make unrelated change to move snapshot_timebase * call here ! */ register_decrementer_clockevent (smp_processor_id ()); +vtime_reset (); }/* This function is only called on the boot processor */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 88/484 bpf, sockmap: Reject unhashed UDP sockets on sockmap update
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 66efd3368ae10d05e08fbe6425b50fdec7186ac7 ]
UDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means sk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false.
Because sockmap accepts unbound UDP sockets, a BPF program can increment a socket's refcount via lookup. If the socket is subsequently bound, the transition from unbound to bound causes bpf_sk_release() to skip the decrement of the refcount, causing a memory leak.
unreferenced object 0xffff88810bc2eb40 (size 1984):
comm "test_progs", pid 2451, jiffies 4295320596 hex dump (first 32 bytes):
7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00 ................
02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
backtrace (crc bdee079d):
kmem_cache_alloc_noprof+0x557/0x660
sk_prot_alloc+0x69/0x240
sk_alloc+0x30/0x460
inet_create+0x2ce/0xf80
__sock_create+0x25b/0x5c0
__sys_socket+0x119/0x1d0
__x64_sys_socket+0x72/0xd0
do_syscall_64+0xa1/0x5f0
entry_SYSCALL_64_after_hwframe+0x76/0x7eInstead of special-casing for refcounted sockets, reject unhashed UDP sockets during sockmap updates, as there is no benefit to supporting those. This effectively reverts the commit under Fixes, with two exceptions:
1. sock_map_sk_state_allowed() maintains a fall-through return true.
2. In the spirit of commit b8b8315e39ff ("bpf, sockmap: Remove unhash handler for BPF sockmap usage"), the proto::unhash BPF handler is not reintroduced.
Historical note: this issue is related to commit 67312adc96b5 ("bpf: reject unhashed sockets in bpf_sk_assign").
--- net/core/sock_map.c | 2 ++ 1 file changed, 2 insertions(+)
net/core/sock_map.c +2 -0
@@ -539,6 +539,8 @@ static bool sock_map_sk_state_allowed(const struct sock *sk) {if (sk_is_tcp (sk))return (1 << sk->sk_state) & (TCPF_ESTABLISHED |TCPF_LISTEN ); +if (sk_is_udp (sk)) +return sk_hashed (sk);if (sk_is_stream_unix (sk))return (1 << sk->sk_state) &TCPF_ESTABLISHED ; if (sk_is_vsock(sk) &&
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 89/484 can: j1939: fix lockless local-destination check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuhao Fu <[email protected]>
[ Upstream commit e4e8af62adab2fdcca230006f829407a953070cd ]
j1939_priv.ents[].nusers is documented as protected by priv->lock, and its updates already happen under that lock. j1939_can_recv() also reads it under read_lock_bh(). However, j1939_session_skb_queue() and j1939_tp_send() still read priv->ents[da].nusers without taking the lock.
Those transport-side checks decide whether to set J1939_ECU_LOCAL_DST, so they can race with j1939_local_ecu_get() and j1939_local_ecu_put() while userspace is binding or releasing sockets concurrently with TP traffic. This can misclassify TP/ETP sessions as local or remote and take the wrong transport path.
Fix both transport paths by routing the destination-locality check through a helper that reads ents[].nusers under read_lock_bh(&priv->lock).
--- net/can/j1939/transport.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
net/can/j1939/transport.c +14 -4
@@ -350,6 +350,18 @@ static void j1939_session_skb_drop_old(struct j1939_session *session) } } +static bool j1939_address_is_local (struct j1939_priv *priv,u8 addr) +{ +bool local = false; + +read_lock_bh (&priv->lock); +if (j1939_address_is_unicast (addr) && priv->ents[addr].nusers) + local = true; +read_unlock_bh (&priv->lock); + +return local; +} +void j1939_session_skb_queue (struct j1939_session *session,struct sk_buff *skb) {
@@ -358,8 +370,7 @@ void j1939_session_skb_queue(struct j1939_session *session,j1939_ac_fixup (priv, skb); -if (j1939_address_is_unicast (skcb->addr.da) && - priv->ents[skcb->addr.da].nusers) +if (j1939_address_is_local (priv, skcb->addr.da)) skcb->flags |=J1939_ECU_LOCAL_DST ; skcb->flags |=J1939_ECU_LOCAL_SRC ;
@@ -2021,8 +2032,7 @@ struct j1939_session *j1939_tp_send(struct j1939_priv *priv,return ERR_PTR (ret);/* fix DST flags, it may be used there soon */ -if (j1939_address_is_unicast (skcb->addr.da) && - priv->ents[skcb->addr.da].nusers) +if (j1939_address_is_local (priv, skcb->addr.da)) skcb->flags |=J1939_ECU_LOCAL_DST ;/* src is always local, I'm sending ... */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 90/484 ksmbd: pin conn during async oplock break notification
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qihang <[email protected]>
[ Upstream commit aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9 ]
smb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn pointer in an async ksmbd_work and then queue that work on ksmbd-io. The work only increments conn->r_count, which prevents teardown from passing the pending-request wait after the increment, but it does not pin the struct ksmbd_conn object.
If connection teardown races with an oplock break notification, the last conn reference can be dropped before the queued worker finishes. The worker then uses the freed conn in ksmbd_conn_write() and ksmbd_conn_r_count_dec().
Take a real conn reference when publishing the conn pointer to the async work item, and drop it after the notification work has decremented r_count. Apply the same lifetime rule to lease break notification, which uses the same work->conn pattern.
--- fs/smb/server/oplock.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/smb/server/oplock.c +4 -2
@@ -705,6 +705,7 @@ static void __smb2_oplock_break_noti(struct work_struct *wk) out:ksmbd_free_work_struct (work);ksmbd_conn_r_count_dec (conn); +ksmbd_conn_put (conn); }/**
@@ -740,7 +741,7 @@ static int smb2_oplock_break_noti(struct oplock_info *opinfo) br_info->open_trunc = opinfo->open_trunc; work->request_buf = (char *)br_info; - work->conn = conn; + work->conn =ksmbd_conn_get (conn); work->sess = opinfo->sess;ksmbd_conn_r_count_inc (conn);
@@ -814,6 +815,7 @@ static void __smb2_lease_break_noti(struct work_struct *wk) out:ksmbd_free_work_struct (work);ksmbd_conn_r_count_dec (conn); +ksmbd_conn_put (conn); }/**
@@ -853,7 +855,7 @@ static int smb2_lease_break_noti(struct oplock_info *opinfo)memcpy (br_info->lease_key, lease->lease_key,SMB2_LEASE_KEY_SIZE ); work->request_buf = (char *)br_info; - work->conn = conn; + work->conn =ksmbd_conn_get (conn); work->sess = opinfo->sess;ksmbd_conn_r_count_inc (conn);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 91/484 ksmbd: validate compound request size before reading StructureSize2
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei (Microsoft) <[email protected]>
[ Upstream commit 15b38176fd1530372905c602fde51fe89ec8c877 ]
When ksmbd validates a compound (chained) SMB2 request, ksmbd_smb2_check_message() reads pdu->StructureSize2 without first checking that the compound element is large enough to contain it. StructureSize2 is a 2-byte field at offset 64 (__SMB2_HEADER_STRUCTURE_SIZE) from the start of each element.
The compound-walking logic only guarantees that a full 64-byte SMB2 header is present for the trailing element: when NextCommand is 0, len is reduced to the number of bytes remaining after next_smb2_rcv_hdr_off. A remote client can craft a compound request whose last element has exactly 64 bytes, so the 2-byte StructureSize2 read at offset 64 extends one byte past the receive buffer, producing a slab-out-of-bounds read.
BUG: KASAN: slab-out-of-bounds in ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402) Read of size 2 at addr ffff888012ae31ac by task kworker/0:1/14 The buggy address is located 172 bytes inside of allocated 173-byte region Workqueue: ksmbd-io handle_ksmbd_work Call Trace: ... kasan_report (mm/kasan/report.c:595) ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402) handle_ksmbd_work (fs/smb/server/server.c:119) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Reject any compound element that is too small to hold StructureSize2 before dereferencing it.
--- fs/smb/server/smb2misc.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/smb/server/smb2misc.c +5 -0
@@ -400,6 +400,11 @@ int ksmbd_smb2_check_message(struct ksmbd_work *work)return 1 ; } +if (len < __SMB2_HEADER_STRUCTURE_SIZE +sizeof (__le16)) { +ksmbd_debug (SMB ,"Message is too small for StructureSize2\n" ); +return 1 ; + } +if (smb2_req_struct_sizes[command] != pdu->StructureSize2) { if (!(command == SMB2_OPLOCK_BREAK_HE && (le16_to_cpu(pdu->StructureSize2) == OP_BREAK_STRUCT_SIZE_20 ||
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 92/484 drm/i915/selftests: Fix GT PM sort comparators
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emre Cecanpunar <[email protected]>
[ Upstream commit 612978b83f45bf7018815209db5395d759db6f26 ]
Compare the sampled clock values instead of their addresses. Comparing addresses leaves the samples unsorted, preventing the code from discarding the minimum and maximum samples.
--- drivers/gpu/drm/i915/gt/selftest_gt_pm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/gt/selftest_gt_pm.c +4 -4
@@ -16,9 +16,9 @@ static int cmp_u64(const void *A, const void *B) {const u64 *a =A , *b =B ; -if (a < b) +if (*a < *b)return -1 ; -else if (a > b) +else if (*a > *b)return 1 ;else return 0 ;
@@ -28,9 +28,9 @@ static int cmp_u32(const void *A, const void *B) {const u32 *a =A , *b =B ; -if (a < b) +if (*a < *b)return -1 ; -else if (a > b) +else if (*a > *b)return 1 ;else return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 93/484 net/sched: act_tunnel_key: Defer dst_release to RCU callback
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit f1f5c8a3955f8fda3f84ed883ac8daa1847e724c ]
Fix a race-condition use-after-free in tunnel_key_release_params().
The function releases the metadata_dst of the old params synchronously via dst_release() while deferring the params struct free with kfree_rcu(). A concurrent tunnel_key_act() reader on the datapath may still hold the old params pointer (under rcu_read_lock_bh) and proceed to call dst_clone(¶ms->tcft_enc_metadata->dst) after the writer's dst_release has already pushed the dst's rcuref to RCUREF_DEAD.
[email protected] produced a poc which i (and Victor) verified that KASAN reports:
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 BUG: KASAN: slab-use-after-free in atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326 BUG: KASAN: slab-use-after-free in __rcuref_put include/linux/rcuref.h:109 BUG: KASAN: slab-use-after-free in rcuref_put include/linux/rcuref.h:173 BUG: KASAN: slab-use-after-free in dst_release+0x5b/0x370 net/core/dst.c:168 Write of size 4 at addr ffff88806158de40 by task poc/9388 CPU: 0 UID: 0 PID: 9388 Comm: poc Tainted: G W 7.1.0-rc7 #7 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 print_report+0x139/0x4ad mm/kasan/report.c:482 kasan_report+0xe4/0x1d0 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:186 kasan_check_range+0x125/0x200 mm/kasan/generic.c:200 instrument_atomic_read_write include/linux/instrumented.h:112 atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326 __rcuref_put include/linux/rcuref.h:109 rcuref_put include/linux/rcuref.h:173 dst_release+0x5b/0x370 net/core/dst.c:168 refdst_drop include/net/dst.h:272 skb_dst_drop include/net/dst.h:284 skb_release_head_state+0x293/0x400 net/core/skbuff.c:1163 skb_release_all net/core/skbuff.c:1187 [..] Allocated by task 9391: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 __kasan_kmalloc+0x9a/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 __do_kmalloc_node mm/slub.c:5296 __kmalloc_noprof+0x2f1/0x830 mm/slub.c:5308 kmalloc_noprof include/linux/slab.h:954 kzalloc_noprof include/linux/slab.h:1188 offload_action_alloc+0x2f/0x130 net/core/flow_offload.c:35 tcf_action_offload_add_ex+0x1ba/0x880 net/sched/act_api.c:258 tcf_action_offload_add net/sched/act_api.c:293 tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547 tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101 [..] Freed by task 9391: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 __kasan_slab_free+0x6b/0x90 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 slab_free_hook mm/slub.c:2689 slab_free mm/slub.c:6251 kfree+0x21f/0x6b0 mm/slub.c:6566 tcf_action_offload_add_ex+0x4ad/0x880 net/sched/act_api.c:284 tcf_action_offload_add net/sched/act_api.c:293 tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547 tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101 The buggy address belongs to the object at ffff88806158de00 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 64 bytes inside of
freed 256-byte region [ffff88806158de00, ffff88806158df00)
The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x4fff00000000240(workingset|head|node=1|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 04fff00000000240 ffff88801c841b40 ffffea0001856290 ffffea0001856190 raw: ffff88806158d600 0000000800100009 00000000f5000000 0000000000000000
head: 04fff00000000240 ffff88801c841b40 ffffea0001856290 ffffea0001856190
head: ffff88806158d600 0000000800100009 00000000f5000000 0000000000000000
head: 04fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9391, tgid 9378 (poc), ts 123227323196, free_ts 0 set_page_owner include/linux/page_owner.h:32 post_alloc_hook+0xfe/0x140 mm/page_alloc.c:1853 prep_new_page mm/page_alloc.c:1861 get_page_from_freelist+0x110c/0x2fc0 mm/page_alloc.c:3941 __alloc_frozen_pages_noprof+0x263/0x2bc0 mm/page_alloc.c:5221 alloc_slab_page mm/slub.c:3278 allocate_slab mm/slub.c:3467 new_slab+0xa6/0x690 mm/slub.c:3525 refill_objects+0x271/0x420 mm/slub.c:7272 refill_sheaf mm/slub.c:2816 __pcs_replace_empty_main+0x373/0x630 mm/slub.c:4652 alloc_from_pcs mm/slub.c:4750 slab_alloc_node mm/slub.c:4884 __do_kmalloc_node mm/slub.c:5295 __kmalloc_noprof+0x66d/0x830 mm/slub.c:5308 kmalloc_noprof include/linux/slab.h:954 metadata_dst_alloc+0x26/0x90 net/core/dst.c:298 tun_rx_dst include/net/dst_metadata.h:144 __ip_tun_set_dst include/net/dst_metadata.h:208 tunnel_key_init+0xb01/0x1b90 net/sched/act_tunnel_key.c:451 tcf_action_init_1+0x46b/0x6c0 net/sched/act_api.c:1428 tcf_action_init+0x448/0xa20 net/sched/act_api.c:1503 tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101
[..]
==================================================================
Fix by moving dst_release() into a custom RCU callback that runs after the grace period, matching the lifetime of the containing params struct. Readers in the datapath therefore always find a live rcuref when calling dst_clone().
--- net/sched/act_tunnel_key.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
net/sched/act_tunnel_key.c +10 -4
@@ -344,14 +344,20 @@ static const struct nla_policy tunnel_key_policy[TCA_TUNNEL_KEY_MAX + 1] = { [TCA_TUNNEL_KEY_ENC_TTL] = { .type = NLA_U8 }, }; -static void tunnel_key_release_params (struct tcf_tunnel_key_params *p) +static void tunnel_key_release_params_rcu (struct rcu_head *head) { -if (!p) -return ; +struct tcf_tunnel_key_params *p =container_of (head,typeof (*p), rcu); +if (p->tcft_action ==TCA_TUNNEL_KEY_ACT_SET )dst_release (&p->tcft_enc_metadata->dst); +kfree (p); +} -kfree_rcu (p, rcu); +static void tunnel_key_release_params (struct tcf_tunnel_key_params *p) +{ +if (!p) +return ; +call_rcu (&p->rcu, tunnel_key_release_params_rcu); } static int tunnel_key_init(struct net *net, struct nlattr *nla,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 94/484 sctp: fix auth_hmacs array size in struct sctp_cookie
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit e0b5252a59383b77d1b8dbeda00b7184dd95f4d3 ]
The auth_hmacs array in struct sctp_cookie is supposed to store a complete SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr followed by N HMAC identifiers.
However, the array size was calculated using an extra 2 bytes instead of sizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers are configured, the HMAC-ALGO parameter stored in the endpoint is larger than the auth_hmacs buffer in the cookie.
As a result, sctp_association_init() copies beyond the end of auth_hmacs when initializing the association, corrupting the adjacent auth_chunks field. This can lead to an invalid HMAC identifier being accepted and later cause an out-of-bounds read in sctp_auth_get_hmac().
Fix the array size calculation by including the full SCTP parameter header size.
--- include/net/sctp/structs.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/net/sctp/structs.h +2 -1
@@ -322,7 +322,8 @@ struct sctp_cookie {__u8 auth_random[sizeof (struct sctp_paramhdr ) +SCTP_AUTH_RANDOM_LENGTH ]; -__u8 auth_hmacs[SCTP_AUTH_NUM_HMACS *sizeof (__u16) +2 ]; +__u8 auth_hmacs[sizeof (struct sctp_paramhdr ) + +SCTP_AUTH_NUM_HMACS *sizeof (__u16)];__u8 auth_chunks[sizeof (struct sctp_paramhdr ) +SCTP_AUTH_MAX_CHUNKS ];/* This is a shim for my peer's INIT packet, followed by
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 95/484 mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit 56d96fededd61192cd7cc8d2b0f36adfd59036c3 ]
On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed attribute table itself instead of calling ip_valid_fib_dump_req(). The RTA_OIF arm passes tb[RTA_OIF] to nla_get_u32() without checking it is present, so an RTM_GETROUTE dump for AF_MPLS with strict checking and no RTA_OIF hits a NULL dereference.
RTM_GETROUTE is RTNL_KIND_GET, which rtnetlink_rcv_msg() permits without CAP_NET_ADMIN, so an unprivileged user can trigger it.
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189)
Call Trace:
mpls_dump_routes (net/mpls/af_mpls.c:2236)
netlink_dump (net/netlink/af_netlink.c:2331)
__netlink_dump_start (net/netlink/af_netlink.c:2446)
rtnetlink_rcv_msg (net/core/rtnetlink.c:7033)
netlink_rcv_skb (net/netlink/af_netlink.c:2556)
netlink_unicast (net/netlink/af_netlink.c:1345)
netlink_sendmsg (net/netlink/af_netlink.c:1900)
__sock_sendmsg (net/socket.c:790)
____sys_sendmsg (net/socket.c:2684)
___sys_sendmsg (net/socket.c:2738)
__sys_sendmsg (net/socket.c:2770)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)Skip unset attributes, as ip_valid_fib_dump_req() does.
--- net/mpls/af_mpls.c | 3 +++ 1 file changed, 3 insertions(+)
net/mpls/af_mpls.c +3 -0
@@ -2125,6 +2125,9 @@ static int mpls_valid_fib_dump_req(struct net *net, const struct nlmsghdr *nlh,int ifindex;if (i ==RTA_OIF ) { +if (!tb[i]) +continue ; + ifindex =nla_get_u32 (tb[i]); filter->dev =__dev_get_by_index (net, ifindex);if (!filter->dev)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 96/484 wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huihui Huang <[email protected]>
commit 61a799ffd1e5a4fd3702d547828b7ff3d161468e upstream.
at76_guess_freq() checks only that the received frame is at least a bare 802.11 header (24 bytes) before subtracting the fixed management-body offset:
len -= el_off;
For both beacon and probe response frames, el_off is 36. If the frame is shorter than el_off, subtracting it causes the calculated IE length to wrap. The length is eventually passed to cfg80211_find_elem_match() as a very large unsigned value, so the element walk runs beyond the RX skb.
This path is reached from at76_rx_tasklet() while scanning. If the device delivers a truncated beacon or probe response, the oversized IE length causes an out-of-bounds read during scanning.
Skip the IE lookup if the frame does not reach the variable elements, before subtracting el_off.
--- drivers/net/wireless/atmel/at76c50x-usb.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/wireless/atmel/at76c50x-usb.c +5 -2
@@ -1527,13 +1527,16 @@ static inline int at76_guess_freq(structif (ieee80211_is_probe_resp (hdr->frame_control)) { el_off = offsetof(struct ieee80211_mgmt, u.probe_resp.variable); - el = ((struct ieee80211_mgmt *)hdr)->u.probe_resp.variable; }else if (ieee80211_is_beacon (hdr->frame_control)) { el_off = offsetof(struct ieee80211_mgmt, u.beacon.variable); - el = ((struct ieee80211_mgmt *)hdr)->u.beacon.variable; }else { goto exit; } + +if (len < el_off) + goto exit; + + el = priv->rx_skb->data + el_off; len -= el_off; el =cfg80211_find_ie (WLAN_EID_DS_PARAMS , el, len);
Greg Kroah-Hartman
maintainerPATCH 97/484 USB: storage: add NO_ATA_1X quirk for Longmai USB Key
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang Wei <[email protected]>
commit 3b4ca2e01c1dd8c00b675b794732945f460a471b upstream.
The Longmai Technologies USB Key (0x04b4:0xb708) advertises itself as a SCSI/Bulk-only mass storage device but does not correctly handle ATA pass-through commands. When such a command (ATA_12 or ATA_16) is sent to the device it fails to respond and the transfer eventually times out, leaving the device unusable.
Add an unusual_devs entry for this device that sets the US_FL_NO_ATA_1X flag, so usb-storage short-circuits ATA pass-through commands and returns INVALID COMMAND OPERATION CODE (0x20 0x05 0x24 0x00) instead of forwarding them to the device.
Information about the device in /sys/kernel/debug/usb/devices:
T: Bus=02 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 12 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=06 Prot=50 MxPS=64 #Cfgs= 1 P: Vendor=04b4 ProdID=b708 Rev= 1.00 S: Manufacturer=Longmai Technologies S: Product=USB Key C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/storage/unusual_devs.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/storage/unusual_devs.h +7 -0
@@ -395,6 +395,13 @@ UNUSUAL_DEV( 0x04b3, 0x4001, 0x0110, 0x USB_SC_DEVICE, USB_PR_CB, NULL, US_FL_MAX_SECTORS_MIN), +/* Reported by Ai Chao <[email protected]> */ +UNUSUAL_DEV (0x04b4 ,0xb708 ,0x0000 ,0xffff , +"Longmai Technologies" , +"USB Key" , +USB_SC_SCSI ,USB_PR_BULK ,NULL , + US_FL_NO_ATA_1X), +/* * Reported by Simon Levitt <[email protected]> * This entry needs Sub and Proto fields
Greg Kroah-Hartman
maintainerPATCH 98/484 usb: chipidea: fix usage_count leak when autosuspend_delay is negative
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit fc3afb5728e297994863f8a2a01b88a920bbf53e upstream.
The probe() calls pm_runtime_use_autosuspend(), but remove() does not call pm_runtime_dont_use_autosuspend(). This can lead to a usage_count leak if autosuspend_delay is set to a negative value.
The pm_runtime_use_autosuspend() also notes that it's important to undo this with pm_runtime_dont_use_autosuspend() at driver exit time.
--- drivers/usb/chipidea/core.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/chipidea/core.c +1 -0
@@ -1265,6 +1265,7 @@ static void ci_hdrc_remove(struct platfousb_role_switch_unregister (ci->role_switch);if (ci->supports_runtime_pm) { +pm_runtime_dont_use_autosuspend (&pdev->dev);pm_runtime_get_sync (&pdev->dev);pm_runtime_disable (&pdev->dev);pm_runtime_put_noidle (&pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 99/484 usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinchao Wang <[email protected]>
commit d5e5cd3654d2b5359a12ea6586120f05b28634ee upstream.
dummy_hcd embeds a single shared usb_request (dum->fifo_req) that the "emulated single-request FIFO" fast-path in dummy_queue() reuses for small IN transfers: it copies the caller's request into it (req->req = *_req) and queues it, treating list_empty(&fifo_req.queue) as "the slot is free".
The completion side (dummy_timer/transfer/nuke/dummy_dequeue) follows the standard pattern: list_del_init(&req->queue) unlinks the request, then the lock is dropped and usb_gadget_giveback_request() invokes req->complete(). But list_del_init() makes fifo_req.queue look empty *before* the completion callback returns, so a concurrent dummy_queue() on another CPU sees the slot as free, reuses fifo_req and runs req->req = *_req -- overwriting req->complete while dummy_timer is mid-calling it. The indirect call then jumps to a clobbered pointer, causing a general protection fault / page fault in dummy_timer (syzkaller extid faf3a6cf579fc65591ca). The clobbering write is an in-bounds memcpy on a live shared object, so KASAN cannot flag it.
Add a fifo_req_busy bit covering the shared request's whole lifetime:
set it in dummy_queue() when the FIFO fast-path takes fifo_req (making it the fast-path guard, replacing the list_empty(&fifo_req.queue) test), and clear it after the completion callback has returned, via a dummy_giveback() helper used at all four gadget-request giveback sites. The shared slot can no longer be reused until its completion callback has finished.
--- drivers/usb/gadget/udc/dummy_hcd.c | 40 ++++++++++++++++++++++++------------- 1 file changed, 27 insertions(+), 13 deletions(-)
drivers/usb/gadget/udc/dummy_hcd.c +27 -13
@@ -277,6 +277,7 @@ struct dummy { unsigned ints_enabled:1; unsigned udc_suspended:1; unsigned pullup:1; + unsigned fifo_req_busy:1;/* * HOST side support
@@ -328,6 +329,26 @@ static inline struct dummy *gadget_dev_t/* DEVICE/GADGET SIDE UTILITY ROUTINES */ +/* +* Give back a gadget request with dum->lock dropped around the callback. +* If @req is the shared fifo_req, clear fifo_req_busy afterward: the flag +* was set in dummy_queue() when the shared request was taken and must stay +* set until its completion callback has returned; list_del_init() alone +* makes the request look idle while the callback is still running. +* Caller holds dum->lock and has already done list_del_init() + status. +*/ +static void dummy_giveback (struct dummy *dum,struct usb_ep *_ep, +struct dummy_request *req) +{ +bool fifo = req == &dum->fifo_req; + +spin_unlock (&dum->lock); +usb_gadget_giveback_request (_ep, &req->req); +spin_lock (&dum->lock); +if (fifo) + dum->fifo_req_busy =0 ; +} +/* called with spinlock held */ static void nuke (struct dummy *dum,struct dummy_ep *ep) {
@@ -338,9 +359,7 @@ static void nuke(struct dummy *dum, strulist_del_init (&req->queue); req->req.status = -ESHUTDOWN ; -spin_unlock (&dum->lock); -usb_gadget_giveback_request (&ep->ep, &req->req); -spin_lock (&dum->lock); +dummy_giveback (dum, &ep->ep, req); } }
@@ -727,10 +746,11 @@ static int dummy_queue(struct usb_ep *_e/* implement an emulated single-request FIFO */ if (ep->desc && (ep->desc->bEndpointAddress &USB_DIR_IN ) && -list_empty (&dum->fifo_req.queue) && + !dum->fifo_req_busy &&list_empty (&ep->queue) && _req->length <=FIFO_SIZE ) { req = &dum->fifo_req; + dum->fifo_req_busy =1 ; req->req = *_req; req->req.buf = dum->fifo_buf;memcpy (dum->fifo_buf, _req->buf, _req->length);
@@ -784,9 +804,7 @@ static int dummy_dequeue(struct usb_ep *dev_dbg (udc_dev (dum),"dequeued req %p from %s, len %d buf %p\n" , req, _ep->name, _req->length, _req->buf); -spin_unlock (&dum->lock); -usb_gadget_giveback_request (_ep, _req); -spin_lock (&dum->lock); +dummy_giveback (dum, _ep, req); }spin_unlock_irqrestore (&dum->lock, flags);return retval;
@@ -1522,9 +1540,7 @@ top:if (req->req.status != -EINPROGRESS ) {list_del_init (&req->queue); -spin_unlock (&dum->lock); -usb_gadget_giveback_request (&ep->ep, &req->req); -spin_lock (&dum->lock); +dummy_giveback (dum, &ep->ep, req);/* requests might have been unlinked... */ rescan =1 ;
@@ -1908,9 +1924,7 @@ restart:dev_dbg (udc_dev (dum),"stale req = %p\n" , req); -spin_unlock (&dum->lock); -usb_gadget_giveback_request (&ep->ep, &req->req); -spin_lock (&dum->lock); +dummy_giveback (dum, &ep->ep, req); ep->already_seen =0 ; goto restart; }
Greg Kroah-Hartman
maintainerPATCH 100/484 usb: gadget: f_midi: cancel pending IN work before freeing the midi object
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <[email protected]>
commit 5650c18d93a1db7e27cb5a40b394747eb4686d5b upstream.
The f_midi driver embeds a work item (midi->work) whose handler, f_midi_in_work(), dereferences the enclosing struct f_midi through container_of(). This work is armed from two sites: f_midi_complete(), on a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA rawmidi output-stream start.
Neither f_midi_disable() nor f_midi_unbind() cancels midi->work. f_midi_disable() only disables the endpoints and drains the in_req_fifo; it does not synchronize the work item, and the sound card is released asynchronously to the final free of the midi object.
The midi object is reference-counted (midi->free_ref) and is freed in f_midi_free() only once both the usb_function reference and the rawmidi private_data reference have been dropped. In f_midi_unbind(), f_midi_disable() runs before the sound card is released, so while the USB endpoints are already disabled the rawmidi device is still usable by an open substream. A concurrent userspace write on such a substream can reach f_midi_in_trigger() and queue midi->work again after f_midi_disable() has returned. A work item armed this way may still be pending when the last reference drops and f_midi_free() proceeds to kfree(midi), letting f_midi_in_work() dereference the struct after it has been freed, a use-after-free.
For this reason cancelling midi->work in f_midi_disable() would not be
sufficient: the ALSA trigger path can rearm the work after disable() returns. Cancelling at the refcount-zero free site is the boundary after which neither arming source can survive, because by then both references that keep the midi object alive have been dropped: the USB endpoints are already disabled and the rawmidi device has been released.
Fix this by calling cancel_work_sync(&midi->work) in the refcount-zero block of f_midi_free(), before the embedded work_struct is freed along with the rest of the structure. opts->lock is a sleeping mutex, so calling cancel_work_sync() under it is permitted, and the handler takes midi->transmit_lock rather than opts->lock, so no self-deadlock can occur while it waits for a running instance of the work to finish.
This issue was found by an in-house static analysis tool.
--- drivers/usb/gadget/function/f_midi.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/gadget/function/f_midi.c +1 -0
@@ -1301,6 +1301,7 @@ static void f_midi_free(struct usb_funct opts = container_of(f->fi, struct f_midi_opts, func_inst);mutex_lock (&opts->lock);if (!--midi->free_ref) { +cancel_work_sync (&midi->work);kfree (midi->id);kfifo_free (&midi->in_req_fifo);kfree (midi);
Greg Kroah-Hartman
maintainerPATCH 101/484 usb: gadget: printer: fix infinite loop in printer_read()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Melbin K Mathew <[email protected]>
commit c2e819be6a5c7f34344926b4bd7e3dfca58cf48a upstream.
printer_read() uses the same variable for the requested copy size and the number of bytes actually copied to user space. copy_to_user() returns the number of bytes not copied, so when it fails to copy anything, the computed copied length becomes zero.
In that case len, buf, current_rx_bytes and current_rx_buf are left unchanged. If RX data is available and the user buffer remains unwritable, the read loop can repeat indefinitely.
Track the copied length separately and return -EFAULT, or the number of bytes already copied, if an iteration makes no progress.
--- drivers/usb/gadget/function/f_printer.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
drivers/usb/gadget/function/f_printer.c +18 -5
@@ -431,7 +431,7 @@ printer_read(struct file *fd, char __use {struct printer_dev *dev = fd->private_data;unsigned long flags; -size_t size; +size_t size, not_copied, copied;size_t bytes_copied;struct usb_request *req;/* This is a pointer to the current USB rx request. */
@@ -524,10 +524,12 @@ printer_read(struct file *fd, char __useelse size = len; - size -=copy_to_user (buf, current_rx_buf, size); - bytes_copied += size; - len -= size; - buf += size; + not_copied =copy_to_user (buf, current_rx_buf, size); + copied = size - not_copied; + + bytes_copied += copied; + len -= copied; + buf += copied;spin_lock_irqsave (&dev->lock, flags);
@@ -542,6 +544,17 @@ printer_read(struct file *fd, char __useif (dev->interface <0 ) goto out_disabled; +if (!copied) { + dev->current_rx_req = current_rx_req; + dev->current_rx_bytes = current_rx_bytes; + dev->current_rx_buf = current_rx_buf; +spin_unlock_irqrestore (&dev->lock, flags); +mutex_unlock (&dev->lock_printer_io); +return bytes_copied ? bytes_copied : -EFAULT ; + } + + size = copied; +/* If we not returning all the data left in this RX request * buffer then adjust the amount of data left in the buffer. * Othewise if we are done with this RX request buffer then
Greg Kroah-Hartman
maintainerPATCH 102/484 USB: gadget: snps-udc: fix device name leak on probe failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 29a142d3e8b35ebc9e0bcc78f4bc26c9b6a9ac0b upstream.
The gadget device name is set by UDC core when registering the gadget and must not be set before to avoid leaking the name in intermediate error paths (e.g. when detecting an older chip revision).
--- drivers/usb/gadget/udc/snps_udc_core.c | 1 - 1 file changed, 1 deletion(-)
drivers/usb/gadget/udc/snps_udc_core.c +0 -1
@@ -3133,7 +3133,6 @@ int udc_probe(struct udc *dev)/* device struct setup */ dev->gadget.ops = &udc_ops; -dev_set_name (&dev->gadget.dev,"gadget" ); dev->gadget.name = name; dev->gadget.max_speed =USB_SPEED_HIGH ;
Greg Kroah-Hartman
maintainerPATCH 103/484 USB: gadget: fsl-udc: fix device name leak on probe failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 6b874d00c466e73c6448a89856407fe46b2f50e4 upstream.
The gadget device name is set by UDC core when registering the gadget and must not be set before to avoid leaking the name in intermediate error paths (e.g. on dma pool creation failure).
--- drivers/usb/gadget/udc/fsl_udc_core.c | 1 - 1 file changed, 1 deletion(-)
drivers/usb/gadget/udc/fsl_udc_core.c +0 -1
@@ -2465,7 +2465,6 @@ static int fsl_udc_probe(struct platform udc_controller->gadget.name = driver_name;/* Setup gadget.dev and register with kernel */ -dev_set_name (&udc_controller->gadget.dev,"gadget" ); udc_controller->gadget.dev.of_node = pdev->dev.of_node;if (!IS_ERR_OR_NULL (udc_controller->transceiver))
Greg Kroah-Hartman
maintainerPATCH 104/484 usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sonali Pradhan <[email protected]>
commit 1febec7e47cdcd01f43fb0211094e3010474666e upstream.
When unpacking host-supplied NTBs, ncm_unwrap_ntb() checks datagram length against frame_max but does not verify that the datagram fits within the declared block length. Additionally, when decoding multiple NTBs from a single socket buffer, subsequent block lengths are not checked against the actual remaining buffer data.
With these checks missing, a malicious USB host can specify datagram offsets and lengths that point beyond the block, or supply secondary NTB headers declaring lengths larger than the buffer. skb_put_data() then copies adjacent kernel memory from skb_shared_info into the network skb.
Fix this by verifying that sufficient buffer space remains for the NTB header before parsing, handling zero-length block declarations, ensuring that block lengths never exceed the remaining buffer space, and verifying that each datagram payload stays strictly within the block boundary.
--- drivers/usb/gadget/function/f_ncm.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
drivers/usb/gadget/function/f_ncm.c +13 -4
@@ -1175,6 +1175,10 @@ static int ncm_unwrap_ntb(struct getherint to_process = skb->len; parse_ntb: +if (to_process < (int )opts->nth_size) { +INFO (port->func.config->cdev,"Packet too small for headers\n" ); + goto err; + } tmp = (__le16 *)ntb_ptr;/* dwSignature */
@@ -1195,8 +1199,12 @@ parse_ntb: tmp++;/* skip wSequence */ block_len =get_ncm (&tmp, opts->block_length); +if (block_len ==0 ) + block_len = to_process; +/* (d)wBlockLength */ -if ((block_len < opts->nth_size + opts->ndp_size) || (block_len > ntb_max)) { +if ((block_len < opts->nth_size + opts->ndp_size) || (block_len > ntb_max) || + (block_len > to_process)) {INFO (port->func.config->cdev,"Bad block length: %#X\n" , block_len); goto err; }
@@ -1259,7 +1267,7 @@ parse_ntb: index = index2;/* wDatagramIndex[0] */ if ((index < opts->nth_size) || - (index > block_len - opts->dpe_size)) { + (index > block_len)) {INFO (port->func.config->cdev,"Bad index: %#X\n" , index); goto err;
@@ -1271,7 +1279,8 @@ parse_ntb:* ethernet hdr + crc or larger than max frame size */ if ((dg_len <14 + crc_len) || - (dg_len > frame_max)) { + (dg_len > frame_max) || + (dg_len > block_len - index)) {INFO (port->func.config->cdev,"Bad dgram length: %#X\n" , dg_len); goto err;
@@ -1296,7 +1305,7 @@ parse_ntb: dg_len2 =get_ncm (&tmp, opts->dgram_item_len);/* wDatagramIndex[1] */ -if (index2 > block_len - opts->dpe_size) { +if (index2 > block_len) {INFO (port->func.config->cdev,"Bad index: %#X\n" , index2); goto err;
Greg Kroah-Hartman
maintainerPATCH 105/484 usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <[email protected]>
commit 0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb upstream.
The Broadcom BDC UDC driver registers its IRQ handler with devm_request_irq() in bdc_udc_init(), so the IRQ is released by devm only after bdc_remove() returns. devm releases resources in reverse LIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() -> bdc_mem_free() manually before returning: bdc_udc_exit() tears down individual endpoint objects via bdc_free_ep(), while bdc_hw_exit() -> bdc_mem_free() frees and NULLs the DMA-coherent status-report ring (bdc->srr.sr_bds) and kfree()s bdc->bdc_ep_array. Both happen while the IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED) remains deliverable in the window up to the post-remove devm free_irq().
On receipt of a shared interrupt in that window, bdc_udc_interrupt() dereferences bdc->srr.sr_bds[bdc->srr.dqp_index] (NULL or freed DMA) and dispatches sr_handler callbacks that index into bdc_ep_array, causing a NULL-deref or use-after-free.
The same window affects the delayed_work bdc->func_wake_notify, which is armed from the IRQ handler via bdc_sr_uspc() -> handle_link_state_change() -> schedule_delayed_work() and may self-rearm from its own callback bdc_func_wake_timer(). No cancel exists anywhere in the driver, so a queued work item that fires after bdc_remove() returns and the bdc structure is devm-freed dereferences freed memory.
Replace devm_request_irq() with request_irq() and add an explicit free_irq(bdc->irq, bdc) in bdc_remove(). Clear BDC_GIE before free_irq() to stop the device from asserting interrupts, then free_irq() drains any in-flight handler, then cancel_delayed_work_sync() drains the func_wake_notify delayed work. This ordering ensures the IRQ handler and delayed work cannot interfere with the subsequent endpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit(). Wire the matching free_irq() into the bdc_udc_init() error path so the IRQ is released on probe failure, and route the bdc_init_ep() failure through err0 instead of returning directly.
This issue was found by an in-house static analysis tool.
--- drivers/usb/gadget/udc/bdc/bdc_core.c | 20 ++++++++++++++++++++ drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 ++++--- 2 files changed, 24 insertions(+), 3 deletions(-)
drivers/usb/gadget/udc/bdc/bdc_core.c +20 -0
@@ -586,9 +586,29 @@ disable_clk:static void bdc_remove (struct platform_device *pdev) {struct bdc *bdc; +unsigned long flags; +u32 temp; bdc =platform_get_drvdata (pdev);dev_dbg (bdc->dev,"%s ()\n" , __func__); +/* +* Disable the device interrupt source before freeing the IRQ: +* clear BDC_GIE so the controller stops asserting interrupts, +* then free_irq drains any in-flight handler. +*/ +spin_lock_irqsave (&bdc->lock, flags); + temp =bdc_readl (bdc->regs,BDC_BDCSC ); + temp &= ~BDC_GIE ; +bdc_writel (bdc->regs,BDC_BDCSC , temp); +spin_unlock_irqrestore (&bdc->lock, flags); +free_irq (bdc->irq, bdc); +/* +* Drain func_wake_notify after free_irq: the IRQ handler arms this +* delayed_work via bdc_sr_uspc -> handle_link_state_change -> +* schedule_delayed_work (self-rearmed in bdc_func_wake_timer), so +* the IRQ must be released first to prevent re-arm after cancel. +*/ +cancel_delayed_work_sync (&bdc->func_wake_notify);bdc_udc_exit (bdc);bdc_hw_exit (bdc);bdc_phy_exit (bdc);
drivers/usb/gadget/udc/bdc/bdc_udc.c +4 -3
@@ -530,8 +530,8 @@ int bdc_udc_init(struct bdc *bdc) bdc->gadget.name =BRCM_BDC_NAME ; - ret =devm_request_irq (bdc->dev, bdc->irq, bdc_udc_interrupt, -IRQF_SHARED ,BRCM_BDC_NAME , bdc); + ret =request_irq (bdc->irq, bdc_udc_interrupt,IRQF_SHARED , +BRCM_BDC_NAME , bdc);if (ret) { dev_err(bdc->dev, "failed to request irq #%d %d\n",
@@ -542,7 +542,7 @@ int bdc_udc_init(struct bdc *bdc) ret =bdc_init_ep (bdc);if (ret) {dev_err (bdc->dev,"bdc init ep fail: %d\n" , ret); -return ret; + goto err0; } ret =usb_add_gadget_udc (bdc->dev, &bdc->gadget);
@@ -571,6 +571,7 @@ int bdc_udc_init(struct bdc *bdc) err1:usb_del_gadget_udc (&bdc->gadget); err0: +free_irq (bdc->irq, bdc);bdc_free_ep (bdc);return ret;
Greg Kroah-Hartman
maintainerPATCH 106/484 usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <[email protected]>
commit b70dc75e85ba968b7b76eebfe5d63000080b875b upstream.
uvc_send_response() builds the UVC control response from a user-supplied struct uvc_request_data:
req->length = min_t(unsigned int, uvc->event_length, data->length); ... memcpy(req->buf, data->data, req->length);
req->length is clamped to uvc->event_length, which is taken from the host control request wLength (up to UVC_MAX_REQUEST_SIZE, 64), and to data->length, which comes from the UVCIOC_SEND_RESPONSE ioctl and is only checked for being negative. The source buffer data->data is only 60 bytes, so a response with uvc->event_length and data->length both greater than 60 makes memcpy() read past the end of data->data.
Clamp req->length to sizeof(data->data) as well.
--- drivers/usb/gadget/function/uvc_v4l2.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/gadget/function/uvc_v4l2.c +2 -0
@@ -191,6 +191,8 @@ uvc_send_response(struct uvc_device *uvcreturn usb_ep_set_halt (cdev->gadget->ep0); req->length = min_t(unsigned int, uvc->event_length, data->length); +if (req->length >sizeof (data->data)) + req->length =sizeof (data->data); req->zero = data->length < uvc->event_length;memcpy (req->buf, data->data, req->length);
Greg Kroah-Hartman
maintainerPATCH 107/484 USB: serial: ftdi_sio: add support for E+H FXA291
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Pambor <[email protected]>
commit fad0fd120e29041b3e6cdf41bb12e3184fb524a2 upstream.
The Commubox FXA291 by Endress+Hauser AG is a USB serial converter based on FT232B which is used to communicate with field devices.
It enumerates using the FTDI vendor ID and a custom PID.
usb 1-9: New USB device found, idVendor=0403, idProduct=e510, bcdDevice= 4.00 usb 1-9: New USB device strings: Mfr=1, Product=2, SerialNumber=0 usb 1-9: Product: FXA291
usb 1-9: Manufacturer: Endress+Hauser
usb 1-9: SerialNumber: 00000000ftdi_sio 1-9:1.0: FTDI USB Serial Device converter detected
usb 1-9: Detected FT232B
usb 1-9: FTDI USB Serial Device converter now attached to ttyUSB0
--- drivers/usb/serial/ftdi_sio.c | 2 ++ drivers/usb/serial/ftdi_sio_ids.h | 5 +++++ 2 files changed, 7 insertions(+)
drivers/usb/serial/ftdi_sio.c +2 -0
@@ -1075,6 +1075,8 @@ static const struct usb_device_id id_tab { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 3) },/* Abacus Electrics */ { USB_DEVICE(FTDI_VID, ABACUS_OPTICAL_PROBE_PID) }, +/* Endress+Hauser AG devices */ + { USB_DEVICE(FTDI_VID, FTDI_EH_FXA291_PID) }, { } /* Terminating entry */ };
drivers/usb/serial/ftdi_sio_ids.h +5 -0
@@ -314,6 +314,11 @@#define FTDI_ELV_UIO88_PID 0xFB5F/* USB-I/O Interface (UIO 88) */ /* +* Endress+Hauser AG product ids (FTDI_VID) +*/ +#define FTDI_EH_FXA291_PID 0xE510 + +/* * EVER Eco Pro UPS (http://www.ever.com.pl/) */
Greg Kroah-Hartman
maintainerPATCH 108/484 USB: serial: io_edgeport: cap received transmit credits
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sunho Park <[email protected]>
commit faaddd811c5099f11a5f52e68a6b31a5898cda4f upstream.
The interrupt-status packet reports transmit credits returned by the device. edge_interrupt_callback() adds the 16-bit value to txCredits without checking maxTxCredits.
edge_write() uses txCredits minus the software FIFO count as the amount of data that fits. Since the FIFO is allocated with maxTxCredits bytes, txCredits exceeding maxTxCredits can cause OOB write in ring buffer.
Cap accumulated credits at maxTxCredits. Conforming devices should never hit the cap.
--- drivers/usb/serial/io_edgeport.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/serial/io_edgeport.c +2 -1
@@ -646,7 +646,8 @@ static void edge_interrupt_callback(struif (edge_port && edge_port->open) {spin_lock_irqsave (&edge_port->ep_lock, flags); - edge_port->txCredits += txCredits; + edge_port->txCredits =min (edge_port->txCredits + txCredits, + edge_port->maxTxCredits);spin_unlock_irqrestore (&edge_port->ep_lock, flags); dev_dbg(dev, "%s - txcredits for port%d = %d\n",
Greg Kroah-Hartman
maintainerPATCH 109/484 USB: serial: keyspan_pda: fix data loss on receive throttling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 42a97c0480f96a2977e6d51ce512adc780f1ef5d upstream.
Killing the interrupt-in urb when the line disciple requests throttling may lead to data loss if an ongoing transfer is cancelled.
Instead set a flag to prevent the completion handler from resubmitting the urb until the port is unthrottled.
--- drivers/usb/serial/keyspan_pda.c | 44 +++++++++++++++++++++++++++++++-------- 1 file changed, 35 insertions(+), 9 deletions(-)
drivers/usb/serial/keyspan_pda.c +35 -9
@@ -35,6 +35,8 @@ struct keyspan_pda_private {struct work_struct unthrottle_work;struct usb_serial *serial;struct usb_serial_port *port; +bool throttled; +bool throttle_req; };static int keyspan_pda_write_start (struct usb_serial_port *port);
@@ -150,6 +152,7 @@ static void keyspan_pda_rx_interrupt(strint retval;int status = urb->status;struct keyspan_pda_private *priv; +bool throttled = false;unsigned long flags; priv =usb_get_serial_port_data (port);
@@ -211,16 +214,24 @@ static void keyspan_pda_rx_interrupt(str } exit: - retval =usb_submit_urb (urb,GFP_ATOMIC ); -if (retval) -dev_err (&port->dev, -"%s - usb_submit_urb failed with result %d\n" , - __func__, retval); +spin_lock_irqsave (&port->lock, flags); +if (priv->throttle_req) { + priv->throttled = true; + throttled = true; + } +spin_unlock_irqrestore (&port->lock, flags); + +if (!throttled) { + retval =usb_submit_urb (urb,GFP_ATOMIC ); +if (retval) +dev_err (&port->dev,"failed to resubmit in urb: %d\n" , retval); + } }static void keyspan_pda_rx_throttle (struct tty_struct *tty) {struct usb_serial_port *port = tty->driver_data; +struct keyspan_pda_private *priv =usb_get_serial_port_data (port);/* * Stop receiving characters. We just turn off the URB request, and
@@ -230,16 +241,29 @@ static void keyspan_pda_rx_throttle(stru* send an XOFF, although it might make sense to foist that off upon * the device too. */ -usb_kill_urb (port->interrupt_in_urb); +spin_lock_irq (&port->lock); + priv->throttle_req = true; +spin_unlock_irq (&port->lock); }static void keyspan_pda_rx_unthrottle (struct tty_struct *tty) {struct usb_serial_port *port = tty->driver_data; +struct keyspan_pda_private *priv =usb_get_serial_port_data (port); +bool throttled; +int ret; + +spin_lock_irq (&port->lock); + throttled = priv->throttled; + priv->throttled = false; + priv->throttle_req = false; +spin_unlock_irq (&port->lock); -/* just restart the receive interrupt URB */ -if (usb_submit_urb (port->interrupt_in_urb,GFP_KERNEL )) -dev_dbg (&port->dev,"usb_submit_urb(read urb) failed\n" ); +if (throttled) { + ret =usb_submit_urb (port->interrupt_in_urb,GFP_KERNEL ); +if (ret) +dev_err (&port->dev,"failed to submit in urb: %d\n" , ret); + } }static speed_t keyspan_pda_setbaud (struct usb_serial *serial,speed_t baud)
@@ -579,6 +603,8 @@ static int keyspan_pda_open(struct tty_sspin_lock_irq (&port->lock); priv->tx_room = rc; + priv->throttled = false; + priv->throttle_req = false;spin_unlock_irq (&port->lock); rc =usb_submit_urb (port->interrupt_in_urb,GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 110/484 USB: serial: option: add TDTECH MT5710-CN
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chukun Pan <[email protected]>
commit 55645e4f3c6022ffb160ad3617d2b624eaa38501 upstream.
Add support for the TDTECH MT5710-CN (5G redcap) module based on the Huawei HiSilicon Balong chip.
T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=3466 ProdID=3301 Rev=ff.ff S: Manufacturer=TD Tech Ltd. S: Product=TDTECH MT571X S: SerialNumber=0123456789ABCDEF C:* #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr= 0mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0d Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0d Prot=00 Driver=cdc_ncm E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncm I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncm E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=13 Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=12 Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=1c Driver=option E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=14 Driver=option E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Interface: ECM / NCM + DIAG + AT + SERIAL + GPS
--- drivers/usb/serial/option.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/option.c +1 -0
@@ -2497,6 +2497,7 @@ static const struct usb_device_id option .driver_info = RSVD(5) }, { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x1003, 0xff), /* Rolling RW135R-GL (laptop MBIM) */ .driver_info = RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x3466, 0x3301, 0xff) }, /* TDTECH MT5710-CN */ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0x00, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 111/484 crypto: rsa-pkcs1pad: Dont WARN on an empty digest
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doruk Tan Ozturk <[email protected]>
KEYCTL_PKEY_VERIFY lets an unprivileged caller supply a zero-length digest (in_len == 0). keyctl_pkey_params_get_2() accepts the zero length and the request reaches pkcs1pad_verify(), where the empty digest is rejected but only after being passed through WARN_ON(!digest_size). The warning is therefore directly user-triggerable, and on kernels built with panic_on_warn=1 an unprivileged process can panic the machine -- a local denial of service. Reproduced as UID 65534 in a setuid sandbox.
Keep rejecting the invalid request with -EINVAL, but do not emit a warning for the user-controlled length.
Mainline does not contain this code path; commit 1e562deacecc ("crypto: rsassa-pkcs1 - Migrate to sig_alg backend") removed pkcs1pad_verify() in v6.13-rc1. This is a minimal fix for the affected stable branches. It applies as-is to 6.1.y, 6.6.y and 6.12.y (identical pkcs1pad_verify); the 5.10.y/5.15.y form is sent as a separate patch due to the older req->dst_len spelling.
Found by 0sec automated security-research tooling (https://0sec.ai).
--- crypto/rsa-pkcs1pad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/rsa-pkcs1pad.c +1 -1
@@ -534,7 +534,7 @@ static int pkcs1pad_verify(struct akcipher_request *req)const unsigned int digest_size = req->dst_len;int err; -if (WARN_ON (req->dst) ||WARN_ON (!digest_size) || +if (WARN_ON (req->dst) || !digest_size || !ctx->key_size || sig_size != ctx->key_size)return -EINVAL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 112/484 Revert "drm/amd/display: Add missing kdoc for ALLM parameters"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit bca364c4c75796650e53837fbec174a866141511.
--- drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c +0 -2
@@ -447,8 +447,6 @@ void mod_build_vsc_infopacket(const struct dc_stream_state *stream,* * @stream: contains data we may need to construct VSIF (i.e. timing_3d_format, etc.) * @info_packet: output structure where to store VSIF -* @ALLMEnabled: indicates whether ALLM HF-VSIF should be generated -* @ALLMValue: ALLM bit value to advertise in HF-VSIF */ void mod_build_hf_vsif_infopacket (const struct dc_stream_state *stream,struct dc_info_packet *info_packet)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 113/484 RISC-V: KVM: Serialize virtual interrupt pending state updates
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xie Bo <[email protected]>
commit d024a0a7879e6f37c0152aacf6d8e37b214a1738 upstream.
KVM RISC-V tracks guest local interrupt state with two bitmaps:
- irqs_pending: interrupts that should be visible to the guest
- irqs_pending_mask: interrupts whose pending state changed
The current code updates those bitmaps with independent atomic bitops and assumes a multiple-producer, single-consumer protocol. That model does not actually hold.
kvm_riscv_vcpu_sync_interrupts() is not a pure consumer. When the guest changes guest-visible HVIP state, sync_interrupts() writes both irqs_pending and irqs_pending_mask to reflect the new guest state back into KVM state. As a result, irqs_pending and irqs_pending_mask form a single logical state transition, but they are not updated atomically as a pair.
This allows a race where a newly injected interrupt is lost. For example:
CPU0 CPU1
---- ----
kvm_riscv_vcpu_set_interrupt(VS_SOFT)
set_bit(VS_SOFT, irqs_pending)
kvm_riscv_vcpu_sync_interrupts()
sees guest-cleared HVIP.VSSIP sets irqs_pending_mask clear_bit(IRQ_VS_SOFT, irqs_pending)
set_bit(VS_SOFT, irqs_pending_mask)
kvm_vcpu_kick()
After that interleaving, a later flush can update HVIP without VSSIP even though a new virtual interrupt was injected. In practice, the guest can remain blocked in WFI with work pending.
The same pending/mask protocol is shared by VS soft interrupts, PMU overflow delivery, and AIA high interrupt synchronization, so the race is not limited to one interrupt source.
Fix this by serializing all updates to irqs_pending and irqs_pending_mask with a per-vCPU raw spinlock. This keeps the pending bit and the dirty mask as one state transition across:
- set/unset interrupt
- guest HVIP sync
- interrupt flush to guest CSR state
- vCPU reset
- AIA CSR writes that clear dirty state
Use non-atomic bitmap operations while holding the lock. Hold the lock across the AIA sync, flush, and pending checks as well, so both bitmap words share the same serialization domain.
This intentionally replaces the existing lockless protocol instead of trying to repair it with additional barriers. The problem is not memory ordering on a single field; it is that two separate bitmaps encode one shared state machine while both producers and sync paths can modify them. A per-vCPU raw spinlock keeps the fix small, local, and suitable for backporting.
[ bo: Drop IRQ_PMU_OVF handling, which is not present in 6.6.y, and
adapt the reset and CSR helpers to their older signatures. ]
--- arch/riscv/include/asm/kvm_host.h | 10 ++--- arch/riscv/kvm/aia.c | 35 +++++++++++++---- arch/riscv/kvm/vcpu.c | 64 ++++++++++++++++++++++--------- arch/riscv/kvm/vcpu_onereg.c | 8 +++- 4 files changed, 85 insertions(+), 32 deletions(-)
arch/riscv/include/asm/kvm_host.h +5 -5
@@ -202,13 +202,13 @@ struct kvm_vcpu_arch {/* * VCPU interrupts * -* We have a lockless approach for tracking pending VCPU interrupts -* implemented using atomic bitops. The irqs_pending bitmap represent -* pending interrupts whereas irqs_pending_mask represent bits changed -* in irqs_pending. Our approach is modeled around multiple producer -* and single consumer problem where the consumer is the VCPU itself. +* The irqs_pending bitmap represents pending interrupts whereas +* irqs_pending_mask represents bits changed in irqs_pending. Updates +* to these bitmaps are serialized so vcpu interrupt sync/flush cannot +* drop a newly injected interrupt while syncing guest-visible HVIP. */ #define KVM_RISCV_VCPU_NR_IRQS 64 +raw_spinlock_t irqs_pending_lock;DECLARE_BITMAP (irqs_pending,KVM_RISCV_VCPU_NR_IRQS );DECLARE_BITMAP (irqs_pending_mask,KVM_RISCV_VCPU_NR_IRQS );
arch/riscv/kvm/aia.c +28 -7
@@ -71,12 +71,15 @@ void kvm_riscv_vcpu_aia_flush_interrupts(struct kvm_vcpu *vcpu)struct kvm_vcpu_aia_csr *csr = &vcpu->arch.aia_context.guest_csr;unsigned long mask, val; +lockdep_assert_held (&vcpu->arch.irqs_pending_lock); +if (!kvm_riscv_aia_available ())return ; -if (READ_ONCE (vcpu->arch.irqs_pending_mask[1 ])) { - mask =xchg_acquire (&vcpu->arch.irqs_pending_mask[1 ],0 ); - val =READ_ONCE (vcpu->arch.irqs_pending[1 ]) & mask; + mask = vcpu->arch.irqs_pending_mask[1 ]; +if (mask) { + vcpu->arch.irqs_pending_mask[1 ] =0 ; + val = vcpu->arch.irqs_pending[1 ] & mask; csr->hviph &= ~mask; csr->hviph |= val;
@@ -87,6 +90,8 @@ void kvm_riscv_vcpu_aia_sync_interrupts(struct kvm_vcpu *vcpu) {struct kvm_vcpu_aia_csr *csr = &vcpu->arch.aia_context.guest_csr; +lockdep_assert_held (&vcpu->arch.irqs_pending_lock); +if (kvm_riscv_aia_available ()) csr->vsieh =csr_read (CSR_VSIEH ); }
@@ -96,13 +101,22 @@ bool kvm_riscv_vcpu_aia_has_interrupts(struct kvm_vcpu *vcpu, u64 mask) {int hgei;unsigned long seip; +#ifdef CONFIG_32BIT +unsigned long flags; +bool pending; +#endif if (!kvm_riscv_aia_available ())return false;#ifdef CONFIG_32BIT -if (READ_ONCE (vcpu->arch.irqs_pending[1 ]) & - (vcpu->arch.aia_context.guest_csr.vsieh &upper_32_bits (mask))) +raw_spin_lock_irqsave (&vcpu->arch.irqs_pending_lock, flags); + pending = vcpu->arch.irqs_pending[1 ] & + (vcpu->arch.aia_context.guest_csr.vsieh & +upper_32_bits (mask)); +raw_spin_unlock_irqrestore (&vcpu->arch.irqs_pending_lock, flags); + +if (pending)return true;#endif
@@ -190,6 +204,9 @@ int kvm_riscv_vcpu_aia_set_csr(struct kvm_vcpu *vcpu, unsigned long val) {struct kvm_vcpu_aia_csr *csr = &vcpu->arch.aia_context.guest_csr; +#ifdef CONFIG_32BIT +unsigned long flags; +#endif if (reg_num >=sizeof (struct kvm_riscv_aia_csr ) /sizeof (unsigned long ))return -ENOENT ;
@@ -198,8 +215,12 @@ int kvm_riscv_vcpu_aia_set_csr(struct kvm_vcpu *vcpu, ((unsigned long *)csr)[reg_num] = val;#ifdef CONFIG_32BIT -if (reg_num ==KVM_REG_RISCV_CSR_AIA_REG (siph)) -WRITE_ONCE (vcpu->arch.irqs_pending_mask[1 ],0 ); +if (reg_num ==KVM_REG_RISCV_CSR_AIA_REG (siph)) { +raw_spin_lock_irqsave (&vcpu->arch.irqs_pending_lock, flags); + vcpu->arch.irqs_pending_mask[1 ] =0 ; +raw_spin_unlock_irqrestore (&vcpu->arch.irqs_pending_lock, + flags); + }#endif }
arch/riscv/kvm/vcpu.c +46 -18
155 lines not on this page · raw message
arch/riscv/kvm/vcpu_onereg.c +6 -2
@@ -361,6 +361,7 @@ static int kvm_riscv_vcpu_general_set_csr(struct kvm_vcpu *vcpu, unsigned long reg_val) {struct kvm_vcpu_csr *csr = &vcpu->arch.guest_csr; +unsigned long flags;if (reg_num >=sizeof (struct kvm_riscv_csr ) /sizeof (unsigned long ))return -ENOENT ;
@@ -372,8 +373,11 @@ static int kvm_riscv_vcpu_general_set_csr(struct kvm_vcpu *vcpu, ((unsigned long *)csr)[reg_num] = reg_val; -if (reg_num ==KVM_REG_RISCV_CSR_REG (sip)) -WRITE_ONCE (vcpu->arch.irqs_pending_mask[0 ],0 ); +if (reg_num ==KVM_REG_RISCV_CSR_REG (sip)) { +raw_spin_lock_irqsave (&vcpu->arch.irqs_pending_lock, flags); + vcpu->arch.irqs_pending_mask[0 ] =0 ; +raw_spin_unlock_irqrestore (&vcpu->arch.irqs_pending_lock, flags); + }return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 114/484 usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xincheng Zhang <[email protected]>
commit 1fc50f1ecde39feb4fccdaf4bc71aa6c0eb25c49 upstream.
The VIA VL805/806 xHCI controller advertises AC64, but fails to handle DMA addresses at or above 0x1000000000. On systems with large amounts of RAM, this can cause USB device failures when the controller is given DMA addresses beyond its usable address width.
Do not use XHCI_NO_64BIT_SUPPORT for this controller. That quirk clears the cached AC64 capability and limits DMA to 32 bits, causing unnecessary bouncing for addresses between 4GiB and 64GiB and hiding the controller's real AC64 capability from code that may need to distinguish register access width from usable DMA address width.
Track the usable DMA address width separately from the AC64 capability. Initialize the generic xhci->dma_mask_bits field to 64 and let PCI quirks reduce it for controllers with narrower DMA support. Set VIA VL805/806 to 36 bits so the DMA API only hands it addresses in the range it can handle while keeping HCCPARAMS1.AC64 visible.
--- drivers/usb/host/xhci-pci.c | 1 + drivers/usb/host/xhci.c | 15 ++++++++++----- drivers/usb/host/xhci.h | 1 + 3 files changed, 12 insertions(+), 5 deletions(-)
drivers/usb/host/xhci-pci.c +1 -0
@@ -510,6 +510,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)if (pdev->vendor ==PCI_VENDOR_ID_VIA && pdev->device ==PCI_DEVICE_ID_VIA_VL805 ) { xhci->quirks |=XHCI_LPM_SUPPORT ; xhci->quirks |=XHCI_TRB_OVERFETCH ; + xhci->dma_mask_bits =36 ; } if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
drivers/usb/host/xhci.c +10 -5
@@ -5267,6 +5267,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)if (xhci->hci_version >0x100 ) xhci->hcc_params2 =readl (&xhci->cap_regs->hcc_params2); + xhci->dma_mask_bits =64 ;/* xhci-plat or xhci-pci might have set max_interrupters already */ if ((!xhci->max_interrupters) || xhci->max_interrupters >HCS_MAX_INTRS (xhci->hcs_params1))
@@ -5308,12 +5309,16 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)if (xhci->quirks &XHCI_NO_64BIT_SUPPORT ) xhci->hcc_params &= ~BIT (0 ); -/* Set dma_mask and coherent_dma_mask to 64-bits, -* if xHC supports 64-bit addressing */ +/* +* Set dma_mask and coherent_dma_mask to 64-bits if xHC supports +* 64-bit addressing, unless a controller-specific quirk callback +* limits the usable address width. +*/ if (HCC_64BIT_ADDR (xhci->hcc_params) && - !dma_set_mask (dev,DMA_BIT_MASK (64 ))) { -xhci_dbg (xhci,"Enabling 64-bit DMA addresses.\n" ); -dma_set_coherent_mask (dev,DMA_BIT_MASK (64 )); + !dma_set_mask (dev,DMA_BIT_MASK (xhci->dma_mask_bits))) { +xhci_dbg (xhci,"Enabling %u-bit DMA addresses.\n" , + xhci->dma_mask_bits); +dma_set_coherent_mask (dev,DMA_BIT_MASK (xhci->dma_mask_bits)); }else {/* * This is to avoid error in cases where a 32-bit USB
drivers/usb/host/xhci.h +1 -0
@@ -1538,6 +1538,7 @@ struct xhci_hcd {int event_ring_max;/* 4KB min, 128MB max */ int page_size; +unsigned int dma_mask_bits;/* Valid values are 12 to 20, inclusive */ int page_shift;/* msi-x vectors */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 115/484 wifi: ath9k: hif_usb: dont dereference hif_dev after re-arming firmware request
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheng Yongkang <[email protected]>
[ Upstream commit dad9f96945d77ecd4708f730c06ef54dcd8cc057 ]
ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_dev as the completion context, and then still dereferences hif_dev:
dev_info(&hif_dev->udev->dev, "ath9k_htc: Firmware %s requested\n", hif_dev->fw_name);
The re-armed callback ath9k_hif_usb_firmware_cb() runs on the "events" workqueue and, when the firmware is missing, walks the retry chain into ath9k_hif_usb_firmware_fail() -> complete_all(&hif_dev->fw_done). That releases the wait_for_completion(&hif_dev->fw_done) in a concurrent ath9k_hif_usb_disconnect(), which then kfree()s hif_dev. The trailing dev_info() in the frame that re-armed the request can therefore read freed memory (hif_dev->udev, the first field of struct hif_device_usb):
BUG: KASAN: slab-use-after-free in ath9k_hif_request_firmware Read of size 8 ... by task kworker/... ath9k_hif_request_firmware ath9k_hif_usb_firmware_cb drivers/net/wireless/ath/ath9k/hif_usb.c:1247 request_firmware_work_func Allocated by ...: ath9k_hif_usb_probe drivers/net/wireless/ath/ath9k/hif_usb.c Freed by ...: ath9k_hif_usb_disconnect -> kfree drivers/net/wireless/ath/ath9k/hif_usb.c
The fw_done barrier only makes disconnect wait for the firmware chain to *terminate*; it does not protect the outer ath9k_hif_request_firmware() frame that re-armed the request and keeps touching hif_dev afterwards.
Drop the post-request dev_info(): it is the only use of hif_dev after the async request is armed, and it is purely informational (the dev_err() on the failure path runs only when request_firmware_nowait() did not arm a callback, so hif_dev is still alive there).
This was first reported by syzbot as a single, non-reproduced crash that was later auto-obsoleted, and was independently rediscovered by the reFuzz fuzzer, which produced a C reproducer (USB-gadget connect/disconnect of an ath9k_htc device whose firmware download fails). The vulnerable code is unchanged and still present in v7.1-rc6, where the slab-use-after-free reproduces under KASAN once the (sub-microsecond) race window is widened.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +1 -6
@@ -1225,15 +1225,10 @@ static int ath9k_hif_request_firmware(struct hif_device_usb *hif_dev, ret =request_firmware_nowait (THIS_MODULE , true, hif_dev->fw_name, &hif_dev->udev->dev,GFP_KERNEL , hif_dev, ath9k_hif_usb_firmware_cb); -if (ret) { +if (ret)dev_err (&hif_dev->udev->dev,"ath9k_htc: Async request for firmware %s failed\n" , hif_dev->fw_name); -return ret; - } - -dev_info (&hif_dev->udev->dev,"ath9k_htc: Firmware %s requested\n" , - hif_dev->fw_name);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 116/484 wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaole Zhang <[email protected]>
[ Upstream commit e8d85672dd7e2523f774caafba8f858384e18df7 ]
In ATH11K_QMI_EVENT_FW_READY, ATH11K_FLAG_REGISTERED is set unconditionally even when ath11k_core_qmi_firmware_ready() fails. This leaves the driver in an inconsistent state where initialization is considered complete although the firmware ready handling did not finish successfully. During the subsequent SSR, the driver enters the restart path based on this incorrect state and dereferences uninitialized srng members, resulting in a NULL pointer dereference.
Call trace: ath11k_hal_srng_access_begin+0xc/0x60 [ath11k] (P) ath11k_ce_cleanup_pipes+0x17c/0x180 [ath11k] ath11k_core_restart+0x40/0x168 [ath11k]
Fix this by:
- skipping firmware_ready if ATH11K_FLAG_REGISTERED is already set
- setting ATH11K_FLAG_REGISTERED only when firmware_ready succeeds
- setting ATH11K_FLAG_QMI_FAIL and aborting the FW_READY handling on error
Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1
--- drivers/net/wireless/ath/ath11k/qmi.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath11k/qmi.c +8 -3
@@ -3276,9 +3276,14 @@ static void ath11k_qmi_driver_event_work(struct work_struct *work)clear_bit (ATH11K_FLAG_CRASH_FLUSH , &ab->dev_flags);clear_bit (ATH11K_FLAG_RECOVERY , &ab->dev_flags); -ath11k_core_qmi_firmware_ready (ab); -set_bit (ATH11K_FLAG_REGISTERED , &ab->dev_flags); - +if (!test_bit (ATH11K_FLAG_REGISTERED , &ab->dev_flags)) { + ret =ath11k_core_qmi_firmware_ready (ab); +if (ret) { +set_bit (ATH11K_FLAG_QMI_FAIL , &ab->dev_flags); +break ; + } +set_bit (ATH11K_FLAG_REGISTERED , &ab->dev_flags); + }break ;case ATH11K_QMI_EVENT_COLD_BOOT_CAL_DONE :break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 117/484 hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit 9ab8656548cd737b98d0b19c4253aff8d68e97f4 ]
hid_hw_stop() does not stop the device IO.
This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within corsairpsu_probe(). If the probe operation fails after "io start" has been initiated, this race condition will result in a uaf vulnerability [1].
CPU0 CPU1
==== ====corsairpsu_probe()
hid_device_io_start()
... unlock driver_input_lock
hid_hw_stop()
kfree(hidraw) __hid_input_report()
... acquire driver_input_lock hid_report_raw_event()
hidraw_report_event()
... access hidraw's list_lock // trigger uaf
Consequently, when corsairpsu_probe() fails and hid_hw_stop() needs to be executed, the io_started flag is first cleared while holding the driver_input_lock to prevent potential race conditions involving input reports.
[1]
BUG: KASAN: slab-use-after-free in rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56 Call Trace: hidraw_report_event+0x5d/0x3a0 drivers/hid/hidraw.c:577 hid_report_raw_event+0x311/0x1730 drivers/hid/hid-core.c:2076 __hid_input_report drivers/hid/hid-core.c:2152 [inline] hid_input_report+0x44e/0x580 drivers/hid/hid-core.c:2174 hid_irq_in+0x47e/0x6d0 drivers/hid/usbhid/hid-core.c:286 __usb_hcd_giveback_urb+0x3b3/0x5e0 drivers/usb/core/hcd.c:1657 dummy_timer+0x8a9/0x47d0 drivers/usb/gadget/udc/dummy_hcd.c:2005 Allocated by task 10: hidraw_connect+0x57/0x430 drivers/hid/hidraw.c:606 hid_connect+0x5bf/0x19d0 drivers/hid/hid-core.c:2277 hid_hw_start+0xa8/0x120 drivers/hid/hid-core.c:2387 corsairpsu_probe+0xd9/0x3c0 drivers/hwmon/corsair-psu.c:782 Freed by task 10: hidraw_disconnect+0x4f/0x60 drivers/hid/hidraw.c:662 hid_disconnect drivers/hid/hid-core.c:2362 [inline] hid_hw_stop+0x101/0x1e0 drivers/hid/hid-core.c:2407 corsairpsu_probe+0x327/0x3c0 drivers/hwmon/corsair-psu.c:826
Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().
[groeck: Updated subject and description;
call hid_device_io_stop() only if IO has been started]
--- drivers/hwmon/corsair-psu.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/corsair-psu.c +1 -0
@@ -831,6 +831,7 @@ static int corsairpsu_probe(struct hid_device *hdev, const struct hid_device_id fail_and_close:hid_hw_close (hdev); +hid_device_io_stop (hdev); fail_and_stop:hid_hw_stop (hdev);return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 118/484 hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 94c87871b051d7ad758828a805215a2ec194512a ]
Calling hid_hw_stop() does not stop the device IO.
This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability.
Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().
--- drivers/hwmon/corsair-cpro.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/corsair-cpro.c +1 -0
@@ -558,6 +558,7 @@ static int ccp_probe(struct hid_device *hdev, const struct hid_device_id *id) out_hw_close:hid_hw_close (hdev); +hid_device_io_stop (hdev); out_hw_stop:hid_hw_stop (hdev);return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 119/484 hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 59d104b54b0b42e30fd2a68d24ee5c49dcc54d1e ]
Calling hid_hw_stop() does not stop the device IO.
This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability.
Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().
--- drivers/hwmon/nzxt-smart2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/nzxt-smart2.c +1 -1
@@ -774,7 +774,7 @@ static int nzxt_smart2_hid_probe(struct hid_device *hdev, out_hw_close:hid_hw_close (hdev); - +hid_device_io_stop (hdev); out_hw_stop:hid_hw_stop (hdev);return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 120/484 watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
[ Upstream commit 7362ba0f9c96ac3ad6a2ca3995bd9fc9a28a8661 ]
When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to default_gov.
If the governor being unregistered is currently set as default_gov, the default_gov is never cleared. This leads to 2 use-after-free issues:
1. New watchdog devices registered after this point will inherit the dangling default_gov.
2. Existing watchdog devices using the unregistered governor will have their wdd->gov reassigned to the dangling default_gov.
Fix the UAF by clearing default_gov if it matches the governor being unregistered.
--- drivers/watchdog/watchdog_pretimeout.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/watchdog/watchdog_pretimeout.c +2 -0
@@ -165,6 +165,8 @@ void watchdog_unregister_governor(struct watchdog_governor *gov) }spin_lock_irq (&pretimeout_lock); +if (default_gov == gov) + default_gov =NULL ;list_for_each_entry (p, &pretimeout_list, entry)if (p->wdd->gov == gov) p->wdd->gov = default_gov;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 121/484 wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Morgun <[email protected]>
[ Upstream commit 7f11e70629650ff6ea140984e5ce188b775b2683 ]
When the first entry in msdu_details has a zero buffer address, the code accesses msdu_details[i - 1] with i == 0, causing a buffer underflow.
Fix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding a separate check for i == 0 before the main condition to prevent the out-of-bounds access.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/ath/ath11k/dp_rx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/ath/ath11k/dp_rx.c +3 -0
@@ -4619,6 +4619,9 @@ static void ath11k_hal_rx_msdu_list_get(struct ath11k *ar, msdu_details = &msdu_link->msdu_link[0 ];for (i =0 ; i <HAL_RX_NUM_MSDU_DESC ; i++) { +if (!i &&FIELD_GET (BUFFER_ADDR_INFO0_ADDR , + msdu_details[i].buf_addr_info.info0) ==0 ) +break ;if (FIELD_GET (BUFFER_ADDR_INFO0_ADDR , msdu_details[i].buf_addr_info.info0) ==0 ) { msdu_desc_info = &msdu_details[i -1 ].rx_msdu_info;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 122/484 wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit 0fe8010fc5b147607fc19ba010ba469afc95f35f ]
ath11k_pci_soc_global_reset() tries to reset the device by writing to the PCIE_SOC_GLOBAL_RESET register. But it doesn't do a read-back to ensure that the write gets flushed to the device before the delay.
This may lead to the delay on the host to be insufficient, if the posted write doesn't reach the device before the delay.
So add a read-back after writing to the PCIE_SOC_GLOBAL_RESET register and before the delay.
Compile tested only.
--- drivers/net/wireless/ath/ath11k/pci.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/ath/ath11k/pci.c +4 -0
@@ -181,6 +181,8 @@ static void ath11k_pci_soc_global_reset(struct ath11k_base *ab) val |=PCIE_SOC_GLOBAL_RESET_V ;ath11k_pcic_write32 (ab,PCIE_SOC_GLOBAL_RESET , val); +/* Flush the posted write to the device */ +ath11k_pcic_read32 (ab,PCIE_SOC_GLOBAL_RESET );/* TODO: exact time to sleep is uncertain */ delay =10 ;
@@ -190,6 +192,8 @@ static void ath11k_pci_soc_global_reset(struct ath11k_base *ab) val &= ~PCIE_SOC_GLOBAL_RESET_V ;ath11k_pcic_write32 (ab,PCIE_SOC_GLOBAL_RESET , val); +/* Flush the posted write to the device */ +ath11k_pcic_read32 (ab,PCIE_SOC_GLOBAL_RESET );mdelay (delay);
Signature · 1 line
2.53.0